ykrishhh/ou-hunt-report

# OU.edu 红队狩猎 对俄克拉荷马大学基础设施的一项全面安全评估，发现了 6 个已验证的漏洞，并附有可用的概念验证（PoC）漏洞利用。        ## 目录 - [视觉资源](#visual-assets) - [仓库结构](#repository-structure) - [发现结果](#findings) - [攻击链](#attack-chain) - [基础设施图](#infrastructure-map) - [发现严重程度](#findings-severity) - [仪表板](#dashboard) - [知识图谱 (Understand-Anything)](#knowledge-graph-understand-anything) - [图表](#diagrams) - [POC](#pocs) - [报告](#reports) - [使用的工具](#tools-used) - [许可证](#license) ## 视觉资源 静态 SVG（在 GitHub 网页端**和**移动应用上均可渲染——与 Mermaid 不同）： | 资源 | 预览 | |-------|---------| | 严重程度分类 |  | | 攻击链 |  | | 知识图谱 |  | ## 发现结果 | # | 发现 | 严重程度 | 目标 | |---|---------|----------|--------| | 1 | XST (TRACE 方法) | 高危 | www.ou.edu | | 2 | 电子邮件欺骗 | 高危 | ou.edu | | 3 | Exchange 主机名泄露 | 中危 | exchange.ou.edu | | 4 | BeyondTrust SAML 泄露 | 中危 | remote.ou.edu | | 5 | Drupal Cache-Tags 泄露 | 低危 | libraries.ou.edu | | 6 | Git 仓库存在 | 信息 | libraries.ou.edu | ## 攻击链 ``` graph TD A[Attacker] --> B[Exchange Hostname Disclosure] A --> C[BeyondTrust SAML Leak] A --> D[Drupal Cache-Tags Leak] B --> E[Identify Domain Controller] C --> F[Map SAML Federation] D --> G[Enumerate Internal IDs] E --> H[Exploit Phase] F --> H G --> H H --> I[Session Hijacking via XST] H --> J[Email Spoofing Attack] I --> K[Account Takeover] J --> L[Credential Theft] K --> M[AD Compromise] L --> M M --> N[Forest Compromise] ``` ## 基础设施图 ``` graph LR A[coe.ou.edu] -->|shares IP| B[www.ou.edu] C[exchange.ou.edu] --> D[sso.ou.edu] E[remote.ou.edu] --> D F[libraries.ou.edu] --> G[Pantent CDN] B --> H[F5 BIG-IP] C --> H ``` ## 发现严重程度 ``` graph TD A1[XST - TRACE Method] --> E[Impact] A2[Email Spoofing] --> E B1[Exchange Hostname] --> E B2[BeyondTrust SAML] --> E E --> F[Account Takeover] E --> G[Data Theft] E --> H[AD Compromise] style A1 fill:#ff4444 style A2 fill:#ff4444 style B1 fill:#ffaa00 style B2 fill:#ffaa00 ``` ## 仓库结构 ``` ou-hunt-report/ ├── README.md # This file ├── FINAL_COMBINED.md # Master findings report (entry point) ├── reports/ # Written reports │ ├── EXECUTIVE_SUMMARY.md │ ├── ATTACK_MATRIX.md │ ├── REMEDIATION_CHECKLIST.md │ ├── KNOWLEDGE_GRAPH.md │ ├── COMBINED_REPORT.md │ ├── EXPLOIT_REPORT.md │ ├── FINAL_REPORT.md │ ├── REPORT.md │ └── TEST_DIAGRAM.md ├── pocs/ # Proof-of-concept exploits │ ├── xst_poc.html │ ├── xst_poc.sh │ ├── email_spoof_poc.py │ └── beyondtrust_poc.md ├── diagrams/ # Mermaid source + interactive viewer │ ├── ATTACK_CHAIN.mmd │ ├── INFRASTRUCTURE.mmd │ ├── FINDINGS_SEVERITY.mmd │ └── DIAGRAMS.html ├── dashboard/ # Interactive visual dashboard │ └── DASHBOARD.html ├── assets/ # Portable SVG/PNG (render on app + web) │ ├── severity.svg / .png │ ├── attack-chain.svg / .png │ ├── knowledge-graph.svg / .png │ └── gen_assets.py └── understand/ # Understand-Anything knowledge graph ├── knowledge-graph.json ├── GRAPH.md └── gen_graph.py ``` ## 仪表板 打开 [`dashboard/DASHBOARD.html`](dashboard/DASHBOARD.html) 获取所有发现结果的交互式可视化概览。 **在线访问：** https://ykrishhh.github.io/ou-hunt-report/ （通过 GitHub Pages 部署） ## 知识图谱 (Understand-Anything) 此仓库的结构化知识图谱，使用 Understand-Anything 的 schema (`understand/knowledge-graph.json`) 生成。完整图谱见 [`understand/GRAPH.md`](understand/GRAPH.md)。 ``` graph TD concept_target_www_ou_edu["www.ou.edu"] concept_target_ou_edu["ou.edu"] concept_target_exchange_ou_edu["exchange.ou.edu"] concept_target_remote_ou_edu["remote.ou.edu"] concept_target_libraries_ou_edu["libraries.ou.edu"] concept_target_sso_ou_edu["sso.ou.edu"] concept_target_coe_ou_edu["coe.ou.edu"] concept_finding_XST_TRACE_Method["XST (TRACE Method)"] concept_finding_Email_Spoofing["Email Spoofing"] concept_finding_Exchange_Hostname_Disclosure["Exchange Hostname Disclosure"] concept_finding_BeyondTrust_SAML_Leak["BeyondTrust SAML Leak"] concept_finding_Drupal_CacheTags_Leak["Drupal Cache-Tags Leak"] concept_finding_Git_Repository_Existence["Git Repository Existence"] document_ATTACK_MATRIX_md["ATTACK_MATRIX.md"] document_COMBINED_REPORT_md["COMBINED_REPORT.md"] document_EXECUTIVE_SUMMARY_md["EXECUTIVE_SUMMARY.md"] document_EXPLOIT_REPORT_md["EXPLOIT_REPORT.md"] document_FINAL_COMBINED_md["FINAL_COMBINED.md"] document_FINAL_REPORT_md["FINAL_REPORT.md"] document_KNOWLEDGE_GRAPH_md["KNOWLEDGE_GRAPH.md"] document_REMEDIATION_CHECKLIST_md["REMEDIATION_CHECKLIST.md"] document_REPORT_md["REPORT.md"] document_TEST_DIAGRAM_md["TEST_DIAGRAM.md"] document_ATTACK_CHAIN_mmd["ATTACK_CHAIN.mmd"] document_DASHBOARD_html["DASHBOARD.html"] document_DIAGRAMS_html["DIAGRAMS.html"] document_FINDINGS_SEVERITY_mmd["FINDINGS_SEVERITY.mmd"] document_INFRASTRUCTURE_mmd["INFRASTRUCTURE.mmd"] document_email_spoof_poc_py["email_spoof_poc.py"] document_xst_poc_html["xst_poc.html"] document_xst_poc_sh["xst_poc.sh"] concept_target_www_ou_edu -->|exposes| concept_finding_XST_TRACE_Method concept_target_ou_edu -->|exposes| concept_finding_Email_Spoofing concept_target_exchange_ou_edu -->|exposes| concept_finding_Exchange_Hostname_Disclosure concept_target_remote_ou_edu -->|exposes| concept_finding_BeyondTrust_SAML_Leak concept_target_libraries_ou_edu -->|exposes| concept_finding_Drupal_CacheTags_Leak concept_target_libraries_ou_edu -->|exposes| concept_finding_Git_Repository_Existence document_ATTACK_MATRIX_md -->|documents| concept_finding_XST_TRACE_Method document_ATTACK_MATRIX_md -->|documents| concept_finding_Email_Spoofing document_ATTACK_MATRIX_md -->|documents| concept_finding_Exchange_Hostname_Disclosure document_ATTACK_MATRIX_md -->|documents| concept_finding_BeyondTrust_SAML_Leak document_ATTACK_MATRIX_md -->|documents| concept_finding_Drupal_CacheTags_Leak document_ATTACK_MATRIX_md -->|documents| concept_finding_Git_Repository_Existence document_COMBINED_REPORT_md -->|documents| concept_finding_XST_TRACE_Method document_COMBINED_REPORT_md -->|documents| concept_finding_Email_Spoofing document_COMBINED_REPORT_md -->|documents| concept_finding_Exchange_Hostname_Disclosure document_COMBINED_REPORT_md -->|documents| concept_finding_BeyondTrust_SAML_Leak document_COMBINED_REPORT_md -->|documents| concept_finding_Drupal_CacheTags_Leak document_COMBINED_REPORT_md -->|documents| concept_finding_Git_Repository_Existence document_EXECUTIVE_SUMMARY_md -->|documents| concept_finding_XST_TRACE_Method document_EXECUTIVE_SUMMARY_md -->|documents| concept_finding_Email_Spoofing document_EXECUTIVE_SUMMARY_md -->|documents| concept_finding_Exchange_Hostname_Disclosure document_EXECUTIVE_SUMMARY_md -->|documents| concept_finding_BeyondTrust_SAML_Leak document_EXECUTIVE_SUMMARY_md -->|documents| concept_finding_Drupal_CacheTags_Leak document_EXECUTIVE_SUMMARY_md -->|documents| concept_finding_Git_Repository_Existence document_EXPLOIT_REPORT_md -->|documents| concept_finding_XST_TRACE_Method document_EXPLOIT_REPORT_md -->|documents| concept_finding_Email_Spoofing document_EXPLOIT_REPORT_md -->|documents| concept_finding_Exchange_Hostname_Disclosure document_EXPLOIT_REPORT_md -->|documents| concept_finding_BeyondTrust_SAML_Leak document_EXPLOIT_REPORT_md -->|documents| concept_finding_Drupal_CacheTags_Leak document_EXPLOIT_REPORT_md -->|documents| concept_finding_Git_Repository_Existence document_FINAL_COMBINED_md -->|documents| concept_finding_XST_TRACE_Method document_FINAL_COMBINED_md -->|documents| concept_finding_Email_Spoofing document_FINAL_COMBINED_md -->|documents| concept_finding_Exchange_Hostname_Disclosure document_FINAL_COMBINED_md -->|documents| concept_finding_BeyondTrust_SAML_Leak document_FINAL_COMBINED_md -->|documents| concept_finding_Drupal_CacheTags_Leak document_FINAL_COMBINED_md -->|documents| concept_finding_Git_Repository_Existence document_FINAL_REPORT_md -->|documents| concept_finding_XST_TRACE_Method document_FINAL_REPORT_md -->|documents| concept_finding_Email_Spoofing document_FINAL_REPORT_md -->|documents| concept_finding_Exchange_Hostname_Disclosure document_FINAL_REPORT_md -->|documents| concept_finding_BeyondTrust_SAML_Leak document_FINAL_REPORT_md -->|documents| concept_finding_Drupal_CacheTags_Leak document_FINAL_REPORT_md -->|documents| concept_finding_Git_Repository_Existence document_KNOWLEDGE_GRAPH_md -->|documents| concept_finding_XST_TRACE_Method document_KNOWLEDGE_GRAPH_md -->|documents| concept_finding_Email_Spoofing document_KNOWLEDGE_GRAPH_md -->|documents| concept_finding_Exchange_Hostname_Disclosure document_KNOWLEDGE_GRAPH_md -->|documents| concept_finding_BeyondTrust_SAML_Leak document_KNOWLEDGE_GRAPH_md -->|documents| concept_finding_Drupal_CacheTags_Leak document_KNOWLEDGE_GRAPH_md -->|documents| concept_finding_Git_Repository_Existence document_REMEDIATION_CHECKLIST_md -->|documents| concept_finding_XST_TRACE_Method document_REMEDIATION_CHECKLIST_md -->|documents| concept_finding_Email_Spoofing document_REMEDIATION_CHECKLIST_md -->|documents| concept_finding_Exchange_Hostname_Disclosure document_REMEDIATION_CHECKLIST_md -->|documents| concept_finding_BeyondTrust_SAML_Leak document_REMEDIATION_CHECKLIST_md -->|documents| concept_finding_Drupal_CacheTags_Leak