{"title":"Uknow - Stay hungry Stay foolish","link":[{"@attributes":{"href":"\/atom.xml","rel":"self"}},{"@attributes":{"href":"https:\/\/uknowsec.cn\/"}}],"updated":"2024-01-17T15:38:44.133Z","id":"https:\/\/uknowsec.cn\/","author":{"name":"uknow"},"generator":"Hexo","entry":[{"title":"cobaltstrike\u6a21\u5757\u529f\u80fd\u4fee\u6539\u8fc7360\u6838\u6676","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/cobaltstrike%E6%A8%A1%E5%9D%97%E5%8A%9F%E8%83%BD%E4%BF%AE%E6%94%B9%E8%BF%87360%E6%A0%B8%E6%99%B6.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/cobaltstrike\u6a21\u5757\u529f\u80fd\u4fee\u6539\u8fc7360\u6838\u6676.html","published":"2021-12-29T16:17:17.000Z","updated":"2024-01-17T15:38:44.133Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <p>\u4f17\u6240\u5468\u77e5\uff0cCobalt Strike\u7684\u4e00\u4e9b\u529f\u80fd\u6a21\u5757\u90fd\u662f\u7528spawn\u7684\u65b9\u6cd5\u5b9e\u73b0\uff0c\u5176\u539f\u7406\u5c31\u662f\u542f\u52a8\u4e00\u4e2a\u8fdb\u7a0b\uff0c\u7136\u540e\u5bf9\u8be5\u8fdb\u7a0b\u8fdb\u884c\u529f\u80fd\u6a21\u5757dll\u53cd\u5c04\u6ce8\u5165\uff0c\u9ed8\u8ba4profile\u4e0b\u662f\u542f\u52a8rundll32.exe\u8fd9\u4e2a\u8fdb\u7a0b\uff0c\u8fd9\u79cd\u884c\u4e3a\u5728\u6570\u5b57\u7684\u6838\u6676\u6a21\u5f0f\u4e0b\u662f\u4f1a\u88ab\u62e6\u622a\u7684\u3002\u524d\u4e24\u5929\u521a\u597d\u5728\u5410\u53f8\u770b\u5230\u4e00\u7bc7\u6587\u7ae0\u6709\u8bb2\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"\u975e\u7ea6\u675f\u59d4\u6d3e + Kerberos\u4e2d\u7ee7","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/%E9%9D%9E%E7%BA%A6%E6%9D%9F%E5%A7%94%E6%B4%BE%20+%20Kerberos%E4%B8%AD%E7%BB%A7.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/\u975e\u7ea6\u675f\u59d4\u6d3e + Kerberos\u4e2d\u7ee7.html","published":"2021-11-29T16:17:17.000Z","updated":"2024-01-17T15:47:51.257Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"0x00-\u524d\u8a00\">0x00 \u524d\u8a00<\/span><\/h3><p>\u672c\u6587\u5c06\u4ece\u4e24\u4e2a\u573a\u666f\u9610\u8ff0\u3010\u975e\u7ea6\u675f\u59d4\u6d3e + Kerberos \u4e2d\u7ee7\u3011\u7684\u7ec4\u5408\u4f7f\u7528\u3002<\/p>\n<p>\u4e24\u4e2a\u573a\u666f\u4e2d\uff0c\u653b\u51fb\u673a\u5747\u5728\u57df\u5916\uff08\u540c\u5185\u7f51\uff09<\/p>\n<h3><span id=\"0x01-\u5b9e\u6218\u573a\u666f\u4e00\u62e5\u6709\u5df2\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"\u57fa\u4e8e\u8d44\u6e90\u7684\u7ea6\u675f\u59d4\u6d3e","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/%E5%9F%BA%E4%BA%8E%E8%B5%84%E6%BA%90%E7%9A%84%E7%BA%A6%E6%9D%9F%E5%A7%94%E6%B4%BE.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/\u57fa\u4e8e\u8d44\u6e90\u7684\u7ea6\u675f\u59d4\u6d3e.html","published":"2021-08-29T16:17:17.000Z","updated":"2024-01-17T15:48:01.208Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"0x00-\u524d\u8a00\">0x00 \u524d\u8a00<\/span><\/h3><p><strong>\u57fa\u4e8e\u8d44\u6e90\u7684\u7ea6\u675f\u59d4\u6d3e(RBCD)<\/strong>\u662f\u5728 Windows Server 2012 \u4e2d\u65b0\u52a0\u5165\u7684\u529f\u80fd\uff0c\u4e0e\u4f20\u7edf\u7684\u7ea6\u675f\u59d4\u6d3e\u76f8\u6bd4\uff0c\u5b83\u4e0d\u518d\u9700\u8981\u57df\u7ba1\u7406\u5458\u6743\u9650\u53bb\u8bbe\u7f6e\u76f8\u5173\u5c5e\u6027\u3002RB\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"FRP\u6539\u9020\u8ba1\u5212\u7eed","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/FRP%E6%94%B9%E9%80%A0%E8%AE%A1%E5%88%92%E7%BB%AD.