腾讯玄武实验室安全动态推送
Tencent Xuanwu Lab Security Daily News
-
[ Android ] Android - libutils UTF16 to UTF8 conversion heap-buffer-overflow https://bugs.chromium.org/p/project-zero/issues/detail?id=840
" Android libutils 库 UTF16 到 UTF8 转换过程中的一个堆溢出漏洞（CVE-2016-3861），来自 Project Zero Issue 840： https://t.co/mpT7AqbwgF"
-
[ Conference ] #PacSec 2016 Tokyo Oct26-27 12 speakers announced http://pacsec.jp/speakers.html new attendee fee 2days: CAD$650~ 1day: CAD$400~ register by Oct20
" PacSec 2016 会议的议题名单公布了，会议将于 10.26 ～ 10.27 在东京举办： https://t.co/Du2OrD5Ivn "
-
[ Others ] Exploits the CAPCOM.SYS driver Windows x64 allows user-land functions to be executed in the context of the kernel. https://github.com/rapid7/metasploit-framework/pull/7363
" Metasploit 新增加了一个 CAPCOM.SYS 驱动的本地提权 Exploit： https://t.co/dTtunrpm0w"
-
[ Others ] BIND - CVE-2016-2776: Assertion Failure in buffer.c https://kb.isc.org/article/AA-01419
" 域名解析服务 BIND 在构造响应时存在的一个断言失败漏洞（CVE-2016-2776）： https://t.co/y4WijfQDWc "
-
[ Others ] Droid-Hunter - Android Application Vulnerability Analysis And Android Pentest Tool http://www.kitploit.com/2016/09/droid-hunter-android-application.html
" Droid-Hunter - Android 应用漏洞分析和渗透测试工具： https://t.co/DF0BBgIfry"
-
[ Windows ] PowerShell Security at DerbyCon https://blogs.msdn.microsoft.com/powershell/2016/09/27/powershell-security-at-derbycon/
" DerbyCon 会议一篇关于 PowerShell 安全性的演讲： https://t.co/pxHKPTJyEJ "
-
[ Windows ] [Blog Post] Application Whitelisting Bypass - CSI.EXE C# Scripting http://subt0x10.blogspot.com/2016/09/application-whitelisting-bypass-csiexe.html Feedback Welcome.
" 基于 CSI.EXE 和 C# Scripting，Bypass 应用白名单： https://t.co/fVGjYEH3vj "
-
Xuanwu Spider via FreeBuf[ Android ] Android 漏洞 CVE-2015-3825 分析及 exploit 实战：从 Crash 到劫持 PC： http://www.freebuf.com/vuls/115352.html
-
Xuanwu Spider via FreeBuf
[ Tools ] VaultPasswordView：可用于查看 windows Vault 密码的工具： http://www.freebuf.com/sectool/115339.html
-
Xuanwu Spider via FreeBuf
[ ReverseEngineering ] 逆向工厂（二）：静态分析技术 ： http://www.freebuf.com/articles/system/114904.html
-
Xuanwu Spider via MottoIN
[ Popular Software ] MSSQL 通过 Agent Jobs 实现命令执行： http://www.mottoin.com/89870.html
-
Xuanwu Spider via MottoIN
[ Pentest ] 使用 NETSHELL 执行恶意 DLLs 实现主机持久化控制： http://www.mottoin.com/89905.html
-
Xuanwu Spider via Seebug
[ Browser ] Web Worker 中的 importScripts 和 baseHref 同源策略绕过问题： http://paper.seebug.org/57/