【知识】5月4日 - 每日安全知识热点

热点概要：WordPress Core <= 4.7.4全版本密码重置漏洞(0day)、WordPress <4.7.1 远程代码执行漏洞（非插件无需认证，附Poc,演示视频）、Pwning PHP mail() function For Fun And RCE 、bug bounty – 绕过限制劫持Skype账号、PHPCMS V9.6.1 任意文件读取漏洞分析（含PoC，已有补丁）

资讯类：

---

不要轻易点击您刚刚收到您的电子邮件中的Google文档链接，防止钓鱼

http://thehackernews.com/2017/05/google-docs-phishing-email.html

技术类：

---

WordPress Core <= 4.7.4全版本密码重置漏洞(0day)

https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html

WordPress <4.7.1 远程代码执行漏洞（非插件无需认证，附Poc,演示视频）

https://exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html

Pwning PHP mail() function For Fun And RCE

https://exploitbox.io/paper/Pwning-PHP-Mail-Function-For-Fun-And-RCE.html

为什么mail函数在php中是危险的？

https://www.ripstech.com/blog/2017/why-mail-is-dangerous-in-php/

bug bounty – 绕过限制劫持Skype账号

http://blog.csdn.net/u011721501/article/details/71107858

Mirai, BrickerBot, Hajime攻击一个共同的IoT设备

https://securingtomorrow.mcafee.com/mcafee-labs/mirai-brickerbot-hajime-attack-common-iot-weakness

Reverse Engineering of Xbox Security Method 3

http://oct0xor.github.io/2017/05/03/xsm3/

针对KONNI恶意软件的分析

http://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html

CVE-2017-0563：Google Nexus 9 Cypress传感器固件可以通过I2C总线的方式注入

https://alephsecurity.com/vulns/aleph-2017009

通过Task Scheduler绕过UAC

https://pentestlab.blog/2017/05/03/uac-bypass-task-scheduler/

GDB 插件pwndbg

https://github.com/pwndbg/pwndbg

PHPCMS V9.6.1 任意文件读取漏洞分析（含PoC，已有补丁）

http://bobao.360.cn/learning/detail/3805.html

Fastjson Unserialize Vulnerability Write Up

https://ricterz.me/posts/Fastjson%20Unserialize%20Vulnerability%20Write%20Up

The slides of BFH2017 漏洞分析与利用培训课程 PPT

https://exploit.courses/files/bfh2017/content.html