Vesselin Bontchev bontchev

## magniber_decryptor.cpp
/*
 * This tool will decrypt files encrypted by the Magniber ransomware with
 * AES128 ( CBC mode ) algorithm.
 *
 * RE and report by MalwareBytes ( @hasherezade )
 *
 *  https://blog.malwarebytes.com/threat-analysis/2017/10/magniber-ransomware-exclusively-for-south-koreans/
 *
 * Decryptor written by Simone 'evilsocket' Margaritelli
 *

## infineon-roca.md

      
              1 file
            
          
              1 fork
            
          
              3 comments
            
          
              21 stars
            
          
                hannob
                / infineon-roca.md
            
            
              Last active
              October 25, 2020 15:55
            
              
                Affected Products and Keys by Infineon RSA vulnerability
              
          
    Collecting some information about the extend and affected products and keys of the Infineon RSA vulnerability (ROCA).

Official ROCA infos by the bug finders
Test tool on Github
Online test
Information from Infineon
CVE-2017-15361
CERT/CC advisory

Estonian eID cards

  
## smbloris.c
/* SMBLoris attack proof-of-concept
 *
 * Copyright 2017 Hector Martin "marcan" <marcan@marcan.st>
 *
 * Licensed under the terms of the 2-clause BSD license.
 *
 * This is a proof of concept of a publicly disclosed vulnerability.
 * Please do not go around randomly DoSing people with it.
 *
 * Tips: do not use your local IP as source, or if you do, use iptables to block

## Petna.txt
Petna / Eternalblue Petya
-------------------------

Hashes:
Main DLL: 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
Hashes below via McAfee article: https://securingtomorrow.mcafee.com/mcafee-labs/new-variant-petya-ransomware-spreading-like-wildfire/
Main DLL: 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
PSEXEC.EXE: f8dbabdfa03068130c277ce49c60e35c029ff29d9e3c74c362521f3fb02670d5
64-bit EXE: 02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f
32-bit EXE: eae9771e2eeb7ea3c6059485da39e77b8c0c369232f01334954fbac1c186c998

## Petya_ransomware.md

      
              1 file
            
          
              46 forks
            
          
              42 comments
            
          
              209 stars
            
          
                vulnersCom
                / Petya_ransomware.md
            
            
              Last active
              July 6, 2023 19:30
            
          
    #petya #petrWrap #notPetya

Win32/Diskcoder.Petya.C

Ransomware attack.

About

This gist was built by the community of the researchers and was scribed by Kir and Igor from the QIWI/Vulners.
We are grateful for the help of all those who sent us the data, links and information.
Together we can make this world a better place!
Gist updates


## eternalblue8_exploit.py
#!/usr/bin/python
# This file has no update anymore. Please see https://github.com/worawit/MS17-010
from impacket import smb, ntlm
from struct import pack
import sys
import socket

'''
EternalBlue exploit for Windows 8 and 2012 by sleepya
The exploit might FAIL and CRASH a target system (depended on what is overwritten)

## Wannacrypt0r-FACTSHEET.md

      
              1 file
            
          
              158 forks
            
          
              267 comments
            
          
              713 stars
            
          
                rain-1
                / Wannacrypt0r-FACTSHEET.md
            
            
              Last active
              March 10, 2024 11:03
                — forked from Epivalent/Wannacrypt0r-FACTSHEET.md
            
          
    WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm


Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

  
## BadTalkTitles
😒🙅🙄

$thing for fun and profit
all your $thing are belong to $shutup
honey I $verbed the $thing
$thing demystified
$thing: a deep dive
$verb all the things
make $thing great again
$x and $y and $z, oh my!

## INSTALL.md

      
              2 files
            
          
              10 forks
            
          
              5 comments
            
          
              35 stars
            
          
                thomhastings
                / INSTALL.md
            
            
              Last active
              September 29, 2022 05:33
            
          
    Notes on Shadow Brokers EQGRP-LiT

credit: @GossiTheDog: "If you want to setup FUZZBUNCH (the Equation exploit framework) you need Win7 VM + Python 2.6 + Pywin 2.6, then python fb.py for shell"

h/t @x0rz @DEYCrypt @hackerfantastic
HOW 2 SETUP + INSTALL FUZZBUNCH & DANDERSPRITZ

context: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation

writeup: https://www.trustedsec.com/blog/equation-group-dump-analysis-full-rce-win7-fully-patched-cobalt-strike/

decrypted files: https://github.com/x0rz/EQGRP_Lost_in_Translation

  
## ransomcanary.ps1
<#
Powershell script to create and monitor a ransomware canary file;
If the canary is modified, the script will notify the user, log the data,
create an entry in the event log, and stop the workstation service,
crippling the machine's ability to map or access network drives.
Modified from a script found at freeforensics.org
#>


$DirPath = "C:\Temp\"
	/*
	* This tool will decrypt files encrypted by the Magniber ransomware with
	* AES128 ( CBC mode ) algorithm.
	*
	* RE and report by MalwareBytes ( @hasherezade )
	*
	* https://blog.malwarebytes.com/threat-analysis/2017/10/magniber-ransomware-exclusively-for-south-koreans/
	*
	* Decryptor written by Simone 'evilsocket' Margaritelli
	*
	/* SMBLoris attack proof-of-concept
	*
	* Copyright 2017 Hector Martin "marcan" <marcan@marcan.st>
	*
	* Licensed under the terms of the 2-clause BSD license.
	*
	* This is a proof of concept of a publicly disclosed vulnerability.
	* Please do not go around randomly DoSing people with it.
	*
	* Tips: do not use your local IP as source, or if you do, use iptables to block
	Petna / Eternalblue Petya
	-------------------------

	Hashes:
	Main DLL: 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
	Hashes below via McAfee article: https://securingtomorrow.mcafee.com/mcafee-labs/new-variant-petya-ransomware-spreading-like-wildfire/
	Main DLL: 64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1
	PSEXEC.EXE: f8dbabdfa03068130c277ce49c60e35c029ff29d9e3c74c362521f3fb02670d5
	64-bit EXE: 02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f
	32-bit EXE: eae9771e2eeb7ea3c6059485da39e77b8c0c369232f01334954fbac1c186c998
	#!/usr/bin/python
	# This file has no update anymore. Please see https://github.com/worawit/MS17-010
	from impacket import smb, ntlm
	from struct import pack
	import sys
	import socket

	'''
	EternalBlue exploit for Windows 8 and 2012 by sleepya
	The exploit might FAIL and CRASH a target system (depended on what is overwritten)
	😒🙅🙄

	$thing for fun and profit
	all your $thing are belong to $shutup
	honey I $verbed the $thing
	$thing demystified
	$thing: a deep dive
	$verb all the things
	make $thing great again
	$x and $y and $z, oh my!
	<#
	Powershell script to create and monitor a ransomware canary file;
	If the canary is modified, the script will notify the user, log the data,
	create an entry in the event log, and stop the workstation service,
	crippling the machine's ability to map or access network drives.
	Modified from a script found at freeforensics.org
	#>


	$DirPath = "C:\Temp\"