Viyat viyatb

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

Option 1: Command-line download extension as zip and extract

extension_id=jifpbeccnghkjeaalbbjmodiffmgedin   # change this ID
curl -L -o "$extension_id.zip" "https://clients2.google.com/service/update2/crx?response=redirect&os=mac&arch=x86-64&nacl_arch=x86-64&prod=chromecrx&prodchannel=stable&prodversion=44.0.2403.130&x=id%3D$extension_id%26uc" 
unzip -d "$extension_id-source" "$extension_id.zip"

Thx to crxviewer for the magic download URL.

Setting up Vim as your Go IDE

Intro

I've been wanting to do a serious project in Go. One thing holding me back has been a my working environment. As a huge PyCharm user, I was hoping the Go IDE plugin for IntelliJ IDEA would fit my needs. However, it never felt quite right. After a previous experiment a few years ago using Vim, I knew how powerful it could be if I put in the time to make it so. Luckily there are plugins for almost anything you need to do with Go or what you would expect form and IDE. While this is no where near comprehensive, it will get you writing code, building and testing with the power you would expect from Vim.

Getting Started

I'm assuming you're coming with a clean slate. For me this was OSX so I used MacVim. There is nothing in my config files that assumes this is the case.

create tasks T{NNNN} asign them
create a branch with name like "T{NNNN}-boo-hoo"
git checkout -b T1234-boo-foo
commit changes on that branch until it gets ready to be reviewed
git commit -am 'first'
git commit -am 'now it works'
check if it's lint free (NOTE: it runs lint against only modified files)
arc lint
push a review request to the server. This will create a diff with id D{NNNN}
arc diff

	package jwtex

	import (
	"encoding/base64"
	"encoding/json"
	"fmt"
	"strings"
	"testing"
	)

	#!/bin/bash

	# Written by Frans Rosén (twitter.com/fransrosen)
	_debug="$2" #turn on debug
	_timeout="20"
	#you need a valid key, since the errors happens after it validates that the key exist. we do not need the secret key, only access key
	_aws_key="AKIA..."
	H_ACCEPT="accept-language: en-US,en;q=0.9,sv;q=0.8,zh-TW;q=0.7,zh;q=0.6,fi;q=0.5,it;q=0.4,de;q=0.3"
	H_AGENT="user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36"

	package main

	import (
	"context"
	"flag"
	"fmt"
	"log"
	"net/http"
	"os"
	"os/signal"

	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>

	// Convert PhantomJs cookies to NetScape HTTP cookie file format
	// NOTE: It dose not create NetScape HTTP cookie file, this function return only cookie file contents
	// NOTE: PhantomJs do not store "host only" cookie param, all cookies will have "host only" param set to false (line 15)
	// I use this function to export PhantomJs cookies to CURL cookiejar file
	// This is modified version of EditThisCookie cookie_helpers.js cookiesToString function
	// USAGE: phantomJsCookiesToNetScapeString(phantom.cookies);

	var phantomJsCookiesToNetScapeString = function(cookies) {
	var string = "";
	string += "# Netscape HTTP Cookie File\n";

	"""
	SQLAlchemy, PostgreSQL (psycopg2), and autocommit

	See blog post: http://oddbird.net/2014/06/14/sqlalchemy-postgres-autocommit/

	"""
	from contextlib import contextmanager

	from sqlalchemy import create_engine, event
	from sqlalchemy.orm import sessionmaker, Session as BaseSession