Glenn Wilkinson glennzw

Creating a "DMG installer" for OS X

A DMG Installer is convenient way to provide end-users a simple way to install an application bundle. They are basically a folder with a shortcut to the Applications directory but they can be customized with icons, backgrounds, and layout properties. A DMG file (.dmg) is a Mac OS X Disk Image file and it is used to package files or folders providing compression, encryption, and read-only to the package.

##Creating the DMG file #Disk Utility

Code example using WebCrypto, File API, indexedDB, createObjectURL and Workers.

<input type="file" onsubmit="process_upload">

var workerjs=' \
  onmessage=function(evt) { \
		var encrypt=crypto.workersubtle.encrypt({name:"AES-CBC",iv:new Uint8Array(16)},evt.data[0]); \
		var buffer=evt.data[1]; \

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

	import numpy as np
	import pylab as pl

	x = np.random.uniform(1, 100, 1000)
	y = np.log(x) + np.random.normal(0, .3, 1000)

	pl.scatter(x, y, s=1, label="log(x) with noise")
	pl.plot(np.arange(1, 100), np.log(np.arange(1, 100)), c="b", label="log(x) true function")
	pl.xlabel("x")
	pl.ylabel("f(x) = log(x)")

	#!/usr/bin/env python
	# coding: UTF-8

	import socket
	import struct

	DEBUG = True
	DEBUG2 = False

	PTP_OC_GetDeviceInfo = 0x1001

	from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer
	import json

	class WebHook(BaseHTTPRequestHandler):
	def do_POST(self):
	self.send_response(200)
	self.end_headers()
	print json.dumps(json.loads(self.rfile.read(int(self.headers.getheader('content-length')))), indent=4)

	server = HTTPServer(('0.0.0.0', 8000), WebHook)

	#!/bin/python

	import requests
	import threading
	import os

	API_KEY = "XXXXXXXXXXXXXXXXX"
	QUERY = "port:5900 authentication"

	class VNCSnapshot(threading.Thread):

	package main

	import (
	"flag"
	"fmt"
	"time"
	)

	// Fake a long and difficult work.
	func DoWork() {

	function Invoke-MS16-032 {
	<#
	.SYNOPSIS

	PowerShell implementation of MS16-032. The exploit targets all vulnerable
	operating systems that support PowerShell v2+. Credit for the discovery of
	the bug and the logic to exploit it go to James Forshaw (@tiraniddo).

	Targets:

	// (c) 2017 Yami Odymel
	// This code is licensed under MIT license.
	package main

	import (
	"fmt"
	"html"
	"strconv"
	)