每周蓝军技术推送(2024.6.22-6.28)
2024-6-28 08:57:42 Author: mp.weixin.qq.com(查看原文) 阅读量:3 收藏

Web安全

未经验证的用户输入导致Django ORM函数利用风险

https://www.elttam.com/blog/plormbing-your-django-orm/#content

 内网渗透

DACL与ACE风险识别与滥用技术

https://www.thehacker.recipes/ad/movement/dacl

通过 SCCM 应用部署规避防御并横向移动

https://www.guidepointsecurity.com/blog/sccm-exploitation-evading-defenses-and-moving-laterally-with-sccm-application-deployment/

重用445端口进行NTLM Relay攻击

https://www.x33fcon.com/slides/x33fcon24_-_Nick_Powers_-_Relay_Your_Heart_Away_An_OPSEC-Conscious_Approach_to_445_Takeover.pdf

终端对抗

高级初始访问有效载荷构建技术

https://www.linkedin.com/feed/update/urn:li:activity:7211761335305437184/

GrimResource:利用特制MSC文件的代码执行技术

https://www.elastic.co/security-labs/grimresource

https://github.com/ZERODETECTION/MSC_Dropper

https://gist.github.com/joe-desimone/2b0bbee382c9bdfcac53f2349a379fa4

FetchPayloadFromDummyFile:利用偏移数组在运行时构造载荷

https://github.com/NUL0x4C/FetchPayloadFromDummyFile

Gimmick:按需动态解密内存节区,闲置时重新加密

https://github.com/pygrum/gimmick

Lifetime-Amsi-EtwPatch:修改Powershell配置文件永久关闭AMSI与ETW

https://github.com/EvilBytecode/Lifetime-Amsi-EtwPatch

Bootkit内核修补检测绕过

https://tulach.cc/bootkits-and-kernel-patching/

漏洞相关

CVE-2024-30088:Windows 内核提权漏洞POC

https://github.com/tykawaii98/CVE-2024-30088

CVE-2024-30078:Windows Wi-Fi驱动RCE漏洞补丁逆向

https://x.com/f4rmpoet/status/1804918333231243704

CVE-2024-3833:Chrome v8引擎RCE漏洞

https://github.blog/2024-06-26-attack-of-the-clones-getting-rce-in-chromes-renderer-with-duplicate-object-properties/

Chromium 嵌入式框架(CEF)RCE漏洞利用链分析

https://www.darknavy.org/blog/exploiting_steam_usual_and_unusual_ways_in_the_cef_framework/

macOS平台Electron攻击面分析

https://khronokernel.com/macos/2024/06/19/MDOYVR-2024.html

macOS平台借助Twitch的特权帮助工具实现提权

https://blog.kandji.io/twitch-privileged-helper

模糊测试器开发 4:快照、代码覆盖率和模糊测试

https://h0mbre.github.io/Lucid_Snapshots_Coverage/#

云安全

利用 GCP Cloud Build 进行权限升级

https://blog.pwnedlabs.io/blog.pwnedlabs.io/exploiting-gcp-cloud-build-for-privilege-escalation

人工智能和安全

Naptime:评估大语言模型的进攻性安全能力

https://googleprojectzero.blogspot.com/2024/06/project-naptime.html

RedFlag:利用AI识别高风险的代码修改

https://github.com/Addepar/RedFlag

其他

使用机器学习检测基于住宅代理的僵尸网络

https://blog.cloudflare.com/residential-proxy-bot-detection-using-machine-learning

nyxstone:基于LLVM的开源编译/反编译框架

https://github.com/emproof-com/nyxstone

M01N Team公众号

聚焦高级攻防对抗热点技术

绿盟科技蓝军技术研究战队

官方攻防交流群

网络安全一手资讯

攻防技术答疑解惑

扫码加好友即可拉群

往期推荐

每周蓝军技术推送(2024.6.15-6.21)

每周蓝军技术推送(2024.6.8-6.14)

每周蓝军技术推送(2024.6.1-6.7)


文章来源: https://mp.weixin.qq.com/s?__biz=MzkyMTI0NjA3OA==&mid=2247493622&idx=1&sn=71e8355321a5495f3d185327b2dc9d40&chksm=c18427e7f6f3aef12f2a362057770d3e0feaf49e681abe45898458d93dc83f9f2fbbfb1e6043&scene=58&subscene=0#rd
如有侵权请联系:admin#unsafe.sh