Web安全
借助mTLS身份认证机制，绕过多重身份验证 (MFA)
https://edermi.github.io/post/2024/mfa_bypass_mtls/
内网渗透
BloodHound 中的 ADCS 攻击路径-第3部分
https://posts.specterops.io/adcs-attack-paths-in-bloodhound-part-3-33efb00856ac
从Linux操作系统攻击AD域
https://gatari.dev/posts/the-art-of-exploiting-ad-from-linux/
Impacket的ZSH Shell集成
https://github.com/dadevel/impacket-zsh-integration
Personal-Vault-BEK：破解OneDrive的个人保险库，读取加密文件
https://malwaremaloney.blogspot.com/2024/09/cracking-onedrives-personal-vault.html
https://github.com/Beercow/Personal-Vault-BEK
终端对抗
EchoStrike：Golang实现的持久化反向shell
https://github.com/stivenhacker/EchoStrike
GhostStrike：基于异或加密与进程镂空的载荷加载器
https://github.com/stivenhacker/GhostStrike
goffloader：Golang实现的BOF加载器
https://github.com/praetorian-inc/goffloader
NtDumpBOF：Native Dump凭据转储工具的BOF版本
https://github.com/deh00ni/NtDumpBOF
remote_wrapper：可扩展的Mythic包装器，允许远程封装载荷
https://github.com/Flangvik/remote_wrapper
从“Potatoes”说起，Windows权限提升的10年发展
https://www.youtube.com/watch?v=rPZx1zbKJnI
为何内核级ETW是最好的，揭秘未公开日志结构
https://www.elastic.co/security-labs/kernel-etw-best-etw
漏洞相关
CVE-2024-38014：Windows MSI安装器SYTEM权限提升漏洞
https://sec-consult.com/blog/detail/msi-installer-repair-to-system-a-detailed-journey/
msiscan：扫描MSI安装包中的本地权限提升漏洞
https://github.com/sec-consult/msiscan
MSI文件的漏洞挖掘与滥用分析
https://cicada-8.medium.com/evil-msi-a-long-story-about-vulnerabilities-in-msi-files-1a2a1acaf01c
CVE-2024-26230：Windows telephony 服务UAF本地提权漏洞EXP
https://github.com/Wa1nut4/CVE-2024-26230
CVE-2024-30051：Windows DWM核心库权限提升漏洞分析
https://www.coresecurity.com/core-labs/articles/windows-dwm-core-library-elevation-privilege-vulnerability-cve-2024-30051
低完整性权限下利用CVE-2021-31956 Windows 内核堆溢出漏洞
https://3sjay.github.io/2024/09/08/Windows-Kernel-Pool-Exploitation-CVE-2021-31956-Part1.html
CVE-2024-41498：IOMap64.sys 物理内存读写漏洞
https://blog.reveng.ai/physmem-e-when-kernel-drivers-peek-into-memory/
CVE-2024–27394：分析TCP-AO UAF漏洞，深入研究RCU条件竞争
https://blog.theori.io/deep-dive-into-rcu-race-condition-analysis-of-tcp-ao-uaf-cve-2024-27394-f40508b84c42
CVE-2024-40711：Veeam Backup & Replication 认证/未认证 RCE漏洞分析
https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/
CVE-2023-27532：Veeam Backup & Replication 身份认证绕过漏洞细节批漏
https://blog.scrt.ch/2024/09/10/getting-code-execution-on-veeam-through-cve-2023-27532
CVE-2024-5274：Chrome V8 JavaScript解析器越界读写漏洞分析
https://www.darknavy.org/blog/cve_2024_5274_a_minor_flaw_in_v8_parser_leading_to_catastrophes/
COMThanasia：COM漏洞挖掘分析辅助套件
https://github.com/CICADA8-Research/COMThanasia
使用Angr挖掘现实目标的漏洞
https://plowsec.github.io/angr-introspection-2024.html
云安全
Microsoft Intune如何被滥用于混合身份环境中的横向移动
https://securityintelligence.com/x-force/detecting-intune-lateral-movement/
利用错误配置的 GitLab OIDC AWS IAM 角色
https://hackingthe.cloud/aws/exploitation/Misconfigured_Resource-Based_Policies/exploiting_misconfigured_gitlab_oidc_aws_iam_roles/
人工智能和安全
OpenAI发布o1系统新模型，基于思维链的强化学习使模型具备自我矫正能力
https://openai.com/index/introducing-openai-o1-preview/
https://openai.com/index/learning-to-reason-with-llms/
https://cdn.openai.com/openai-preparedness-framework-beta.pdf
提高大型语言模型安全性的分步指南
https://cloudsecurityalliance.org/blog/2024/09/10/a-step-by-step-guide-to-improving-large-language-model-security
针对LLM进行红队测试的综合指南
https://www.aporia.com/learn/red-teaming-large-language-models/
基于LLM的边缘智能：架构、应用、安全的综合调查
https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=10669603
探索LLM用于恶意软件检测
https://arxiv.org/pdf/2409.07587
其他
Chrome浏览器常见攻击方式与检测日志源
https://trustedsec.com/blog/when-on-workstation-do-as-the-local-browsers-do
edr-artifacts：收集EDR产品网络与主机工件信息，帮助搜寻潜在滥用
https://github.com/cbecks2/edr-artifacts
M01N Team公众号
聚焦高级攻防对抗热点技术
绿盟科技蓝军技术研究战队
官方攻防交流群
网络安全一手资讯
攻防技术答疑解惑
扫码加好友即可拉群
往期推荐
