剑客
关注科技互联网

10月4日-每日安全知识热点

10月4日-每日安全知识热点

热点概要: 对Bind漏洞CVE-2016-2776的细节分析、一个简单的MBR劫持演示代码、在busybox中利用提取文件的2种方法、H4CK1T CTF 2016 Quals部分关卡的writeup、

国内热词:

Linux Kernel 4.8发布

报告称升级到macOS Sierra后PS和Office 2016不是很稳定

法国银行推出新型“动态密码”支付卡

AMD再发七代APU:性能吊打Core i5

资讯类:

三星Knox漏洞导致黑客可以完全控制你的手机

http://www.wired.co.uk/article/samsung-knox-security-vulnerabilities

研究人员破解了MARSJOKE勒索软件的加密

https://threatpost.com/researchers-break-marsjoke-ransomware-encryption/121022/

EMC 存储系统发现 0day

http://www.zdnet.com/article/multiple-zero-day-flaws-found-in-emc-storage-systems/

技术类:

CVE-2016-2246:一分钟的pwn掉HP Thin Pro OS瘦客户端

http://blog.malerisch.net/2016/10/pwning-thin-client-in-less-two-minutes2-cve2016-2246.html

DerbyCon CTF的web关卡命令执行处字符绕过writeup

https://labs.signalsciences.com/hacking-the-hard-way-at-the-derbycon-ctf-d35b4dd4c97d#.sd8a1dp77

暗网调查第四部分:使用机器学习(Scikit-Learn )发现隐藏服务克隆站

http://www.automatingosint.com/blog/2016/09/dark-web-osint-part-four-using-scikit-learn-to-find-hidden-service-clones/

对CVE-2016-2776的细节分析

http://blog.infobytesec.com/2016/10/a-tale-of-dns-packet-cve-2016-2776.html

Securing HyperCat

https://blog.securitycompass.com/securing-hypercat-3a676ca08161#.lvnp6mcfu

H4CK1T CTF 2016 Quals – Hex0gator – Paraguay – 250 – PPC 关卡的 Write-up

https://crackinglandia.wordpress.com/2016/10/02/h4ck1t-ctf-2016-quals-hex0gator-paraguay-250-ppc-write-up/

H4CK1T CTF 2016 Quals – Mexico Pentest – 150 pts 关卡的 Write-up

https://crackinglandia.wordpress.com/2016/10/02/h4ck1t-ctf-2016-quals-mexico-pentest-150-pts-write-up/

H4CK1T CTF 2016 Quals – Argentina – r34n1m4710n – 100 pts 关卡的 Write-up

https://crackinglandia.wordpress.com/2016/10/02/h4ck1t-ctf-2016-quals-argentina-r34n1m4710n-100-pts-write-up/

H4CK1T CTF 2016 Quals – PhParanoid – Malaysia – 225 – Rever$e 关卡的 Write-up

https://crackinglandia.wordpress.com/2016/10/02/h4ck1t-ctf-2016-quals-phparanoid-malaysia-225-revere-write-up/

H4CK1T CTF 2016 Quals – Crypt00perator – Ethiopia – 95 – Rever$e 关卡的 Write-up

https://crackinglandia.wordpress.com/2016/10/02/h4ck1t-ctf-2016-quals-crypt00perator-ethiopia-95-revere-write-up/

一个简单的MBR劫持演示程序

https://github.com/DavidBuchanan314/pwn-mbr

Fluxion:WPA/WPA2无线网络审计工具

https://github.com/deltaxflux/fluxion

在busybox中利用提取文件的2种方法

https://bitquark.co.uk/blog/2016/10/03/exfiltrating_files_with_busybox

Windows Firewall Control 路径没有引号包含导致的权限提升漏洞POC

https://www.exploit-db.com/exploits/40443/

价值1万美金的ams.upload.pornhub.com站XXE漏洞

https://hackerone.com/reports/142562

Polyglot :假冒的CTB-locker勒索软件,解密工具在https://support.kaspersky.com/viruses/disinfection/8547

https://securelist.com/blog/research/76182/polyglot-the-fake-ctb-locker/

本文由 安全客 原创发布,如需转载请注明来源及本文地址。

本文地址:http://bobao.360.cn/news/detail/3614.html

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址