Skip to content

Instantly share code, notes, and snippets.

@brad-anton
Last active May 16, 2017 20:33
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save brad-anton/264cc0be50b527627024647656fe40ae to your computer and use it in GitHub Desktop.
Save brad-anton/264cc0be50b527627024647656fe40ae to your computer and use it in GitHub Desktop.
A simple test to check the behavior of WannaCry's Kill Switch functionality
/*
A simple test to check the behavior of WannaCry's Kill Switch
functionality. Compile with Visual Studio.
@brad_anton
Example Run:
Set DNS to 208.67.222.222
C:\Users\user\Desktop\WannaCryTest\Debug>WannaCryTest.exe
GOOD: WannaCry would have been aborted!
Add hosts file (C:\Windows\System\drivers\etc\hosts) entry:
127.0.0.1 www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
C:\Users\user\Desktop\WannaCryTest\Debug>WannaCryTest.exe
NOT GOOD: WannaCry would have executed and further infected!!!
*/
#include "stdafx.h"
#include <Windows.h>
#include <wininet.h>
#pragma comment(lib, "wininet.lib")
void main()
{
HANDLE hInt;
HANDLE hUrl;
hInt = InternetOpen(NULL, INTERNET_OPEN_TYPE_DIRECT,
NULL, NULL, 0);
hUrl = InternetOpenUrl(hInt, L"http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com", NULL, 0, INTERNET_FLAG_RELOAD | INTERNET_FLAG_NO_CACHE_WRITE, NULL);
if (hUrl)
{
printf("GOOD: WannaCry would have been aborted!");
InternetCloseHandle(hUrl);
}
else {
printf("NOT GOOD: WannaCry would have executed and further infected!!!");
}
InternetCloseHandle(hInt);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment