Permalink
Switch branches/tags
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
570 lines (525 sloc) 15.6 KB
<!DOCTYPE html>
<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type"/>
<meta content="腾讯玄武实验室安全动态推送(Tencent Xuanwu Lab Security Daily News) - 2018/07/21" name="description">
<meta content="index, follow" name="robots"/>
<meta content="width=device-width, initial-scale=1" name="viewport"/>
<title>腾讯玄武实验室安全动态推送(Tencent Xuanwu Lab Security Daily News) - 2018/07/21</title>
<style>
body{
width: 40%;
margin: 0 auto;
min-width: 700px;
}
#weibowrapper{
/*width: 390px;*/
/*width = auto;*/
/*font-family: "Courier", "Serif";*/
/*font-family: "PingHei","Lucida Grande", "Lucida Sans", "Helvetica", "Arial", "Sans Serif", "Consolas";*/
font-family: "Helvetica Neue", "Helvetica", "Arial", "Microsoft Yahei", "微软雅黑", "Consolas";
font-size: 14px;
/*color: #a7a7a7;*/
}
#weibowrapper li{
list-style: none;
}
#singleweibo{
border-top: 1px solid #f0f0f0;
color: black;
margin-bottom: 30px;
}
#weibowrapper .weibolist{
margin: 0px 0px;
padding: 0px 10px;
}
#singleweibologo{
float: left;
/*width: 24px;*/
width: 17px;
height: 17px;
margin-right: 5px;
}
#singleweibologo img{
float: left;
width: 15px;
height: 13px;
max-height: 15px;
max-width: 15px;
/*width: 80%;
height: 80%;*/
}
.singleweibotext a{
text-decoration: none;
/*color: #37485b;*/
color: #a7a7a7;
}
.singleweibotext{
word-wrap: break-word;
}
.singleweibotext .category{
font-style: italic;
color: #a7a7a7;
}
.singleweiboretweet{
border: 1px solid #f0f0f0;
}
.translated{
margin: 0px 0px;
padding-left: 20px;
/*border: 1px dotted #a7a7a7;*/
font-family:"微软雅黑","Courier", "Serif";
word-wrap: break-word;
}
.translated p{
color: black;
}
.singleweiboimage, a img{
max-width: 400px;
max-height: 600px;
/*width: expression(this.width > 500? 500px;'auto';)
height: expression(this.width > 600? 600px;'auto';);*/
}
.singleweiboimage{
/*margin-left: auto;
margin-right: auto;*/
margin-left: 25px;
}
#avatar{
font-family: "微软雅黑","Courier", "Serif";
color: #37485b;
width: 100%;
height: 150px;
margin-top: 30px;
text-align: center;
}
#avatar_pic{
display: inline-block;
vertical-align: middle;
}
#avatar img{
max-height: 120px;
max-width: 300px;
/*width: 250px;
height:145px;*/
}
#logo_title{
display: inline-block;
vertical-align: middle;
font-family: "微软雅黑","Courier", "Serif";
}
#logo_title h2{
font-weight: normal;
font-size: 18px;
}
#logo_title p{
font-size: 14px;
}
#datenavigate{
text-align: center;
margin: 20px 0;
padding-left: 10px;
padding-right: 10px;
font-size: 14px;
font-family: "Helvetica Neue", "Helvetica", "Arial", "Microsoft Yahei", "微软雅黑", "Consolas";
}
#datenavigate a{
text-decoration: none;
color: #37485b;
}
#prevpage{
margin-left: 50px;
display: inline-block;
float: left;
}
#currentpage{
display: inline-block;
}
#nextpage{
margin-right: 50px;
display: inline-block;
float: right;
}
/* manualpost style*/
#manualfeedlist li{
list-style: none;
}
#manualfeedlist{
margin: 0px 0px;
padding: 0px 10px;
}
.singlemanualfeed{
margin-top: 15px;
padding-top: 5px;
border-top: 1px solid #f0f0f0;
}
.singlefeedheader{
}
.singlefeedlogo{
float: left;
/*width: 24px;*/
width: 13px;
height: 13px;
margin-right: 5px;
margin-top: 3px;
}
.singlefeedlogo img{
float: left;
width: 13px;
height: 13px;
max-height: 15px;
max-width: 15px;
/*width: 80%;
height: 80%;*/
}
.singlefeedauthor{
height: 24px;
/*width: 35%;*/
margin-left: 5px;
}
.singlefeedauthor p{
margin: 0 0px;
color: #a7a7a7;
}
.singlefeedtext a{
text-decoration: none;
color: #37485b;
}
.singlefeedtext{
word-wrap: break-word;
}
.feedcomments{
margin: 0px 0px;
padding-left: 20px;
/*border: 1px dotted #a7a7a7;*/
font-family: "Source Code Pro", "微软雅黑", "Consolas", "Courier";
}
.feedcomments p{
font-size: 14px;
color: #a7a7a7;
}
.feedcomments button{
display: none;
margin: 5px;
color: #666;
