Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Upload Upload Upload Upload Attack Attack Attack Attack Framework Framework Framework Framework Version Version Version Version 1.0 1.0 1.0 1.0 CasperKid [Syclover][Insight-Labs] 2011/10/6 [*] Team : Syclover Security Team & Insight Labs [*] Web : www.myclover.org & www.insight-labs.org [*] Blog : hi.baidu.com/hackercasper [*] Mail : casperkid.syclover@gmail.com 前言 这篇 paper 还是断断续续憋了我两个月左右想把整个攻击能抽象出一个体系出来所 以一直拖了很久才最终成型个中艰辛还是在自己能体会原本 paper 是投到 webzine0x06 后来刺总(axis)说 webzine0x06 要 11 月才发布很多朋友又在催就提前公开这篇 paper 了 在现在越来越安全的体系下sql injection 这类漏洞已经很难在安全性较高的站点出现 比如一些不错的.NET 或 JAVA 的框架基本上都是参数化传递用户输入以及其他一些能防御 SQL 注入的 API直接封死注入攻击在非 php 的 web 安全中出现概率很大而且威力也很 大的攻击主要有两种第一种是 sql injection第二种便是上传攻击php 的还有本地/远程 文件包含或代码注入漏洞等) 通常 web 站点会有用户注册功能而当用户登入之后大多数情况下都会存在类似头像 上传附件上传一类的功能这些功能点往往存在上传验证方式不严格的安全缺陷是在 web 渗透中非常关键的突破口只要经过仔细测试分析来绕过上传验证机制往往会造成被 攻击者直接上传 web 后门进而控制整个 web 业务的控制权复杂一点的情况是结合 web server 的解析漏洞来上传后门获取权限 这篇 paper 或许还并不算完善但在分类总结上还是比较全面我看过 OWASP 和 Acunetix 对上传攻击的分类很多方面并不够全面在写 paper 这段时间因为也在学习其他 东西比较忙现在才把这篇 paper 算写了一个相对来说比较完整的版本麻雀虽小五脏 俱全之中有不足之处希望大家有类似经验的提出来以便我能更加完善这篇 paper也 让大家的交流产生更大的价值 还有关于这个 framework当时看有部分朋友有些误解以为有这个 framework就一 定能挖到 exp 之类为了不误导大家在这里还是做个说明我的本意只是为了提供一种 相对来说系统的分析方法比如给你一份 upload 的源码或者一个 website你怎么来系统地 进行白盒/黑盒分析它并从流程中找出它的逻辑漏洞或其他漏洞来而不是去猜它会有什 么漏洞更高层次的渗透不应该是去猜测目标而是通过好的分析和总结能确定甚至预测目 标要自己能心里真正清楚目标的信息是什么版本有什么漏洞一次就成功而不是我 猜下这样是否能成功的侥幸心理渗透不是猜测而是结合社会工程学收集到足够多的信息 明确甚至预测目标的环境然后不做过多的动作而让自己最大化隐藏完成渗透测试 在写 paper 时保存的图像分辨率都比较高大家用 100%分辨率观看时可能不太清晰 需要看图像的细节时推荐大家用 200%-400%分辨率来观看即可 目录概览 目录概览 目录概览 目录概览 0x00 上传检测流程概述 0x01 客户端检测绕过(javascript 检测) 0x02 服务端检测绕过(MIME 类型检测) 0x03 服务端检测绕过(目录路径检测) 0x04 服务端检测绕过(文件扩展名检测) - 黑名单检测 - 白名单检测 - .htaccess 文件攻击 0x05 服务端检测绕过(文件内容检测) - 文件幻数检测 - 文件相关信息检测 - 文件加载检测 0x06 解析攻击 - 网络渗透的本质 - 直接解析 - 本地文件包含解析 - .htaccess 解析 - web 应用程序解析漏洞及其原理 0x07 上传攻击框架 - 轻量级检测绕过攻击 - 路径/扩展名检测绕过攻击 - 文件内容性检测绕过攻击 - 上传攻击框架 - 结语 0x00 上传检测流程概述 通常一个文件以 HTTP 协议进行上传时将以 POST 请求发送至 web 服务器 web 服务器接收到请求后并同意后用户与 web 服务器将建立连接并传输 data 而一般一个文件上传过程中的检测如下图红色标记部分 A 客户端 javascript 检测 (通常为检测文件扩展名) B 服务端


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Dance with Apple Core 盘古安全实验室 关于我们  专业的移动安全研究团队  专注物联时代安全  专心与最新的安全技术 Apple内核101  内核 (XNU)是Mach/BSD的混合体  运行的驱动程序在单独分离的一套框架  DriverKit也就是现在的IOKit Apple内核101  BSD  XNU的最上层是POSIX/BSD体系  采用FreeBSD6.0的代码  提供files, processes/pthread, signals等等  Apple扩展: 增加了很多独有的syscalls  Mach  内核中的微内核  NeXTSTEP时代的遗留产物  提供task, thread, memory以及IPC通讯机制的实现  处理底层的异常中断及陷入 Apple内核101  IOKit (DriverKit)  自主的驱动程序环境  移植自NextSTEP时代的DriverKit  采用面向对象并且受限制的C++框架  采用复杂的多层机制IORegistry  采用它自身的IPC子系统(mach)  在内核中parse XML(!!!)  内核中主要的attack surface IOKit 101  自包含的运行环境  IO* API封装着内核态的API  驱动相对容易移植  C++运行库由libkern提供  驱动通过IORegistry注册并且分类  用户态的API由IOKit.framework提供  映射内存至用户态  对Userclient提供方法和属性设置接口 IOKit 101  IOService  自动向IORegistry注册驱动  在驱动生命周期内提供callback  支持notification  支持中断处理  并且提供Userclient机制和用户态API进行通讯 IOKit 101  IOKit User Clients  直接和用户态交互的接口  并非所有驱动都提供User Clients  通过继承IOUserClient实现  调用的方法保存在vtable  IOKit会校验对应方法的参数(类型, size)  Struct / Scalar (二进制数据以及整数或者内存地址) IOKit 漏洞举例  内核中提供XML解析  其中OSUnserializeBinary用于反序列化二进制XML数据  OSUnserializeBinary 通过动态数组的方式来手动管理OSobject的 指针  存在多个漏洞 IOKit 漏洞举例  CVE-2016-1828 use-after-free漏洞  当我们在XML字典中两次设置同一个key的时候 会导致前一个key的对象指针指向的内容被释 放掉  但是OSUnserializeBinary内部动态数组中还保 存了前一个对象的指针  当这个指针被引用的时候导致UAF IOKit 漏洞举例  CVE-2016-4655 / CVE-2016-4680  内核info-leak漏洞  在处理kOSSerializeNumber时二进制内 容中的长度直接传递给 OSNumner::withNumber函数 IOKit 漏洞举例  OSNumber  实际上长度不能大于64字节  但是代码在初始化size的时候并没有对用户输入做验证  会影响调用size getter函数numberOfBits()/numberOfBytes() IOKit 漏洞举例  is_io_registry_entry_get_property_bytes  该函数用于获取指定key的数据  Bytes=&offsetBytes 指向栈上的数据  长度是我们控制的  bcopy调用会导致泄露栈上的数据  函数返回地址/堆地址/cookie IOKit/MIG 漏洞举例  IOSurfaceRootUserClient port UAF (CVE-2017-13861)  UserClient异步调用的时候会释放一个传入的port结构  IOConnectCallAsyncStructMethod(connect, 17, port, &references, 1, input, sizeof(input), NULL, NULL);  17号调用中的releaseAsyncReference64操作从而引发iokit_release_port_send释放传入 的port结构 IOKit/MIG 漏洞举例  IOSurfaceRootUserClient port UAF (CVE-2017-13861)  返回至上层的MIG代码时会继续对这个已经释放过port进行清理操作导致UAF  ipc_kmsg_destroy->ipc_kmsg_cl


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents RollBack A New Time-Agnostic Replay Attack Against the Automotive Remote Keyless Entry Systems Joint work with Jun Wen Wong (NCS Group / DSBJ), Soundarya Ramesh (NUS), Rohini Poolat Parameswarath (NUS), Mun Choon Chan (NUS) Levente Csikor NCS Group Institute for Infocomm Research, A*STAR Hoon Wei Lim NCS Group #BHUSA @BlackHatEvents Information Classification: General Keyless car thefts have been on the rise 2/42 #BHUSA @BlackHatEvents Information Classification: General Keyless car thefts have been on the rise  Keyless entry car technology now accounts for nearly 50% of all vehicle thefts UK Daily Mail, Jul 2021  The risk of technology-enabled vehicle theft will continue to increase Auto-ISAC Threat Assessment Report 2021  Keyless entry/key fob is one of top two most common attack vectors Upstream Global Automotive Cybersecurity Report 2022 3/42 #BHUSA @BlackHatEvents Information Classification: General Threats against remote keyless entry systems  Manipulation of key fob signals  Signal jamming  Relay (ampliﬁcation) attacks  Replay attacks  Attack on key management and cryptographic algorithms  Key enrolment  Key replacement  Key extraction 4/42 #BHUSA @BlackHatEvents Information Classification: General Recent car hacks based on replay of signals 5/42 #BHUSA @BlackHatEvents Information Classification: General Our new findings in a nutshell  New replay attack - RollBack  Revealed highly unusual behavior  more effective than previously known key fob replay attacks  Initial discovery in Aug 2021: unlocked a car by replaying two consecutive signals within 5 seconds  Derived new generic attack metrics in Mar 2022 that work across different car makes & models: no. of signals, sequence, interval, instructions in the signal  Appear consistent with security assessments by Thatcham Research  Consumer Security Ratings 2021  Responsible disclosure  Notiﬁed key fob chip manufacturers in Apr 2022  Shared ﬁndings with Auto-ISAC in May 2022 Source: Thatcham


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Asymmetric Defense Asymmetric Defense How to Fight Off the NSA Red Team with Five People or Less Efstratios L. Gavas Department of Marine Transportation United States Merchant Marine Academy DEFCON 17 Asymmetric Defense Outline Introduction What is the Point? About the USMMA About the CDX Network Design Overview of Network Design Quick Guides Operating Systems Tools Network Application Servers FreeBSD Asymmetric Defense Introduction What is the Point? Who should listen? These are not solutions for everyone  Small shops with smaller budgets  Limited resources  Unreasonable expectations Asymmetric Defense Introduction What is the Point? What I hope you take away  Simplicity is the only way to save yourself  If you dont understand it  it is not secure!  Dont be afraid of your system Asymmetric Defense Introduction About the USMMA What is the USMMA? No, they are not Marines (mostly)  Established to train merchant marine ofﬁcers  Part of the Department of Transportation  The folks that operate those HUGE ships  Smallest of the ﬁve US undergraduate service academies  The one you have not heard of  Things they are NOT:  Navy, Coast Guard, Marines, normal . . .  They may become one of the above (except normal) Asymmetric Defense Introduction About the CDX What is the CDX?  A week-long, annual information security event for students from various military institutions  Air Force Institute of Technology (AFIT)  Naval Postgraduate School (NPS)  Royal Military College of Canada (RMC)  United States Air Force Academy (USAFA)  United States Coast Guard Academy (USCGA)  United States Merchant Marine Academy (USMMA)  United States Military Academy (USMA)  United States Naval Academy (USNA) Asymmetric Defense Introduction About the CDX What is the CDX?  Each team is given a mock budget to secure a poorly conﬁgured/compromised network  Email, Instant Messaging, Database and Web Servers, Workstations, and a Domain Controller  Administrate network while under live-attacks from NSA Red T


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Unboxing Android Everything you wanted to know about Android packers Slava Makkaveev Avi Bashan Who Are We? @Avi Founder at myDRO, former Mobile R&D Team Leader at Check Point, security researcher at Lacoon Mobile Security. Experienced in OS Internal research, mobile security, Linux kernel. @Slava Senior Security Researcher at Check Point, former Security Researcher at Verint. Holds a Phd in Computer Science. Vast experience in mobile reverse engineering and Linux internals and malware analysis. Boxing Apps  Malware authors use various boxing techniques to prevent  Static Code Analysis  Reverse Engineering  This can be done by proprietary techniques or 3rd party software  This Includes  Code Obfuscation  Anti Debugging  Anti Tampering  Anti Dumper  Anti Decompiler  Anti Runtime Injection Maliciousness of Packed Apps Analyzed 13,000 Apps (July 2017) Techniques to protect an apps code  Obfuscators  Packers  Protectors Apk Protection Techniques  Obfuscators  Packers  Protectors Apk Protection Techniques pm.getClass().getMethod("getPackageSizeInfo", String.class, Class.forName("android.content.pm.IPackageStatsObserver")).invoke(pm, packInfo.packageName, new IPackageStatsObserver.Stub() { public void onGetStatsCompleted(PackageStats pStats, boolean succeeded) { } }); v6.getClass().getMethod("getPackageSizeInfo", String.class, Class.forName("android.a.a.a")).invoke(v6, ((PackageInfo)v0_5).packageName, new a() { public void a(PackageStats arg3, boolean arg4) { } });  Obfuscators  Packers  Protectors Apk Protection Techniques Original DEX  Obfuscators  Packers  Protectors Packer Loader Encrypted DEX APK APK Packing process Apk Protection Techniques Packer Loader Encrypted DEX  Obfuscators  Packers  Protectors Packer Loader Original DEX APK APK Execution Apk Protection Techniques  Obfuscators  Packers  Protectors Apk Protection Techniques  Obfuscators  Packers  Protectors Original DEX Encrypted Modified DEX APK APK Protection Process Protector Loader Apk Protection Technique


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

/* This file has been generated by the Hex-Rays decompiler. Copyright (c) 2007-2017 Hex-Rays <info@hex-rays.com> Detected compiler: GNU C++ */ #include <defs.h> //------------------------------------------------------------------------- // Function declarations __int64 (**init_proc())(void); void sub_4620(); // int printf(const char *format, ...); // __int64 __fastcall __cxa_begin_catch(_QWORD); weak // size_t strlen(const char *s); // int memcmp(const void *s1, const void *s2, size_t n); // __int64 __fastcall __cxa_allocate_exception(_QWORD); weak // __int64 __fastcall __cxa_atexit(_QWORD, _QWORD, _QWORD); weak // _QWORD __cdecl operator new(unsigned __int64); idb // void __noreturn exit(int status); // int scanf(const char *format, ...); // _QWORD std::ios_base::Init::Init(std::ios_base::Init *this); idb // int puts(const char *s); // __int64 __fastcall __cxa_end_catch(_QWORD); weak // void __fastcall __noreturn __cxa_throw(__int64 a1, __int64 a2, __int64 a3); // void _Unwind_Resume(struct _Unwind_Exception *); // __int64 __fastcall _cxa_finalize(_QWORD); weak __int64 (**sub_4750())(void); __int64 sub_4790(); __int64 (**sub_47E0())(void); __int64 sub_4820(); _QWORD *run_funkies(); void __fastcall __noreturn do_goto(int a1); void __noreturn nope(); void __fastcall main(__int64 a1, char **a2, char **a3); __int64 __fastcall sub_579A(int a1, int a2); __int64 sub_57E3(); _QWORD *__fastcall sub_57F8(_QWORD *a1); void sub_5812(); void __noreturn opcode_118(); void __noreturn opcode_87(); void __noreturn opcode_76(); void __noreturn opcode_5(); void __noreturn opcode_19(); void __noreturn opcode_50(); void __noreturn opcode_27(); void __noreturn opcode_103(); void __noreturn opcode_80(); void __noreturn opcode_43(); void __noreturn opcode_113(); void __noreturn opcode_17(); void __noreturn opcode_104(); void __noreturn opcode_122(); void __noreturn opcode_114(); void __noreturn opcode_6(); void __noreturn opcode_123(); void __noreturn opcode_35(); void __noreturn opcode_3


