Tencent Security Xuanwu Lab Daily News
• Analyzing a PJL directory traversal vulnerability – exploiting the Lexmark MC3224i printer (part 2):
https://research.nccgroup.com/2022/02/18/analyzing-a-pjl-directory-traversal-vulnerability-exploiting-the-lexmark-mc3224i-printer-part-2/
・ 利用 PJL 路径穿越漏洞攻击 Lexmark MC3224i 打印机
– Jett
• EvilPlayout: Attack Against Iran’s State Broadcaster – Check Point Research:
https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/
・ EvilPlayout – 伊朗 IRIB 广播公司被网络攻击的事件分析
– Jett
• [IoT] GitHub – 0vercl0k/zenith: Zenith exploits a memory corruption vulnerability in the NetUSB driver to get remote-code execution on the TP-Link Archer C7 V5 router for Pwn2Own Austin 2021.:
https://github.com/0vercl0k/zenith
・ Zenith – Pwn2Own TP-Link AC1750 Smart Wi-Fi Router Exploit
– Jett
• [Tools] Delphi API monitoring with Frida, Part 2:
https://www.hexacorn.com/blog/2022/02/19/delphi-api-monitoring-with-frida-part-2/
・ Delphi API monitoring with Frida, Part 2
– lanying37
• Steal Credentials & Bypass 2FA Using noVNC:
https://mrd0x.com/bypass-2fa-using-novnc/
・ Steal Credentials & Bypass 2FA Using noVNC
– Jett
• [Linux] New Linux Privilege Escalation Flaw Uncovered in Snap Package Manager:
https://thehackernews.com/2022/02/new-linux-privilege-escalation-flaw.html
・ Linux Snap 包管理器被发现提权漏洞
– Jett
• 我是如何利用环境变量注入执行任意命令:
https://tttang.com/archive/1450/
・ 我是如何利用环境变量注入执行任意命令
– lanying37
• [Defend, Mitigation] [PDF] https://arxiv.org/pdf/2112.07213.pdf:
https://arxiv.org/pdf/2112.07213.pdf
・ 基于 ARM Pointer Authentication 特性，为内核提供硬件级的 CFI 保护
– Jett
• [Tools] trailofbits/publications:
https://github.com/trailofbits/publications
・ Trail of Bits 公开的一些安全研究成果合辑
– Jett
• [Wireless] GitHub – parsdefense/CVE-2021-1965: CVE-2021-1965 WiFi Zero Click RCE Trigger PoC:
https://github.com/parsdefense/CVE-2021-1965
・ 高通骁龙平台 CVE-2021-1965 WiFi Zero Click RCE Trigger PoC
– Jett
* 查看或搜索历史推送内容请访问：
https://sec.today
* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab
原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(02-21)
