Aggregator

几年前笔者当时在为终端安全的发展找路的时候，主要看了两个方面，一个是计算环境的变化产生的市场，就是基于移动终

Linux x64 下的万能 Gadget

Similar to April, threat actors in May continued targeting the deserialization vulnerabilities found in Oracle WebLogic to mine cryptocurrency.

This is the second in a series of blog posts that shares how the MSRC responds to elevated threats to customers through the Software and Services Incident Response Plan (SSIRP). In ourlast blog post, we looked at the history of the Microsoft Security Response Center and SSIRP, and how Microsoft takes a holistic view to helping to protect and defend customers.

This is the second in a series of blog posts that shares how the MSRC responds to elevated threats to customers through the Software and Services Incident Response Plan (SSIRP). In ourlast blog post, we looked at the history of the Microsoft Security Response Center and SSIRP, and how Microsoft takes a holistic view to helping to protect and defend customers.

BurpSuite - Authz 背景

在平时的测试中，会经常的碰到业务功能较多的站点，如果想全面又快速的完成逻辑越权漏洞的检测不得不借助Authz插件去辅助检测越权问题。

Authz的工作原理

我们平时做测试的时候发现越权问题都是基于修改ID的方式：A的ID改成B的ID然后进行请求查看是否可以越权获取到信息，或当ID的规律已知情况下基于Burp Intruder模块直接去遍历ID。而基于Authz的检测是不一样的，其是将用户认证的HTTP请求头进行修改（Cookie之类的），然后通过响应长度、响应状态码判断是否存在越权；从本质上来讲没有任何区别，只是换了一个角度，但这样的好处是一定程度上的减少了测试的时间（例如：一个商城的业务系统，你有A、B账户，A账户买了个商品获得一个订单信息请求，当你想测试是否能越权获取B账户订单时就需要使用B账户去再购买，然后判断测试。）

BurpSuite Authz插件界面

安装Authz插件

Github地址：https://github.com/portswigger/authz

快速安装->在BurpSuite的BApp Store应用市场可以直接下载安装：

使用Authz插件检测

使用插件检测的前提条件：同个业务系统中两个测试账号

作用：A账户用于功能的操作，B账户用于提供凭证（Cookie或者其他的用户身份凭证请求头）

举例说明：

一个业务系统，将A、B账户登入，同时获取B账户的Cookie或者其他的用户身份凭证请求头，填入到Authz的New Header里：

A账户去请求（Burp别忘了监听着），寻找读取类请求（该类请求要包含ID之类的特征）然后右键请求包将该请求发送到Authz插件内：

发送的请求会在Burp的Authz的Tab标签窗口内：

当收集的差不多了，点击run跑起来：

结果会在Responses处显示：

当原响应内容长度、响应状态码和被修改后请求的响应内容长度、响应状态码一致则会绿。

也就代表着存在越权，单击选择一行即可在下面展示出请求、响应的报文：

这里经过进一步检验（理论上不需要检验，但出于对测试的严谨态度还是检验一下比较好～）顺利的发现了三枚越权访问漏洞。

一个业务系统测完之后就Clear掉所有的东西，接着下一个业务系统咯：

Authz的优点和缺点总结

优点：使用简单、省时省力

缺点：只是适用于检测越权读取类操作，删除编辑类操作还需人工判断。

On June 25th, I discovered a new bot named Silexbot on my honeypot. The bot itself is a blunt tool used to destroy IoT devices. Its author, someone who claims to be a 14-year-old boy from Europe, has made his...

Access attacks that circumvent user authentication, such as phishing or credential stuffing, are the types that most commonly lead to a breach.

https://github.com/NickstaDB/SerializationDumper SerializationDumper-v1.1.jar 用法 ：

Technology can only continue to thrive with the direct influence of those involved in its evolution. When the experiences of those people are broad, the tech industry benefits from the diversity of what they bring to the table. At Akamai,...

作者: 我是小三博客: http://www.cnblogs.com/2014asm/由于时间和水平有限，本文会存在诸多不足，希望得到您的及时反馈与指正，多谢! 0x00：黑客入侵与防御方案介绍 1. 入侵是指黑客在任何地方，通过网络远程控制目标电脑/手机/服务器/网络设备，进而随意地读取目标的隐私

It looked like a simple XSS in the Outlook Android app, but the app developers couldn’t reproduce it so they didn’t fix it. Then things got interesting. Here’s the story of how I discovered CVE-2019-1105.

Interacting with Active Directory on the Mac Did you ever have to interact with Active Directory on a MAC? If yes, this post might be interesting for you. I am pretty new to the Mac and basic things I know how to do on Windows need some research to figure out. This time around I explore Active Directory/LDAP Server interactions. First, there is the Directory Utility on MacOS which can be quite useful.