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

skill === 向选定的进程发送信号冻结进程 ## 补充说明 **skill命令** 用于向选定的进程发送信号冻结进程这个命令初学者并不常用深入之后牵涉到系统服务优化之后可能会用到 ### 语法 ```shell skill(选项) ``` ### 选项 ```shell -f快速模式 -i交互模式每一步操作都需要确认 -v冗余模式 -w激活模式 -V显示版本号 -t指定开启进程的终端号 -u指定开启进程的用户 -p指定进程的id号 -c指定开启进程的指令名称 ``` ### 实例 如果您发现了一个占用大量CPU和内存的进程但又不想停止它该怎么办考虑下面的top命令输出 ```shell top -c -p 16514 23:00:44 up 12 days, 2:04, 4 users, load average: 0.47, 0.35, 0.31 1 processes: 1 sleeping, 0 running, 0 zombie, 0 stopped CPU states: cpu user nice system irq softirq iowait idle total 0.0% 0.6% 8.7% 2.2% 0.0% 88.3% 0.0% Mem: 1026912k av, 1010476k used, 16436k free, 0k shrd, 52128k buff 766724k actv, 143128k in_d, 14264k in_c Swap: 2041192k av, 83160k used, 1958032k free 799432k cached PID USER PRI NI SIZE RSS SHARE stat %CPU %MEM time CPU command 16514 oracle 19 4 28796 26M 20252 D N 7.0 2.5 0:03 0 oraclePRODB2... ``` 既然您确认进程16514占用了大量内存您就可以使用skill命令冻结它而不是停止它 ```shell skill -STOP 1 ``` 之后检查top输出 ```shell 23:01:11 up 12 days, 2:05, 4 users, load average: 1.20, 0.54, 0.38 1 processes: 0 sleeping, 0 running, 0 zombie, 1 stopped CPU states: cpu user nice system irq softirq iowait idle total 2.3% 0.0% 0.3% 0.0% 0.0% 2.3% 94.8% Mem: 1026912k av, 1008756k used, 18156k free, 0k shrd, 3976k buff 770024k actv, 143496k in_d, 12876k in_c Swap: 2041192k av, 83152k used, 1958040k free 851200k cached PID USER PRI NI SIZE RSS SHARE STAT %CPU %MEM TIME CPU COMMAND 16514 oracle 19 4 28796 26M 20252 T N 0.0 2.5 0:04 0 oraclePRODB2... ``` 现在CPU 从 0% 空闲变为 94% 空闲该进程被有效冻结过一段时间之后您可能希望唤醒该进程 ```shell skill -CONT 16514 ``` 如果希望暂时冻结进程以便为完成更重要的进程腾出空间该方法非常有用 此命令用途很广如果您要停止 "oracle" 用户的所有进程只需要一个命令即可实现 ```shell skill -STOP oracle ``` 可以使用用户PID命令或终端 id 作为参数以下命令可停止所有 rman 命令 ```shell skill -STOP rman ``` 如您所见skill 决定您输入的参数进程 ID用户 ID 或命令并进行相应操作这可能会导致在某些情况下出现这样的问题您可能具有同名的用户和命令最好的示例是 "oracle" 进程通常由用户 "oracle" 运行因此当您希望停止名为 "oracle" 的进程时可执行以下命令 ```shell skill -STOP oracle ``` 用户 "oracle" 的所有进程都停止包括您可能要使用的会话要非常明确地执行命令您可以选择使用一个新参数指定参数的类型要停止一个名为 oracle 的命令可执行以下命令 ```shell skill -STOP -c oracle ``


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

java.io.ObjectInputStream 反序列化分析 - Skay 这主要参考了李三师傅的章 http://redteam.today/2020/02/14/Java%E5%8E%9F%E 7%94%9F%E5%BA%8F%E5%88%97%E5%8C%96%E4%B8%8E%E5%8F%8D%E5%B A%8F%E5%88%97%E5%8C%96%E4%BB%A3%E7%A0%81%E7%AE%80%E8%A6%8 1%E5%88%86%E6%9E%90/ 膜膜膜 感觉看了章下明了好多当然还有好很多疑问 图镇楼 (1) 先起个Demo调试环境 被序列化的类 /** 1 我们的序列化和反序列化法 * @auther Skay 2 * @date 2020/12/20 22:06 3 * @description 4 */ 5 public class theObj implements java.io.Serializable{ 6 public String theObj; 7 public void mailCheck() 8 { 9 System.out.println("This is the "+this.theObj); 10 } 11 } 12 import java.io.*; 1 2 /** 3 * @auther Skay 4 * @date 2020/12/20 22:07 5 * @description 6 */ 7 public class SerializeDemo { 8 public static void main(String [] args) 9 { 10 serialize(); 11 deserialize(); 12 } 13 14 public static void serialize(){ 15 theObj theobj = new theObj(); 16 theobj.theObj = "I'm the obj"; 17 try 18 { 19 // 打开一个文件输入流 20 FileOutputStream fileOut = 21 new FileOutputStream("se.txt"); 22 // 建立对象输入流 23 ObjectOutputStream out = new ObjectOutputStream(fileOut); 24 //输出反序列化对象 25 out.writeObject(theobj); 26 out.close(); 27 fileOut.close(); 28 System.out.printf("Serialized data is saved in se.txt\n"); 29 }catch(Exception e) 30 { 31 e.printStackTrace(); 32 } 33 } 34 35 public static void deserialize(){ 36 theObj theobj = null; 37 try 38 { 39 运如下 (2) 调试分析 1.序列化 writeobject 1.1 预处理 我们断点下到writeobject中先进预处理逻辑进writeobject0 // 打开一个文件输入流 40 FileInputStream fileIn = new FileInputStream("se.txt"); 41 // 建立对象输入流 42 ObjectInputStream in = new ObjectInputStream(fileIn); 43 // 读取对象 44 theobj = (theObj) in.readObject(); 45 in.close(); 46 fileIn.close(); 47 }catch(Exception e) 48 { 49 e.printStackTrace(); 50 return; 51 } 52 System.out.println("Deserialized theObj..."); 53 System.out.println("This is the "+theobj.theObj); 54 } 55 } 56 这参考章提到的是通过内省拿到desc(ObjectOutputStreamClass), 官档中描述ObjectOutputStreamClass 类的序列化描述符它包含类的名称和 serialVersionUID可以使 lookup 法找到/创建 在此 Java VM 中加载的具体类的 ObjectStreamClass 以便于后期对标类进内省(内省我暂时的理解是反射的阉割版本阉割了反射的修改功 能但是暂时


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Exploiting Qualcomm WLAN And Modem Over-The-Air Xiling Gong, Peter Pi Tencent Blade Team About Us Xiling Gong (@GXiling) Senior security researcher at Tencent Blade Team. Focus on Android Security, Qualcomm Firmware Security. Speaker of BlackHat, CanSecWest. Peter Pi(@tencent_blade) Senior security researcher at Tencent Blade Team. Find many vulnerabilities of vendors like Google, Microsoft, Apple, Qualcomm, Adobe and Tesla. The #1 Researcher of Google Android VRP in year 2016. Speaker of BlackHat, CanSecWest, HITB, GSEC and Hitcon. About Tencent Blade Team  Founded by Tencent Security Platform Department in 2017  Focus on security research in the areas of AIoT, Mobile devices, Cloud virtualization, Blockchain, etc  Report 200+ vulnerabilities to vendors such as Google, Apple, Microsoft, Amazon  We talked about how to break Amazon Echo at DEFCON26  Blog: https://blade.tencent.com Agenda  Introduction and Related Work  The Debugger  Reverse Engineering and Attack Surface  Vulnerability and Exploitation  Escaping into Modem  Escaping into Kernel  Stability of Exploitation  Conclusions Agenda  Introduction and Related Work  The Debugger  Reverse Engineering and Attack Surface  Vulnerability and Exploitation  Escaping into Modem  Escaping into Kernel  Stability of Exploitation  Conclusions Introduction  Broadcom WIFI Chip  2017, Gal Beniamini  Over The Air: Exploiting Broadcoms Wi-Fi Stack  2017, Nitay Artenstein, BlackHat USA 2017  BROADPWN: REMOTELY COMPROMISING ANDROID AND IOS VIA A BUG IN BROADCOM'S WI-FI CHIPSETS  Marvel WIFI Chip  2019, Denis Selyanin  Zero Nights 2018 , Researching Marvell Avastar Wi-Fi: from zero knowledge to over- the-air zero-touch RCE  Blog 2019, Remotely compromise devices by using bugs in Marvell Avastar Wi-Fi: from zero knowledge to zero-click RCE  How about Qualcomm WIFI? Qualcomm WLAN (MSM8998) WLAN Firmware Baseband Subsystem Linux Kernel QCACLD2/3 Full MAC Layer Application Android Framework Wifi Demon Modem Firmware Agenda  Introducti


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# 程序加载 程序加载过程其实就是系统创建或者扩充进程镜像的过程它只是按照一定的规则把文件的段拷贝到虚拟内存段中进程只有在执行的过程中使用了对应的逻辑页面时才会申请相应的物理页面通常来说一个进程中有很多页是没有被引用的因此延迟物理读写可以提高系统的性能为了达到这样的效率可执行文件以及共享目标文件所拥有的段的文件偏移以及虚拟地址必须是合适的也就是说他们必须是页大小的整数倍 在 Intel 架构中虚拟地址以及文件偏移必须是 4KB或者更大的数且为 2 的整数幂次的整数倍 下面是一个可执行文件加载到内存中布局的例子 对应的代码段以及数据段的解释如下 在这个例子中尽管代码段和数据段在模4KB的意义下相等但是仍然最多有4个页面包含有不纯的代码或者数据当然实际中会取决于页大小或者文件系统的块大小 - 代码段的第一个页包含了ELF头程序头部表以及其他信息 - 代码段的最后一页包含了数据段开始部分的副本 - 数据段的最后一页包含了代码段的最后部分的副本至于多少暂未说明 - 数据段的最后一部分可能会包含与程序运行无关的信息 逻辑上说系统会对强制控制内存的权限就好比每一个段的权限都是完全独立的段的地址会被调整以便于确保内存中的每一个逻辑页都只有一组类型的权限在上面给出的例子中文件的代码段的最后一部分和数据段的开始部分都会被映射两次分别在数据段的虚拟地址以及代码段的虚拟地址 数据段的结尾需要好好处理没有被初始化的数据一般来说系统要求它们以0开始因此如果一个文件的最后一页包含不在逻辑页中的信息那么剩下的数据必须被初始化为0剩下的三个页中的杂质数据在逻辑上说并不是进程镜像的一部分系统可以选择删除它们该文件对应的虚拟内存镜像如下假设每一页大小为4KB 在加载段时可执行文件与共享目标文件有所区别可执行文件通常来说包含绝对代码为了能够使得程序正确执行每一个段应该在用于构建可执行文件的虚拟地址处因此系统直接使用p_vaddr作为虚拟地址 另一方面共享目标文件通常包含地址独立代码这使得在不同的进程中同一段的虚拟地址可能会有所不同但这并不会影响程序的执行行为尽管系统会为不同的进程选择不同的虚拟地址但是它仍旧维持了段的相对地址因为地址独立代码在不同的段中使用相对地址因此在虚拟内存中的虚拟地址之间的差肯定和在文件中的相应的虚拟地址的差相同下面给出了可能的对于同一共享目标文件不同进程的情况描述了相对地址寻址此外这个表还给出了基地址的计算方法


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MesaTEE SGX借助 Intel SGX 重新 定义人工智能和大数据分析 Yu Ding 百度 X-Lab 安全研究员 May-29-2019 自我介绍  https://dingelish.com  https://github.com/dingelish  https://github.com/baidu/rust-sgx-sdk  在百度 X-Lab 担任安全研究员  Rust 爱好者  漏洞利用/缓解领域博士  从事 Rust-SGX 项目 MesaTEE SGX 借助 Intel SGX 重新定义人工智能和大数据分析 适用于 隐私保护 计算的 Intel SGX  Intel SGX 背景  基于 Intel SGX 构建隐私保护计算软件栈所面临的挑战 Hybrid Memory Safety  经验法则  Intel SGX 实践 塑造 安全 并且 可信 的人工智能/大数据分析框架  可信到底指什么  使用 Intel SGX 实现可信赖的人工智能和大数据分析 MesaTEE SGX 借助 Intel SGX 重新定义人工智能和大数据分析 适用于 隐私保护 计算的 Intel SGX  Intel SGX 背景  基于 Intel SGX 构建隐私保护计算软件栈所面临的挑战 Hybrid Memory Safety  经验法则  Intel SGX 实践 塑造 安全 并且 可信 的人工智能/大数据分析框架  可信 (Trustworthy) 到底指什么  使用 Intel SGX 实现可信赖的人工智能和大数据分析 MesaTEE SGX 借助 Intel SGX 重新定义人工智能和大数据分析 MesaTEE SGX 借助 Intel SGX 重新定义人工智能和大数据分析 MesaTEE SGX 借助 Intel SGX 重新定义人工智能和大数据分析  云供应商  数据所有者  算法提供商也可以是数据所有者  相互之间无法信任  数据离开所有者后依然可以 保证 能够 受到控制 MesaTEE SGX 借助 Intel SGX 重新定义人工智能和大数据分析  解决方案概述  使用 Intel SGX 建立信任和 TEE  安全可信的身份验证/授权  安全可信的渠道  安全可信的执行环境  使用 hybrid memory safety 构建系统  可信赖的人工智能和大数据分析 MesaTEE SGX 借助 Intel SGX 重新定义人工智能和大数据分析 MesaTEE SGX 借助 Intel SGX 重新定义人工智能和大数据分析 适用于 隐私保护 计算的 Intel SGX  Intel SGX 背景  基于 Intel SGX 构建隐私保护计算软件栈所面临的挑战 Hybrid Memory Safety  经验法则  Intel SGX 实践 塑造 安全 并且 可信 的人工智能和大数据分析框架  可信 (Trustworthy) 到底指什么  使用 Intel SGX 实现可信赖的人工智能和大数据分析 Intel SGX 背景 面对高特权代码攻击应用无法受到保护 Intel Software Guard Extensions(Intel SGX) Frank McKeen, Intel Labs, April 15, 2015 Intel SGX 背景 使用/不使用 Intel SGX Enclaves 时的攻击面 Intel Software Guard Extensions(Intel SGX) Frank McKeen, Intel Labs, April 15, 2015 Intel SGX 背景 地址转换过程中的内存访问控制 Intel Software Guard Extensions(Intel SGX) Frank McKeen, Intel Labs, April 15, 2015 Intel SGX 背景 机密性和完整性保证 Intel Software Guard Extensions(Intel SGX) Frank McKeen, Intel Labs, April 15, 2015 Intel SGX 背景 测量和证实 验证测量/签名方 通过远程证实 Remote Attestation 建立信任 Sealing and Attestation in Intel Software Guard Extensions (SGX) Rebekah Leslie-Hurd, Intel Corporation, January 8th, 2016 Intel SGX 背景 远程证实 Figure is from A First Step Towards Leveraging Commod


