【第三期】国内外技术牛文每周精选

1.Subtee_AllTheThings

Github：https://github.com/demonsec666/Subtee_AllTheThings

2.NET_CSC_calc

https://docs.microsoft.com/zh-cn/dotnet/csharp/language-reference/compiler-options/command-line-building-with-csc-exe

http://www.ggsec.cn/NET-CS-calc.html

c:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe demon.cs

using System; namespace HelloWorld { class Program { static void Main(string[] args) { System.Diagnostics.Process.Start(“calc.exe”); } } }

3.WSH注入：一个研究案例

https://posts.specterops.io/wsh-injection-a-case-study-fd35f79d29dd

4.逆向一行JS

Reverse Engineering One Line of JavaScript

5.Windows内核开发教程第5部分

https://www.exploit-db.com/docs/english/43529-windows-kernel-exploitation-tutorial-part-5-null-pointer-dereference.pdf?rss

6.CPU漏洞补丁伪装恶意软件

https://blog.malwarebytes.com/cybercrime/2018/01/fake-spectre-and-meltdown-patch-pushes-smoke-loader/

7.2018年的第一个Mac恶意软件MaMi

https://www.bleepingcomputer.com/news/apple/the-first-mac-malware-of-2018-is-a-dns-hijacker-called-mami/

8.DG在Windows 10 S：滥用InstallUtil

https://tyranidslair.blogspot.co.uk/2017/08/dg-on-windows-10-s-abusing-installutil.html

9.HackSys Extreme易受攻击的驱动程序 -各种Windows 7 x86内核漏洞

https://github.com/Cn33liz/HSEVD-VariousExploits

10.kill?Windows事件日志

https://github.com/Cn33liz/HSEVD-VariousExploits

11.atomic-red-team：Small and highly portable detection tests mapped to the Mitre ATT&CK Framework

https://github.com/redcanaryco/atomic-red-team

12.通过MSIL字节码注入的.NET Instrumentation

http://phrack.org/papers/dotnet_instrumentation.html

13.缓解DNS重新绑定对守护进程的攻击

https://github.com/transmission/transmission/pull/468

14.对上传漏洞的总结

上传漏洞总结
====================
Apache 2.0.59
Apache 2.2.16
Apache 2.2.11
Apache 2.2.17
Apache 2.2.6
Apache 2.0.59
Apache 2.2.8
Apache 2.0.x <= 2.0.59
Apache 2.2.x <= 2.2.17
Apache 2.2.2 <= 2.2.8

均可上传[x.php.tat]尝试

IIS6.0 (Win2003 SP2 + IIS6.0) [ /a.asp;aaaa /a.asp/a.txt] 自身漏洞
IIS7.0 (Win2008 R1 + IIS7.0) [a.jpg/.php] php-cgi漏洞
IIS7.5 (Win2008 R2 + IIS7.5) [a.jpg/.php] php-cgi漏洞

对低版本的 Nginx 可以在任意文件名后面添加 %00.php 进行解析攻击

nginx 0.5.* [/a.jpg%00.php] 自身漏洞?nginx 0.6.* [%00.php] 自身漏洞?nginx 0.7 <= 0.7.65 [/a.jpg/.php] php-cgi漏洞
nginx 0.8 <= 0.8.37 [/a.jpg/.php] php-cgi漏洞

[*]Apache 的扩展名顺序解析漏洞?这个是 Apache 自身的漏洞
[*] IIS 的 asp 解析漏洞这个是 IIS 自身的漏洞
[*] Nginx 的%00 解析漏洞这个是 Nginx 自身的漏洞
[*] php-cgi 的默认配置漏洞?这类漏洞主要出现在 IIS 和 Nginx 这类以 CGI 形式调用 php 的 web 应用程序，而 Apache 通常是以 module 的形式去调用 php，所以很少出现这个漏洞

15.对代码审计的总结

https://github.com/jiangsir404/Audit-Learning 记录自己对“代码审计”的理解和总结，对危险函数的深入分析以及在p牛的博客和代码审计圈的收获

16.PowerShell?runspace后利用工具包

https://github.com/Cn33liz/p0wnedShell

17.WEBLOGIC XMLDECODER RCE之RMI利用

https://kylingit.com/blog/weblogic-xmldecoder-rce%E4%B9%8Brmi%E5%88%A9%E7%94%A8/

18.隐藏的后门