Web安全
.soap为后缀的IIS webshell
https://red.0xbad53c.com/red-team-operations/initial-access/webshells/iis-soap
Spring4Shell扫描器
https://github.com/fullhunt/spring4shell-scan
内网渗透
通过QUIC协议与SMB协议交互
https://www.trustedsec.com/blog/making-smb-accessible-with-ntlmquic/
DelegationBOF: 针对Kerberos的相关攻击bof
https://github.com/IcebreakerSecurity/DelegationBOF
终端对抗
通过COM接口IRundown::DoCallback()实现进程注入
https://www.mdsec.co.uk/2022/04/process-injection-via-component-object-model-com-irundowndocallback/
通过.NET动态PINVOKE执行非托管代码
https://bohops.com/2022/04/02/unmanaged-code-execution-with-net-dynamic-pinvoke/
滥用共享PE Section进行代码注入
https://billdemirkapi.me/sharing-is-caring-abusing-shared-sections-for-code-injection/
利用delegation和xml 加载器绕过Windows Defender
https://kymb0.github.io/malwaredev-bypass-av-xml/
LOLBAS:DumpMinitool.exe dump LSASS
https://twitter.com/mrd0x/status/1511415432888131586
CobaltNotion: Cobalt Strike模仿notion流量的profile
https://github.com/HuskyHacks/CobaltNotion
绕过access mask审计策略
https://jsecurity101.medium.com/bypassing-access-mask-auditing-strategies-480fb641c158
DDexec:Linux无文件执行代码
https://github.com/arget13/DDexec
Boopkit: 利用eBPF实现的TCP后门
https://github.com/kris-nova/boopkit
漏洞相关
Microsoft Defender for Endpoint 的调试方法以及身份伪造漏洞分析
https://medium.com/falconforce/debugging-the-undebuggable-and-finding-a-cve-in-microsoft-defender-for-endpoint-ce36f50bb31
基于符号执行技术的二进制漏洞挖掘
https://docs.google.com/presentation/d/1E3uE-4mYpenw0s40rtMbIdxj3fJgC79aHCeiIlJSY5Y
CVE-2022-1015/CVE-2022-1016 ：Linux内核netfilter子系统 nf_tables漏洞分析,poc
https://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/
https://github.com/pqlx/CVE-2022-1015
云安全
Azure AD攻击：query同步状态；管理员信息暴露
https://www.secureworks.com/research/azure-active-directory-exposes-internal-information
Azure 云DevOps攻防研究
https://labs.f-secure.com/blog/performing-and-preventing-attacks-on-azure-cloud-environments-through-azure-devops/
其他
Windows对KUSER_SHARED_DATA启用内核地址空间随机化(KASLR)
https://msrc-blog.microsoft.com/2022/04/05/randomizing-the-kuser_shared_data-structure-on-windows/
M01N Team
聚焦高级攻防对抗热点技术
绿盟科技蓝军技术研究战队
往期推荐
原文始发于微信公众号（M01N Team）：每周蓝军技术推送（2022.4.2-4.8）