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/FRP\u6539\u9020\u8ba1\u5212\u7eed.html","published":"2020-12-29T16:17:17.000Z","updated":"2020-12-31T08:30:22.919Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u524d\u8a00\">\u524d\u8a00<\/span><\/h3><p>\u4e4b\u524d@Wfox\u5e08\u5085\u5728\u7fa4\u91cc\u63d0\u5230\u201c\u901a\u8fc7websocket\u534f\u8bae\u8ba9FRP\u7528\u4e0a\u57df\u524d\u7f6e\uff0c\u53ef\u4ee5\u9690\u85cf\u771f\u5b9e\u670d\u52a1ip\u5730\u5740\u201d\u3002\u6700\u8fd1\u6ca1\u6709\u9879\u76ee\uff0c\u91cd\u65b0\u8fdb\u884c\u4e00\u4e0bfrp\u6539\u9020\u8ba1\u5212\u3002<\/p>\n<h3><span id=\"\u53ef\u884c\u6027\u8bc1\u660e\">\u53ef\u884c\u6027\u8bc1\u660e<\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"OXID_Find\uff1a\u901a\u8fc7OXID\u89e3\u6790\u5668\u83b7\u53d6Windows\u8fdc\u7a0b\u4e3b\u673a\u4e0a\u7f51\u5361\u5730\u5740","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/OXID_Find%EF%BC%9A%E9%80%9A%E8%BF%87OXID%E8%A7%A3%E6%9E%90%E5%99%A8%E8%8E%B7%E5%8F%96Windows%E8%BF%9C%E7%A8%8B%E4%B8%BB%E6%9C%BA%E4%B8%8A%E7%BD%91%E5%8D%A1%E5%9C%B0%E5%9D%80.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/OXID_Find\uff1a\u901a\u8fc7OXID\u89e3\u6790\u5668\u83b7\u53d6Windows\u8fdc\u7a0b\u4e3b\u673a\u4e0a\u7f51\u5361\u5730\u5740.html","published":"2020-07-19T11:17:17.000Z","updated":"2020-07-19T11:24:29.708Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u6570\u636e\u89e3\u6790\u8fc7\u7a0b\">\u6570\u636e\u89e3\u6790\u8fc7\u7a0b<\/span><\/h3><p>\u89c4\u5f8b\uff1a<\/p>\n<ul>\n<li>\u6bcf\u4e00\u4e2aString Binding\u90fd\u4ee5<code>\\x07\\x00<\/code>\u5f00\u5934\u3002<\/li>\n<li>\u6bcf\u4e00\u4e2aStringBinding\u90fd\u4ee5<code>\\x0\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"frsocks+protoplex+\u6d41\u91cf\u91cd\u5b9a\u5411\u5b9e\u73b0\u7aef\u53e3\u590d\u7528","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/frsocks+protoplex+%E6%B5%81%E9%87%8F%E9%87%8D%E5%AE%9A%E5%90%91%E5%AE%9E%E7%8E%B0%E7%AB%AF%E5%8F%A3%E5%A4%8D%E7%94%A8.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/frsocks+protoplex+\u6d41\u91cf\u91cd\u5b9a\u5411\u5b9e\u73b0\u7aef\u53e3\u590d\u7528.html","published":"2020-07-16T11:17:17.000Z","updated":"2020-07-16T15:27:23.643Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u524d\u8a00\">\u524d\u8a00<\/span><\/h3><p>\u524d\u6bb5\u65e5\u5b50<code>A-team<\/code>\u7fa4\u91cc\u7684\u5e08\u5085<code>sunshine<\/code>\uff0c\u8bb2\u5230\u4e86\u4e00\u4e2a\u7aef\u53e3\u590d\u7528\u7684\u65b9\u6848\uff0c\u5e76\u53d1\u4e86\u51e0\u4e2a\u5de5\u5177\uff0c\u8fd9\u91cc\u7b80\u5355\u8bb0\u5f55\u5b9e\u8df5\u4e00\u4e0b\u3002<\/p>\n<h3><span id=\"frso\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"\u5229\u7528ReflectiveDLL\u6765\u6b66\u88c5\u4f60\u7684Cobalt Strike","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/%E5%88%A9%E7%94%A8ReflectiveDLL%E6%9D%A5%E6%AD%A6%E8%A3%85%E4%BD%A0%E7%9A%84Cobalt%20Strike.