(转载)2020.9.14-9.20一周安全知识动态

2020.9.14-9.20一周安全知识动态

转自image-20200929114557052

浏览器漏洞相关

•[compiler] Fix bug in SimplifiedLowering’s overflow computation

1
https://chromium.googlesource.com/v8/v8/+/e371325bcb03f20a362ebfa48225159702c6fde7SimplifiedLowering-0处理不当

•Firefox for Android LAN-Based Intent Triggering

1
https://gitlab.com/gitlab-com/gl-security/security-operations/gl-redteam/red-team-tech-notes/-/tree/master/firefox-android-2020针对firefox安卓端 Lan网段的攻击利用脚本

漏洞挖掘相关

•OneFuzz - A self-hosted Fuzzing-As-A-Service platform

1
https://github.com/microsoft/onefuzz

CTF相关

•CSAW CTF Quals 2020 Writeups

1
https://ptr-yudai.hatenablog.com/entry/2020/09/14/181939https://github.com/perfectblue/ctf-writeups/tree/master/2020/csaw-quals-2020csaw-quals-2020 writeup

操作系统漏洞相关

•SRC-2020-0019 : Microsoft Exchange Server DlpUtils AddTenantDlpPolicy Remote Code Execution Vulnerability

1
2
https://srcincite.io/advisories/src-2020-0019/
https://srcincite.io/pocs/cve-2020-16875.ps1.txthttps://srcincite.io/pocs/cve-2020-16875.py.txtcve-2020-16875ExchangeServerDlpUtilsAddTenantDlpPolicy RCE漏洞公告及poc

•Espressif ESP32: Bypassing Flash Encryption (CVE-2020-15048)

1
https://raelize.com/posts/espressif-systems-esp32-bypassing-flash-encryption/CVE-2020-15048绕过Flash加密漏洞分析

•MemFuck: Bypassing User-Mode Hooks

1
https://winternl.com/memfuck/绕过User-ModeHook

•CVE-2020-9964 - An iOS infoleak

1
https://muirey03.blogspot.com/2020/09/cve-2020-9964-ios-infoleak.htmlIOS信息泄露漏洞CVE-2020-9964分析

•CVE-2020-1472 Zerologon exploit

1
2
https://github.com/nccgroup/nccfsas/tree/main/Tools/SharpZeroLogonhttps://github.com/BC-SECURITY/Invoke-ZeroLogonhttps://www.lares.com/blog/from-lares-labs-defensive-guidance-for-zerologon-cve-2020-1472/
https://www.secura.com/blog/zero-logonCVE-2020-1472Zerologon利用脚本及漏洞分析

应用程序漏洞相关

•How I Hacked Facebook Again! Unauthenticated RCE on MobileIron MDM

1
https://github.com/iamnoooob/CVE-Reverse/tree/master/CVE-2020-15505https://blog.orange.tw/2020/09/how-i-hacked-facebook-again-mobileiron-mdm-rce.htmlMobileiron MDM RCE CVE-2020-15505 poc及writeup

•Zerologon: instantly become domain admin by subverting Netlogon cryptography (CVE-2020-1472)

1
https://www.secura.com/blog/zero-logonCVE-2020-1472Zerologon提权漏洞分析

•Clash of the (Spam)Titan

1
2
https://sensepost.com/blog/2020/clash-of-the-spamtitan/
https://github.com/sensepost/ClashofSpamTitanSpamTitanGateway漏洞挖掘

•CVE-2020-9496: RCE IN APACHE OFBIZ XMLRPC VIA DESERIALIZATION OF UNTRUSTED DATA

1
https://www.zerodayinitiative.com/blog/2020/9/14/cve-2020-9496-rce-in-apache-ofbiz-xmlrpc-via-deserialization-of-untrusted-dataApacheOFBiz CVE-2020-9496 RCE 分析

•POSTGRESQL CODE EXECUTION: UDF REVISITED

1
https://medium.com/@afinepl/postgresql-code-execution-udf-revisited-3b08412f47c1POSTGRESQL 代码执行分析

•Aruba Clearpass RCE (CVE-2020-7115)

1
https://dozer.nz/posts/aruba-clearpass-rceArubaClearPassPolicyManager<= 6.9.0免认证CVE-2020-7115漏洞分析

工具相关

•Symbolizer - A fast execution trace symbolizer for Windows

1
https://github.com/0vercl0k/symbolizerwindows trace symbolizer 工具

•Reverse Shell Generator

1
https://weibell.github.io/reverse-shell-generator/在线反弹shell生成器
Page View
⬆︎UP