<commit_before>---
layout: post
title: 20171020 安全动态
subtitle: 2017/10/20
date: 2017-10-20
author: FR
header-img: img/post-bg-dailysec.jpg
catalog: true
tags:
    - daily
    - vulnerability
    - linux
    - rootkit
---
#### 安全新闻
- **[五组数字看懂2017年网络安全大势](https://www.csoonline.com/article/3153707/security/top-5-cybersecurity-facts-figures-and-statistics-for-2017.html)**

- **[2018年恶意软件预测：从漫长的夏季学习勒索软件](https://nakedsecurity.sophos.com/2017/11/03/2018-malware-forecast-learning-from-the-long-summer-of-ransomware/)**  
    > [完整版下载：](https://www.sophos.com/en-us/en-us/medialibrary/PDFs/technical-papers/malware-forecast-2018.pdf?la=en)

- **[黑客通过扫描拿下使用默认SSH凭证的以太坊挖矿设备](https://www.bleepingcomputer.com/news/security/hackers-using-default-ssh-creds-to-take-over-ethereum-mining-equipment/)**

- **[网络入侵的时间维度考虑](https://www.recordedfuture.com/cyber-operations-time/)**

- **[【技术分享】目标韩国！黑客组织利用云服务攻击](http://bobao.360.cn/learning/detail/4507.html)**

- **[]()**

- **[]()**

- **[]()**

#### 技术动态
- **[通过扰乱TCB来抵御TCP重置攻击](https://github.com/seclab-ucr/INTANG)**

- **[命名管道安全前缀分析](https://tyranidslair.blogspot.co.uk/2017/11/named-pipe-secure-prefixes.html)**

- **[Nmap扫描实践：原理解析与参数配置](http://www.kalitut.com/2017/11/nmap-scan-systems-for-open-ports.html)**

- **[数据结构——你所需要的一切](https://medium.freecodecamp.org/all-you-need-to-know-about-tree-data-structures-bceacb85490c)**

- **[用C语言写的一个简单的虚拟机](https://github.com/rmccullagh/como-lang-ng/blob/master/vm/simple.c)**

- **[PROPagate：一种新的代码注入技巧](http://www.hexacorn.com/blog/2017/11/03/propagate-a-new-code-injection-trick-64-bit-and-32-bit/)**

- **[fridump：基于Frida的通用内存dump工具](http://www.example.com/)**
    > **[ link-1 ](http://pentestcorner.com/introduction-to-fridump/)**  
    > **[ link-2 ](https://github.com/Nightbringer21/fridump)**  
    > **[Android平台示例](http://pentestcorner.com/fridump-android-examples/)**  
    > **[iOS平台示例](http://pentestcorner.com/fridump-ios-examples/)**

- **[Kernelpop：内核提权exploit框架](http://www.example.com/)**
    > **[ link-1 ](http://www.kitploit.com/2017/11/kernelpop-kernel-privilege-escalation.html )**  
    > **[ link-2 ](https://github.com/spencerdodd/kernelpop)**

- **[如何搭建一个简单的恶意软件分析环境](https://www.malwaretech.com/2017/11/creating-a-simple-free-malware-analysis-environment.html)**

- **[通过Vhost访问localhost——virtual host枚举](https://blog.securitybreached.org/2017/11/04/access-localhost-via-virtual-host-virtual-host-enumeration/)**

- **[Snort 3.0 with ElasticSearch, LogStash, and Kibana (ELK) 发布](http://blog.snort.org/2017/11/snort-30-with-elasticsearch-logstash.html)**

- **[如何感染PE文件](http://www.example.com/)**
    > **[ Part I ](https://0x00sec.org/t/pe-file-infection/401 )**  
    > **[ Part II ](https://0x00sec.org/t/pe-file-infection-part-ii/4135 )**