English Version 中文版本

Introduction

Today, we are going to talk about the installation password of Hex-Rays IDA Pro, which is the most famous decompiler. What is installation password? Generally, customers receive a custom installer and installation password after they purchase IDA Pro. The installation password is required during installation process. However, if someday we find a leaked IDA Pro installer, is it still possible to install without an installation password? This is an interesting topic.

After brainstorming with our team members, we verified the answer: Yes! With a Linux or MacOS version installer, we can easily find the password directly. With a Windows version installer, we only need 10 minutes to calculate the password. The following is the detailed process:

* Linux and MacOS version

The first challenge is Linux and MacOS version. The installer is built with an installer creation tool called InstallBuilder. We found the plaintext installation password directly in the program memory of the running IDA Pro installer. Mission complete!

This problem is fixed after we reported through Hex-Rays. BitRock released InstallBuilder 19.2.0 with the protection of installation password on 2019/02/11.

* Windows version

It gets harder on Windows version because the installer is built with Inno Setup, which store its password with 160-bit SHA-1 hash. Therefore, we cannot get the password simply with static or dynamic analyzing the installer, and brute force is apparently not an effective way. But the situation is different if we can grasp the methodology of password generation, which lets us enumerate the password more effectively!

Although we have realized we need to find how Hex-Rays generate password, it is still really difficult, as we do not know what language the random number generator is implemented with. There are at least 88 random number generators known. It is such a great variation.

We first tried to find the charset used by random number generator. We collected all leaked installation passwords, such as hacking team’s password, which is leaked by WikiLeaks.

• FgVQyXZY2XFk (link)
• 7ChFzSbF4aik (link)
• ZFdLqEM2QMVe (link)
• 6VYGSyLguBfi (link)

From the collected passwords we can summarize the charset: 23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz

The missing of 1, I, l, 0, O, o, N, n seems to make sense because they are confusing characters. Next, we guess the possible charset ordering like these:

23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz ABCDEFGHJKLMPQRSTUVWXYZ23456789abcdefghijkmpqrstuvwxyz 23456789abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ abcdefghijkmpqrstuvwxyz23456789ABCDEFGHJKLMPQRSTUVWXYZ abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789 ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz23456789

Lastly, we picked some common languages（c/php/python/perl）to implement a random number generator and enumerate all the combinations. Then we examined whether the collected passwords appears in the combinations. For example, here is a generator written in C language:

#include<stdio.h> #include<stdlib.h> char _a[] = "23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz"; char _b[] = "ABCDEFGHJKLMPQRSTUVWXYZ23456789abcdefghijkmpqrstuvwxyz"; char _c[] = "23456789abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ"; char _d[] = "abcdefghijkmpqrstuvwxyz23456789ABCDEFGHJKLMPQRSTUVWXYZ"; char _e[] = "abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789"; char _f[] = "ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz23456789"; int main() { char bufa[21]={0}; char bufb[21]={0}; char bufc[21]={0}; char bufd[21]={0}; char bufe[21]={0}; char buff[21]={0}; unsigned int i=0; while(i<0x100000000) { srand(i); for(size_t n=0;n<20;n++) { int key= rand() % 54; bufa[n]=_a[key]; bufb[n]=_b[key]; bufc[n]=_c[key]; bufd[n]=_d[key]; bufe[n]=_e[key]; buff[n]=_f[key]; } printf("%s\n",bufa); printf("%s\n",bufb); printf("%s\n",bufc); printf("%s\n",bufd); printf("%s\n",bufe); printf("%s\n",buff); i=i+1; } }

After a month, we finally generated the IDA Pro installation passwords successfully with Perl, and the correct charset ordering is abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789. For example, we can generate the hacking team’s leaked password FgVQyXZY2XFk with the following script:

#!/usr/bin/env perl # @_e = split //,"abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789"; $i=3326487116; srand($i); $pw=""; for($i=0;$i<12;++$i) { $key = rand 54; $pw = $pw . $_e[$key]; } print "$i $pw\n";

With this, we can build a dictionary of installation password, which effectively increase the efficiency of brute force attack. Generally, we can compute the password of one installer in 10 minutes.

We have reported this issue to Hex-Rays, and they promised to harden the installation password immediately.

Summary

In this article, we discussed the possibility of installing IDA Pro without owning installation password. In the end, we found plaintext password in the program memory of Linux and MacOS version. On the other hand, we determined the password generation methodology of Windows version. Therefore, we can build a dictionary to accelerate brute force attack. Finally, we can get one password at a reasonable time.