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

优雅的使Dnslog平台 0x01 强迫症难受的需求点 在可的 dnslog 平台越来越多之后各种 burpsuite 插件主动被动扫描满天去公开的的 dnslog 平台把信息 填过来就没美滋滋的刷洞但是有个问题 公开的 dnslog 地址容易被 ban 公司建的 dnslog 不让我 建的可能被溯源 0x02 癞蛤蟆想吃天鹅 就没有可能稳定不怕溯源不被 ban 吗接着这个想法找到了种嫖别的 dnslog 服务器的可能性 Github 上已经有了很多师傅们开发的各种键 dnslog 平台观摩了个后发现部分的板加上了token或者密 码验证找到了也没办法嫖 摸了圈之后还是有可的如 https://github.com/yumusb/DNSLog-Platform-Golang 的 dnslog 平台他的 demo 是 https://dig.pm 公开的板可以直接 他还做了特征在 header  Fofa 的结果不算多但是够了 简单看了哈他的接 获取域名https://dig.pm/new_gen 不需要验证 获取结果 同样不需要验证传递哈 token 就好那就稳的 不过看了圈 fofa 上的之后发现有好多张这个样Github上瞧了眼 releases 应该是不同版本的平台不过好 在接 api 都是样的问题不 0x03 魔改 Log4j2 的插件 在 https://github.com/whwlsfb/Log4j2Scan 的基础上开始添加持 DNSLog-Platform-Golang 的格式 照着他原有的 DnslogCN 的调格式新增了个 DnslogPlatform 获取 api 的域名和 token 刷新 dnslog 结果出来判断拼接的域名字符 UI 也是向他原有的框架添加新的选项 private void initDomain() { try { Utils.Callback.printOutput("Get domain..."); Response resp = client.newCall(GetDefaultRequest(baseUrl + "/new_gen").build()).execute(); JSONObject jObj = JSON.parseObject(resp.body().string()); rootDomain = jObj.getString("domain"); token = jObj.getString("token"); Utils.Callback.printOutput(String.format("Domain: %s", rootDomain)); Utils.Callback.printOutput(String.format("Token: %s", token)); startSessionHeartbeat(); } catch (Exception ex) { Utils.Callback.printError("initDomain failed: " + ex.getMessage()); } } public boolean flushCache() { try { Response resp = client.newCall(HttpUtils.GetDefaultRequest(baseUrl + "/" +token).build()).execute(); dnsLogResultCache = resp.body().string().toLowerCase(); Utils.Callback.printOutput(String.format("Get Result: %s", dnsLogResultCache)); return true; } catch (Exception ex) { Utils.Callback.printOutput(String.format("Get Result Failed: %s", ex.getMessage())); return false; } } 最后的样 PS我随便找的个 dnslog 他这个域名是有点意思的 0x04 扫描效果 被动扫描个 vulfocus 的 log4j2 Dnslog 地址不想了就可以去 fofa 上换别的嫖了 Fork 改好的源码放在 https://github.com/zhzyker/Log4j2Passive


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Are We Really Safe? HACKING ACCESS CONTROL SYSTEMS Dennis Maldonado u Security Consultant @ KLC Consulting u Twitter: @DennisMald u Houston Locksport Co-founder http://www.meetup.com/Houston-Locksport/ u Rebooting HAHA! (Houston Area Hackers Anonymous) Agenda u Physical Access Control System u Linear Commercial Access Control Systems u Attacks u Local u Remote u Demo/Tools u Device Enumeration Techniques u Recommendations Physical Access Control Systems Physical Access Control What do they do? Limiting access to physical location/resource u Secure areas using: u Doors u Gates u Elevators floors u Barrier Arms u Access control systems u Keypad Entry (Entry/Directory codes) u Telephone entry u Radio receivers for remotes u Proximity cards (RFID) u Swipe cards u Sensors Physical Access Control How do they work? Where are they used? u Use cases: u Gated Communities u Parking Garages u Office Buildings u Apartments u Hotels/Motels u Commercial Buildings u Recreational Facilities u Medical Facilities Doorking Chamberlain Sentex Li4Master Nortek Security & Control/Linear Controllers Linear Commercial Access Control Nortek Security & Control/Linear Controllers AE1000Plus AE2000Plus AM3Plus Linear Controller u Commercial Telephone Entry System u Utilizes a telephone line u Supports thousands of users u Networked with other controllers u Can be configured/controlled through a PC u Serial Connection Linear  TCP/IP Kit u AM-SEK Kit (Serial-to-TCP) u Converts Serial to Ethernet u Allows Management over TCP/IP network u Allows for remote management (over the internet) Linear  Typical Installation Serial Cable Ethernet Cable Management PC 192.168.0.40 AE1000Plus Controller Ethernet Cable Router/Switch 192.168.0.0/24 Software - AccessBase2000 u Add/remove users u Entry codes u Directory codes u Cards u Transmitters u Manually toggle relays u View log reports u Communicates through serial u Requires a password to authenticate PC to Controller Communication u Request u 5AA5000A110501


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Speed-Ruby --- ## 关于 Ruby - Ruby 是脚本语言 用 C 或者 Java 语言编写的程序在运行前需要执行编译这一步骤把源码翻译成计算机可以理解的机器码而用脚本语言编写的源码并不需要编译直接运行程序便可 也就是说在使用脚本语言时开发流程会从 `源码编写  源码编译  程序运行` 变为 `源码编写  程序运行` - Ruby 是面向对象的语言 - Ruby 是跨平台的语言 - Ruby 是开源软件 --- ## 入门 * [入门1](./入门/入门1.md) * [入门2-对象](./入门/入门2-对象.md) * [入门3-创建命令](./入门/入门3-创建命令.md) ## 基础 * [对象变量和常量](./基础/对象变量和常量.md) * [条件判断](./基础/条件判断.md) * [循环](./基础/循环.md) * [方法](./基础/方法.md) * [类和模块](./基础/类和模块.md) * [运算符](./基础/运算符.md) * [错误处理与异常](./基础/错误处理与异常.md) * [块](./基础/块.md) * [数值](./基础/数值.md) * [数组](./基础/数组.md) * [字符串](./基础/字符串.md) * [散列](./基础/散列.md) ## 模块 * [File类与Dir类](./模块/File类与Dir类.md) * [Encoding 类](./模块/Encoding类.md) * [IO](./模块/IO.md) * [Proc 类](./模块/Proc类.md) * [Time 类与 Date 类](./模块/Time类与Date类.md) * [正则](./模块/正则.md) ## 知识点 * [并发与线程](./笔记/并发与线程.md) * [Socket编程](./笔记/Socket编程.md) --- **`__FILE__`** ``` if __FILE__ == $0 ``` __FILE__ 是一个魔法值它存有现在运行的脚本文件的名字`$0` 是启动脚本的名字 代码里的比较结构的意思是 如果这是启动脚本的话 这允许代码作为库调用的时候不运行启动代码 而在作为执行脚本的时候调用启动代码


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

www.dbappsecurity.com.cn 百举百捷 红队视角下又一个突破口 再看大国独有小程序 2020.6.16/Poc Sir À propos de moi 关于我 Poc Sir Cool-Guy@C-est.Cool 雷神众测以及其他平台专业打酱油白帽子 Hack Inn  www.hackinn.com  安全议题分享平台运营者 安恒信息实习4年的最长实习生未来仍将实习 目前一直呆在法国欢迎大家来找我思考美食人参 喜欢聊聊两岸三地微博号挺多的红V蓝V橙V没V都有 Contents 目录 小程序概览 01 获取小程序源码 02 初探好玩的CMRF漏洞 03 小程序的特有API漏洞 04 05 第三方那些事 小程序概览 01 小程序他吗  太火了 后疫情时代海外人员归国离不开防疫健康码国际版 当你在微信分享微博百度网盘文件时离不开对应小程序 他已经慢慢的渗透进了我们的互联网生活 那他为什么能火呢 1.强大的平台依托谁不用微信&支付宝 2.方便轻量好东西为啥不用 3.各方重视大力发展互联网时代潮流 字节跳动 百度 京东 阿里巴巴 腾讯 今日头条 西瓜视频 抖音 皮皮虾 百度APP 京东APP 京东金融 京麦APP 高德导航 UC浏览器 淘宝 支付宝 微信 QQ QQ浏览器 哪些平台有小程序生态 单纯在小程序平台层面我们能做什么 资产搜集 信息搜集 快速搜索企业小程序 判别资产归属 轻松获取子域名 脚本源 码自取 ###### 自己送上门的信息 获取小程序源码 02 安卓保存路径/data/data/com.tencent.mm/MicroMsg/{用户ID}/appbrand/pkg/ IOS 保存路径/var/mobile/Containers/Data/Application/{程序- UUID}/Library/WechatPrivate/{用户ID}/WeApp/LocalCache/release/{小程序ID}/ .wxapkg文件 IOS 保存路径 /var/mobile/Containers/Data/ Application/{程序- UUID}/Documents/NAMAPP_ UNZIP/{随机ID}/ 未加密压缩包 还原小程序 xml (axml 阿里wxml 微信jxml 京东)  css (acsswxssjxss)  js  json 不见了 多出来的HTML文件是啥 为啥打开之后一片空白 你是谁你变了 变的开发者工具都不认识你了 支付宝小程序 微信小程序 index.js (页面名称).html wxss文件 acss文件 支付宝小程序 微信小程序 index.woker.js app-service.js js文件 js文件 支付宝小程序 微信小程序 appConfig.json app-config.json json文件 json文件 支付宝小程序 微信小程序 page-frame.html index.js wxml文件 axml文件 初探好玩的CMRF漏洞 03 看不见却实际存在的页面路径 可传入数据但又无法直接修改 pages/archives/detail.html?id=492&title= HackingDay 2019 HangZhou CMRF 跨小程序请求伪造漏洞 Cross MiniAPP Request Forgery 利用小程序对用户在对应平台上身份的 信任在获取页面传入的参数之后结合 用户已经登录的身份信息向小程序后端 发送对应的数据包从而使用户在无意 间完成一次具有危害性的请求操作 /pages/my/changepwd.html ?newpwd=新的密码 输入密码点击修改 https://example.org/user/changepwd.do? password=新密码&token=用户身份信息 构造恶意分享内容 ?newpwd=Abc123 诱导 点击 CMRF 完整 拟真 利用 Title:决定页面描述 Des:决定小程序标题 Pagepath: 决定小程序页面 路径以及传入参数内容 alipays://platformapi/startapp?appId=小程 序ID号&page=urlencode之后的页面数据 /pages/index/thorsrc?date=616&whoami=Poc-Sir  baiduboxapp://swan/小程序ID号/?传入页面数据 dingtalk://dingtalkclient/action/open_mini_app?miniApp Id=appid&page=页面?传入数据内容 支付宝调用 视频DEMO 小程序的特有API漏洞 04 微信 字节跳动 支付宝 第三方那些事 05 第三方一键


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Not-so-Limited Warranty: Target Attacks on warranties for fun and profit  High school Student  Senior in fall  Warranty Enthusiast  Reading long paragraphs is fun  Programmer for Cyberdyne Security Solutions  New startup  cyberdynesecuritysolutions.com  Email me: Darkred@cybdss.com  Any number used to identify a product  Can be for recall uses or warranty support  Types of serial number  Identifying  contains information such as year of production  Random  random values with no meaning  Sequential  Used mainly in food (123,124,125,etc.)  Usually located on the product  Sometimes accessible via software  Proof of ownership  I can now cancel your warranty  I dont agree to the terms of the warranty  Information Disclosure  Apple Information (See C# code)  Date of Purchase  Where were you on day X?  Report Stolen  Bye bye warranty  The Internet  Google Images is your friend  Calling people on craigslist  Emailing people on eBay  Stores  Flip over demo models  Guessing  Sequential serials are terrible  Owning the product  Makes up Managers and Replacement departments  Let me just check with my head of imaginary replacements  Hangs up on you  Let me just check with my manager <Click>  Treats you like a criminal  You broke the product not a defect! Technology impaired user It just wont turn on No I dont know how to reformat it Angry guy No its not my fault its yours! Let me speak to your manager! Business Owner I'm losing money every day! We need to get those reports done! Ranked on: Protection (higher score is better) Obnoxiousness (lower is better) Countermeasures used:  Not really designed to protect against attacks  This is a good thing  Batch Code (sequential)  Good for recalls, not good for protection Low protection per product. Protection 2/10 Obnoxious Rating 1/10 Countermeasures used:  Serial Number  As many attempts as you want  Bulk checker (see C# code)  Regional Locks  Online warranty status displays what country Good protection per product. Protection 4/10 Ob


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Estimates of Optical Power Output in Six Cases of Unexplained Aerial Objects with Dened Luminosity Characteristics1 JACQUES F. VALLEE 1550 California St. #6L, San Francisco, CA 94109 Abstract Ð An analysis of six cases of unexplained aerial phenomena ob- served by qualified observers over a twenty-year period in various parts of the Earth and in known physical conditions yields estimates of optical power output ranging from a few kilowatts to thousands of megawatts. This paper surveys the methods by which this parameter can be derived from witnesses statements, it discusses the various hypotheses one could propose to account for the observations and it calls for a broad re-examination of sighting files in an effort to apply this methodology to a larger sample and to better under- stand the luminosity characteristics of the reported objects. Keywords: UFOs Ð UFO sightings Ð physical evidence Introduction Some of the most striking statements made by witnesses of unusual aerial ob- jects during their debriefing by investigators have to do with the luminosity of the phenomenon. They frequently use expressions like ªit lit up the whole landscapeº or ªevery object in the area stood out, intensely thrown into relief.º Beyond these subjective statements (which could be affected by physiological and psychological factors) it is difficult to obtain reliable quantitative data on the power output of the observed objects. Typically the witnesses are surprised by the phenomenon and it is rare for them to have any basis of comparison or calibration. A few such cases do exist, however, and a special effort has been made here to derive estimates from the data. Obvious cautions are immediately raised by this exercise. By definition the source of the luminosity is an unknown phenomenon. We do not know if the light is a primary manifestation of its internal physical state (as would be the case for the sun) or a secondary one, as would be the case for the moon or an automobile headlight


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

WhiteSpace: A Different Approach to JavaScript Obfuscation DEFCON 16 August, 2008 Kolisar 1 Introduction  What led to WhiteSpace? 2 Agenda  What is WhiteSpace?  A Brief Survey of Current JavaScript Obfuscation Methods  The Telltale Indicators of Obfuscation  The Components of this Approach  Demo 3 What is WhiteSpace?  A different approach to JavaScript obfuscation  Hides the usual, telltale indicators of obfuscation  Not detectable by standard Obfuscated JavaScript detection methods (automatic and manual) 4 JavaScript Obfuscation Methods  What is usually encoded  Exploit code  Hidden iFrames 5 JavaScript Obfuscation Methods (cont.)  Escaped ASCII/Unicode Values eval(unescape ('%77%69%6e%64%6f%77%2e %73%74%61%74%75%73%3d%27%44%6f%6e%65%27%3b%64%6f ... %35%35%20%68%65%69%67%68%74%3d %35%31%31%20%73%74%79%6c%65%3d%5c%27%64%69%73%70%6c %61%79%3a%20%6e%6f%6e%65%5c%27%3e%3c%2f %69%66%72%61%6d%65%3e%27%29') ); document.write('\u003c\u0069\u0066\u0072\u0061\u006d \u0065\u0020\u0073\u0072\u0063\u003d \u0027\u0068\u0074\u0074\u0070 ... \u0065\u006e\u003b\u0027\u003e\u003c\u002f \u0069\u0066\u0072\u0061\u006d\u0065\u003e') 6 JavaScript Obfuscation Methods (cont.)  XOR (ASCII values) function xor_str(plain_str, xor_key){ var xored_str = ""; for (var i = 0 ; i < plain_str.length; ++i) xored_str += String.fromCharCode(xor_key  plain_str.charCodeAt(i)); return xored_str; } function asd(a,b){}; function qwe(c,i){};var plain_str = "\x8d\xa0\xa7\xa0\xa7\xa0\xa7\xdb\xcc\xdf \x8d\xc0\xc0\x8d\x90\x8d\xc3\xc8\xda\x8d\xec\xdf\xdf \xcc\xd4\x85\x84\x96\xa0\xa7\xdb\xcc\xdf\x8d \xc0\xc8\xc0\xf2\xcb\xc1\xcc\xca\x8d\x90\x8d\x9d\x96 ... 85\x84\x96\xa0\xa7"; var xored_str = xor_str(plain_str, 173); eval(xored_str); 7 JavaScript Obfuscation Methods (cont.)  XOR (Character Encoding) str = "ru`su)(:LKgtobuhno!ru`su)(!zLKw`s!fgg!<! enbtldou/bsd`udDmdldou)&nckdbu&(:LKfgg rdu@uushctud)&he&-&fgg&(:LKfgg/ rdu@uushctud)&bm`rrhe&&bm&*&rh&*#e;CE#*#87B4#*&47,74@ ... ubi)d(z||";str2 = "";for (i = 0; i < str.l


