攻防技战术动态一周更新 - 20250331

漏洞相关

1、

红队技术

1、Virtual Host Enumeration – How to Uncover Hidden Web Assets

https://www.freecodecamp.org/news/virtual-host-enumeration-tutorial/

2、Reliable system call interception.

https://blog.mggross.com/intercepting-syscalls/

3、我用NodeJS+electron自研了个C2和木马并绕过了360+火绒内存扫描(附源码)

https://xz.aliyun.com/news/17480

4、红队技巧分享：看看二进制漏洞研究与免杀相结合

5、【技术干货】一个命令搞定Windows UAC防护，微软却不愿修复

7、【免杀思路】如何快速解决QVM！(篇一)

8、Call Stack Spoofer

https://medium.com/@s12deff/call-stack-spoofer-6183a67e4179

9、REFORGING SLIVER: HOW SIMPLE CODE EDITS CAN OUTMANEUVER EDR

https://fortbridge.co.uk/research/reforging-sliver-how-simple-code-edits-can-outmaneuver-edr/

10、Shellcode Encryption Visual Studio Extension

https://medium.com/@s12deff/shellcode-encryption-visual-studio-extension-4c087b710079

11、攻防实战|记一次和安全产品贴身肉搏

12、议题分享： 企业设备安全设备漏洞分析与利用

https://bestwing.me/Security-Equipment-Vulnerability-Research.html

13、Combining Dll Sideloading and Syscalls for Evasion

https://medium.com/@luisgerardomoret_69654/combining-dll-sideloading-and-syscalls-for-evasion-dc2280154a5e

蓝队技术

1、bikasaha/MaLAware: MaLAware v1.0.0

https://zenodo.org/records/14809826

2、Sanctum EDR

https://github.com/0xflux/Sanctum

Sanctum is a proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust.

工具类

1、DocEx

https://github.com/DarkSpaceSecurity/DocEx

APT Emulation tool to exfiltrate sensitive .docx, .pptx, .xlsx, .pdf files

2、🧙‍♂️ Loki Command & Control

https://github.com/boku7/Loki

3、go-rpcclient

https://github.com/jfjallid/go-rpcclient

4、CobaltStrike-[坤坤版]-4.5

https://github.com/D13Xian/CobaltStrike-KunKun

5、一款图形化的 .DS_Store文件泄露、.git目录泄露、.svn目录泄露漏洞利用工具

6、peeko

https://github.com/b3rito/peeko

peeko – Browser-based XSS C2 for stealthy internal network exploration via infected browser.

其他类

1、Intel® Virtualization Technology - Redirect Protection (Intel® VT-rp)

https://community.intel.com/t5/Blogs/Tech-Innovation/Client/Intel-Virtualization-Technology-Redirect-Protection-Intel-VT-rp/post/1672593