We really enjoy this process: surmise wisely and prove it with our best. It can broaden our experience no matter the result is correct or not. This is why we took a whole month to verify such a difficult surmise. We also take this attitude in our Red Team Assessment. You would love to give it a try!

Lastly, we would like to thank for the friendly and rapid response from Hex-Rays. Although this issue is not included in Security Bug Bounty Program, they still generously awarded us IDA Pro Linux and MAC version, and upgraded the Windows version for us. We really appreciate it.

Timeline

• Jan 31, 2019 - Report to Hex-Rays
• Feb 01, 2019 - Hex-Rays promised to harden the installation password and reported to BitRock
• Feb 11, 2019 - BitRock released InstallBuilder 19.2.0

English Version 中文版本

前言

Hex-Rays IDA Pro 是目前世界上最知名的反組譯工具，今天我們想來聊聊它的安裝密碼。什麼是安裝密碼？一般來說，在完成 IDA Pro 購買流程後，會收到一個客製化安裝檔及安裝密碼，在程式安裝過程中，會需要那組安裝密碼才得以繼續安裝。那麼，如果今天在網路上發現一包洩漏的 IDA Pro 安裝檔，我們有可能在不知道密碼的狀況下順利安裝嗎？這是一個有趣的開放性問題。

在我們團隊成員腦力激盪下，給出了一個驗證性的答案：是的，在有 Linux 或 MacOS 版安裝檔的狀況下，我們可以直接找到正確的安裝密碼；而在有 Windows 版安裝檔的狀況下，我們只需要十分鐘就可算出安裝密碼。

下面就是我們的驗證流程：

* Linux 以及 MacOS 版

最先驗證成功的是 Linux 及 MacOS 版，這兩個版本都是透過 InstallBuilder 封裝成安裝檔。我們嘗試執行安裝程式，並在記憶體中直接發現了未加密的安裝密碼。任務達成！

在透過 Hex-Rays 協助回報後，BitRock 也在 2019/02/11 釋出了 InstallBuilder 19.2.0，加強了安裝密碼的保護。

* Windows 版

在 Windows 版上解決這個問題是項挑戰，因為這個安裝檔是透過 Inno Setup 封裝的，其安裝密碼是採用 160-bit SHA-1 hash 的方式儲存，因此我們無法透過靜態、動態程式分析直接取得密碼，透過暴力列舉也不是一個有效率的方式。不過，如果我們掌握了產生密碼的方式，那結果可能就不一樣了，我們也許可以更有效率的窮舉。

雖然我們已經有了方向是要找出 Hex-Rays 如何產生密碼，但要去驗證卻是”非常困難”的。因為我們不知道亂數產生器是用什麼語言實作的，而目前已知至少有 88 種亂數產生器，種類太多了。同時，我們也無法知道亂數產生器所使用的字元組和字元順序是什麼。

要找出亂數產生器所使用的字元組是眾多困難事中比較簡單的一件，首先，我們竭盡所能的收集所有 IDA Pro 的安裝密碼，例如 WikiLeaks 所揭露的 hackingteam 使用之密碼：

• FgVQyXZY2XFk (link)
• 7ChFzSbF4aik (link)
• ZFdLqEM2QMVe (link)
• 6VYGSyLguBfi (link)

從所有收集到的安裝密碼中我們整理出所用到的字元組： 23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz

少了 1, I, l, 0, O, o, N, n 字元，推測這些都是容易混淆的字元，因此不放入密碼字元組中是合理的。接著，我們用這些字元組，猜測可能的排列順序：

23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz ABCDEFGHJKLMPQRSTUVWXYZ23456789abcdefghijkmpqrstuvwxyz 23456789abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ abcdefghijkmpqrstuvwxyz23456789ABCDEFGHJKLMPQRSTUVWXYZ abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789 ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz23456789

最後，我們挑選幾個比較常見的語言（c/php/python/perl）並使用上述的字元組實作亂數產生器，列舉所有亂數組合，看看我們收集到的安裝密碼有沒有出現在這些組合中。例如我們用下面程式碼列舉 C 語言的亂數組合：

#include<stdio.h> #include<stdlib.h> char _a[] = "23456789ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz"; char _b[] = "ABCDEFGHJKLMPQRSTUVWXYZ23456789abcdefghijkmpqrstuvwxyz"; char _c[] = "23456789abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ"; char _d[] = "abcdefghijkmpqrstuvwxyz23456789ABCDEFGHJKLMPQRSTUVWXYZ"; char _e[] = "abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789"; char _f[] = "ABCDEFGHJKLMPQRSTUVWXYZabcdefghijkmpqrstuvwxyz23456789"; int main() { char bufa[21]={0}; char bufb[21]={0}; char bufc[21]={0}; char bufd[21]={0}; char bufe[21]={0}; char buff[21]={0}; unsigned int i=0; while(i<0x100000000) { srand(i); for(size_t n=0;n<20;n++) { int key= rand() % 54; bufa[n]=_a[key]; bufb[n]=_b[key]; bufc[n]=_c[key]; bufd[n]=_d[key]; bufe[n]=_e[key]; buff[n]=_f[key]; } printf("%s\n",bufa); printf("%s\n",bufb); printf("%s\n",bufc); printf("%s\n",bufd); printf("%s\n",bufe); printf("%s\n",buff); i=i+1; } }

