每日安全动态推送(4-19)

渗透技巧 1年前 (2023) admin
396 0 0
Tencent Security Xuanwu Lab Daily News

• [Windows] Discord DLL hijacking / Automation via Excel Macros.:
https://github.com/MitchHS/Discord-DLL-Hijacking

   ・ 以 Discord 可执行文件为例介绍如何做 DLL 劫持 – WireFish


• [Android] Attacking Android Antivirus Applications:
https://blog.scrt.ch/2023/03/29/attacking-android-antivirus-applications/

   ・ 攻击 Android 防病毒应用程序,介绍 Android 应用程序安全模型 – SecTodayBot


• AspEmail 5.6.0.2 Weak Permissions / Local Privilege Escalation:
https://packetstormsecurity.com/files/171905

   ・ AspEmail可被滥用用于获取系统控制权 – SecTodayBot


• Re: CVE-2023-2002: Linux Bluetooth: Unauthorized management command execution:
https://seclists.org/oss-sec/2023/q2/37

   ・ Linux 蓝牙模块未授权管理命令执行漏洞 – WireFish


• GDidees CMS 3.9.1 Local File Disclosure / Directory Traversal ≈ Packet Storm:
https://packetstormsecurity.com/files/171894

   ・ GDidees CMS v3.9.1及以下版本被发现存在本地文件泄露漏洞,该功能原本主要用于下载二维码 – SecTodayBot


• [Android] Getting root on an Android 12 emulated device with Google Services:
https://markuta.com/rooted-android-12-emulator/

   ・ 利用 Google 服务在 Android 12 模拟器上获取 root 权限 – WireFish


• Re: CVE-2022-45064: Apache Sling Engine: Include-based XSS:
https://seclists.org/oss-sec/2023/q2/42

   ・ Apache Sling Engine 基于包含的XSS – WireFish


• PowerShell Obfuscation Bible:
https://github.com/t3l3machus/PowerShell-Obfuscation-Bible

   ・ 用于手动混淆 PowerShell 脚本以实现 AV 规避的技术、示例和一些理论的集合 – SecTodayBot


• [Tools] Persistence Techniques That Persist:
https://www.cyberark.com/resources/threat-research-blog/persistence-techniques-that-persist

   ・ 如何通过滥用Windows注册表项、服务和计划任务来获取持久化 – SecTodayBot


* 查看或搜索历史推送内容请访问:
https://sec.today

* 新浪微博账号:腾讯玄武实验室
https://weibo.com/xuanwulab


原文始发于微信公众号(腾讯玄武实验室):每日安全动态推送(4-19)

版权声明:admin 发表于 2023年4月19日 下午12:00。
转载请注明:每日安全动态推送(4-19) | CTF导航

相关文章

暂无评论

您必须登录才能参与评论!
立即登录
暂无评论...