https://blog.1sec.day/tags/%E6%A8%AA%E5%90%91%E7%A7%BB%E5%8A%A8/ Recent content in 横向移动 on 思安录 | Thinking's Security Notes Hugo -- gohugo.io zh-cn Thinking Thinking Tue, 15 Apr 2025 00:00:00 +0000 https://blog.1sec.day/posts/2025-04-15-cve-2025-52287-wsus-deserialize/ Tue, 15 Apr 2025 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2025-04-15-cve-2025-52287-wsus-deserialize/ <p>WSUS 把 SimpleAuth 插件的认证 Cookie 当作『已验证信任』，但生成 Cookie 的链路上没有强制反序列化保护——攻击者通过 4 阶段攻击（先获取会话 ID、拿认证 Cookie、用 Cookie 触发 SimpleAuth、注入恶意 .NET 反序列化 payload）就能在补丁分发中心拿下 RCE。</p> https://blog.1sec.day/posts/2025-02-23-lazarus-apt-attack/ Sun, 23 Feb 2025 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2025-02-23-lazarus-apt-attack/ <blockquote> <p>网络安全对抗是一场持久战。本文由我（Thinking）与山哥（23pds）联合撰写。</p> </blockquote> https://blog.1sec.day/posts/2022-10-04-cve-2022-41082-exchange-rce/ Tue, 04 Oct 2022 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2022-10-04-cve-2022-41082-exchange-rce/ <p>ProxyNotShell 攻击链的 SSRF 前置——CVE-2022-41082 单独存在时只让攻击者打 Exchange 的内部 PowerShell Remoting，但配合 CVE-2022-41040 直接变成全网 RCE。</p> https://blog.1sec.day/posts/2021-07-15-cve-2020-10770-keycloak-ssrf/ Wed, 18 Nov 2020 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2021-07-15-cve-2020-10770-keycloak-ssrf/ <p>仅仅一个 OIDC 参数——<code>request_uri</code>——就足以把 Keycloak 变成代理。在没有任何有效校验的情况下，攻击者控制的任何 URL 都会变成 Keycloak 替他发出的请求。</p> https://blog.1sec.day/posts/2016-11-15-cve-2016-3053-aix-privesc/ Tue, 15 Nov 2016 00:00:00 +0000 Thinking https://blog.1sec.day/posts/2016-11-15-cve-2016-3053-aix-privesc/ <p>IBM AIX 的 libc 在处理某些系统调用时，对调用者的身份校验存在缝隙——本地普通账户只要拿到这个缝隙，就能直接获得 root shell。</p>