document_REMEDIATION_CHECKLIST_md -->|documents| concept_finding_Git_Repository_Existence document_REPORT_md -->|documents| concept_finding_XST_TRACE_Method document_REPORT_md -->|documents| concept_finding_Email_Spoofing document_REPORT_md -->|documents| concept_finding_Exchange_Hostname_Disclosure document_REPORT_md -->|documents| concept_finding_BeyondTrust_SAML_Leak document_REPORT_md -->|documents| concept_finding_Drupal_CacheTags_Leak document_REPORT_md -->|documents| concept_finding_Git_Repository_Existence document_TEST_DIAGRAM_md -->|documents| concept_finding_XST_TRACE_Method document_TEST_DIAGRAM_md -->|documents| concept_finding_Email_Spoofing document_TEST_DIAGRAM_md -->|documents| concept_finding_Exchange_Hostname_Disclosure document_TEST_DIAGRAM_md -->|documents| concept_finding_BeyondTrust_SAML_Leak document_TEST_DIAGRAM_md -->|documents| concept_finding_Drupal_CacheTags_Leak document_TEST_DIAGRAM_md -->|documents| concept_finding_Git_Repository_Existence document_ATTACK_CHAIN_mmd -->|visualizes| concept_finding_XST_TRACE_Method document_ATTACK_CHAIN_mmd -->|visualizes| concept_finding_Email_Spoofing document_ATTACK_CHAIN_mmd -->|visualizes| concept_finding_Exchange_Hostname_Disclosure document_ATTACK_CHAIN_mmd -->|visualizes| concept_finding_BeyondTrust_SAML_Leak document_ATTACK_CHAIN_mmd -->|visualizes| concept_finding_Drupal_CacheTags_Leak document_ATTACK_CHAIN_mmd -->|visualizes| concept_finding_Git_Repository_Existence document_DASHBOARD_html -->|visualizes| concept_finding_XST_TRACE_Method document_DASHBOARD_html -->|visualizes| concept_finding_Email_Spoofing document_DASHBOARD_html -->|visualizes| concept_finding_Exchange_Hostname_Disclosure document_DASHBOARD_html -->|visualizes| concept_finding_BeyondTrust_SAML_Leak document_DASHBOARD_html -->|visualizes| concept_finding_Drupal_CacheTags_Leak document_DASHBOARD_html -->|visualizes| concept_finding_Git_Repository_Existence document_DIAGRAMS_html -->|visualizes| concept_finding_XST_TRACE_Method document_DIAGRAMS_html -->|visualizes| concept_finding_Email_Spoofing document_DIAGRAMS_html -->|visualizes| concept_finding_Exchange_Hostname_Disclosure document_DIAGRAMS_html -->|visualizes| concept_finding_BeyondTrust_SAML_Leak document_DIAGRAMS_html -->|visualizes| concept_finding_Drupal_CacheTags_Leak document_DIAGRAMS_html -->|visualizes| concept_finding_Git_Repository_Existence document_FINDINGS_SEVERITY_mmd -->|visualizes| concept_finding_XST_TRACE_Method document_FINDINGS_SEVERITY_mmd -->|visualizes| concept_finding_Email_Spoofing document_FINDINGS_SEVERITY_mmd -->|visualizes| concept_finding_Exchange_Hostname_Disclosure document_FINDINGS_SEVERITY_mmd -->|visualizes| concept_finding_BeyondTrust_SAML_Leak document_FINDINGS_SEVERITY_mmd -->|visualizes| concept_finding_Drupal_CacheTags_Leak document_FINDINGS_SEVERITY_mmd -->|visualizes| concept_finding_Git_Repository_Existence document_INFRASTRUCTURE_mmd -->|visualizes| concept_finding_XST_TRACE_Method