Web安全
Java中的XML安全研究
https://semgrep.dev/blog/2022/xml-security-in-java
Confluence与Struts下的OGNL表达式注入攻击研究
https://secops.group/blog/ognl-injection-decoded/
高度可定制化的JNDI和Java反序列化利用工具-JNDInjector
https://mp.weixin.qq.com/s/-OE1MlqaCUl7gmSPVNBr7g
内网渗透
用于armv5、armv7、mipseb和x64架构的Shellcode版SOCKS4服务器
https://github.com/nobodyisnobody/docs/tree/main/a.socks.proxy.shellcode
SeeProxy：使用CobaltStrike可延展配置文件验证的Golang反向代理
https://github.com/nopbrick/SeeProxy
golddigger：快速递归搜索文件敏感信息
https://github.com/ustayready/golddigger
starhound-importer：使用CLI从SharpHound或AzureHound将数据导入BloodHound
https://github.com/malacupa/starhound-importer
通过自动客户端推送安装的SCCM站点接管
https://posts.specterops.io/sccm-site-takeover-via-automatic-client-push-installation-f567ec80d5b1
使用纯Metasploit利用基于资源的约束委派 (RBCD)
https://www.n00py.io/2023/01/exploiting-resource-based-constrained-delegation-rbcd-with-pure-metasploit/
利用WebDAV共享和PetitPotam进行横向移动的新型攻击方式及武器化项目
https://www.hackingarticles.in/lateral-movement-webclient-workstation-takeover/
https://github.com/outflanknl/C2-Tool-Collection/blob/main/BOF/StartWebClient/SOURCE/StartWebClient.c
https://github.com/eversinc33/SharpStartWebclient
latma：从域中收集身份验证日志并搜索潜在的横向移动攻击和可疑活动
https://github.com/silverfort-open-source/latma
终端对抗
FlavorTown：C和C#实现的多种Shellcode执行方式
https://github.com/Wra7h/FlavorTown/
APCLdr：具有规避功能的有效载荷加载器
https://github.com/NUL0x4C/APCLdr
滥用异常以执行代码的各种方法
https://billdemirkapi.me/exception-oriented-programming-abusing-exceptions-for-code-execution-part-1/
https://billdemirkapi.me/abusing-exceptions-for-code-execution-part-2/
使用CMD武器化LNK文件
https://jfma7.medium.com/weaponizing-lnk-files-with-cmd-a18091f7cf66
ExplorerPersist：资源管理器持久化技术，劫持cscapi.dll加载路径并将恶意DLL写入Windows目录
https://github.com/gavz/ExplorerPersist
Inline-Execute-PE：在CobaltStrike中将非托管Windows可执行文件加载到Beacon内存中执行
https://github.com/Octoberfest7/Inline-Execute-PE
amd-ryzen-master-driver-v17-exploit：CS BOF和可执行文件，利用AMD的Ryzen主驱动程序漏洞，可实现禁用EDR、禁用ETW TI、转储LSASS等恶意操作
https://github.com/tijme/amd-ryzen-master-driver-v17-exploit
Meterpreter BOFLoader操作指南
https://www.trustedsec.com/blog/operators-guide-to-the-meterpreter-bofloader/
代理DLL加载以躲避ETWTI堆栈跟踪
https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/
代理DLL加载以隐藏可疑堆栈痕迹到用户分配RX区域
https://0xdarkvortex.dev/hiding-in-plainsight/
使用WSL2规避EDR
https://snikt.net/blog/2023/01/27/using-wsl2-to-hide-from-edr/
secret_handshake：通过mTLS使用x509证书的C2通道
https://github.com/jconwell/secret_handshake
Silhouette：强制将LSASS页面存储至磁盘以转储凭据
https://github.com/elastic/Silhouette
debloat：从膨胀的可执行文件中删除多余部分的分析辅助工具
https://github.com/Squiblydoo/debloat
利用用户态硬件堆栈保护漏洞缓解机制（HSP）以检测栈伪装技术及局限性分析
https://www.elastic.co/cn/security-labs/finding-truth-in-the-shadows
从内核模式使用ETW事件检测使用直接系统调用或手动代码映射的恶意样本
https://www.countercraftsec.com/blog/detecting-malicious-artifacts-using-an-etw-consumer-in-kernel-mode/
漏洞相关
CVE-2022-38181：Arm Mali GPU漏洞，从安卓应用获取Pixel 6上的任意内核代码执行与root权限
https://github.blog/2023-01-23-pwning-the-all-google-phone-with-a-non-google-bug/
在Linux内核中利用null-dereferences实现double free
https://googleprojectzero.blogspot.com/2023/01/exploiting-null-dereferences-in-linux.html
CVE-2023-22809：Linux sudo任意文件写漏洞
https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22809.pdf
CVE-2023-0179：nftables子系统缓冲区溢出漏洞
https://github.com/TurtleARM/CVE-2023-0179-PoC
CVE-2023-21752：Windows备份服务的任意文件删除漏洞POC
https://github.com/Wh04m1001/CVE-2023-21752
CVE-2022-41033: Windows COM+事件系统服务权限提升漏洞
https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2022/CVE-2022-41033.html
CVE-2022-34718：Windows TCP/IP RCE漏洞分析
https://securityintelligence.com/posts/dissecting-exploiting-tcp-ip-rce-vulnerability-evilesp/
云安全
AzBelt：Nim实现的用于枚举Azure相关凭据的独立DLL和sliver扩展
https://github.com/daddycocoaman/AzBelt
Azure攻击路径管理
https://sofblocks.github.io/azure-attack-paths/
AWS CloudTrail漏洞：未记录的API允许CloudTrail绕过
https://securitylabs.datadoghq.com/articles/iamadmin-cloudtrail-bypass/
客户端SSRF到Google Cloud项目接管[Google VRP]
https://blog.geekycat.in/client-side-ssrf-to-google-cloud-project-takeover/
gato：GitHub自托管运行器枚举和攻击工具
https://github.com/praetorian-inc/gato
azure-security-survival-kit：Azure集中日志检测和潜在威胁检测
https://github.com/03-Cyber/azure-security-survival-kit
其他
360发布2022年APT研究报告
https://github.com/blackorbird/APT_REPORT/blob/master/summary/2023/360_APT_Annual_Research_Report_2022.pdf
phishim：可以绕过大多数MFA和静默运行Chrome选项卡减少配置时间的钓鱼辅助工具
https://github.com/jackmichalak/phishim
C2-Hunter：实时从恶意软件中提取C2流量
https://github.com/ZeroMemoryEx/C2-Hunter
ChatGPT在攻防两端场景中的应用分析
https://securityblueteam.medium.com/chatgpt-for-offensive-and-defensive-cyber-f954f51aa79f
M01N Team公众号
聚焦高级攻防对抗热点技术
绿盟科技蓝军技术研究战队
官方攻防交流群
网络安全一手资讯
攻防技术答疑解惑
扫码加好友即可拉群
往期推荐
如有侵权请联系:admin#unsafe.sh