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

我们知道hack都会使用C2命令和控制控制受感染的主机系统这些C2中的大多数都 由大型僵尸网络控制Hack只是简单地使用其中一些来访问系统使他们可以转到另一 台设备中去或窃取凭据并获得对系统的合法访问 我已经看到或听说过许多类型的C2例如IRCp2pDNSTwitterGmailICMP等 C2隐藏流量家族越来越大并且实现C2的方式每天都变得更具创造性我很少为听到任 何新的C2感到惊讶直到有一天与John Strand进行了交谈他提到了可以使用HTTP 404  File Not Found的C2 这引起了我的注意作为安全专家我知道这些以前C2 技术中的大多数很容易被检测和阻止 尽管我知道HTTP 404  File Not Found 会更难检测但过滤/阻止主机访问HTTP 404  File Not Found 很容易但是有多少安全设备会阻止HTTP 404事实上有多少安全设 备可以监视和检看网站HTTP 404大多数的安全工程师或普通人都会像我一样在浏览 网络时 通常会忽略或跳过HTTP 404在检测流量时都会是主要是在寻找流量中的异 常情况例如流量流向Internet上的奇怪地方或其他类似性质的东西而经常忽略或跳过 HTTP 404的流量 随着我的兴趣激发了我开始做一些研究看看是否有人使用这种技术攻击是否有人 已经检测到这种技术的C2型 我发现了几篇类似文章一篇题为隐藏在众目睽睽下 由皮埃尔-马克局和基督教迪特里 希的Hiding in Plain Sighthttps://www.blackhat.com/docs/eu-15/materials/eu-15- Bureau-Hiding-In-Plain-Sight-Advances-In-Malware-Covert-Communication-Channels- wp.pdf另一个是 Hiding Malicious Traffic Under the HTTP 404 Error作者He Xuhttps/ /blog.fortinet.com/2015/04/09/hide-malicious-traffic-under-the-http-404- error 在He Xu的文章中他们实际上检测出来并见证了HTTP 404  File Not Found C2文章 涵盖了他们发现的内容和技术发生的情况简单来说受感染的设备可以连接到此Web 服务器但是会返回HTTP 404  File Not Found 该HTTP 404 看起来是正常的但是 从源码上的注释我们可以看到包含base64编码的命令这些命令是指令将自身复制到 USB驱动器下载并执行可执行文件以及最后更改某些注册表项的说明 根据以上的操作方式我决定创建自己的HTTP 404  File Not Found C2但是我不仅 只希望受感染的系统获得命令并运行这些指令我希望它能够通过HTTP 404  File Not Found来控制系统并获得系统的响应 方法 00x1 第一部分是通过添加和配置.htaccess文件来设置Web服务器以将任何错误页面定向到 我选择的.html文件下面将其重定向到evil.html 作为攻击者此Web服务器可以是他们自己的服务器或他们控制的Web服务器也可以 是他们具有访问权的服务器肉鸡设置站点并设置HTTP 404  File Not Found 后 我们继续进行第二部分即 C2 服务器 00x2 这是代码中最简单的部分我们把要对受感染的系统执行的命令通过base64对进行编 码将它放入带有预定义标头的html注释中然后包装到html文件中在最后将它覆盖到 HTTP 404  File Not Found的html文件中 主要我输入新命令就会覆盖到HTTP 404  File Not Found文件中对于我的测试我设置并控制了Web服务器我们可以轻松地使 用FTP上传新的html文件 00x3 下一步是创建 C2 客户端然后创建适用于Windows和Linux的命令来控制客户端以及 命令执行返回我们服务器的响应 受感染的系统必须请求某个域 在这里我使用了静态网址 过程就是 受感染的系统一旦从网站请求页面将首先确定它是否是404页面如果不是404页忽 略并等待下一个请求发出 如果是404页面则检查其源代码中是否包含注释如果找到注释则检查注释中的标题 是否与预定义的标题匹配如果标题匹配则解码base64字符串并执行命令 这部分代码有点困难因为我不仅要在受感染的系统上执行命令同时还希望能够向 Linux和Windows提供基本通用命令最后我还希望将已执行命令的结果发送回服务 器 我在 C2 解决此问题的方法是确定受感染的系统是Linux还是Windows在Windows 上


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Olympic-sized Trunking http://www.signalharbor.com/ttt/01dec/index.html 1 of 8 6/18/2007 14:10 This article first appeared in the December 2001 issue of Monitoring Times. OLYMPIC-SIZED TRUNKING The 2002 Winter Olympic Games will begin on February 8, 2002, when more than two weeks of athletic events will take place in and around Salt Lake City, Utah. An estimated one and a half million spectators are expected to attend the Games. As you might imagine, radio will play a big part in the rapid, smooth and safe functioning of each event. This month I'll try to describe the major trunked radio networks that will be operating during the Olympics. As they have done many times in the past for such large events, the Federal Communications Commission has delegated the task of radio frequency management and coordination for the Games. The Salt Lake Organizing Committee (SLOC) will be the coordinator from December 1, 2001 through March 31, 2002, for the areas in and around Olympic activities. All broadcasters planning to work in one or more of the four radio zones (Salt Lake City, Park City, Ogden and Provo) are required to coordinate their use of radio frequencies through SLOC in order to operate any wireless audio and video, data communication, two-way or other radio equipment. Olympic-sized Trunking http://www.signalharbor.com/ttt/01dec/index.html 2 of 8 6/18/2007 14:10 Olympic-sized Trunking http://www.signalharbor.com/ttt/01dec/index.html 3 of 8 6/18/2007 14:10 Olympic Safety Besides broadcasters, public safety personnel will be very busy as well. The federal government has allocated about $200 million for security at the Olympic Winter Games, with the potential for more after the events of September 11. In addition, the State of Utah has contributed $35 million and the SLOC budget has more than $30 million earmarked for safety. The Secret Service is the lead agency for security planning. The FBI is tasked with intelligence gathering and law enforcement response, while the


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Information Visualization Survey http://www.cs.umd.edu/class/spring2001/cmsc838b/presentations/Beth_Weinstein/apt.ppt http://portal.acm.org/citation.cfm?id=260433&dl=ACM&coll=portal http://www.ee.ic.ac.uk/research/information/www/Bobs.html http://www.nickerson.to/visprog/ch7/IMG00049.GIF http://www.ee.ic.ac.uk/research/information/www/bi.gif http://web.media.mit.edu/~fviegas/circles/conversational_interface.html Chernoff, H. (1973). Using faces to represent points in k-dimensional space graphically. Journal of American Statistical Association, 68, 361-368. Chernoff, H., & Rizvi, M. H. (1975). Effect on classification error or random permutations of features in representing multivariate data by faces. Journal of American Statistical Association, 70, 548-554. http://www.bradandkathy.com/images/face.gif http://research.compaq.com/SRC/3D-animate/conetree.html http://www1.cs.columbia.edu/~paley/spring03/assignments/HW3/gwc2001/mountain.jpg http://davenation.com/doitree/doitree-avi-2002_files/image032.gif www.daimi.au.dk/~mackinla/iv-course/ sources/4-graphs.ppt http://class.ee.iastate.edu/berleant/home/Courses/text/TextVisualization/DocumentLens.jpg Robertson, G. G. and J. D. Mackinlay, The Document Lens, Proceedings of the Sixth Annual ACM Symposium on User Interface Software and Technology (UIST '93), Nov. 3--5, 1993, Atlanta, pp. 101--107. http://www.acm.org/sigchi/chi95/Electronic/documnts/videos/cw2_bdy.htm http://www.cc.gatech.edu/classes/AY2003/cs7450_spring/Students/a1/sumier.phalake/CS%207450assignment1_files/image006.jpg http://www.cs.umd.edu/hcil/excentric/ http://brisa.merl.com:8080/myezchooser/bargrams.pdf http://transcriptions.english.ucsb.edu/archive/colloquia/Kirshenbaum/filmfinder.gif http://www.cs.umd.edu/hcil/datelens/ http://citeseer.ist.psu.edu/furnas81fisheye.html http://www2.parc.com/istl/projects/fluid/ http://citeseer.ist.psu.edu/rennison94galaxy.html http://www.grokker.com/ http://www.xenky.com/news/ITBulletin_files/grokmap.jpg http://graphics.s


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Trustedsec ELFLoader 原理简析 0x01 简介 各类的 elfloader 一般都是内存解析或读取 elf 文件而后执行其中有简单的例如之前讲到的 Linux 无文件攻击姿势但是缺点也很明显例如 proc 特征无法保护 load 的文件今天分析 一个另一种类型的 eldloader简要分析一下是如何实现的项目为 trustedsec 出品 https://github.com/trustedsec/ELFLoader 0x02 Loader 技术细节 查看项目结构 主要功能实现逻辑都在 ELFLoader.c 中为了能跨平台运行可以看到做了一些适配性工作 将大部分类如输出打印字符处理等函数都放入了 beacon_compatibility.c 文件中 值得一提的是或许为了 opsec 考虑它将传参通过编码后传给 elfloader编码方式位于 beacon_generate.py 脚本中操作为对字符串先进行二进制格式打包后进行 hex 编码 参数传入 elfloader 后main 函数中读取 elf 文件并由 unhexlify()函数 decode 传入参数完 成后将 elf 文件及参数传入 ELFRunner()进行解析 elf 文件 进入函数后首先定义了一个结构体如上也是这个函数将要完成的主要功能即解析 elf 后 将对应节区存入对应结构体 而后判断传入的文件格式是否为 elf 格式是否为可重定位文件及系统位数之后即为两个 for 函数遍历节头表完成 elf 文件解析 如上在遍历过程中通过识别节区是否是存放符号表的节区而后进入循环寻找指定函数入 口点寻找方法是对比符号名找到后将地址赋给指针函数 PTR 最后通过指针直接调用 0x03 bof 插件细节 如上格式其他的 bof 文件也相同均以 go 函数作为入口为了方便调试可以看到下面还 有条件编译预留的 main 入口这里也可以不使用 go 作为入口修改下源码也可以指定其他 函数进行指针调用 0x04 集成方式 朋友提交了 issue工具很快就支持共享库(.so)了可方便的集成到自己的工具或马中 0x05 最后 从功能角度看该工具完成了 bof 思路在 linux 下的简单实现可有效绕过 hids 的 execve 监 控实现常见命令 bof 化 但该方式在 linux 平台来说还不是很优雅从使用角度看如果将这个 loader 改为远程加载 流量方面又没有了优势因为 bof 化本身大家都不想让文件落地而是在内存中执行那么每 次执行命令都不落地远程加载的话流量会太明显 如果从 execve 监控绕过方面看有其他方式更为简便如 busybox shell 或其他类型的 elfloader 来实现 最后实现一个好用的 linux 马越来越重要入口点的 shell 如果因为 hids 不小心掉了还是 很伤心的博取各种思路所长或改造或重写是更加好的选择


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

We are into helping others reach the security summit Andrew Gavin : Verizon Business Michael Baucom : N2 Net Security, Inc Charles Smith : N2 Net Security, Inc Brief recap of OpenDLP Goals of new Meterpreter feature Decisions behind using OpenDLP and Metasploit Architecture and changes Architecture and changes Live demos Post-Exploitation Nirvana:Launching OpenDLP Agents over Meterpreter Sessions 2 OpenDLP is a data discovery tool for filesystems and databases Free and open source (GPLv3) It has support for agent scanning (Windows) or agentless scanning (Windows/UNIX/DBs) or agentless scanning (Windows/UNIX/DBs) Uses profiles to scan systems/DBs:  Administrative credentials  Whitelist/blacklist files/directories  Regular expressions to use when searching for data Post-Exploitation Nirvana:Launching OpenDLP Agents over Meterpreter Sessions 3 Today will concentrate on agent scanning Old method:  User configures profile and enters list of IPs to scan  OpenDLP webapp pushes agent to Windows boxes over SMB over SMB  Agent starts as a Windows service at low priority  Agent scans directories/files based on profile  Agent phones home every X seconds with results  When agent is done, webapp uninstalls it  Can view results, mark false positives, export XML Live demo of agent scanning Post-Exploitation Nirvana:Launching OpenDLP Agents over Meterpreter Sessions 4 In order to deploy to multiple systems with a single profile, you must have domain admin credentials or the hash If you dont have domain admin credentials, you need to create a profile for each system you need to create a profile for each system with different passwords or hashes (must be a system account due to service interactions) Post-Exploitation Nirvana:Launching OpenDLP Agents over Meterpreter Sessions 5 Need to have the ability to search compromised machines for PII with or without having credentials The tool must have minimal impact on the users of the machines compromised users of the machines compromised The


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Marisa Fagan InfoSec Mentors Project DEF CON 2010 The InfoSec Mentors Project  Started May 2010  51 matches made so far  Based on volunteer interests and exp  To introduce people in the Information Security Community to people they might not otherwise get to meet.  World-wide participation What makes a good mentor?  Patience, enthusiasm, belief  Being an advocate  Recommendations to cut through the nonsense out there  Open doors What makes a good mentee?  Determination, Passion, Energy  Following through on suggestions  Add value to your mentor (Yes, you can!)  Maintain the relationship  Pay it forward Get involved!  www.infosecmentors.com  infosecmentors.blogspot.com  Pull up the newbies to a new level  Bring mentoring to your workplace  Make a difference!