- **[如何构建自己的区块链](http://www.example.com/)**
    > **[ Part 1 ](https://bigishdata.com/2017/10/17/write-your-own-blockchain-part-1-creating-storing-syncing-displaying-mining-and-proving-work/)**  
    > **[ Part 2 ](https://bigishdata.com/2017/10/27/build-your-own-blockchain-part-2-syncing-chains-from-different-nodes/)**  
    > **[ Part 3 ](https://bigishdata.com/2017/11/02/build-your-own-blockchain-part-3-writing-nodes-that-mine/)**

- **[xsssniper：XSS自动发现工具](https://securityonline.info/xsssniper-automatic-xss-discovery-tool/)**

- **[CertStream – 实时查看发布的SSL证书 （含Python、JS、Go、Java的库）](https://certstream.calidog.io/)**

- **[如何用Python建一个TCP后门](http://www.example.com/)**
    > **[ Part 1 ](https://0x00sec.org/t/how-to-make-a-reverse-tcp-backdoor-in-python-part-1/1038)**  
    > **[ Part 2 ](https://0x00sec.org/t/how-to-make-a-reverse-tcp-backdoor-in-python-part-2/1040)**

- **[Linux平台如何感染运行的进程](http://www.example.com/)**
    > **[ link-1 ](https://0x00sec.org/t/linux-infecting-running-processes/1097 )**  
    > **[ link-2 ](https://github.com/0x00pf/0x00sec_code/tree/master/mem_inject )**

- **[使用runscripthelper.exe绕过应用的白名单机制](https://posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc )**

- **[藏在ppsx中的恶意代码](https://www.virustotal.com/en/file/56b9af6035fcc0758733427227cc06aeba678866a3dd5403204d11c5e827de58/analysis/1509619765/)**

- **[Bypassing Browser Security Warnings with Pseudo Password Fields](https://www.troyhunt.com/bypassing-browser-security-warnings-with-pseudo-password-fields/)**

- **[【技术分享】基于API调用的恶意软件分析技术](http://bobao.360.cn/learning/detail/4646.html)**

- **[CSE Cybsec ZLab的研究员发布Bad Rabbit的详细分析报告](http://securityaffairs.co/wordpress/65048/malware/full-analysis-bad-rabbit.html)**
    > **[报告下载地址](http://csecybsec.com/download/zlab/20171101_CSE_BadRabbit_Full_Report.pdf)**

- **[Diamorphine - LKM Rootkit for Linux Kernels 2.6.x/3.x/4.x](http://www.example.com/)**
    > **[ link-1 ](http://www.kitploit.com/2017/11/diamorphine-lkm-rootkit-for-linux.html)**  
    > **[ link-2 ](https://github.com/m0nad/Diamorphine)**

- **[LKM Linux rootkit](https://github.com/f0rb1dd3n/Reptile)**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

#### 漏洞仓库
- **[Wordpress插件ImageManager文件上传漏洞](https://cxsecurity.com/issue/WLB-2017110031)**

- **[WordPress Plugin JTRT Responsive Tables 4.1 SQL注入](https://www.exploit-db.com/exploits/43110/)**

- **[Oracle PeopleSoft Enterprise PeopleTools < 8.55远程代码执行（通过XXE盲注）](http://www.example.com/)**
    > **[ link-1 ](https://www.exploit-db.com/exploits/43114/ )**  
    > **[ link-2 ](https://www.ambionics.io/blog/oracle-peoplesoft-xxe-to-rce)**

- **[杀软Vir.IT eXplorer的提权漏洞](https://www.exploit-db.com/exploits/43109/)**
    > **[漏洞作者的博客详细介绍](https://www.greyhathacker.net/?p=990)**

- **[OctoberCMS 1.0.426 (Build 426) CSRF漏洞](https://www.exploit-db.com/exploits/43106/)**

- **[WordPress的user-login-history插件中的多个XSS](https://cxsecurity.com/issue/WLB-2017110006)**

- **[Ingenious学校管理系统2.3.0 'friend_index' SQL注入](https://www.exploit-db.com/exploits/43108/)**