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/\u5229\u7528ReflectiveDLL\u6765\u6b66\u88c5\u4f60\u7684Cobalt Strike.html","published":"2020-07-06T19:17:17.000Z","updated":"2020-07-08T08:25:49.143Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u524d\u8a00\">\u524d\u8a00<\/span><\/h3><p>Cobalt Strike\u5df2\u7ecf\u6210\u4e86\u76ee\u524d\u5de5\u4f5c\u4e2d\u7ecf\u5e38\u7528\u6e17\u900f\u5de5\u5177\u4e86\uff0c\u901a\u5e38\u6211\u4eec\u4f1a\u901a\u8fc7\u5199\u4e00\u4e0b\u63d2\u4ef6\u6765\u6b66\u88c5\u81ea\u5df1\u7684Cobalt Strike\uff0c\u6bd4\u5982\u6211\u4eec\u4f1a\u7528<code>bexecute_assembly<\/code>\u6765\u5bf9\u81ea\u5df1\u7f16\u5199\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"FRP\u6539\u9020\u8ba1\u5212","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/FRP%E6%94%B9%E9%80%A0%E8%AE%A1%E5%88%92.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/FRP\u6539\u9020\u8ba1\u5212.html","published":"2020-06-20T19:17:17.000Z","updated":"2020-06-21T04:04:47.268Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u524d\u8a00\">\u524d\u8a00<\/span><\/h3><p>frp\u65e0\u7591\u662f\u4f17\u591a\u4ee3\u7406\u5de5\u5177\u4e2d\uff0c\u7528\u5f97\u6700\u8212\u670d\u7684\u4e86\u3002\u4f46\u662f\u4ed6\u8fd8\u662f\u5b58\u5728\u51e0\u4e2a\u7f3a\u70b9\u7684\u3002<\/p>\n<ul>\n<li>.ini\u914d\u7f6e\u6587\u4ef6\u6cc4\u9732\u670d\u52a1\u5668\u4fe1\u606f\u3002<\/li>\n<li><p>\u975eTLS\u7279\u5f81\u660e\u663e<\/p>\n<\/li>\n<li><p>g\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"\u8f93\u5165\u8868\u6ce8\u5165","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/%E8%BE%93%E5%85%A5%E8%A1%A8%E6%B3%A8%E5%85%A5.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/\u8f93\u5165\u8868\u6ce8\u5165.html","published":"2020-06-12T19:17:17.000Z","updated":"2020-06-12T19:06:40.838Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u524d\u8a00\">\u524d\u8a00<\/span><\/h3><p>\u200b      \u4e0a\u7bc7\u6ca1\u6709\u8bb2\u62ff\u7834\u8f6e\u80ce\u5927\u4f6c\u5de5\u5177\u7684\u539f\u7406\uff0c\u540c\u65f6\u5de5\u5177\u751f\u6210\u7684DLL\u76ee\u524d\u4e0d\u662f\u514d\u6740\u7684\u3002\u6240\u4ee5\u8fd9\u91cc\u8bb2\u4e00\u4e0b\u5de5\u5177\u7684\u539f\u7406\u3002\u5b9e\u9645\u4e0a\uff0c\u6ce8\u5165\u5de5\u5177\u4f1a\u5c06\u8f93\u5165\u7684shellcode\u8fdb\u884c\u4e00\u4e2a\u5904\u7406\uff0c\u7136\u540e\u5c06\u4ed6\u5199\u5165\u5230\u548c<code>conf.in\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"DLL\u52ab\u6301+\u91cd\u65b0\u5236\u4f5c\u5b89\u88c5\u5305\u5728\u9493\u9c7c\u4e0e\u53cd\u9493\u9c7c\u7684\u5229\u7528","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/DLL%E5%8A%AB%E6%8C%81+%E9%87%8D%E6%96%B0%E5%88%B6%E4%BD%9C%E5%AE%89%E8%A3%85%E5%8C%85%E5%9C%A8%E9%92%93%E9%B1%BC%E4%B8%8E%E5%8F%8D%E9%92%93%E9%B1%BC%E7%9A%84%E5%88%A9%E7%94%A8.