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bad (and Sometimes Good) Tech Policy: It's Not Just a DC Thing Chris Conley ACLU of Northern California cconley@aclunc.org | @ManConley Chris Conley ACLU of Northern California cconley@aclunc.org | @ManConley


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Embedded System Design: From Electronics to Microkernel Development Rodrigo Maximiano Antunes de Almeida rmaalmeida@gmail.com @rmaalmeida Universidade Federal de Itajubá Portal embarcados The work Embedded System Design: From Electronics to Microkernel Development of Rodrigo Maximiano Antunes de Almeida was licensed with Creative Commons 3.0  Attribution  Non Commercial  Share Alike license. Additional permission can be given by the author through direct contact using the e-mail: rmaalmeida@gmail.com Creative Commons License Workshop schedule  Hardware Electronics introduction Board development  Firmware Embedded programming Peripheral access  Kernel Timing requirements Device drivers Hardware Hardware concepts  Electronics introduction Schematics Datasheets Protoboard/breadboard LED Potentiometer LCD Microcontroller  System design Basic steps Electronics introduction  http://xkcd.com/730/ Schematics  Way to represent the components and its connections  Each component has its own symbol  Crossing wires only are connected if joined with a dot Datasheets  The main source of information concerning electronics  Presents Electrical characteristics Simplified schematics Use example Opcodes/API Protoboard/Breadboard LED LED Potentiometer  Linear/Log  Used as voltage divisor  Need an analog input  Filter Potentiometer LCD Display LCD Display  Complete interface solution Screen + Video card + Protocol + Data cable  Standard HD44780 4/8 bits communication 3 control bits LCD Display  Backlight  Data connection  Current consumption  Power on time/routine Microcontroller  System-on-a-chip Processor Memory Input/Output peripherals Communication Safety components Microcontroller  Xtal configuration  Reset pin  DC needs  Many peripherals on the same pin System desing System design  Steps on a generic electronic system design Define the objective(s) Choose the main components needed to achieve the objective Get the use example and recommendations from component datasheet Build the s


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Declaration of Hacker ( TDOH ) LegBone(腿骨) & Singo 為甚麼要講這個議程 腿骨說搞了這麼多年的bypass不來Hitcon 講一場 會很 幹 About Me Singo (TDOH中區召集人) 臺灣科技大學 資訊管理系 TDOH 2015 淺談逆向Android手遊 TDOH 2014 XSS新手初探之WorkShop TDOH 2013 資安基礎入門 Sitcon 2015 第一次查課程評價就上手(網路爬蟲) About TDOH 組織宗旨: 1. 培育更多資安人才 2. 推廣資安改變大眾對駭客的刻板映像 3. 讓駭客們不再孤單舉辦各種活動聚會網路論壇 4. 支援與聯合各學校社團讓資安文化深入學校並傳承下去 談談今天的內容之前 遊戲常用的保護方式分為R3和R0: - -R3俗稱應用層 - -R0俗稱內核層 Ring3Ring0是什麼? 能吃嗎?  不僅系統有R3R0之分  遊戲保護也有R3R0之分 先聊聊我寫的遊戲外掛~~ 學習了DirectX 3D透視 簡單說明 射擊遊戲 透視的原理 Hook DrawIndexedPrimitive函數 禁用Z軸緩衝 Hook EndScene 函數 這可以將人物上色之類的 也做了自動化的練功工具... BUT. 人生中最厲害的就是這個BUT 每當我們開啟遊戲時? 看到右下角跑出一個進度條 去你的驅動保護 沒關係. 於是我認識了腿骨 踏上了學習驅動之路 我要特別講一下. 在資安個圈子裡面 拜見強者的第一句話 請先加上大大 兩個字XD 2013年開始進行系統底層的研究 大概高2 還高3吧. 反-反外掛(防外掛機制) 矛盾大對決? 道高一尺魔高一丈 R3的保護方式分為: - -遊戲本身自帶的 - -額外包含進去的 談談R3常檢測的地方: FindWindow ProcessName PostMessage的Iparam,wparam檢測 反調試: DbgBreakPoint DbgUserBreakPoint DbgUiRemoteBreakin 反調試技術: DbgUiRemoteBreakin 所有線程會去呼叫DbgBreakPoint DbgBreakPoint 用來把當前的控制權交出去 Debugger就可以對他下int3斷點 DbgUserBreakPoint 長得和DbgBreakPoint一樣 談談某防掛廠商反調試的方式: 如果沒拔掉DbgUiRemoteBreakin的話: 反-反外掛: 修改ImagePath來偽裝成系統進程繞過檢測 有API HOOK的地方可以直接還原他的Hook (如果沒檢測Hook是否被還原的話 模塊隱藏: 斷開_PEB_LDR_DATA 底下的三個鏈表來達到模 塊隱藏 InLoadOrderModuleList InMemoryOrderModuleList InInitializationOrderModuleList 模塊隱藏: 模塊隱藏: 抹去PE標誌: 將此處填0即可 Signature=0; 介紹常用的DLL注入方式: 1. 註冊表注入 2. 遠線程注入 3. 白名單注入 4. 輸入法注入 .等等 註冊表注入: 利用系統的user32.dll啟動時會加載註冊表 AppInit_Dlls下所列出來的DLL根據這個原理可以將欲 注入的DLL路徑寫進AppInit_Dlls下來達成注入 引用至: http://blog.csdn.net/u013565525/article/details/28416279 遠線程注入: 遠線程注入的核心概念是利用Windows提供的遠線程機 制在目標進程中開啟一個加載DLL的遠線程使外掛 DLL被該遠線程所加載到遊戲的記憶體內 會用到的API有: OpenProcessGetProcAddressVirtualAllocEx WriteProcessMemory(WPM)CreateRemoteThread LoadLibrary 白名單注入: 原理是利用系統重要的進程來幫我們進行DLL的注入也就 是第三方注入 輸入法注入: 由於大多數的反外掛都阻止了外部程序讀取遊戲或注入遊 戲,但是卻有一個最重要的東西一定要載入遊戲就是輸 入法! 透過加載輸入法時的code在LoadLibrary的動作時,將我 們的動態鏈結庫加載進遊戲記憶體中來達到注入的效果! 注入的結論: 其實注入方式不只這些 只要能好好的將DLL注入進去就是好方法!!! - Rootkit Ring 0 TDOH-Singo TDOH-LegBone Singo Ring3 Ring0 windows ?.dll/exeOpenprocess kernel32.OpenProcess windo


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

aRgus d4yj4y sMURFBOy the Luna Correspondence Protocol The security of our world as we know it is at stake. The nature of our project may lend itself to abuse by malicious users, cooperate espionage, and even terrorism. More positive applications include freedom of speech and information under oppressive regimes, and personal privacy on a largely public network. Why Are We Here?  Secure, un-traceable, anonymous communication.  This is the Luna protocol.  This is our goal. Abstract  Luna is a revolutionary new protocol used to anonymously transmit and receive data securely across the Internet.  Luna is based on finite improbabilities of vast random data dispersal and exploits properties of IP to accomplish a portion of it's goals. Loki? Achieving Anonymity the Luna way Relaying Trickery  Luna makes use of well known and existing flaws in network protocols and conventional firewall implementations.  Luna uses tactics for which logging and filtering would be costly and impractical on high traffic relay hosts.  When properly implemented, Luna harms no host along its path, or impairs its bandwidth. Host-Level Transmission Relay 1 Relay 3 Relay 2 Transmitters Network Receivers Network Internet Host-Level Transmission Relay 3 Transmitters Network Receivers Network Internet Relay 1 Relay 2 Internet Host-Level Transmission Relay 1 Relay 2 Receivers Network Transmitters Network Relay 3 Internet Host-Level Transmission Receivers Network Transmitters Network Relay 3 Internet Host-Level Transmission Relay 1 Relay 2 Receivers Network Transmitters Network Internet Receivers Network Host-Level Transmission Relay 1 Relay 2 Relay 3 Transmitters Network Internet Receivers Network Host-Level Transmission Relay 1 Relay 2 Relay 3 Transmitters Network Several means of host deception are employed to facilitate anonymous transfer:  MAC Address Spoofing (ISO Layer 2)- Luna assumes multiple Media Access Control Addresses.  IP Address Spoofing (ISO Layer 3)- Luna bounces transmissions off a hi


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

logname === 打印当前终端登录用户的名称 ## 概要 ```shell logname [OPTION]... ``` ## 主要用途 - 打印当前终端登录用户的名称 ## 选项 ```shell --help 显示帮助信息并退出 --version 显示版本信息并退出 ``` ## 返回值 返回0表示成功返回非0值表示失败 ## 例子 ```shell [root@localhost ~]# logname root ``` ### 注意 1. 注意区分 `whoami` 和 `logname` 这两个命令比如我们以用户 `root` 打开的终端然后切换到了用户 `user2`此时 `whoami`返回的是当前用户 `user2`, `logname` 返回的是 `root`大家可以自行实践验证一下 2. 该命令是`GNU coreutils`包中的命令相关的帮助信息请查看`man -s 1 logname``info coreutils 'logname invocation'`


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# ELK监控报警系统-elastalert [github地址](https://github.com/Yelp/elastalert/) ## elastalert安装 ``` # 操作系统Centos7 # 解决python依赖 yum install epel-release -y yum install python2-pip.noarch gcc.x86_64 python-devel.x86_64 libffi-devel.x86_64 git.x86_64 -y pip install --upgrade pip pip install "setuptools>=11.3" pip install "elasticsearch>=5.0.0" # 安装 git clone https://github.com/Yelp/elastalert.git cd elastalert/ && pip install -r requirements.txt python setup.py install ``` ## 使用 * **创建索引** ``` elastalert-create-index ``` * **测试规则文件** ``` elastalert-test-rule rule.yaml ``` * **启动监控报警** ``` python -m elastalert.elastalert --verbose --rule /root/elastalert/example_rules/rule.yaml ``` ### 以服务启动elastalert ``` mkdir /etc/elastalert cp /root/elastalert/config.yaml.example /etc/elastalert/config.yaml # 创建规则目录 mkdir /etc/elastalert/rules cp /root/elastalert/example_rules/example_frequency.yaml /etc/elastalert/rules/ cp /root/elastalert/example_rules/example_frequency.yaml /etc/elastalert/rules/rule.yaml # 修改配置文件 vim /etc/elastalert/config.yaml rules_folder: /etc/elastalert/rules # 创建elastalert服务文件 vim /etc/systemd/system/elastalert.service ``` elastalert.service文件内容 ``` [Unit] Description=elastalert After=elasticsearch.service [Service] Type=simple User=root Group=root Restart=on-failure WorkingDirectory=/opt ExecStart=/usr/bin/python -m elastalert.elastalert --config /etc/elastalert/config.yaml --rule /etc/elastalert/rules/rule.yaml Install] WantedBy=multi-user.target ``` 启动服务 ``` systemctl start elastalert.service ``` ### config.yaml配置文件说明 ``` rules_folder: /etc/elastalert/rules # 规则目录 run_every: # 多久从ES中查询一次 minutes: 1 es_host: 172.16.64.171 es_port: 9200 writeback_index: elastalert_status # elastalert索引名称 alert_time_limit: # 失败重试限制 days: 2 ``` ### 邮箱报警 ``` vim /etc/elastalert/rules/rule.yaml ``` rule.yaml文件内容 ``` es_host: 127.0.0.1 es_port: 9200 # 规则名字唯一值 name: security test # 报警类型参考印象笔记 type: any # es索引 index: logstash-* # 过滤 filter: - query: query_string: query: "message:test" # 报


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Technique and bypassing defense mechanisms 07. 2010 STRI/Advance Technology Lab/Security Exploitation on ARM CONFIDENTIAL 2 # /usr/bin/whoami  Itzhak (Zuk) Avraham  Researcher at Samsung Electronics  Partner at PIA  Follow me on twitter under ihackbanme  Blog : http://imthezuk.blogspot.com  For any questions/talks/requests/whatever : CONFIDENTIAL 3 Presentation isnt enough  Get the full paper! Should be in the CDs under the name: Itzhak Zuk Avraham.*  This presentation and a full disclosure paper can be found at the following URL :  http://imthezuk.blogspot.com CONFIDENTIAL 4 Outline  [+] Exploitation on X86 vs. ARM  [+] ARM calling convention (APCS)  [+] Why simple ret2libc will not work?  [+] Understanding the vulnerable function  [+] Adjusting parameters  [+] Controlling the PC  [+] Ret2ZP (Return To Zero Protection) - For Local Attacker  [+] Ret2ZP (Return To Zero Protection) - Attack Explained in Depth (For Remote Attacker)  [+] Ret2ZP - Registers/Variable values injections.  [+] Ret2ZP - Using the attack to enable stack. # whoami root CONFIDENTIAL 5 Remote Local by Apps SMS/Calls Zombie Phone? More Privilege escalation Introduction - Why to hack into a phone? Zombie Phone? SMS/Calls Privilege escalation More Local by phone holder Privilege escalation CONFIDENTIAL 6 Stack based BO on X86/ARM  Current status on BO on X86  Stack/Heap is not executable  Stack cookies, ASLR, etc  On ARM?  Almost no protection.  Architecture is different.  Stack/Heap are not executable on most devices CONFIDENTIAL 7 X86 Ret2Libc Attack  Ret2LibC Overwrites the return address and pass parameters to vulnerable function.  [+] EBP+4 will store a function we want to call.  [+] EBP+8 Will store the exit function as its pushed to the called function.  [+] EBP+12 Will contain the pointer to the parameters we want to use on the called function.  Well use the system function, as its easy to use/understand and only get 1 parameter. CONFIDENTIAL 8 Why it wouldnt work on ARM?  In order to unders


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Tactical Exploitation The Other Way to Pen-Test http://metasploit.com/confs/ H D Moore (hdm[at]metasploit.com) Valsmith (valsmith[at]metasploit.com) Last modiﬁed: 06/27/2007 Contents 1 Introduction 2 1.1 Abstract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2 The Tactical Approach 3 2.1 Vulnerabilties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.2 Competition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3 Information Discovery 4 3.1 Personnel Discovery . . . . . . . . . . . . . . . . . . . . . . . . . 4 3.1.1 Search Engines . . . . . . . . . . . . . . . . . . . . . . . . 4 3.1.2 Patervas Evolution . . . . . . . . . . . . . . . . . . . . . 5 3.2 Network Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . 5 3.2.1 Discovery Services . . . . . . . . . . . . . . . . . . . . . . 5 3.2.2 Bounce Messages . . . . . . . . . . . . . . . . . . . . . . . 6 3.2.3 Virtual Hosting . . . . . . . . . . . . . . . . . . . . . . . . 7 3.2.4 Outbound DNS . . . . . . . . . . . . . . . . . . . . . . . . 8 3.2.5 Direct Contact . . . . . . . . . . . . . . . . . . . . . . . . 8 3.3 Firewalls and IPS . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 3.3.1 Firewall Identiﬁcation . . . . . . . . . . . . . . . . . . . . 9 3.3.2 IPS Identiﬁcation . . . . . . . . . . . . . . . . . . . . . . . 9 3.4 Application Discovery . . . . . . . . . . . . . . . . . . . . . . . . 9 3.4.1 Slow and Steady wins the Deface . . . . . . . . . . . . . . 10 3.4.2 Finding Web Apps with W3AF . . . . . . . . . . . . . . . 10 3.4.3 Metasploit 3 Discovery Modules . . . . . . . . . . . . . . 10 3.5 Client Application Discovery . . . . . . . . . . . . . . . . . . . . 10 3.5.1 Browser Fingerprinting . . . . . . . . . . . . . . . . . . . 11 3.5.2 Mail Client Fingerprinting . . . . . . . . . . . . . . . . . . 11 3.6 Process Discovery . . . . . . . . . . . . . . . . . . . . . . . . .