- **[ZyXEL PK5001Z调制解调器被发现后门账号](https://www.exploit-db.com/exploits/43105/)**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**<commit_msg>Update 2017-11-07-01-20171107-安全态势.md<commit_after>---
layout: post
title: 20171020 安全动态
subtitle: 2017/10/20
date: 2017-10-20
author: FR
header-img: img/post-bg-dailysec.jpg
catalog: true
tags:
    - daily
    - vulnerability
    - linux
    - rootkit
    - 提权
    - bot
    - 僵尸网络
    - shell
    - injection
    - 逆向
    - 恶意软件分析
---
#### 安全新闻
- **[五组数字看懂2017年网络安全大势](https://www.csoonline.com/article/3153707/security/top-5-cybersecurity-facts-figures-and-statistics-for-2017.html)**

- **[2018年恶意软件预测：从漫长的夏季学习勒索软件](https://nakedsecurity.sophos.com/2017/11/03/2018-malware-forecast-learning-from-the-long-summer-of-ransomware/)**  
    > [完整版下载：](https://www.sophos.com/en-us/en-us/medialibrary/PDFs/technical-papers/malware-forecast-2018.pdf?la=en)

- **[黑客通过扫描拿下使用默认SSH凭证的以太坊挖矿设备](https://www.bleepingcomputer.com/news/security/hackers-using-default-ssh-creds-to-take-over-ethereum-mining-equipment/)**

- **[网络入侵的时间维度考虑](https://www.recordedfuture.com/cyber-operations-time/)**

- **[【技术分享】目标韩国！黑客组织利用云服务攻击](http://bobao.360.cn/learning/detail/4507.html)**

- **[微软公布其开源扫描工具Sonar](http://www.example.com)**
    > **[ link-1 ](http://securityaffairs.co/wordpress/64796/hacking/micorsoft-sonar-tool.html)**
    > **[ link-2 ](https://github.com/sonarwhal/sonar)**

- **[]()**

- **[]()**

#### 技术动态
- **[通过扰乱TCB来抵御TCP重置攻击](https://github.com/seclab-ucr/INTANG)**

- **[命名管道安全前缀分析](https://tyranidslair.blogspot.co.uk/2017/11/named-pipe-secure-prefixes.html)**

- **[Nmap扫描实践：原理解析与参数配置](http://www.kalitut.com/2017/11/nmap-scan-systems-for-open-ports.html)**

- **[数据结构——你所需要的一切](https://medium.freecodecamp.org/all-you-need-to-know-about-tree-data-structures-bceacb85490c)**

- **[用C语言写的一个简单的虚拟机](https://github.com/rmccullagh/como-lang-ng/blob/master/vm/simple.c)**

- **[PROPagate：一种新的代码注入技巧](http://www.hexacorn.com/blog/2017/11/03/propagate-a-new-code-injection-trick-64-bit-and-32-bit/)**

- **[fridump：基于Frida的通用内存dump工具](http://www.example.com/)**
    > **[ link-1 ](http://pentestcorner.com/introduction-to-fridump/)**  
    > **[ link-2 ](https://github.com/Nightbringer21/fridump)**  
    > **[Android平台示例](http://pentestcorner.com/fridump-android-examples/)**  
    > **[iOS平台示例](http://pentestcorner.com/fridump-ios-examples/)**

- **[Kernelpop：内核提权exploit框架](http://www.example.com/)**
    > **[ link-1 ](http://www.kitploit.com/2017/11/kernelpop-kernel-privilege-escalation.html )**  
    > **[ link-2 ](https://github.com/spencerdodd/kernelpop)**

- **[如何搭建一个简单的恶意软件分析环境](https://www.malwaretech.com/2017/11/creating-a-simple-free-malware-analysis-environment.html)**

- **[通过Vhost访问localhost——virtual host枚举](https://blog.securitybreached.org/2017/11/04/access-localhost-via-virtual-host-virtual-host-enumeration/)**

- **[Snort 3.0 with ElasticSearch, LogStash, and Kibana (ELK) 发布](http://blog.snort.org/2017/11/snort-30-with-elasticsearch-logstash.html)**

