正文

每周蓝军技术推送（2024.9.14-9.20）

admin
admin V管理员 /0 评论 /91 阅读
0920
此篇文章发布距今已超过63天，您需要注意文章的内容或图片是否可用！

Web安全

CVE-2024-38816：Spring框架路径遍历漏洞

https://spring.io/security/cve-2024-38816

内网渗透

DGPOEdit：欺骗组策略本地主机已入域，以自非域主机编辑域组策略

https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/

https://github.com/CCob/DGPOEdit

利用Agent任务劫持SQL服务器凭据以域内权限提升

https://www.netspi.com/blog/technical-blog/network-pentesting/hijacking-sql-server-credentials-with-agent-jobs-for-domain-privilege-escalation/

kcmdump：从SSSD的KCM数据库中转储 Kerberos票据

https://github.com/synacktiv/kcmdump

AD域攻击十年盘点与未来展望

https://35950c24-b118-4502-b087-73855692e67c.usrfiles.com/ugd/35950c_a8f1e3659cc5402e9d732e6f8693fbbe.pdf

终端对抗

JarPlant：向JAR文件中植入恶意载荷

https://github.com/w1th4d/JarPlant

EXE-or-DLL-or-ShellCode：构建可同时作为EXE/DLL与Shellcode加载的特殊载荷

https://github.com/Dump-GUY/EXE-or-DLL-or-ShellCode

GlobalUnProtect：解密VPN身份验证令牌Cookie并重放使用

https://rotarydrone.medium.com/decrypting-and-replaying-vpn-cookies-4a1d8fc7773e

https://github.com/rotarydrone/GlobalUnProtect

Bear C2：内置Russia背景APT攻击模拟TTPs的C2框架

https://github.com/S3N4T0R-0X0/BEAR

规避EDR与SOC的终端对抗技巧

https://docs.google.com/presentation/d/1yUaalv-a_5oI9qYMUC7VCRqgkwIQFtlJcRWxI5TaAaE/edit

https://github.com/magisterquis/alpt4ats

zpoline：Linux syscall hook工具

https://github.com/yasukata/zpoline

漏洞相关

Sliver、Havoc等多个开源C2框架漏洞利用被公开

https://blog.includesecurity.com/2024/09/vulnerabilities-in-open-source-c2-frameworks/

https://github.com/hyperreality/c2-vulnerabilities

CVE-2024-7965：Chrome V8引擎历史0day漏洞POC公布 

https://github.com/bi-zone/CVE-2024-7965

CVE-2024-45409：ruby-saml库身份验证绕过漏洞，影响GitLab多个版本

https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2

https://about.gitlab.com/releases/2024/09/17/patch-release-gitlab-17-3-3-released/

CVE-2023-28324：Ivati EPM AgentPortal RCE漏洞POC

https://github.com/horizon3ai/CVE-2023-28324

AlcaWASM挑战赛WP，挖掘并利用浏览器Lua解释器内的漏洞

https://deda.lol/posts/2024-09-12-escape_alcawasm/

云安全

标准化Multi-Cloud特权访问架构白皮书，保护AWS、Azure和GCP中的 IAM

https://services.google.com/fh/files/misc/standardizing-privileged-access-architecture-for-multi-cloud.pdf

CloudGoat AWS攻击靶场提权利用场景“glue_privesc”

https://rhinosecuritylabs.com/cloud-security/cloudgoat-walkthrough-glue_privesc/

cloudkicker：自建Azure OSINT情报收集工具

https://github.com/nyxgeek/cloudkicker

借助Typosquatting技术攻击Github Actions

https://orca.security/resources/blog/typosquatting-in-github-actions/

人工智能和安全

local-llm-ctf：本地LLM越狱CTF挑战，突破安全围栏获取Flag

https://bishopfox.com/blog/large-language-models-llm-ctf-lab

https://github.com/BishopFox/local-llm-ctf

利用大型语言模型（LLM）进行恶意攻击的手段与防范

https://www.helpnetsecurity.com/2024/09/09/ai-cybersecurity-needs/

Hackphyr：针对网络安全环境的本地微调LLM Agent

https://arxiv.org/abs/2409.11276

LLMjacking安全风险

https://sysdig.com/blog/growing-dangers-of-llmjacking/

社工钓鱼

recaptcha-phish：使用假reCAPTCHA验证器钓鱼

https://github.com/JohnHammond/recaptcha-phish

其他

通过域名抢注劫持MOBI域名WHOIS服务器，进而欺骗CA认证与RCE攻击

https://labs.watchtowr.com/we-spent-20-to-achieve-rce-and-accidentally-became-the-admins-of-mobi/

binsider：ELF二进制分析工具

https://github.com/orhun/binsider

Linux常见持久化技术与检测手段

https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms

M01N Team公众号

聚焦高级攻防对抗热点技术

绿盟科技蓝军技术研究战队

官方攻防交流群

网络安全一手资讯

攻防技术答疑解惑

扫码加好友即可拉群

往期推荐


推荐站内搜索：最好用的开发软件、免费开源系统、渗透测试工具云盘下载、最新渗透测试资料、最新黑客工具下载……
https://ZhouSa.com