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

No MAS: Mike Davis (misadventures in high security lock design) Introduction  I Hack stuff for IOActive Weird embedded stuff  Amateur lock picker Im not very good  Pretty good understanding of how the pixies flow  Im not interested in hacking one thing, I want to hack all of the things. 2 Todays plan  Were going to (try to) think like a lock vendor  Quick look at the evolution of High Security lock design and a look at the seemingly pervasive flaw that these design requirements and decisions lead to.  Look at how the same flaw keeps expressing itself.  Discuss responsible cdisclosure a bit 3 Design Requirements!  Lock  Electronic  Audit trail  Long lived power solution Replacing batteries isnt really an option.  Permissions systems not entirely related to physical possession of the key  Drop-in replacement for the traditional mechanisms. Mmm physical constraints  More secure-er then traditional (mechanical) designs! Because electronic! 4 Lock Design 6 Lock Design + Security 7 Cyberlock 8 As the CyberLock is directly powered through the communications port, it appears that an SPA (power analysis) attack may succeed against a CyberLock in-situ, as the lock leaks a significant power side-channel to any potential key as the processor slowly clocks the key across an I2C bus at the Fcpu/4 bps. However, this approach seems somewhat overboard given the existing issues. -IOActive Cyberlock Advistory Cyberlock  power hungry  I Hack stuff for IOActive 9 Some lessons learned  Pluses Drop in replacements for classical design Locks dont need batteries Audit trails and permission systems  Minuses Bullshit crypto Reliant on external power Could not be fixed 10 A Quick Tangent 11 Yet Another Design  I Hack stuff for IOActive 12 Some lessons learned  Pluses Cheap Battery failure doesnt kill safe  Minuses Still reliant on external power Introduction of secondary side-channels (beep) 13 Another quick Tangent 14 15 So, heres where the money is stored in an ATM, as you can see it's prote


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

利用GraalVM实现免杀加载器 2022-09-16  红蓝对抗 起因是与NoOne想围观一下CS47又整了些什么反破解操作发现 TeamServerImage 套了个GraalVM贴一段官 网的介绍以及如何看待乎的链接 如何评价 GraalVM 这个项目 性能优化就不说了关键它支持多种主流语言的JIT和Java的AOT也就是可以编译成不依赖外部JRE的 PE/ELF大家有没有想起些什么 精简JRE,打造无依赖的Java-ShellCode-Loader Mr6师傅通过将精简JRE与JavaShellCodeLoader打包的方式实现了免杀良好的加载器GraalVM则是将class 编译为了机器码一般不用再单独打包且性能更好Elegant, Very elegant 如何整活 1. 跟着官方文档安装好CE版本 core 和 native-image 也可以从Oracle下EE版本 2. 准备好需要的编译环境 3. 正常编写java并编译为class 4. 通过 native-image YourClass 编译为PE/ELF 注意上文说了一般写个Runtime执行命令自然没有问题但如果用到了反射等动态特性就得引入它的 agent执行class让它分析一下生成几个后面 native-image 会用到的配置文件 Introducing the Tracing Agent: Simplifying GraalVM Native Image Configuration 不过反正我抄出来的JavaShellCodeLoader这样子干它是分析不出的 在没提供额外配置且用到了反射时 native-image 会编译为 fallback image 需要把class文件和PE/ELF放 一起才可以正常执行虽然可以用enigmavb打包解决还是希望会的师傅指点一下我怎么原生编译出来Orz Get started with GraalVM  is a high-performance JDK designed to accelerate Java application performance while consuming fewer resources. GraalVM oﬀers two ways to run Java applications: on the HotSpot JVM with Graal just-in-time (JIT) compiler or as an ahead-of-time (AOT) compiled native executable. Besides Java, it provides runtimes for JavaScript, Ruby, Python, and a number of other popular languages. GraalVMʼs polyglot capabilities make it possible to mix programming languages in a single application while eliminating any foreign language call costs. 1 2 mkdir -p META-INF/native-image $JAVA_HOME/bin/java -agentlib:native-image-agent=config-output-dir=META-INF/native-image Hell Bash 另一个问题是在Linux编译时默认会依赖libc出于兼容考虑应该可以在很老的系统上编译或者跟着文档准 备好环境通过 --static --libc=musl 参数静态打包 我因为一些库本来就有或是通过 pamac 装上了没完全按步骤走然后报错了似乎是把 -lz 参数当成文件 最终效果 VT几乎全过相信我那一个红的是误报2333 原生shellcode就能过defender不过瞎捣鼓还是有几率被杀


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

**reDuh简介** reDuh是sensepost由2008-07年发布从本质上讲可以将JSP/PHP/ASP/ASPX等页面上传到目标服务器便可以访问该服务器后面的主机 BlackHat USA 2008介绍 https://drive.google.com/open?id=1AqmtuBnHQJS-FjVHzJMNNWokda048By- Github https://github.com/sensepost/reDuh **攻击机** 192.168.1.5 Debian 192.168.1.4 Windows 7 **靶机** 192.168.1.119 Windows 2003 **安装** ```bash root@John:~# git clone https://github.com/sensepost/reDuh.git Cloning into 'reDuh'... remote: Enumerating objects: 47, done. remote: Total 47 (delta 0), reused 0 (delta 0), packreused 47 Unpacking objects: 100% (47/47), done. root@John:~# cd reDuh/ root@John:~/reDuh# ls README.markdown reDuhClient reDuhServers ``` ![](media/1baa9c1874d47e57ff19724c1e050dd8.jpg) **靶机执行** 以aspx为demo ![](media/853cde273f8ee0873156e9c624258201.jpg) **攻击机执行** 绑定端口 ```bash root@John:~/reDuh/reDuhClient/dist# java jar reDuhClient.jar http://192.168.1.119/reDuh.aspx [Info]Querying remote web page for usable remote service port [Info]Remote RPC port chosen as 42000 [Info]Attempting to start reDuh from 192.168.1.119:80/reDuh.aspx. Using service port 42000. Please wait... [Info]reDuhClient service listener started on local port 1010 ``` ![](media/2596f6edba3d76db9a416b2011e8fb9b.jpg) 开启新terminal建立隧道 命令如下 [createTunnel][本地绑定端口]: 127.0.0.1:[远程端口] ```bash root@John:~# telnet 127.0.0.1 1010 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is ']'. Welcome to the reDuh command line >>[createTunnel]30080:127.0.0.1:80 Successfully bound locally to port 30080. Awaiting connections. ``` ![](media/9a14208cab4886588559a38d694a5cf1.jpg) 攻击机端口前后对比 ```bash root@John:~# netstat ntlp Active Internet connections (only servers) Proto RecvQ SendQ Local Address Foreign Address State PID/Program na me tcp 0 0 0.0.0.0:902 0.0.0.0:* LISTEN 809/vmwareauthdlau tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 674/sshd tcp6 0 0 :::902 :::* LISTEN 809/vmwareauthdlau tcp6 0 0 :::22 :::* LISTEN 674/sshd root@John:~# netstat ntlp Active Internet connections (only servers) Proto RecvQ SendQ Local Address Foreign Addre


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

-[ Past and Future in OS X Malware ]- 1 Who Am I  An Economist and MBA.  Computer enthusiast for the past 30 years.  Someone who worked at one of the worlds best ATM networks, the Portuguese Multibanco.  A natural-born reverser and assembler of all kinds of things, not just bits & bytes. 2 Whos noar  Self-taught researcher.  Consultant / Insultant in security software.  Former Apple BlackOps.  Uses a Mac since AAPL was $12.  Bought no shares at that time!  Never pwned, although he dares to open my PowerPoint files. 3 Objective  Starting point: Macs are immune to malware.  Latest Flashback variants broke THE myth.  In fact, its quite easy to write high quality OS X malware!  Thats what I want to demonstrate today. 4 Summary  OS X malware history.  Flashback, the mythbuster.  Code injection techniques.  OS.X/Boubou  A PoC infector/virus.  Privilege escalation.  Final remarks. 5 History  From lamware to malware History & glory are not made of:  Backdoors written in REALBasic.  Old IRC bots.  Keyloggers that use Universal Access (logKext rules them all).  PoCs (except mine!). 6 History  Lamware, 2006 Oompa Loompa  Spread via iChat Bonjour buddy list.  Injection into Cocoa apps using Input Managers.  Requires user interaction to execute it. 7 History  Lamware, 2006 Opener 3.9  Same old shell script as a startup item.  The usual trojan horse toolbag:  Hidden admin user (UID < 501), enable SSH, AFP, SMB.  Data mining, hash cracking (JtR), logs cleaning.  New features:  Anti-Little Snitch prequel, anti-virus white-listing.  Capture network traffic using dsniff. 8 History  Lamware, 2007 RSPlug aka DNSChanger  First fake codec package.  Prepend DNS every minute using scutil and cron.  Perl script to call home.  Shell script, later obfuscated using  tr!  Polymorphism? 9 History  Lamware, 2007 10 History  Lamware, 2007 MacSweeper, later iMunizator  First scareware.  -(BOOL)[RegistrationManager isRegistered] and patch a few bytes  And it really works!  Prequel of MacDefender and


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

### large bin attack概述 这种攻击方式主要利用的是 chunk 进入 bin 中的操作在 malloc 的时候遍历 unsorted bin 时对每一个 chunk若无法 exact-fit 分配或不满足切割分配的条件就会将该 chunk 置入相应的 bin 中而此过程中缺乏对 largebin 的跳表指针的检测 以 2.33 版本的 libc 为例从 4052 行开始就是对 largebin chunk 的入 bin 操作 ```cpp else { victim_index = largebin_index (size); bck = bin_at (av, victim_index); fwd = bck->fd; /* maintain large bins in sorted order */ if (fwd != bck) { /* Or with inuse bit to speed comparisons */ size |= PREV_INUSE; /* if smaller than smallest, bypass loop below */ assert (chunk_main_arena (bck->bk)); if ((unsigned long) (size) < (unsigned long) chunksize_nomask (bck->bk)) { fwd = bck; bck = bck->bk; victim->fd_nextsize = fwd->fd; victim->bk_nextsize = fwd->fd->bk_nextsize; fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim; } else { assert (chunk_main_arena (fwd)); while ((unsigned long) size < chunksize_nomask (fwd)) { fwd = fwd->fd_nextsize; assert (chunk_main_arena (fwd)); } if ((unsigned long) size == (unsigned long) chunksize_nomask (fwd)) /* Always insert in the second position. */ fwd = fwd->fd; else { victim->fd_nextsize = fwd; victim->bk_nextsize = fwd->bk_nextsize; if (__glibc_unlikely (fwd->bk_nextsize->fd_nextsize != fwd)) malloc_printerr ("malloc(): largebin double linked list corrupted (nextsize)"); fwd->bk_nextsize = victim; victim->bk_nextsize->fd_nextsize = victim; } bck = fwd->bk; if (bck->fd != fwd) malloc_printerr ("malloc(): largebin double linked list corrupted (bk)"); } } ``` 在 2.29 及以下的版本中根据 unsorted chunk 的大小不同 ```cpp fwd->fd->bk_nextsize = victim->bk_nextsize->fd_nextsize = victim; victim->bk_nextsize->fd_nextsize = victim; ``` 在 unsorted chunk 小于链表中最小的 chunk 的时候会执行前一句反之执行后一句 由于两者大小相同的时候只会使用如下的方法插入所以此时无法利用 ```cpp if ((unsigned long) size == (unsigned long) chunksize_nomask (fwd)) /* Always insert in the second position. */ fwd = fwd->fd; ``` 所以有两种利用方法 在 2.30 版本新加入了对 largebin 跳表的完整性检查使 unsorted chunk 大于链表中最小的 chunk 时的利用失效必须使 unsorted chunk 小于链表中最小的 chunk通过 ```cpp victim->bk_nextsize->fd_nextsize =


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# 剑指 Offer 题解 ## 前言 题目来自何海涛. 剑指 Offer[M]. 电子工业出版社, 2012.刷题网站推荐 - [牛客网](https://www.nowcoder.com/ta/coding-interviews?from=cyc_github) - [Leetcode](https://leetcode-cn.com/problemset/lcof/) ## 数组与矩阵 - [3. 数组中重复的数字](3.%20数组中重复的数字.md) - [4. 二维数组中的查找](4.%20二维数组中的查找.md) - [5. 替换空格](5.%20替换空格.md) - [29. 顺时针打印矩阵](29.%20顺时针打印矩阵.md) - [50. 第一个只出现一次的字符位置](50.%20第一个只出现一次的字符位置.md) ## 栈队列堆 - [9. 用两个栈实现队列](9.%20用两个栈实现队列.md) - [30. 包含 min 函数的栈](30.%20包含%20min%20函数的栈.md) - [31. 栈的压入弹出序列](31.%20栈的压入弹出序列.md) - [40. 最小的 K 个数](40.%20最小的%20K%20个数.md) - [41.1 数据流中的中位数](41.1%20数据流中的中位数.md) - [41.2 字符流中第一个不重复的字符](41.2%20字符流中第一个不重复的字符.md) - [59. 滑动窗口的最大值](59.%20滑动窗口的最大值.md) ## 双指针 - [57.1 和为 S 的两个数字](57.1%20和为%20S%20的两个数字.md) - [57.2 和为 S 的连续正数序列](57.2%20和为%20S%20的连续正数序列.md) - [58.1 翻转单词顺序列](58.1%20翻转单词顺序列.md) - [58.2 左旋转字符串](58.2%20左旋转字符串.md) ## 链表 - [6. 从尾到头打印链表](6.%20从尾到头打印链表.md) - [18.1 在 O(1) 时间内删除链表节点](18.1%20在%20O(1)%20时间内删除链表节点.md) - [18.2 删除链表中重复的结点](18.2%20删除链表中重复的结点.md) - [22. 链表中倒数第 K 个结点](22.%20链表中倒数第%20K%20个结点.md) - [23. 链表中环的入口结点](23.%20链表中环的入口结点.md) - [24. 反转链表](24.%20反转链表.md) - [25. 合并两个排序的链表](25.%20合并两个排序的链表.md) - [35. 复杂链表的复制](35.%20复杂链表的复制.md) - [52. 两个链表的第一个公共结点](52.%20两个链表的第一个公共结点.md) ## 树 - [7. 重建二叉树](7.%20重建二叉树.md) - [8. 二叉树的下一个结点](8.%20二叉树的下一个结点.md) - [26. 树的子结构](26.%20树的子结构.md) - [27. 二叉树的镜像](27.%20二叉树的镜像.md) - [28. 对称的二叉树](28.%20对称的二叉树.md) - [32.1 从上往下打印二叉树](32.1%20从上往下打印二叉树.md) - [32.2 把二叉树打印成多行](32.2%20把二叉树打印成多行.md) - [32.3 按之字形顺序打印二叉树](32.3%20按之字形顺序打印二叉树.md) - [33. 二叉搜索树的后序遍历序列](33.%20二叉搜索树的后序遍历序列.md) - [34. 二叉树中和为某一值的路径](34.%20二叉树中和为某一值的路径.md) - [36. 二叉搜索树与双向链表](36.%20二叉搜索树与双向链表.md) - [37. 序列化二叉树](37.%20序列化二叉树.md) - [54. 二叉查找树的第 K 个结点](54.%20二叉查找树的第%20K%20个结点.md) - [55.1 二叉树的深度](55.1%20二叉树的深度.md) - [55.2 平衡二叉树](55.2%20平衡二叉树.md) - [68. 树中两个节点的最低公共祖先](68.%20树中两个节点的最低公共祖先.md) ## 贪心思想 - [14. 剪绳子](14.%20剪绳子.md) - [63. 股票的最大利润](63.%20股票的最大利润.md) ## 二分查找 - [11. 旋转数组的最小数字](11.%20旋转数组的最小数字.md) - [53. 数字在排序数组中出现的次数](53.%20数字在排序数组中出现的次数.md) ## 分治 - [16. 数值的整数次方](16.%20数值


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The August application logs a significant amount of sensitive data. With social engineering, or temporary access to the unlocked phone of an August user these logs can be extracted. The following procedure can be use to extract log data without the use of any special tools. Step 1: Open settings Step 2: Press and hold the application version number. Step 3: Enter "augustsupport" in the prompt. The prompt is case sensitive. ("DreadfulDow" can be used as well, but it permanently alters the app's settings.) Step 4: Tap send logs to August. Step 5: Change the destination to an email address you control. These logs which are ostensibly useful August support may include usernames, passwords, authentication tokens, offline keys, and firmware keys as shown in the following screenshot: Of note, the information extracted from log files by the above program is sufficient to not only interact with the lock, but also to bypass August's two step authentication system.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Toxic Proxies - Bypassing HTTPS & VPNs to pwn your online identity Alex Chapman @noxrnet Paul Stone @pdjstone Introduction Our Talk Exciting introduction Some history  SSL, PAC, WPAD, sslstrip, HSTS The PAC Attack  bypassing HTTPS  Sniffing your traffic  Stealing your data  Stealing your accounts The VPN Attack  bypassing VPNs Mitgations Fixes Rogue Access Point Attacks Techniques in this talk assume an attacker on the local network, e.g.  Open WiFi network  Attacker on a corporate network  Compromised router Can intercept and modify all non encrypted traffic Can carry out local-network attacks on victims First there was no encryption Sure, why not  its 1993! Then there was SSL Problem: No encryption for sensitive websites Solution: Opt-in encryption, certificates to verify domain ownership Netscape 2 ships with SSL in 1995 Users somewhat safe from passive traffic sniffing attacks But SSL wasnt perfect Many Problems:  Most websites allow connecting over HTTP and HTTPS  Most people connect over HTTP first, site redirects to HTTPS  Evil MITM can prevent user reaching HTTPS site Solution: ??? sslstrip released in 2009 - https://moxie.org/software/sslstrip/  Man-in-the-middle HTTP proxy  Remove redirects to HTTPS  Rewrite HTTPS links to HTTP  Fetch HTTPS-only pages and serve as HTTP  User never actually reaches the real HTTPS site But SSL wasnt perfect HSTS to the rescue! Problem: sslstrip broke HTTPS by just ignoring it Solution: force browser to always use HTTPS HTTP-Strict-Transport-Security header  2010  Removes vulnerable HTTP -> HTTPS redirect Strict-Transport-Security: max-age=31536000; includeSubDomains Proxy Auto-Config (PAC) Problem: Complex intranets require different HTTP proxies depending on which website you want to visit, e.g.:  proxyA.initech.corp for most intranet sites  proxyB.initech.corp for access to preprod sites  proxyC.initech.corp for public internet access Solution: JavaScript file to tell browser which proxy to use for each URL Navigator Proxy