- **[如何感染PE文件](http://www.example.com/)**
    > **[ Part I ](https://0x00sec.org/t/pe-file-infection/401 )**  
    > **[ Part II ](https://0x00sec.org/t/pe-file-infection-part-ii/4135 )**

- **[如何构建自己的区块链](http://www.example.com/)**
    > **[ Part 1 ](https://bigishdata.com/2017/10/17/write-your-own-blockchain-part-1-creating-storing-syncing-displaying-mining-and-proving-work/)**  
    > **[ Part 2 ](https://bigishdata.com/2017/10/27/build-your-own-blockchain-part-2-syncing-chains-from-different-nodes/)**  
    > **[ Part 3 ](https://bigishdata.com/2017/11/02/build-your-own-blockchain-part-3-writing-nodes-that-mine/)**

- **[xsssniper：XSS自动发现工具](https://securityonline.info/xsssniper-automatic-xss-discovery-tool/)**

- **[CertStream – 实时查看发布的SSL证书 （含Python、JS、Go、Java的库）](https://certstream.calidog.io/)**

- **[如何用Python建一个TCP后门](http://www.example.com/)**
    > **[ Part 1 ](https://0x00sec.org/t/how-to-make-a-reverse-tcp-backdoor-in-python-part-1/1038)**  
    > **[ Part 2 ](https://0x00sec.org/t/how-to-make-a-reverse-tcp-backdoor-in-python-part-2/1040)**

- **[Linux平台如何感染运行的进程](http://www.example.com/)**
    > **[ link-1 ](https://0x00sec.org/t/linux-infecting-running-processes/1097 )**  
    > **[ link-2 ](https://github.com/0x00pf/0x00sec_code/tree/master/mem_inject )**

- **[使用runscripthelper.exe绕过应用的白名单机制](https://posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc )**

- **[藏在ppsx中的恶意代码](https://www.virustotal.com/en/file/56b9af6035fcc0758733427227cc06aeba678866a3dd5403204d11c5e827de58/analysis/1509619765/)**

- **[Bypassing Browser Security Warnings with Pseudo Password Fields](https://www.troyhunt.com/bypassing-browser-security-warnings-with-pseudo-password-fields/)**

- **[【技术分享】基于API调用的恶意软件分析技术](http://bobao.360.cn/learning/detail/4646.html)**

- **[CSE Cybsec ZLab的研究员发布Bad Rabbit的详细分析报告](http://securityaffairs.co/wordpress/65048/malware/full-analysis-bad-rabbit.html)**
    > **[报告下载地址](http://csecybsec.com/download/zlab/20171101_CSE_BadRabbit_Full_Report.pdf)**

- **[Diamorphine - LKM Rootkit for Linux Kernels 2.6.x/3.x/4.x](http://www.example.com/)**
    > **[ link-1 ](http://www.kitploit.com/2017/11/diamorphine-lkm-rootkit-for-linux.html)**  
    > **[ link-2 ](https://github.com/m0nad/Diamorphine)**

- **[LKM Linux rootkit](https://github.com/f0rb1dd3n/Reptile)**

- **[【技术分享】漏洞挖掘高级方法](http://bobao.360.cn/learning/detail/4637.html)**

- **[【技术分享】硬件黑客技术——扩展你渗透的攻击面](http://bobao.360.cn/learning/detail/4630.html)**

- **[【技术分享】Powershell Empire 绕过AV实现远控](http://bobao.360.cn/learning/detail/4628.html)**

- **[通过API调用分析恶意软件](https://blog.malwarebytes.com/threat-analysis/2017/10/analyzing-malware-by-api-calls/ )**

- **[如何只修改两个字节就可绕过11个antivirus](https://twitter.com/zerosum0x0/status/925486850399019009)**

- **[Hashcat v4.0 - World's Fastest and Most Advanced Password Recovery Utility](http://www.kitploit.com/2017/10/hashcat-v40-worlds-fastest-and-most.html)**

- **[使用弱nfs权限进行Linux提权](https://haiderm.com/linux-privilege-escalation-using-weak-nfs-permissions/)**