大約一個月的運算，我們終於成功利用 Perl 亂數產生出 IDA Pro 的安裝密碼，而正確的字元組順序為 abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789。例如 hacking team 洩漏的 IDA Pro 6.8 安裝密碼是 FgVQyXZY2XFk，就可用下面程式碼產生：

#!/usr/bin/env perl # @_e = split //,"abcdefghijkmpqrstuvwxyzABCDEFGHJKLMPQRSTUVWXYZ23456789"; $i=3326487116; srand($i); $pw=""; for($i=0;$i<12;++$i) { $key = rand 54; $pw = $pw . $_e[$key]; } print "$i $pw\n";

透過這些資訊，我們可以建立一個用來暴力列舉安裝密碼的字典檔，縮短暴力列舉的時間，實作方式可參考 inno2john 專案。在一般情況下，約十分鐘即可算出 windows 安裝檔的安裝密碼。

在回報 Hex-Rays 後，他們立刻表示之後將會使用更安全的安裝密碼。

總結

本篇文章提出了一個開放性問題：在未知安裝密碼的情況下可不可以安裝 IDA Pro？結果我們在 Linux 以及 MacOS 版發現可以從記憶體中取得明文密碼。而在 Windows 版本中，我們黑箱找到了安裝密碼產生的方式，因此我們可以建立一份字典檔，用以縮短暴力列舉安裝密碼的時間，最終，我們約十分鐘可解出一組密碼，是一個可以接受的時間。

我們真的很喜歡這樣的過程：有根據的大膽猜測，竭盡全力用任何已知資訊去證明我們的想法，不論猜測是對是錯，都能從過程中獲得很多經驗。這也是為什麼我們這次願意花一個月時間去驗證一個成功機率不是很高的假設。附帶一提，這樣的態度，也被運用在我們紅隊演練上，想要試試嗎 :p

寫在最後，要感謝 Hex-Rays 很友善且快速的回應。即使這個問題不包含在 Security Bug Bounty Program 裡面，仍然慷慨的贈送 Linux 和 MAC 版 IDA 及升級原有 Windows 版至 IDA Pro。再次感謝。

時間軸

• Jan 31, 2019 - 向 Hex-Rays 回報弱點
• Feb 01, 2019 - Hex-Rays 說明之後會增加安裝密碼的強度，並協助通報 BitRock
• Feb 11, 2019 - BitRock 釋出了 InstallBuilder 19.2.0

水文预警。Attack CGI / FASTCGI / PHP-FPM / uWSGI with socket ( TCP / Unix Domain Socket )

0x00 前言
         我他妈居然在野蛮的期末考试来临之即写博客，为了防止挂科我会写的短点好腾出时间预习          pyspider是一个基于python的国人研发的爬虫系统，功能非常强大          关于这个东西。介绍如下： 采用Python语言编写，分布式架构，支持多种数据库后端，强大的WebUI支持脚本编辑器，任务监视器，项目管理器以及结果查看器。
0x01 未授权访问的威胁          pyspider还带一个webui的界面，方便调度爬虫调试代码的。可是偏偏一些铁憨憨把这个webui开到公网上面，而webui本身没有任何形式的验证机制并且允许远程执行python代码。
         我查遍了google发现这个威胁好像没人提到，那应该是我第一个发现的吧
         用数字公司的fofa一搜发现有几百个
https://fofa.so/result?q=title%3D%22Dashboard+-+pyspider%22&qbase64=dGl0bGU9IkRhc2hib2FyZCAtIHB5c3BpZGVyIg%3D%3D
0x01 POC&EXP           放https://github.com/TomAPU/poc_and_exp了           随便玩，玩累了就睡觉，没关系的          

The online video player landscape is fragmented with a wide variety of players across a mix of popular platforms. In the world of HTML5-video players in browsers, there are a number of open-source solutions (e.g., hls.js, dash.js, Shaka Player), as well as commercial offerings which include Akamai's AMP.

The Gootkit banking trojan is still active and protecting itself in Italy using a dedicated redirection defense.

Oracle Weblogic远程反序列化命令执行漏洞，该漏洞绕过了最新的Weblogic补丁（CVE-2019-2725）。