Tencent Security Xuanwu Lab Daily News
• cve-2022-27255/DEFCON/slides.pdf:
https://github.com/infobyte/cve-2022-27255/blob/main/DEFCON/slides.pdf
・ 利用 Realtek eCOS SDK 的漏洞攻破多款路由器
– Jett
• Exploiting Web3’s Hidden Attack Surface: Universal XSS on Netlify’s Next.js Library:
https://samcurry.net/universal-xss-on-netlifys-next-js-library/
・ Exploiting Web3’s Hidden Attack Surface: Universal XSS on Netlify’s Next.js Library
– Jett
• [Tools, Vulnerability] MindShaRE: Analyzing BSD Kernels for Uninitialized Memory Disclosures using Binary Ninja:
https://www.zerodayinitiative.com/blog/2022/9/19/mindshare-analyzing-bsd-kernels-with-binary-ninja
・ 利用 Binary Ninja 工具在 FreeBSD 内核中定位内存未初始化漏洞
– Jett
• Security alert: new phishing campaign targets GitHub users:
https://github.blog/2022-09-21-security-alert-new-phishing-campaign-targets-github-users/
・ GitHub 警告称有攻击者伪造 CircleCI 网站窃取用户密钥和双因素认证 code
– Jett
• SpiderSMS/BSidesNairobi 2022 -Michael Kangethe.pdf:
https://github.com/mich01/SpiderSMS/blob/master/BSidesNairobi%202022%20-Michael%20Kangethe.pdf
・ 短消息服务 SMS 安全加密的分析
– Jett
• Breaking Bitbucket: Pre Auth Remote Command Execution (CVE-2022-36804):
https://blog.assetnote.io/2022/09/14/rce-in-bitbucket-server/
・ 利用 Bitbucket Server 的参数注入漏洞实现 Pre Auth RCE (CVE-2022-36804)
– Jett
• [Wireless] n0n5m1l3/Presentations:
https://github.com/n0n5m1l3/Presentations
・ RF Hacking with a Flipper Zero
– Jett
• [Tools] Native function and Assembly Code Invocation – Check Point Research:
https://research.checkpoint.com/2022/native-function-and-assembly-code-invocation/
・ 逆向分析时，直接从汇编层直接 Call 原始 Native Function 的 3 种方案
– Jett
• [Windows] Table of Contents:
https://github.com/SecIdiot/ANGRYORCHARD
・ 利用 NtUserHardErrorControl 实现 Windows 内核任意地址读写
– Jett
• [Linux] Linus Torvalds: Rust will go into Linux 6.1:
https://zd.net/3Sbj5hP#ftag=COS-05-10aaa0j
・ Linux 之父決定將Rust編程語言加入Linux 6.1内核版本中。
– lanying37
* 查看或搜索历史推送内容请访问：
https://sec.today
* 新浪微博账号： 腾讯玄武实验室
https://weibo.com/xuanwulab
原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(09-22)
