腾讯玄武实验室安全动态推送(Tencent Xuanwu Lab Security Daily News)

腾讯玄武实验室安全动态推送

Tencent Xuanwu Lab Security Daily News

2018/06/25

[ Exploit ] hsploit - m101 的 HEVD 漏洞利用程序: https://github.com/m101/hsploit
[ Fuzzing ] 如何正确的 Fuzz JSON Web 服务： https://secapps.com/blog/2018/03/fuzzing-json-web-services
[ Fuzzing ] Fuzzing 编译器 Part 1: http://www.vegardno.net/2018/06/compiler-fuzzing.html
[ Hardware ] 安全团队发现通过一个侧信道漏洞可提取运行在 intel CPU 中程序使用的密钥及其他敏感信息，成功率达 99.8%： https://www.theregister.co.uk/2018/06/22/intel_tlbleed_key_data_leak/
[ iOS ] iOS 11.3.1 Webkit RCE 漏洞(CVE-2018-4233)利用代码详细注释版: https://github.com/externalist/exploit_playground/blob/master/CVE-2018-4233/pwn_i8.js
[ Linux ] 使用 Ptrace 拦截和模拟 Linux 系统调用: http://nullprogram.com/blog/2018/06/23/
[ macOS ] Mach-O 文件格式与利用技巧介绍: http://iokit.racing/machotricks.pdf
[ MalwareAnalysis ] 恶意手机应用感染超过60万设备用于广告点击和信息窃取，RiskIQ 对此做了技术分析： https://www.riskiq.com/blog/interesting-crawls/battery-saving-mobile-scam-app/
[ Pentest ] 使用 U 盘进行网络钓鱼的技巧: http://blog.sevagas.com/?Advanced-USB-key-phishing
[ Pentest ] 渗透测试备忘单: https://github.com/kmkz/Pentesting/blob/master/Pentest-cheat-sheet
[ ReverseEngineering ] The Return of Disassembly Desynchronization,反反汇编技术的进化: https://github.com/yellowbyte/analysis-of-anti-analysis/blob/master/research/the_return_of_disassembly_desynchronization/the_return_of_disassembly_desynchronization.md
[ Web Security ] Apple 分站的 AWS S3 Bucket 配置不当导致任意文件上传： https://medium.com/@jonathanbouman/how-i-hacked-apple-com-unrestricted-file-upload-bcda047e27e3

[ Exploit ] 堆漏洞利用 - Fastbin 攻击： https://0x00sec.org/t/heap-exploitation-fastbin-attack/3627
[ Exploit ] Automatic Heap Layout Manipulation for Exploitation： https://arxiv.org/pdf/1804.08470.pdf
[ Hardware ] 利用反射和 hash 表对 flash 进行漏洞的挖掘与利用： https://github.com/ga1ois/Recon-2018-Montreal/blob/master/Pwn%20Flash%20with%20Reflections%20and%20HashTables.pdf
[ MalwareAnalysis ] 后门病毒通过下载站传播，全面劫持各大主流浏览器： http://www.freebuf.com/articles/paper/175358.html
[ ReverseEngineering ] Detecting Reverse Engineering with Canaries，来自 Collin Mulliner ，作者介绍了一种通过在软件中设置特别标记，以社工逆向人员的方法： https://mulliner.org/collin/publications/Detecting_Reverse_Engineering_with_Canaries_CanSecWest2018.pdf
[ Tools ] 利用二进制插桩来发现漏洞，来自 EuskalHack 上 Joxean Koret 的演讲： https://docs.google.com/presentation/d/e/2PACX-1vQYw4HJ3kzdmjnxklyBK2nyoMV3Iftx5G6IQmaas7z1cJdP04sX9WsWZmZKqtcTOsqbYukDdUyovhXb/pub?start=false&loop=false&delayms=60000&slide=id.p GitHub: https://github.com/joxeankoret/membugtool
[ Tools ] ipv4Bypass - 对同一主机的IPV4和IPV6网络进行端口扫描寻找开放端口差异的工具： https://milo2012.wordpress.com/2018/06/22/using-ipv6-to-bypass-security-tool/
[ Tools ] 十个 cool Nmap 使用技巧： https://blog.urfix.com/10-cool-nmap-tricks-techniques/

2018/06/25