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/DLL\u52ab\u6301+\u91cd\u65b0\u5236\u4f5c\u5b89\u88c5\u5305\u5728\u9493\u9c7c\u4e0e\u53cd\u9493\u9c7c\u7684\u5229\u7528.html","published":"2020-06-11T14:17:17.000Z","updated":"2020-06-11T10:19:09.322Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u524d\u8a00\">\u524d\u8a00<\/span><\/h3><p>\u5728\u7ea2\u961f\u5de5\u4f5c\u4e2d\uff0c\u793e\u5de5\u9493\u9c7c\u4f1a\u662f\u6700\u5e38\u89c1\u7684\u653b\u51fb\u624b\u6bb5\uff0c\u540c\u6837\u84dd\u961f\u5de5\u4f5c\u4e2d\uff0c\u84dd\u961f\u53ef\u4ee5\u901a\u8fc7\u53cd\u5236\u7ea2\u961f\u83b7\u53d6\u52a0\u5206\u3002\u6240\u4ee5\u672c\u6587\u5c31\u7b80\u5355\u8bf4DLL\u52ab\u6301+\u91cd\u5236\u5b89\u88c5\u5305\u5728\u9493\u9c7c\u4e0e\u53cd\u9493\u9c7c\u4e2d\u7684\u5229\u7528\u3002<\/p>\n<h3><span id=\"\u9493\u9c7c\u4e2d\u7684\u5229\u7528\">\u9493\u9c7c\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"ShellCode\u8fdc\u7a0b\u52a0\u8f7d\u5668\u6539\u9020\u8ba1\u5212","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/ShellCode%E8%BF%9C%E7%A8%8B%E5%8A%A0%E8%BD%BD%E5%99%A8%E6%94%B9%E9%80%A0%E8%AE%A1%E5%88%92.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/ShellCode\u8fdc\u7a0b\u52a0\u8f7d\u5668\u6539\u9020\u8ba1\u5212.html","published":"2020-06-01T14:17:17.000Z","updated":"2020-06-10T15:13:06.761Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u524d\u8a00\">\u524d\u8a00<\/span><\/h3><p>shellcode\u52a0\u8f7d\u5668\u52a0\u8f7dshellcode\u5b9e\u73b0\u514d\u6740\u4e0a\u7ebf\uff0c\u76ee\u524d\u53ef\u80fd\u662f\u4f7f\u7528\u6700\u591a\u7684\u65b9\u6cd5\u4e86\u3002<\/p>\n<p>\u73b0\u6709\u7684\u52a0\u8f7d\u5668\u4e5f\u7279\u522b\u591a\uff0c\u4f46\u662f\u6539\u9020\u8f6e\u5b50\u7684\u5fc3\u603b\u662f\u5728\u9a9a\u52a8\uff0c\u6240\u4ee5\u5c31\u5f00\u59cb\u4e86Shellcode\u8fdc\u7a0b\u52a0\u8f7d\u5668\u6539\u9020\u8ba1\u5212\u3002<\/p\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"SweetPotato webshell\u4e0b\u6267\u884c\u547d\u4ee4\u7248","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/SweetPotato%20Webshell%E4%B8%8B%E6%89%A7%E8%A1%8C%E5%91%BD%E4%BB%A4%E7%89%88.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/SweetPotato Webshell\u4e0b\u6267\u884c\u547d\u4ee4\u7248.html","published":"2020-04-17T10:09:17.000Z","updated":"2020-04-17T13:29:50.647Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h2><span id=\"sweetpotato-webshell\u4e0b\u6267\u884c\u547d\u4ee4\u7248\">SweetPotato webshell\u4e0b\u6267\u884c\u547d\u4ee4\u7248<\/span><\/h2><h3><span id=\"\u524d\u8a00\">\u524d\u8a00<\/span><\/h3><p>\u524d\u4e24\u5929\u770b\u5230\u4e86github\u4e0a\u6709\u8001\u5916\u53d1\u4e86\u4e00\u4e2aC#\u7248\u7684\u70c2\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"DLL\u52ab\u6301\u53f3\u952e\u83dc\u5355\u5b9e\u73b0\u6301\u4e45\u5316","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/DLL%E5%8A%AB%E6%8C%81%E5%8F%B3%E9%94%AE%E8%8F%9C%E5%8D%95%E5%AE%9E%E7%8E%B0%E6%8C%81%E4%B9%85%E5%8C%96.