height: 24px;
text-decoration: none;
}
.singlefeedimage, a img{
max-width: 400px;
max-height: 600px;
}
.singlefeedauthor img{
max-height: 12px;
max-width: 12px;
}
.singlefeedtext .category{
font-style: italic;
color: #a7a7a7;
}
hr{
margin-bottom: 20px;
color: #f0f0f0;
}
</style>
<script type="text/javascript">
function ConvertTextToHyperLink()
{
var textElements = document.getElementsByClassName("singleweibotext");
if (textElements.length){
for (var tIdx=0; tIdx < textElements.length; tIdx++){
var aElements = textElements[tIdx].getElementsByTagName("a");
if (aElements.length){
for (var aIdx=0; aIdx < aElements.length; aIdx++){
var matchidx = aElements[aIdx].href.search('%C2%A0');
if (matchidx != -1){
aElements[aIdx].href = aElements[aIdx].href.substr(0, matchidx);
}
}
}
}
}
}
</script>
<script charset="UTF-8" src="http://tajs.qq.com/stats?sId=64975755" type="text/javascript"></script>
</meta></head>
<body onload="ConvertTextToHyperLink()">
<div id="mainbody">
<div id="avatar">
<div id="avatar_pic">
<img src="logo.jpg"/>
</div>
<div id="logo_title">
<h2>腾讯玄武实验室安全动态推送</h2>
<p>Tencent Xuanwu Lab Security Daily News</p>
</div>
</div>
<div id="datenavigate">
<div id="prevpage">
<a href="/cn/secnews/2018/07/20/index.html">Previous</a>
</div>
<div id="currentpage">
<a href="/cn/secnews/2018/07/21/index.html">2018/07/21</a>
</div>
<div id="nextpage">
<a href="/cn/secnews/2018/07/22/index.html">Next</a>
</div>
</div>
<div id="weibowrapper">
<ul class="weibolist">
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Browser ]</span>   Chrome Web Authentication API 将支持 Touch ID 作为平台身份验证器: <a href="https://www.chromestatus.com/feature/5962264427364352" rel="nofollow">https://www.chromestatus.com/feature/5962264427364352</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Browser ]</span>  Exploiting unknown browsers and objects,作者通过自己的工具,去测试了一些未知的浏览器引擎,研究了跨域相关的问题: <a href="https://portswigger.net/kb/papers/exploitingunknownbrowsers.pdf" rel="nofollow">https://portswigger.net/kb/papers/exploitingunknownbrowsers.pdf</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Debug ]</span>  执行自动化调试任务的 PyKD 库介绍系列文章,Part 1: <a href="https://www.zerodayinitiative.com/blog/2018/7/19/mindshare-an-introduction-to-pykd" rel="nofollow">https://www.zerodayinitiative.com/blog/2018/7/19/mindshare-an-introduction-to-pykd</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Linux ]</span>  Linux 提权命令指南: <a href="https://guif.re/linuxeop" rel="nofollow">https://guif.re/linuxeop</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ macOS ]</span>   macOS 上的攻击行为检测 Part 2: <a href="https://posts.specterops.io/hunting-for-bad-apples-part-2-6f2d01b1f7d3" rel="nofollow">https://posts.specterops.io/hunting-for-bad-apples-part-2-6f2d01b1f7d3</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ MalwareAnalysis ]</span>   卡巴斯基对 macOS 木马 Calisto 的分析: <a href="https://securelist.com/calisto-trojan-for-macos/86543/" rel="nofollow">https://securelist.com/calisto-trojan-for-macos/86543/</a></p>
</div>
<div class="singleweiboimage">
<a href="http://pbs.twimg.com/media/Dij42nzVAAAGJqg.jpg" target="_blank">
<img src="http://pbs.twimg.com/media/Dij42nzVAAAGJqg.jpg">
</img></a>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ MalwareAnalysis ]</span>  逆向分析 <a href="http://marveloptics.com" rel="nofollow">marveloptics.com</a> 上的恶意 JS 脚本: <a href="https://blog.jse.li/posts/marveloptics-malware/" rel="nofollow">https://blog.jse.li/posts/marveloptics-malware/</a></p>
</div>
<div class="singleweiboimage">
<a href="http://pbs.twimg.com/media/DiiRDrrXUAAltiw.jpg" target="_blank">
<img src="http://pbs.twimg.com/media/DiiRDrrXUAAltiw.jpg">