- **[【技术分享】PDF文件解析与PDF恶代分析中的一些坑](http://bobao.360.cn/learning/detail/4627.html)**

- **[Domain Trusts攻击指南](https://posts.specterops.io/a-guide-to-attacking-domain-trusts-971e52cb2944)**

- **[Tweep：高级Twitter爬取工具](http://www.kitploit.com/2017/10/tweep-advanced-twitter-scraping-tool.html)**

- **[【技术分享】看我如何利用过期链接进行链接劫持](http://bobao.360.cn/learning/detail/4625.html)**

- **[checkpoint对IoT_Reaper僵尸网络的详细分析](https://research.checkpoint.com/iotroop-botnet-full-investigation/)**

- **[Google Chrome GPU Memory Corruption Vulnerability (CVE-2017-5112)（细节以及POC）](https://bugs.chromium.org/p/chromium/issues/detail?id=740603)**

- **[Blazy：一个现代的登录暴力破解器，也可测试CSRF，点击劫持，Cloudflare 以及WAF](https://github.com/UltimateHackers/Blazy/)**

- **[Exitmap：TOR出口中继的快速模块化的scanner](http://www.example.com)**
    > **[ link-1 ](http://www.kitploit.com/2017/10/exitmap-fast-and-modular-scanner-for.html )**  
    > **[ link-2 ](https://github.com/NullHypothesis/exitmap)**

- **[A Client/Server Model for Masking C&C via Legitimate Behavior over HTTP](https://github.com/trustedsec/trevorc2/blob/master/README.md )**

- **[如何使用Shadow Volume Copies恢复文件](https://www.bleepingcomputer.com/tutorials/how-to-recover-files-and-folders-using-shadow-volume-copies/)**

- **[如何安全地将你的文件藏在图片中](http://hackingnewstutorials.com/how-to-safely-hide-your-files-and-folders-inside-images/)**

- **[【技术分享】让我们一起来消灭CSRF跨站请求伪造](http://www.example.com)**
- **[ （上） ](http://bobao.360.cn/learning/detail/4602.html)**  
- **[ （下） ](http://bobao.360.cn/learning/detail/4618.html)**

- **[跨平台后门生成工具](https://github.com/Souhardya/Zerodoor)**

- **[Netcat与Shellcode：反向Shell](http://morgawr.github.io/hacking/2014/03/29/shellcode-to-reverse-bind-with-netcat)**

- **[Linux通过Voltage Fault注入实现提权](https://www.riscure.com/uploads/2017/10/Riscure_Whitepaper_Escalating_Privileges_in_Linux_using_Fault_Injection.pdf)**

- **[黑客适用的贝叶斯数学](https://camdavidsonpilon.github.io/Probabilistic-Programming-and-Bayesian-Methods-for-Hackers/)**

- **[新的代码注入技巧](http://www.hexacorn.com/blog/2017/10/26/propagate-a-new-code-injection-trick/)**

- **[H2HC大会黑客样例代码](https://github.com/joaomatosf/JavaDeserH2HC)**

- **[智能IoT设备破解](https://thehackernews.com/2017/10/smart-iot-device-hacking.html)**

- **[Reaper僵尸网络分析](http://www.hackerfactor.com/blog/index.php?/archives/782-Dont-Fear-The-Reaper.html)**

- **[【安全科普】CTF之RSA加密算法](http://bobao.360.cn/learning/detail/4617.html)**

- **[【技术分享】Linux内核音频子系统UAF内存漏洞（CVE-2017-15265）技术分析](http://bobao.360.cn/learning/detail/4616.html)**

- **[【技术分享】一种深度隐蔽的域后门方式](http://bobao.360.cn/learning/detail/4599.html)**

- **[SAML认证绕过](http://blog.intothesymmetry.com/2017/10/slack-saml-authentication-bypass.html)**

- **[BlueBorne演示中的POC](https://github.com/ArmisSecurity/blueborne)**

- **[Brida高级移动渗透测试](https://techblog.mediaservice.net/wp-content/uploads/2017/10/HackInBo-2017-Winter-Edition-Federico-Dotta-Advanced-mobile-penetration-testing-with-Brida-141017.pdf)**