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/DLL\u52ab\u6301\u53f3\u952e\u83dc\u5355\u5b9e\u73b0\u6301\u4e45\u5316.html","published":"2020-04-13T10:09:17.000Z","updated":"2020-04-13T12:36:00.600Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"dll\u4ee3\u7406\">DLL\u4ee3\u7406<\/span><\/h3><p>\u5982\u4e0b\u56fe\uff0cDLL\u4ee3\u7406\u662f\u901a\u8fc7\u521b\u5efa\u4e00\u4e2a\u6076\u610f\u7684DLL\u6765\u66ff\u6362\u539f\u6709\u7a0b\u5e8f\u7684DLL\uff0c\u540c\u65f6\u4e0d\u5220\u9664\u539f\u6709\u7a0b\u5e8f\u7684DLL\uff0c\u5c06\u5176\u91cd\u547d\u540d\u3002\u6076\u610f\u7684DLL\u5728\u88ab\u8c03\u7528\u7684\u65f6\u5019\u4f1a\u8fd0\u884c\u6076\u610f\u7684\u4ee3\u7801\u529f\u80fd\uff0c\u5e76\u628a\u539f\u6709\u7684DLL\u529f\u80fd\u90e8\u5206\u8f6c\u53d1\u7ed9\u539f\u59cbDLL\uff0c\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"\u52a0\u8f7d\u8fdc\u7a0bXSL\u6587\u4ef6\u7684\u5b8f\u514d\u6740\u65b9\u6cd5","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/%E5%8A%A0%E8%BD%BD%E8%BF%9C%E7%A8%8BXSL%E6%96%87%E4%BB%B6%E7%9A%84%E5%AE%8F%E5%85%8D%E6%9D%80%E6%96%B9%E6%B3%95.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/\u52a0\u8f7d\u8fdc\u7a0bXSL\u6587\u4ef6\u7684\u5b8f\u514d\u6740\u65b9\u6cd5.html","published":"2020-03-21T10:09:17.000Z","updated":"2020-03-22T03:39:28.505Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u524d\u8a00\">\u524d\u8a00<\/span><\/h3><p>\u200b        \u201c\u6253\u70b9\u8d8a\u6765\u8d8a\u96be\u4e86\uff0c\u793e\u5de5\u9493\u9c7c\u4f1a\u662f\u6700\u5e38\u89c1\u7684\u653b\u51fb\u624b\u6bb5\uff0c0day\u4f1a\u662f\u6700\u6709\u6548\u7684\u653b\u51fb\u624b\u6bb5\uff0c\u7269\u7406\u6e17\u900f\u4f1a\u662f\u5371\u5bb3\u6700\u5927\u7684\u653b\u51fb\u624b\u6bb5\u201c\u3002<\/p>\n<p>\u5728\u9493\u9c7c\u653b\u51fb\u4e2d\u6728\u9a6c\u7684\u5f62\u5f0f\u4e3b\u8981\u5982\u4e0b\uff1a<\/p>\n<ul>\n<li><p\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"frida-hook\u5de5\u5177\u7bc7","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/frida-hook%E5%B7%A5%E5%85%B7%E7%AF%87.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/frida-hook\u5de5\u5177\u7bc7.html","published":"2020-02-06T10:09:17.000Z","updated":"2020-02-06T10:15:02.224Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h2><span id=\"brida\">Brida<\/span><\/h2><h3><span id=\"brida\u7b80\u4ecb\">Brida\u7b80\u4ecb<\/span><\/h3><p>Brida\u662fBurpSuite\u7684\u4e00\u4e2a\u63d2\u4ef6\uff0c\u5b83\u53ef\u4ee5\u5c06Burp\u548cFrida\u7ed3\u5408\u8d77\u6765\u4f7f\u7528\uff0c\u53ef\u4ee5\u5728 BurpSuite\u4e2d\u76f4\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"frida-hook\u5b9e\u6218\u4e8c","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/frida-hook%E5%AE%9E%E6%88%98%E4%BA%8C.