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Truck Duck Board Bill of Materials June 2016 - DEF CON 24 CHECK FOR UPDATES AT: http://truckhacking.github.io Designator(s) Description Package/Footprint Qty Manufacturer Part Number Preferred Vendor Subsitute OK? Notes D1 Power LED 0805 1 OSRAM LG R971-KN-1 Digikey Y PTC1 Thermal Fuse, 2A Hold, 4A Trip Custom 1 LittleFuse 2920L200/24DR Digikey N TVS1 Transient Voltage Suppressor DO-214AC 1 Bourns SMAJ30A Digikey Y Q1 Reverse Polarity Protection FET SOIC8 1 Internation Rectifier IRF9388TRPBF Digikey N VR1 Switching Voltage Regulator TO-220 (Inverted) 1 Murata OKI-78SR-5/1.5-W36H-C Digikey N P1 ,P2 BeagleBone Header 0.100" Header 2 Sullins PRPC023DAAN-RC Digikey Y P3, P4 Screw Terminal Custom 2 Phoenix Contact 1725685 Digikey N U1, U8 J1708 (RS485) Tranceiver SOIC8 2 Texas Instruments SN65HVD08D Digikey N U2, U7 Inverter for J1708 SOT-23-5 2 Fairchild Semi NC7SZ04M5X Digikey N U3, U4 CAN Bus Tranceiver SOIC8 2 Texas Instruments SN65HVD232DR Digikey N U6 Buffer/Bi-directional Level Shifter TSSOP-20 1 Texas Instruments TXS0108EPWR Digikey N J1 DSUB-15 Vehicle Connector DSUB-15 1 FCI ID15S33E4GX00LF Mouser Y Substitute TE 1-1634585-2 R1 Power LED Resistor 0805 1 Panasonic ERJ-6ENF4700V Digikey Y C1 100uF 50V Aluminum Electrolytic Capacitor 6.3x7.7 SMD 1 Nichicon UCM1H101MCL1GS Digikey Y C2 47uF 10V Ceramic Capacitor 1206 1 Taiyo Yuden LMK316BJ106KLHT Digikey Y C3, C4, C5, C6 560pF Ceramic Filter Cap, CAN Lines 0603 4 Kemet C0603C561J5GACTU Digikey Y R3, R4, R6, R7 100 Ohm Resistor, CAN Bus 0603 4 Panasonic ERJ-3EKF1000V Digikey Y R2, R5, R8, R11, R12, R15, R16 4.7K Pull Up/Down Resistors 0603 7 Panasonic ERJ-3EKF4701V Digikey Y R9, R10, R13, R14 47 Ohm Resistors, J1708 Bus 0603 4 Panasonic ERJ-3GEYJ470V Digikey Y C7 0.1 uF Bypass Cap for Level Shifter 0603 1 AVX 0603YC104KAT2A Digikey Y PCB Printed Circuit Board Custom 1 Many NA Many N


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

### 堆利用介绍 在该章节中我们会按照如下的步骤进行介绍 1. 介绍我们所熟知的动态内存分配的堆的宏观操作 2. 介绍为了达到这些操作所使用的数据结构 3. 介绍利用这些数据结构实现堆的分配与回收的具体操作 4. 由浅入深地介绍堆的各种利用技巧 对于不同的应用来说由于内存的需求各不相同等特性因此目前堆的实现有很多种具体如下 ```text dlmalloc  General purpose allocator ptmalloc2  glibc jemalloc  FreeBSD and Firefox tcmalloc  Google libumem  Solaris ``` 这里我们主要以 glibc 中堆的实现为主进行介绍如果后续有时间会继续介绍其它堆的实现及其利用 该部分主要参考的资料如下文中有很多内容会和参考资料中一致以后就不一一说明了 - [black hat heap exploitation](https://www.blackhat.com/presentations/bh-usa-07/Ferguson/Whitepaper/bh-usa-07-ferguson-WP.pdf) - [github heap exploition](https://heap-exploitation.dhavalkapil.com/) - [sploitfun](https://sploitfun.wordpress.com/archives/) - glibc 源码 - 更多的参考文献请看ref目录下的文件


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Adventures in MitM-land Using MITM to Attack Active Directory Authentication Schemes About Us  Senior Engineer @CrowdStrike (Former @Preempt)  Extensive background as a security researcher Sagi Sheinfeld (@sagish1233)  Senior Engineer @CrowdStrike (Former @Preempt)  Previously presented on Black Hat Eyal Karni (@eyal_karni)  Senior Manager, Engineering @CrowdStrike  2xBlack Hat, 1xDEFCON Yaron Zinar (@YaronZi) Is MITM an Important Technique?  Sometimes  Works when other techniques fail  Often overlooked  Active Directory  Relatively old protocols  Usually dont use TLS NTLM Basics Authentication is not bound to the target server! (1) NTLM Negotiate (3) NTLM Authenticate (2) NTLM Challenge (4) NETLOGON (5) Approve/Reject Client Machine Server DC Kerberos Basics (5) AP-Req Client Machine Server DC (1) AS-Req (2) AS-Rep (3) TGS-Req (4) TGS-Rep Signed with servers secret Kerberos vs. NTLM NTLM Kerberos Proteted from Offline Cracking   (except X-roasting) Can Work w/o Storing Hash in RAM   Supports Mutual Authentication   Smart Card Support   Hashes Contain Salt   (except RC4) NTLM Relay 101 (1) NTLM Negotiate (5) NTLM Authenticate (4) NTLM Challenge (7) NETLOGON (8) Approve Client Machine Server (2) NTLM Negotiate (6) NTLM Authenticate (3) NTLM Challenge Attacked Target DC NTLM Relay over DCE/RPC  First suggested by Sylvain Heiniger (@sploutchy)  Found (at least) one interface (TSCH) with no server signing  Used NTLM Relay to create a new scheduled task DCE/RPC Relay Mitigation is Broken https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rpce/425a7c53-c33a-4868-8e5b-2a850d40dc73 Printer Spooler LPE (CVE-2020-1048)  Discovered by Peleg Hadar (@peleghd) and Tomer Bar  For printing, you need a driver, and a port  Any user can install a printer driver (from a pre-existing list)  Generic/ Text can write anything...  The port can be a file instead  We can write arbitrary files  It is a privileged process, and the access checks are done on the client side  We have


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Home Invasion 2.0 Attacking Network-Connected Embedded Devices 0. Abstract 1. Introduction 2. Methodology for devices evaluated 2.1 Belkin WeMo switch 2.2 MiCasaVerde VeraLite 2.3 INSTEON Hub 2.4 Karotz Smart Rabbit 2.5 Linksys Media Adapter 2.6 Lixil Satis Smart Toilet 2.7 Radio Thermostat 2.8 Sonos Bridge 3. Results 3.1 Belkin WeMo switch 3.1.1 Vulnerable libupnp version 3.1.2 Unauthenticated UPnP actions 3.1.2.1 SetBinaryState 3.1.2.2 SetFriendlyName 3.1.2.3 UpdateFirmware 3.2 MiCasaVerde VeraLite 3.2.1 Lack of authentication on web console by default 3.2.2 Lack of authentication on UPnP daemon 3.2.3 Path Traversal 3.2.4 Insufficient Authorization Checks 3.2.4.1 Firmware Update 3.2.4.2 Settings backup 3.2.4.3 Test Lua code 3.2.5 Server Side Request Forgery 3.2.6 CrossSite Request Forgery 3.2.7 Unconfirmed Authentication Bypass 3.2.8 Vulnerable libupnp Version 3.3 INSTEON Hub 3.3.1 Lack of authentication 3.4 Karotz Smart Rabbit 3.4.1 Exposure of wifi network credentials unencrypted to the Karotz server 3.4.2 Python module hijack in wifi setup 3.4.3 Unencrypted remote API calls 3.5 Linksys Media Adapter 3.5.1 Unauthenticated UPnP actions 3.6 LIXIL Satis Smart Toilet 3.6.1 Default Bluetooth PIN 3.7 Radio Thermostat 3.7.1 Unauthenticated API 3.7.2 Disclosure of WiFi passphrase in old firmware versions 3.8 SONOS Bridge 3.8.1 Support Console Information Disclosure 4. Discussion 0. Abstract We evaluated the security of several networkconnected embedded devices marketed for home use. While network connectivity is already commonplace for personal computers, mobile devices such as smartphones, printers, and digital storage units, there are a growing number of networkconnected devices that do not fit these traditional categories. With some of these devices, a compromise would allow an attacker some control over the physical world, posing a different type of risk than that associated with a personal computer. We selected our research targets based on capabilities, availabili


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

COMMON VULNERABILITIES COMMON VULNERABILITIES In this document you can find common vulnerabilities that are reported commonly. We believe that verifying this list and fixing these issues or adding it to out of scope ahead of the start of the project might save you some budget! EXCESSIVE INFORMATION LEAKAGE TROUGH ERRORS/STACK TRACES [ Description ] Websites can leak information about internal services in all kinds of ways but most often this happens because of very excessive errors. Usernames, full paths to internal documents are some examples of information leakage. [ Solution ] Turn off all excessive errors or limit their content to a short description of the problem. LOGIN/LOGOUT/NEWSLETTER CSRF [ Description ] This is often reported as best practice but 99% of these reports are harmless and do not describe a real security risk. [ Solution ] Implement a CSRF protection mechanism that applies to all forms and even protects logged out users. This will also protect against CSRF on newsletter subscription forms. 2 1 SSL CERTIFICATE ISSUES [ Description ] Some websites require a specific SSL setup and are intentionally vulnerable to some low severity SSL attacks. Make sure to check your SSL security at the following two sites: https://www.digicert.com/help/ https://www.ssllabs.com/ssltest/ If your company is vulnerable to a very specific SSL attack and you do not want to fix this because the likelihood of such an attack happening is very low make sure to mention this in the program policy. [ Solution ] Make sure that your SSL connection is completely secure, youll already get a lot of input from the tests mentioned above. REFERENCES TO INTERNAL SERVICES/IP [ Description ] Make sure that no internal IP/hosts are being disclosed publicly, this often happens in response headers, comment sections in code. Load balancers often inject a comment at the end of an HTML page, make sure this is turned off. [ Solution ] Take a look at where this might occur and then remove it. No


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# 比特攻击 ## 概述 简单地说就是利用比特位之间的关系进行攻击 ## 2018 Plaid CTF transducipher 题目如下 ```python #!/usr/bin/env python3.6 import os BLOCK_SIZE = 64 T = [ ((2, 1), 1), ((5, 0), 0), ((3, 4), 0), ((1, 5), 1), ((0, 3), 1), ((4, 2), 0), ] def block2bin(b, length=BLOCK_SIZE): return list(map(int, bin(b)[2:].rjust(length, '0'))) def bin2block(b): return int("".join(map(str, b)), 2) def transduce(b, s=0): if len(b) == 0: return b d, t = T[s] b0, bp = b[0], b[1:] return [b0  t] + transduce(bp, s=d[b0]) def transduceblock(b): return bin2block(transduce(block2bin(b))) def swap(b): l = BLOCK_SIZE // 2 m = (1 << l) - 1 return (b >> l) | ((b & m) << l) class Transducipher: def __init__(self, k): self.k = [k] for i in range(1, len(T)): k = swap(transduceblock(k)) self.k.append(k) def encrypt(self, b): for i in range(len(T)): b = self.k[i] b = transduceblock(b) b = swap(b) return b if __name__ == "__main__": flag = bytes.hex(os.urandom(BLOCK_SIZE // 8)) k = int(flag, 16) C = Transducipher(k) print("Your flag is PCTF{%s}" % flag) with open("data1.txt", "w") as f: for i in range(16): pt = int(bytes.hex(os.urandom(BLOCK_SIZE // 8)), 16) ct = C.encrypt(pt) f.write(str((pt, ct)) + "\n") ``` 题目给了 16 组明密文对 - 明文大小 8 个字节 - 密文大小 8 个字节 - 密钥大小也是 8 个字节 我们所需要求解的就是密钥 可以看到这里主要有两种基本操作 - swap ```python def swap(b): l = BLOCK_SIZE // 2 m = (1 << l) - 1 return (b >> l) | ((b & m) << l) ``` 将给定的数据的高 32 位与低 32 位交换 - transduce ```python T = [ ((2, 1), 1), ((5, 0), 0), ((3, 4), 0), ((1, 5), 1), ((0, 3), 1), ((4, 2), 0), ] def transduce(b, s=0): if len(b) == 0: return b d, t = T[s] b0, bp = b[0], b[1:] return [b0  t] + transduce(bp, s=d[b0]) ``` 其中 - b 是一个 01 数组初始时刻大小为 64 - s 是一个下标 基本流程如下 1. 根据 s 选择使用 T 的哪个元素进而将其分为 d 和 t 2. 将 b 分为两部分一部分只包含头元素另一部分包含其它的元素 3. 将头元素与 t 异或作为当前的头元素然后继续转换剩下的部分 其实我们可以将该函数转换为迭代函数 ```python def transduce_iter(b, s=0): ans = [] for c in b: d, t = T[s] ans += [c  t] s = d[c] return ans ``` 进而由于每次处理的是列表的第一个元素其实该函数是可逆的如下 ```python def invtransduce(b, s=0): if len(b) == 0: return b d, t = T[s] b0, bp = b


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Emperor Has No Cloak  WEP Cloaking Exposed Vivek Ramachandran ( vivek.ramachandran@airtightnetworks.net ) Deepak Gupta ( deepak.gupta@airtightnetworks.net ) Security Research Team (Amit, Gopi, Pravin) AirTight Networks www.airtightnetworks.net Background Claim: WEP key cracking can be prevented using WEP Chaffing. Question: Is it safe to use WEP again now that we have a cloak for it? Vendor aims to Cloak WEP, April 2007  .. [Cloaking] is designed to protect a widely used but flawed wireless LAN encryption protocol ..  .. Cloaking module creates dummy data traffic ... attacker cant tell the difference between product frames from the WLAN and spoofed frames generated ..  Important Note Our presentation this afternoon concerns a technique that we refer to as "chaff insertion," which recently has been proposed as a way to prevent cracking WEP keys. To avoid any confusion, while our abstract may have mentioned "WEP Cloaking," and while we may mention "WEP Cloaking" during the course of our presentation, it should be noted that WEP Cloaking is the name one company is using to refer to its particular implementation of the chaff insertion technique. Our presentation is not intended as an analysis of or commentary on this company's particular implementation, but rather addresses the technique of chaff insertion in general and demonstrates our belief that the approach is easily defeated and does not provide any useful protection against cracking WEP keys. Talk Outline Evolution of WEP Cracking What is WEP Chaffing? What are Chaff packets? WEP Chaffing example Techniques to counter different types of Chaff: Random frames Single key Multiple keys Random keys  Implementation problems with WEP Chaffing Final verdict on WEP Chaffing Q&A Talk Outline Evolution of WEP Cracking What is WEP Chaffing? What are Chaff packets? WEP Chaffing example Techniques to counter different types of Chaff: Random frames Single key Multiple keys Random keys  Implementation problems with WEP Chaff