- **[魔术帽中的兔子：火眼实验室坏兔报告](https://www.fireeye.com/blog/threat-research/2017/10/backswing-pulling-a-badrabbit-out-of-a-hat.html)**

- **[QUIC传输协议介绍](https://blog.acolyer.org/2017/10/26/the-quic-transport-protocol-design-and-internet-scale-deployment/)**

- **[恶意软件分析资源与工具列表](https://github.com/recodeking/MalwareAnalysis)**

- **[Pwn2win 2017：Shift Register介绍](http://blog.dragonsector.pl/2017/10/pwn2win-2017-shift-register.html)**

- **[WAF与静态统计分析](http://blog.ptsecurity.com/2017/10/do-wafs-dream-of-static-analyzers.html)**

- **[反射PE打包：新的打包方式介绍](https://pentest.blog/introducing-new-packing-method-first-reflective-pe-packer/)**

- **[Bad Rabbit勒索软件出现](https://securelist.com/bad-rabbit-ransomware/82851/)**

- **[【技术分享】用户模式下基于异常和内核控制的线程级钩子技术分析](http://bobao.360.cn/learning/detail/4591.html)**

- **[]()**

- **[]()**

- **[]()**

#### 漏洞仓库
- **[Wordpress插件ImageManager文件上传漏洞](https://cxsecurity.com/issue/WLB-2017110031)**

- **[WordPress Plugin JTRT Responsive Tables 4.1 SQL注入](https://www.exploit-db.com/exploits/43110/)**

- **[Oracle PeopleSoft Enterprise PeopleTools < 8.55远程代码执行（通过XXE盲注）](http://www.example.com/)**
    > **[ link-1 ](https://www.exploit-db.com/exploits/43114/ )**  
    > **[ link-2 ](https://www.ambionics.io/blog/oracle-peoplesoft-xxe-to-rce)**

- **[杀软Vir.IT eXplorer的提权漏洞](https://www.exploit-db.com/exploits/43109/)**
    > **[漏洞作者的博客详细介绍](https://www.greyhathacker.net/?p=990)**

- **[OctoberCMS 1.0.426 (Build 426) CSRF漏洞](https://www.exploit-db.com/exploits/43106/)**

- **[WordPress的user-login-history插件中的多个XSS](https://cxsecurity.com/issue/WLB-2017110006)**

- **[Ingenious学校管理系统2.3.0 'friend_index' SQL注入](https://www.exploit-db.com/exploits/43108/)**

- **[ZyXEL PK5001Z调制解调器被发现后门账号](https://www.exploit-db.com/exploits/43105/)**

- **[新的Chrome安全绕过漏洞（CVE-2017-5090）](http://www.securityfocus.com/bid/101591)**

- **[CVE-2017-5097 Chrome漏洞](https://bugs.chromium.org/p/chromium/issues/detail?id=740789)**

- **[【技术分享】使用FireEye实验室的“面向查询的调试器”研究程序的动态状态](http://bobao.360.cn/learning/detail/4608.html)**

- **[坏兔勒索软件技术分析](https://www.endgame.com/blog/technical-blog/badrabbit-technical-analysis)**

- **[CSE Zlab发现坏兔的有趣攻击方向](http://securityaffairs.co/wordpress/64741/malware/preliminary-analysis-bad-rabbit.html)**

- **[暗藏奥妙的UEFI BIOS漏洞](https://embedi.com/blog/uefi-bios-holes-so-much-magic-dont-come-inside)**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**

- **[]()**
{'fraction_non_alphanumeric': 0.2285040547535515, 'fraction_numerical': 0.0626330016679128, 'mean_word_length': 4.518248175182482, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 51, 'https://': 104, 'lorem ipsum': 0, 'www.': 67, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '124340', 'n_tokens_mistral': 8897, 'n_tokens_neox': 8240, 'n_words': 416}