</img></a>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ MalwareAnalysis ]</span>  PaloAlto Unit 42 团队发现新的 Mirai 和 Gafgyt IoT/Linux 僵尸网络活动: <a href="https://researchcenter.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/" rel="nofollow">https://researchcenter.paloaltonetworks.com/2018/07/unit42-finds-new-mirai-gafgyt-iotlinux-botnet-campaigns/</a></p>
</div>
<div class="singleweiboimage">
<a href="http://pbs.twimg.com/media/DijArvHVsAEE4u4.jpg" target="_blank">
<img src="http://pbs.twimg.com/media/DijArvHVsAEE4u4.jpg">
</img></a>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Popular Software ]</span>  CVE-2018-2894 WebLogic 未授权访问致任意文件上传/RCE漏洞检查脚本
: <a href="https://github.com/LandGrey/CVE-2018-2894/" rel="nofollow">https://github.com/LandGrey/CVE-2018-2894/</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Tools ]</span>  ISO7816Analyzer - 7816 通讯的协议解析插件: <a href="https://github.com/nezza/ISO7816Analyzer" rel="nofollow">https://github.com/nezza/ISO7816Analyzer</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Tools ]</span>  dotnet-core-assembly-loading - 使用 .NET Core 加载程序集的示例项目: <a href="https://github.com/richlander/dotnet-core-assembly-loading/blob/master/src/gutenapp/gutenapp/Program.cs" rel="nofollow">https://github.com/richlander/dotnet-core-assembly-loading/blob/master/src/gutenapp/gutenapp/Program.cs</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Tools ]</span>  JS Sniffer - 偷取电子商务数据的框架: <a href="https://www.volexity.com/blog/2018/07/19/js-sniffer-e-commerce-data-theft-made-easy/" rel="nofollow">https://www.volexity.com/blog/2018/07/19/js-sniffer-e-commerce-data-theft-made-easy/</a></p>
</div>
<div class="singleweiboimage">
<a href="http://pbs.twimg.com/media/DiiQoEgVsAAzmr1.jpg" target="_blank">
<img src="http://pbs.twimg.com/media/DiiQoEgVsAAzmr1.jpg">
</img></a>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Tools ]</span>  KdExploitMe - Windows 内核驱动漏洞利用练习项目: <a href="https://github.com/clymb3r/KdExploitMe" rel="nofollow">https://github.com/clymb3r/KdExploitMe</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Tools ]</span>  Robber - 用于查找易受 DLL 劫持的可执行文件的工具: <a href="https://github.com/MojtabaTajik/Robber" rel="nofollow">https://github.com/MojtabaTajik/Robber</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Vulnerability ]</span>  RSA Archer 多漏洞披露(CVE-2018-11059、CVE-2018-11060): <a href="http://seclists.org/fulldisclosure/2018/Jul/69" rel="nofollow">http://seclists.org/fulldisclosure/2018/Jul/69</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Vulnerability ]</span>   Microsoft Translator Hub 自动语言翻译系统越权删除任意项目漏洞披露: <a href="https://haiderm.com/how-i-was-able-to-delete-13k-microsoft-translator-projects/" rel="nofollow">https://haiderm.com/how-i-was-able-to-delete-13k-microsoft-translator-projects/</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Web Security ]</span>  Google Sites SSRF 漏洞详情披露,利用该漏洞成功访问到 Google 生产网络: <a href="https://opnsec.com/2018/07/into-the-borg-ssrf-inside-google-production-network/" rel="nofollow">https://opnsec.com/2018/07/into-the-borg-ssrf-inside-google-production-network/</a></p>
</div>
</div>
</div>
</li>
<li>
<div id="singleweibo">
<div id="singleweibobody">
<div id="singleweibologo">
<img align="left" src="twitter_logo.jpg">
</img></div>
<div class="singleweibotext">
<p><span class="category">[ Windows ]</span>  Windows 10 预览版 17713+ 中 Microsoft Edge 引入新的组策略和 MDM 配置,允许IT管理员管理全屏模式、打印、收藏夹栏、历史记录、新标签页、扩展等: <a href="https://docs.microsoft.com/en-us/microsoft-edge/deploy/new-policies" rel="nofollow">https://docs.microsoft.com/en-us/microsoft-edge/deploy/new-policies</a></p>
</div>
</div>
</div>
</li>
</ul>
<ul id="manualfeedlist">
</ul>
</div>
<div id="datenavigate">
<hr>
<div id="prevpage">
<a href="/cn/secnews/2018/07/20/index.html">Previous</a>
</div>
<div id="currentpage">
<a href="/cn/secnews/2018/07/21/index.html">2018/07/21</a>
</div>
<div id="nextpage">
<a href="/cn/secnews/2018/07/22/index.html">Next</a>
</div>
</hr></div>
</div>
</body>
</html>