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Stalking a City for Fun and Frivolity Pull pin, point toward privacy insurance claimant DRAFT SLIDES Please go to http://www.maliceafterthought.com for updated slides Brendan OConnor Malice Afterthought, Inc. Hi! Im Brendan  CTO/DSS, Malice Afterthought  Law Student: IANAL(Y)  Anything you hear in this presentation isnt legal advice  Most of it isnt even a good idea  Youve been warned Quick Tangent: Weev  U.S. v. Auernheimer  Brief of Meredith Patterson, Brendan O'Connor, Sergey Bratus, Gabriella Coleman, Peyton Engel, Matthew Green, Dan Hirsch, Dan Kaminsky, Samuel Liles, Shane MacDougall, Brian Martin, C.\ Thomas, and Peiter Zatko as Amici Curiae Supporting Appellant -- I got to write this!  Still, though: IANAL. Yet. (One more year!) DARPA Cyber Fast Track  CREEPYDOL IS NOT CFT WORK. I CANNOT EMPHASIZE THIS ENOUGH: DARPA CFT WAS NOT IN THE BUSINESS OF HAVING ME CREATE CREEPY THINGS.  That said, two CFT contracts did let me build two of the core systems: Reticle, and the visualization system.  Thanks! Foreword: Democratizing Surveillance http://www.ﬂickr.com/photos/68979377@N00/3745750194 I. Foreword: The Democratization of Surveillance A. "Security is really the government's area." 1. This was actually said to me by my sister recently, indicating that I'm failing in my duty to educate my family. 2. Those of us in this room know that the government isn't very good at securing things by means *other* than throwing them in prison for large amounts of time. 3. Nonetheless, the government has a near-monopoly on surveillance. Only the Good Guys http://www.ﬂickr.com/photos/chberge/3753079527 4. When it doesn't, the perception of the general public is that "only good guys" have access to terrifying surveillance technology. This is *our fault* for not correcting this misperception, though groups reporting on, e.g., all the BlueCoat boxes they've found in repressive governments are certainly helping. Heck, PRISM was leaked, and this is *still* the thing Im hearing: people


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1 (SSDLC) TWISC@NCKU 2 (SSDLC) 3 1-1 1-2 4 1-1 5 (System Development Life Cycle, SDLC)  (Define)  6  (Design)   (Develop)  7  (Test)   (Deploy)  8  (Maintain)   (Change)  XXX YYY 9 SDLC v.s. SSDLC SDLC   SQL Injection SSDLC  10 11 1-2 12 12 Web Web  (SSDLC) (SSDLC) 13 2-1 2-2 2-3 2-4 2-5 2-6 2-7 14 2-1 15 16  1. 2. hacker 17  3. 4. 18  5. 6. N 1. (Define) 1.1 1.2 1.3 1.4 1.5 1.6 1.7 20 2-2 21 1 4  3 2 22      23     24        25 N 2.1 (Design) 2.1.1 2.2 (Design) 2.2.1 2.3 (Design) 2.3.1 2.3.2 2.3.3 2.3.4 2.3.5 2.3.6 2.4 (Design) 2.4.1 2.4.2 2.4.3 SSL 26 2-3 27 Web II   28     aeg1423p mqi52le6 onhq4i6b 29     30     31     hacker 32   33 N 3.1 (Develop) 3.1.1 SQL Injection 3.1.2 3.2 (Develop) 3.2.1 3.2.2 3.3 (Develop) 3.3.1 3.3.2 3.3.3 34 N 3.4 (Develop) 3.4.1 3.4.2 Default Accounts Passwords 3.4.3 3.5 (Develop) 3.5.1 3.5.2 3.5.3 3.6 (Develop) 3.6.1 3.6.2 3.6.3 Buffer Overflow 3.6.4 N 3.7 (Develop) 3.7.1 3.7.2 3.7.3 3.7.4 3.8 (Develop) 3.8.1 3.8.2 3.8.3 Session Validation Attacks 3.8.4 36 N 3.9 (Develop) 3.9.1 3.9.2 3.9.3 3.10 (Develop) 3.10.1 3.10.2 3.10.3 Brute-Forcing 3.10.4 37 2-4 38    39    update OK 40     ID A123654827 41 N 4.1 (Test) 4.1.1 4.1.2 4.1.3 4.1.4 4.2 (Test) 4.2.1 4.2.2 4.3 (Test) 4.3.1 4.3.2 42 2-5 43    XXXX.. YYYY.. 44       V.1.0 XXX YYY. V.2.0 XXX YYY. 45 N 5.1 (Deploy) 5.1.1 5.2.2 5.2.3 5.2 (Deploy) 5.2.1 5.2.2 5.2.3 5.3 (Deploy) 5.3.1 5.3.2 46 2-6 47  RFP   48 N 6. (Maintain) 6.1 RFP 6.2 6.3 6.4 6.5 49 2-7 50 51       52    1. 2. ? 0131( ) 53    XXX YYY. 54 N 7.1 (Change) 7.1.1 7.1.2 7.2 (Change) 7.2.1 7.3 (Change) 7.3.1 7.3.2 7.3.3 7.4 (Change) 7.4.1 7.4.2 7.4.3 55 3-1 56      Web Web 57 - Web  ASP, JSP...  Web   ASP JSP PHP 58 -    ( VPN..)  59     60     61   ( )     62 - Web  SQL Injection  Web  (Backup test)  (Web Server configuration security test)  (Web Server application weakness test)  or 1=1-- 123 63 -  (Host weakness test)  (Host configuration Security test)  (Connection backup test)  (Fault-Tolerance test)   64    65 - Web    SQ


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Jesse Michael Mickey Shkatov @JesseMichael @HackingThings WHO ARE WE AGENDA  Beginning  .  .  .  .  Conclusions  Q&A  Diego Juarez  https://www.secureauth.com/labs/advisories/asus-drivers-elevation-privilege-vulnerabilities  https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities  https://www.secureauth.com/labs/advisories/asrock-drivers-elevation-privilege-vulnerabilities  @ReWolf  https://github.com/rwfpl/rewolf-msi-exploit + Blog post link in Readme  @NOPAndRoll (Ryan Warns) / Timothy Harrison  https://downloads.immunityinc.com/infiltrate2019-slidepacks/ryan-warns-timothy-harrison-device- driver-debauchery-msr-madness/MSR_Madness_v2.9_INFILTRATE.pptx  @SpecialHoang  https://medium.com/@fsx30/weaponizing-vulnerable-driver-for-privilege-escalation-gigabyte-edition- e73ee523598b PRIOR WORK BACKGROUND Application Windows OS Driver Device BACKGROUND Application Windows OS Driver Device REQUEST MAGIC REQUEST DeviceIoControl(dev, ioctl, inbuf, insize, ...) IOCTL handler in driver called with IRP struct  contains args passed from userspace 2.3. Windows drivers 2.3.1. Signed 2.3.2. WHQL signed 2.3.3. EV signing cert (A Must for Win10 signing process) Briefly explain the process of signing code HOW ITS MADE  RWEverything  LoJax  Slingshot  Game Cheats and Anti-Cheats (CapCom and others)  MSI+ASUS+GIGABYTE+ASROCK KNOWN THREATS  Utility to access almost all hardware interfaces via software  User-space app + signed RwDrv.sys driver  Driver acts as a privileged proxy to hardware interfaces  Allows arbitrary access to privileged resources not intended to be available to user-space  CHIPSEC helper to use RwDrv.sys when available Read & Write Everything  First UEFI malware found in the wild  Implant tool includes RwDrv.sys driver from RWEverything  Loads driver to gain direct access to SPI controller in PCH  Uses direct SPI controller access to rewrite UEFI firmware LoJax  APT campaign brought along its own malicious driver  Active from 201


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

**Authors**: < [nixawk](https://github.com/nixawk) >, < [sjas](https://github.com/sjas) > ---- # Vulnerability Assessment Having identified the most viable attack methods, you need to consider how you will access the target. During vulnerability analysis, you combine the information that youve learned from the prior phases and use it to understand what attacks might be viable. Among other things, vulnerability analysis takes into account port and vulnerability scans, data gathered by banner grabbing, and information collected during intelligence gathering. |**Assessment Categroy**|**Bookmarks**| |:----------------------|:------------| |Network Assessment || |Web Application Assessment|| |Database Assessment|| # Links 1. http://www.exploit-db.com/ 2. http://www.cvedetails.com/ 3. http://packetstormsecurity.com/ 4. http://www.securityfocus.com/bid 5. http://nvd.nist.gov/ 6. http://osvdb.org/ 7. http://cve.mitre.org/ 8. http://sec.jetlib.com/ 9. http://0day.today/ 10. https://www.seebug.org/ 11. https://www.rapid7.com/db/ 12. http://zerodayinitiative.com/advisories/published/ 13. http://exploitsearch.net/ 14. http://nvd.nist.gov/download/nvd-rss-analyzed.xml 15. http://www.intelligentexploit.com/ 16. https://wpvulndb.com/ 17. http://www.wordpressexploit.com/ 18. http://www.drupalexploit.com/ 19. http://www.openwall.com/lists/oss-security/ 20. http://exploitsearch.net/ 21. https://www.vulnerability-lab.com/


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

AFTER SESTA SEX WORK DEFCON 26 MAGGIE MAYHEM @MsMaggieMayhem 2018 WHEN SEX WORKER RIGHTS ARE UNDER ATTACK, WHAT DO WE DO? GET DRESSED, FIGHT BACK! Sex Worker Rights Labor Chant SEX WORK AFTER SESTA SEX WORK AFTER SESTA ABOUT ME  Sex Worker, Birth Worker, Death Worker  Based in San Francisco, CA  Founder of Harm Redux SF Crack Pipe & Safer Smoking Supplies  Former Sex Worker Outreach Project- USA Board of Directors 2015-2017  Full Spectrum Doula  Former HIV Senior Specialist Larkin Street Youth Services  Feminist Porn Award Winner SESTA/FOSTA STOP ENABLING SEX TRAFFICKERS ACT/ FIGHT ONLINE SEX TRAFFICKING ACT Criminalizes the buying, rather than the selling, of sexual services. The Nordic Model: End Demand The belief that commercial sex and trafﬁcking is underpinned by principles of supply and demand and that without the current demand to pay for sex, there would be no supply of people to exploit. FROM BAD GIRLS, TO SAD GIRLS Moral Failures to Human Trafﬁcking Victims ASYMMETRIC ENFORCEMENT OF A LAW WILL ALWAYS INFRINGE ON THE FUNDAMENTAL RIGHTS OF THE NON-CRIMINAL PARTY First street based buyer sting 1964, Nashville, TN First internet based buyer string 1995, Everett, WA Names and/or photos publicized 1975, Eugene, OR First Dear John letters 1982, Aberdeen, MD Surveillance cameras targeting prostitution 1989, Horry County, SC Neighborhood Action Targeting Johns 1975, Knoxville, TN "THIS TURNS NEIGHBORS AGAINST NEIGHBORS AND RECRUITS PEOPLE TO BECOME SPIES FOR THE POLICE. ITS NOT HEALTHY FOR THESE COMMUNITIES." Cynthia Chandler, human-rights attorney, San Leandro SEX WORK AFTER SESTA SEX WORK AFTER SESTA A National Overview of Prostitution and Sex Trafficking Demand Reduction Efforts, Final Report 2012 While it is necessary and just to assist survivors, and expansion of those services is acutely needed, the interventions are not designed to prevent or reduce the occurrence of exploitation. SEX WORK AFTER SESTA  Most law enforcement response to commercial sex is drive


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# T1505-003-webshell-冰蝎 ## 来自ATT&CK的描述 Webshell是一个Web脚本放置在可公开访问的Web服务器上允许攻击者将Web服务器用作网络的网关 Web shell可以提供多种功能如虚拟终端文件管理数据库连接等 除了服务器端脚本之外Webshell可能还有一个客户端接口程序用于与管理Web服务器的通信例如中国菜刀C刀蚁剑冰蝎等 ## 测试案例 暂无可自行本地测试 ## 检测日志 HTTP流量 ## 测试复现 暂无建议自行本地测试 ## 测试留痕 暂无建议本地自行测试抓取流量数据 ## 检测规则/思路 ### suricata规则 参考来源<https://github.com/suricata-rules/suricata-rules/tree/master/Behinder> ```yml alert http any any -> any any (msg: "Behinder3 PHP HTTP Request"; flow: established, to_server; content:".php"; http_uri; pcre:"/[a-zA-Z0-9+/]{1000,}=/i"; flowbits:set,behinder3;noalert; classtype:shellcode-detect; sid: 3016017; rev: 1; metadata:created_at 2020_08_17,by al0ne;) alert http any any -> any any (msg: "Behinder3 PHP HTTP Response"; flow: established,to_client; content:"200"; http_stat_code; flowbits: isset,behinder3; pcre:"/[a-zA-Z0-9+/]{100,}=/i"; classtype:shellcode-detect; sid: 3016018; rev: 1; metadata:created_at 2020_08_17,by al0ne;) ``` ### 自定义检测规则 ``` 自定义规则进行防护(uri_path * rco \.(jsp|jspx|php)$)&&(method * belong POST)&&(request_body * req [\w+/]{1000,}=?=?$) ``` ### 建议 暂无 ## 参考推荐 MITRE-ATT&CK-T1505-003 <https://attack.mitre.org/techniques/T1505/003/> 冰蝎3.0流量特征分析附特征 <https://mp.weixin.qq.com/s/XMLK5OCpH9pICD9EL9nugA> 冰蝎的前世今生:3.0新版本下的一些防护思考 <https://mp.weixin.qq.com/s/WYM3J3daMTFODr4BSkKzxg>


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DEF CON 19 Malware Freakshow 3: They're pwning er'body out there! Nicholas J. Percoco & Jibran Ilyas Copyright Trustwave 2011 Agenda  Introduction  Evolution of Malware  Sample Analysis + Victim + Demo  Sample SL2010-161  Kameo (Grocery Store)  Sample SL2011-014  Memory Dumper (Bar)  Sample SL2011-026  Webcheck.dll (Work)  Sample SL2011-039  Android Malware (Phone)  Conclusions Copyright Trustwave 2011 Inspiration  System Intruder Well There's malware on the interwebs. They're pwning all your systems, snatching your data up. So hide your cards, hide your docs, and hide your phone, 'cause they're pwning er'body out there!  Zero Cool Copyright Trustwave 2011 Introduction  Who are these guys? Nicholas J. Percoco (@c7five)  Head of SpiderLabs at Trustwave  Started my InfoSec career in the 90s  4th DEF CON talk (2 more this weekend  Droid & SSL)  Primary author of Trustwaves Global Security Report Jibran Ilyas (@jibranilyas)  Senior Forensic Investigator, Spiderlabs at Trustwave  9 Years of InfoSec Experience  Speaker at several Global Security Conferences like Black Hat, DEF CON, SecTor, Source Barcelona, etc.  Masters degree from Northwestern University Copyright Trustwave 2011 Introduction  Why give a Freakshow? Exploits are commodi0es. Malware fuels the business of crime*. *They're pwning er'body out there! Copyright Trustwave 2011 Introduction  Whats this about? This the 3rd Itera0on of this Talk  2009  KeyLogger, MemDumper, Video Poker, Sniﬀer  2010  MemDumper, Logon Creden=als Stealer, Sniﬀer, Client-Side (PDF Malware) New Targets This Year -> YOU  Your Grocery Store  Your Favorite Bar  Your Work  Your Smart Phone Copyright Trustwave 2011 Evolution of Malware - 2009  Sloppy malware developers  Just tes=ng the waters  No covert ﬁle system placement  Noisy output ﬁles  Easily detected using Task Manager Copyright Trustwave 2011 Evolution of Malware - 2010  Started to use tricky names for executable  Located in system folders  Output s=ll mainly in plain-text and wri