每日安全动态推送(12-14)

• Precious Gemstones: The New Generation of Kerberos Attacks:
https://unit42.paloaltonetworks.com/next-gen-kerberos-attacks/

   ・ 针对Kerberos的新型攻击，主要基于 Golden Ticket攻击进行扩展和改进 – xmzyshypnc

• [Linux, Tools] Modifying Embedded Filesystems in ARM Linux zImages:
https://jamchamb.net/2022/01/02/modify-vmlinuz-arm.html

   ・ 讲述如何对嵌入到vmlinuxz中的文件系统进行patch，这一类文件系统在嵌入式设备中比较常见。 – Atum

• [Windows] Fuzzing the Shield: CVE-2022–24548:
https://medium.com/s2wblog/fuzzing-the-shield-cve-2022-24548-96f568980c0

   ・ 用 Jackalope fuzz Windows Defender 的核心扫描模块 mpengine.dll，详细介绍了编写 harness 的过程 – WireFish

• CVE-2022-42475: Unauthenticated Remote Code Execution Vulnerability in FortiOS; Exploitation Reported:
https://blog.rapid7.com/2022/12/12/cve-2022-42475-unauthenticated-remote-code-execution-vulnerability-in-fortios-exploitation-reported/

   ・ FortiOS SSL-VPN存在堆缓冲区溢出漏洞，攻击者无需身份验证即可远程命令执行，评分9.3 – keenan

• VMware vCenter Server Content Library denial of service vulnerability:
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1588

   ・ Vmware vCenter Server存在一个DOS漏洞。该漏洞的根本成因是依据不可信的用户的输入（int）分配内存并进行运算，使CPU和内存可能被恶意的输入耗尽 – Atum

• [Tools] Using CyberChef To Automatically Extract Shellcode from PowerShell Loader [Twitch Clip]:
https://www.youtube.com/watch?v=H-An4Tx__t8

   ・ Using CyberChef To Automatically Extract Shellcode from PowerShell Loader  – lanying37

• 1332924 - MicrosoftEdgeUpdate DACL Privilege Escalation - chromium:
https://crbug.com/1332924

   ・ Edge浏览器存在一个DACL权限提升漏洞，可以通过hardlink修改任意文件的DACL到System。其根本成因在于Edge浏览器错误信任了一个任意用户可删改到文件。 – Atum

• [Windows] IIS modules: The evolution of web shells and how to detect them:
https://msft.it/6016eP7ZM

   ・ 微软发布针对恶意IIS模块持续化webshell的演进和检测 – crazyman

• [Tools] K🔑Logger v3.0.0:
https://github.com/De3vil/KLogger

   ・ 一个开源的keylogger，支持win/lin，且目前可以做到免杀。 – Atum

• Multiple Zero-Day Vulnerabilities in Antivirus and Endpoint:
https://gbhackers.com/multiple-zero-day-vulnerabilities/

   ・ 杀软和EDR产品被发现在清除病毒文件时有TOC TOU漏洞，利用这个漏洞攻击者可以删除任意文件，有人基于这个漏洞开发了文件删除工具并发表在了blackhat EU。 – Atum

• [Fuzzing] r/netsec - Finding JIT Optimizer Bugs using SMT Solvers and Fuzzing:
https://www.reddit.com/r/netsec/comments/zjy40m/finding_jit_optimizer_bugs_using_smt_solvers_and/

   ・ 借助SMT(可满足性模块理论)的z3 solver和fuzzer检测PyPy JIT优化中的漏洞 – keenan

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab

原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(12-14)