每日安全动态推送(05-16)

渗透技巧 2年前 (2022) admin
1,116 0 0
Tencent Security Xuanwu Lab Daily News


• 深入浅出 SSL/TLS 协议:
https://evilpan.com/2022/05/15/tls-basics/

   ・ 深入浅出 SSL/TLS 协议 – Jett


• Exploiting a Use-After-Free for code execution in every version of Python 3 | pwn.win:
https://pwn.win/2022/05/11/python-buffered-reader.html

   ・ 有研究员发现一个 Open 10 年的 Python 段错误 issue 可以被成功利用实现代码执行,影响所有 Python 3 版本 – Jett


• [PDF] https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-He-The-Hidden-RCE-Surfaces-That-Control-The-Droids.pdf:
https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-He-The-Hidden-RCE-Surfaces-That-Control-The-Droids.pdf

   ・ Android 的 RCE 攻击面以及动态二进制 Fuzzing,来自 BlackHat Asia 会议 – Jett


• Evil Never Sleeps: When Wireless Malware Stays On After Turning Off iPhones:
https://arxiv.org/abs/2205.06114

   ・ 为保证 iPhone 关机之后可用 NFC、Find My 而实现的低电量模式引入的攻击面研究(Paper) – Jett


• GitHub – shuai06/CVE-2022-30525: Zyxel 防火墙远程命令注入漏洞(CVE-2022-30525)批量检测脚本:
https://github.com/shuai06/CVE-2022-30525

   ・ Zyxel 防火墙远程命令注入漏洞(CVE-2022-30525)批量检测脚本. – lanying37


• g_CiOptions in a Virtualized World – XPN InfoSec Blog:
https://blog.xpnsec.com/gcioptions-in-a-virtualized-world/

   ・ 攻击者禁用驱动签名方法以及 Windows 如何基于虚拟化(VBS)和 Hypervisor(HVCI)实现防护 – Jett


• HackSys Extreme Vulnerable Driver 3 – Stack Overflow + SMEP Bypass | Linxz’ Blog:
https://linxz.tech/post/hevd/2022-05-14-hevd3-stackbufferoverflow/

   ・ HackSys Extreme Vulnerable Driver 3 – Stack Overflow + SMEP Bypass – Jett


• [PDF] https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Zhang-Bypass-CFG-In-Chrome.pdf:
https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Zhang-Bypass-CFG-In-Chrome.pdf

   ・ Bypass CFG in Chrome – Jett


• Firebloom (iBoot) – the type descriptor:
https://saaramar.github.io/iBoot_firebloom_type_desc/

   ・ iBoot Firebloom 逆向 Part 2 – Jett


• Exploiting RBCD Using a Normal User Account*:
https://www.tiraniddo.dev/2022/05/exploiting-rbcd-using-normal-user.html

   ・ Exploiting RBCD Using a Normal User Account – Jett


* 查看或搜索历史推送内容请访问:
https://sec.today

* 新浪微博账号:腾讯玄武实验室
https://weibo.com/xuanwulab


原文始发于微信公众号(腾讯玄武实验室):每日安全动态推送(05-16)

版权声明:admin 发表于 2022年5月16日 上午11:57。
转载请注明:每日安全动态推送(05-16) | CTF导航

相关文章

暂无评论

您必须登录才能参与评论!
立即登录
暂无评论...