Windows特权句柄利用分析
背景在先前的蓝军技术推送中，曾分享过一篇关于泄露句柄利用的技术文章。文中通过在非特权进程中寻找泄露句柄，利用其中的高完整性句柄实现UAC Bypass的技术...
Fakecalls: a talking Trojan
Cybercriminals are always coming up with ever more sophisticated malware. Last year, for example, saw the appearance of an unusual banking Trojan c...
Pwning the bcm61650
The percello prc6000, also known as bcm61650 after Broadcom bought the company, is a chip used in 3g femtocells (Home-nodeB). Here is a summary ...
每日安全动态推送(04-13)
Tencent Security Xuanwu Lab Daily News• CVE-2022-25165: Privilege Escalation to SYSTEM in AWS VPN Client:https://rhinosecuritylabs.com/aws/cve...
How I hacked an ESA's experimental satellite（译文）
点击蓝字 / 关注我们0x00 背景免责声明：早在两个月之前，我们就已经将文中介绍的漏洞提交给了ESA；目前，这些漏洞已经得到了修复。同时，本文发表...
GitHack任意文件写入漏洞预警与修复方案
前言最近几天，关注的lijiejie大佬的GitHack项目提交了commit[1]，Change Log写着Fix abitrary file write vulnerability。GitHack任意文件写入漏洞？这里让...
Is there a 0day in NGINX? F5 investigates claims, finds LDAP issues
nginx 0day UPDATED April 12 9:30AM GMT. “Any headline that ends in a question mark can be answered by the word no” says Betteridge’s Law. Secur...
AWS RDS Vulnerability Leads to AWS Internal Service Credentials
TL; DR Lightspin's Research Team obtained credentials to an internal AWS service by exploiting a local file read vulnerability on the RDS EC2 insta...
慢雾出品 | 余弦：区块链黑暗森林自救手册
前言区块链是个伟大的发明，它带来了某些生产关系的变革，让「信任」这种宝贵的东西得以部分解决。但，现实是残酷的，人们对区块链的理解会存在许多误区。这...
红队工具 | Visual Studio2022微软白名单免杀dump lsass的免杀工具
消息来源推特，推特博主：mr.d0xhttps://twitter.com/mrd0x/status/1511415432888131586?s=20&t=twOtT_clemvEYGQ9YdZ02w可以自行安装Visual Studio2022，...