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/frida-hook\u5b9e\u6218\u4e8c.html","published":"2020-01-07T15:38:13.000Z","updated":"2020-01-07T15:39:13.265Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"traceviewfrida\">Traceview+frida<\/span><\/h3><p>TraceView \u662f Android SDK \u4e2d\u5185\u7f6e\u7684\u4e00\u4e2a\u5de5\u5177\uff0c\u5b83\u53ef\u4ee5\u52a0\u8f7d <strong>trace<\/strong> \u6587\u4ef6\uff0c\u7528\u56fe\u5f62\u7684\u5f62\u5f0f\u5c55\u793a<strong\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"frida-Hook\u5b9e\u6218\u4e00","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/frida-Hook%E5%AE%9E%E6%88%98%E4%B8%80.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/frida-Hook\u5b9e\u6218\u4e00.html","published":"2019-12-23T12:00:04.000Z","updated":"2019-12-23T12:00:55.899Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u90bb\u5c45\u5408\u4f19\u4ebahook\">\u90bb\u5c45\u5408\u4f19\u4ebaHook<\/span><\/h3><p>\u5bf9\u90bb\u5c45\u5408\u4f19\u4ebaAPP\u767b\u5f55sign\u7b7e\u540d\u7b97\u6cd5\u7684hook\u3002<\/p>\n<p><img src=\"https:\/\/uknowsec-1251971873.cos.ap-shanghai.myqc\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"frida-Java\u5c42\u4ee3\u7801Hook","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/frida-Java%E5%B1%82%E4%BB%A3%E7%A0%81Hook.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/frida-Java\u5c42\u4ee3\u7801Hook.html","published":"2019-12-06T02:37:05.000Z","updated":"2019-12-06T02:47:25.684Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"hook\u6784\u9020\u65b9\u6cd5\">Hook\u6784\u9020\u65b9\u6cd5<\/span><\/h3><p>\u8981hook\u7684\u662f\u4e00\u4e2a\u7c7b\u7684\u6784\u9020\u51fd\u6570<\/p>\n<figure class=\"highlight java\"><table><tr><td class=\"gutter\"><pre><span c\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"frida-\u5b89\u88c5\u914d\u7f6e","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/frida-%E5%AE%89%E8%A3%85%E9%85%8D%E7%BD%AE.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/frida-\u5b89\u88c5\u914d\u7f6e.html","published":"2019-12-06T02:35:37.000Z","updated":"2019-12-06T02:53:39.995Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"frida\u5b89\u88c5\">frida\u5b89\u88c5<\/span><\/h3><h4><span id=\"frida-12724-frida-tools-530\">frida-12.7.24\u3001frida-tools-5.3.0<\/span><\/h4><figure clas\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}},{"title":"\u57df\u6e17\u900f-\u57df\u7ef4\u6743","link":{"@attributes":{"href":"https:\/\/uknowsec.cn\/posts\/notes\/%E5%9F%9F%E6%B8%97%E9%80%8F-%E5%9F%9F%E7%BB%B4%E6%9D%83.html"}},"id":"https:\/\/uknowsec.cn\/posts\/notes\/\u57df\u6e17\u900f-\u57df\u7ef4\u6743.html","published":"2019-09-11T14:17:17.000Z","updated":"2019-09-11T15:41:19.350Z","content":{"@attributes":{"type":"html"}},"summary":"\n    \n      \n      \n        <h3><span id=\"\u9ec4\u91d1\u7968\u636e\">\u9ec4\u91d1\u7968\u636e<\/span><\/h3><h4><span id=\"\u7b80\u4ecb\">\u7b80\u4ecb<\/span><\/h4><p>Golden Ticket\uff08\u4e0b\u9762\u79f0\u4e3a\u91d1\u7968\uff09\u662f\u901a\u8fc7\u4f2a\u9020\u7684TGT\uff08TicketGranting Ticket\uff09\uff0c\u56e0\u4e3a\u53ea\u8981\u6709\u4e86\u9ad8\u6743\u9650\u7684TGT\uff0c\u90a3\n      \n    \n    ","category":{"@attributes":{"term":"\u7b14\u8bb0","scheme":"https:\/\/uknowsec.cn\/categories\/notes\/"}}}]}