vulnersCom

#petya #petrWrap #notPetya

Win32/Diskcoder.Petya.C

Ransomware attack.

About

This gist was built by the community of the researchers and was scribed by Kir and Igor from the QIWI/Vulners. We are grateful for the help of all those who sent us the data, links and information. Together we can make this world a better place!

Gist updates

wongwaituck

local smb = require "smb"
local string = require "string"
local vulns = require "vulns"
local stdnse = require "stdnse"
local table = require "table"
local nmap = require "nmap"

description = [[
Checks if target machines are vulnerable to the arbitrary shared library load
vulnerability CVE-2017-7494.

rain-1

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

• Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
• Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
• Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
• Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
• Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

phith0n

import socket
import random
import argparse
import sys
from io import BytesIO

# Referrer: https://github.com/wuyunfeng/Python-FastCGI-Client

PY2 = True if sys.version_info.major == 2 else False

aaaler

#!/bin/sh
curl -sSL https://raw.githubusercontent.com/aaaler/acestreamproxyvlc-pi/master/acestream.service > /etc/systemd/system/acestream.service
curl -sSL https://raw.githubusercontent.com/aaaler/acestreamproxyvlc-pi/master/aceproxy.service > /etc/systemd/system/aceproxy.service
curl -sSL https://raw.githubusercontent.com/aaaler/acestreamproxyvlc-pi/master/vlc-nox.service > /etc/systemd/system/vlc-nox.service
mkdir /etc/aceproxy
curl -sSl https://raw.githubusercontent.com/aaaler/acestreamproxyvlc-pi/master/etc/torrenttv.py > /etc/aceproxy/torrenttv.py #torrent-tv acestream playlist mentioned here, http://torrent-tv.ru/c_playlist.php
curl -sSl https://raw.githubusercontent.com/aaaler/acestreamproxyvlc-pi/master/etc/p2pproxy.py > /etc/aceproxy/p2pproxy.py #torrent-tv login & passwd here
systemctl daemon-reload
docker pull aaaler/aceproxy-pi 
docker pull aaaler/acestream-pi 

ESGuardian

Ку-ку, товарищи! И еще раз ку-ку!
-----------------------------------------
Кое-какие изменения
Я добавил скрипт для установки модифицированной cuckoo от Брэда Шпенглера (Brad Spengler)
https://github.com/brad-accuvant/cuckoo-modified
Компания Accuvant теперь называется Optiv. Поэтму модифицированную Кукушку теперь будем называть cuckoo-1.3-optiv. Разница между "стабильной" Кукушкой и версией Брэда, как между жигулями и тоётой. В том числе в стабильности.
В своем новом скрипте я тоже кое-что поменял. Функциональная разница в том, что теперь после импорта и настройки виртуалки, скрипт ее запускает и становится в позу ожидания нажатия Enter. Это сделано для того, чтобы можно было спокойно подключиться к виртуалке по rdp (порт 7001) и убедиться, что всё с ней в порядке и она нормально работает, а также настроить что-нибудь на машине дополнительно или установить еще какие-нибудь компоненты. Это полезно когда вы переносите виртуалку с одного типа хадваре на другой (например, другие процесс

SchizoDuckie

#!/bin/bash

# change the values below to match your system.

# target the BUILD_DIR to output from an nw.io build process. nwjs-shell-builder recommended!
# https://github.com/Gisto/nwjs-shell-builder
# BASE_DIR is the target directory for this script, where files will be gathered and packaged to 

BUILD_DIR=”/var/www/deploy/TMP/osx-ia32/latest-git”
BASE_DIR=”/var/www/deploy/osx” 

idvoretskyi

= Arch Linux step-by-step installation =
= http://blog.fabio.mancinelli.me/2012/12/28/Arch_Linux_on_BTRFS.html =


== Boot the installation CD ==

== Create partition ==

cfdisk /dev/sda
 * Create a partition with code 8300 (Linux)

vjm

sudo apt-get install -y supervisor

sudo mkdir /usr/share/elasticsearch
cd /usr/share/elasticsearch

sudo wget https://download.elasticsearch.org/kibana/kibana/kibana-4.0.1-linux-x64.tar.gz
sudo wget https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.4.4.tar.gz
sudo wget https://download.elasticsearch.org/logstash/logstash/logstash-1.4.2.tar.gz

sudo tar -zxvf elasticsearch-0.90.0.tar.gz

mattiaslundberg

# Install ARCH Linux with encrypted file-system and UEFI
# The official installation guide (https://wiki.archlinux.org/index.php/Installation_Guide) contains a more verbose description.

# Download the archiso image from https://www.archlinux.org/
# Copy to a usb-drive
dd if=archlinux.img of=/dev/sdX bs=16M && sync # on linux

# Boot from the usb. If the usb fails to boot, make sure that secure boot is disabled in the BIOS configuration.

# Set swedish keymap