If the parameters are located in the places of enabledFeatures and indicatorsFile, then the second possibility is that the JS files are loaded remotely in HTML (these remotely loaded JS files are like the libraries we import in Python. When we need the results of certain functions, we can use them).
@Mikelaotoo
@Mikelaotoo
How to Upgrade DOM XSS to a Complex One-Click Account Takeover Attack for $8,000
In the eighth step of the login process, the value of the parameter next will be placed in the target attribute, and then the client-side JavaScript will use this attribute to redirect the webpage.
@Mikelaotoo
In the eighth step of the login process, the value of the parameter next will be placed in the target attribute, and then the client-side JavaScript will use this attribute to redirect the webpage.
@Mikelaotoo
CVE-2023-42820: User takeover vulnerability caused by the leakage of pseudo-random number seeds
The django-simple-captcha library and Django reCAPTCHA are arguably the only two commonly used captcha generation libraries in the Django ecosystem. However, since Chinese users cannot use reCAPTCHA, it has essentially become the only choice in China. Even my own blog uses it as a dependency for graphic captchas.
@Mikelaotoo
The django-simple-captcha library and Django reCAPTCHA are arguably the only two commonly used captcha generation libraries in the Django ecosystem. However, since Chinese users cannot use reCAPTCHA, it has essentially become the only choice in China. Even my own blog uses it as a dependency for graphic captchas.
@Mikelaotoo
According to SdCheck + 0x490c2, the function CSdCommonImpl::QueryStorageDevice is located in IDA, and the address is where this function calls QueryStorageDevice.
After patch comparison, the function IsWritable was found. This function was modified and is called by QueryStorageDevice.
@Mikelaotoo
After patch comparison, the function IsWritable was found. This function was modified and is called by QueryStorageDevice.
@Mikelaotoo
The quality of the second level has improved dramatically. We simply ignore the empty numbers and downtime, and the active connection rate is around 40%. The accuracy has increased to about 90%.
@Mikelaotoo
@Mikelaotoo
This is really a problem with Bitmap decompression. After I replaced the Bitmap decompression code with rdesktop's C code, all these issues were resolved. Then, I had to check line by line the differences in the Bitmap decompression code between rdesktop and grdp. This was a very frustrating process. Firstly, rdesktop is written in C, and there are huge differences in data structures and code logic between it and Go. I was so confused that I only found these two bugs after a lot of effort:
The decompressed Bitmap data stream was reversed every two bytes, which led to color distortion.
@Mikelaotoo
The decompressed Bitmap data stream was reversed every two bytes, which led to color distortion.
@Mikelaotoo
After successfully implementing the protocol, the first problem we encountered was that the final images had black borders. This might not seem like a big deal at first glance, but it really affected the viewing experience. It's like finding a fly in a delicious bowl of soup while eating:
At first, I thought it was a problem with Bitmap decompression, but after testing, even using rdesktop's Bitmap decompression code directly, the issue persisted. Then, after a lengthy packet-by-packet analysis, I suspected that it was caused by not responding to certain PDU events after successfully implementing the RDP protocol. So I spent a long time reading rdesktop's code to understand the purpose of each event, such as Point, Order, etc. Eventually, I found that on the target machine (Windows 2000), all events had no impact on image display, and the problem remained unsolved at this point.
@Mikelaotoo
At first, I thought it was a problem with Bitmap decompression, but after testing, even using rdesktop's Bitmap decompression code directly, the issue persisted. Then, after a lengthy packet-by-packet analysis, I suspected that it was caused by not responding to certain PDU events after successfully implementing the RDP protocol. So I spent a long time reading rdesktop's code to understand the purpose of each event, such as Point, Order, etc. Eventually, I found that on the target machine (Windows 2000), all events had no impact on image display, and the problem remained unsolved at this point.
@Mikelaotoo
The Licensing phase is the most challenging part of the entire research process. It took me almost four days and I was on the verge of giving up. In the tomatome/grdp project, the interaction regarding Licensing was completely wrong (PS: I didn't initially think about this aspect at all, because other versions of the RDP protocol could successfully proceed. Later, I found that those that succeeded didn't even enter the Licensing interaction stage and went directly to the next stage). Moreover, the official document [MS-RDPBCGR] provides very limited information about the Licensing interaction. Later, I learned that there is a dedicated document for Licensing interaction: [MS-RDPELE]. Only by referring to this document can we finally complete the entire process of Licensing interaction.
@Mikelaotoo
@Mikelaotoo
When the F5 Java servlet processes the incoming POST request (in the doGet method of com.f5.controller), it handles a request constructed from smuggled AJP messages. One of these AJP attributes is "remote_user", which is directly encoded in the AJP request. This attribute is set to "admin", so the call to "request.getRemoteUser()" in Figure (the second highlight) returns "admin".
@Mikelaotoo
@Mikelaotoo
UltraEdit，这款代码编辑器功能还是很强大的，支持可以配置实现FTP连接、SSH、Telnet来处理服务器端的代码。不过，这款编辑器不是免费的，我们需要付费购买。不过市面上有一些所谓的免费版本、破解绿色版本，我们可以试试，但是建议不要作为生产环境。
ICECode 编辑器支持PHP、C、C#等代码。这个编辑器是Chrome浏览器的插件，是不是很意外。如果我们有需要使用的可以安装在浏览器的插件上，算是比较轻便。
@Mikelaotoo
ICECode 编辑器支持PHP、C、C#等代码。这个编辑器是Chrome浏览器的插件，是不是很意外。如果我们有需要使用的可以安装在浏览器的插件上，算是比较轻便。
@Mikelaotoo
❤1
使用AES算法加密文件，删除系统日志
LockerGoga以参数-m启动后，会遍历文件，收集文件列表信息，然后以参数-i SM-originalname -s 创建自身子进程，使用子进程进行加密。其中SM-originalname为共享内存命名，本例中为SM- tgytutrc，样本通过创建共享内存的方式，从父进程向子进程传递要加密的文件路径。
咨询：@Mikelaotoo
LockerGoga以参数-m启动后，会遍历文件，收集文件列表信息，然后以参数-i SM-originalname -s 创建自身子进程，使用子进程进行加密。其中SM-originalname为共享内存命名，本例中为SM- tgytutrc，样本通过创建共享内存的方式，从父进程向子进程传递要加密的文件路径。
咨询：@Mikelaotoo