document_INFRASTRUCTURE_mmd -->|visualizes| concept_finding_Email_Spoofing document_INFRASTRUCTURE_mmd -->|visualizes| concept_finding_Exchange_Hostname_Disclosure document_INFRASTRUCTURE_mmd -->|visualizes| concept_finding_BeyondTrust_SAML_Leak document_INFRASTRUCTURE_mmd -->|visualizes| concept_finding_Drupal_CacheTags_Leak document_INFRASTRUCTURE_mmd -->|visualizes| concept_finding_Git_Repository_Existence document_email_spoof_poc_py -->|exploits| concept_finding_Email_Spoofing document_xst_poc_html -->|exploits| concept_finding_XST_TRACE_Method document_xst_poc_sh -->|exploits| concept_finding_XST_TRACE_Method style document_ATTACK_MATRIX_md fill:#888888,color:#fff style document_COMBINED_REPORT_md fill:#888888,color:#fff style document_EXECUTIVE_SUMMARY_md fill:#888888,color:#fff style document_EXPLOIT_REPORT_md fill:#888888,color:#fff style document_FINAL_COMBINED_md fill:#888888,color:#fff style document_FINAL_REPORT_md fill:#888888,color:#fff style document_KNOWLEDGE_GRAPH_md fill:#888888,color:#fff style document_REMEDIATION_CHECKLIST_md fill:#888888,color:#fff style document_REPORT_md fill:#888888,color:#fff style document_TEST_DIAGRAM_md fill:#888888,color:#fff style document_ATTACK_CHAIN_mmd fill:#888888,color:#fff style document_DASHBOARD_html fill:#888888,color:#fff style document_DIAGRAMS_html fill:#888888,color:#fff style document_FINDINGS_SEVERITY_mmd fill:#888888,color:#fff style document_INFRASTRUCTURE_mmd fill:#888888,color:#fff style document_email_spoof_poc_py fill:#888888,color:#fff style document_xst_poc_html fill:#888888,color:#fff style document_xst_poc_sh fill:#888888,color:#fff ``` ## 图表 打开 [`diagrams/DIAGRAMS.html`](diagrams/DIAGRAMS.html) 在浏览器中查看交互式 Mermaid 图表。 ### Mermaid 源文件 | 文件 | 描述 | |------|-------------| | [`diagrams/ATTACK_CHAIN.mmd`](diagrams/ATTACK_CHAIN.mmd) | 攻击链流程 | | [`diagrams/INFRASTRUCTURE.mmd`](diagrams/INFRASTRUCTURE.mmd) | 基础设施图 | | [`diagrams/FINDINGS_SEVERITY.mmd`](diagrams/FINDINGS_SEVERITY.mmd) | 严重程度分类 | ## POC | 文件 | 描述 | |------|-------------| | [`pocs/xst_poc.html`](pocs/xst_poc.html) | 基于浏览器的 XST 漏洞利用 | | [`pocs/xst_poc.sh`](pocs/xst_poc.sh) | Bash 漏洞利用脚本 | | [`pocs/email_spoof_poc.py`](pocs/email_spoof_poc.py) | 电子邮件欺骗演示 | | [`pocs/beyondtrust_poc.md`](pocs/beyondtrust_poc.md) | BeyondTrust 发现 | ## 报告 | 文件 | 描述 | |------|-------------| | [`FINAL_COMBINED.md`](FINAL_COMBINED.md) | 完整的发现报告 | | [`reports/EXECUTIVE_SUMMARY.md`](reports/EXECUTIVE_SUMMARY.md) | 高级摘要 | | [`reports/ATTACK_MATRIX.md`](reports/ATTACK_MATRIX.md) | 攻击技术与杀伤链 | | [`reports/REMEDIATION_CHECKLIST.md`](reports/REMEDIATION_CHECKLIST.md) | 可操作的修复清单 | | [`reports/KNOWLEDGE_GRAPH.md`](reports/KNOWLEDGE_GRAPH.md) | 交互式知识图谱 | ## 使用的工具 - T3MP3ST Arsenal（73 个适配器） - nuclei, nmap, curl, dig, nikto - Shodan InternetDB ## 许可证 基于 [MIT 许可证](LICENSE) 授权。请参阅 [SECURITY.md](SECURITY.md) 了解 负责任的披露政策，以及 [CONTRIBUTING.md](CONTRIBUTING.md) 了解如何 扩展此仓库。

标签：CISA项目, Cutter, Maven, PoC, 多模态安全, 暴力破解, 漏洞验证, 红队评估, 逆向工具, 配置审计