Skip to content

Instantly share code, notes, and snippets.

View ekojs's full-sized avatar
🏠
Working from home

Eko Junaidi Salam ekojs

🏠
Working from home
View GitHub Profile
@ekojs
ekojs / ga_decrypt.sh
Created December 25, 2023 12:31 — forked from yibe/ga_decrypt.sh
#!/usr/bin/env bash
# Based on https://git-annex.branchable.com/tips/Decrypting_files_in_special_remotes_without_git-annex/
usage() {
echo "Usage: ga_decrypt.sh -r REMOTE [-k SYMLINK] [-d FILE...]"
echo ""
echo " Either lookups up key on REMOTE for annex file linked with SYMLINK"
echo " or decrypts FILE encrypted for REMOTE."
echo ""
@ekojs
ekojs / README.md
Last active September 20, 2021 09:05 — forked from hofmannsven/README.md
My simply Git Cheatsheet
@ekojs
ekojs / migrate.sh
Created February 27, 2018 06:22 — forked from cedricziel/migrate.sh
Very simple migration script to move from gitlab to gogs
#!/bin/env bash
## Needs `jq` (https://stedolan.github.io/jq/) on PATH
## and a personal gogs token of yours.
## Obtain token from https://git.example.com/user/settings/applications
## Usage:
## ./migrate.sh $clone_url $project_name [$optional_group]
## Migrate a repository to gogs into the user namespace of the token-user
## ./migrate.sh git@mygitlab.com:group/repo.git repo
## Migrate a repository to gogs into the group namespace `group` (needs to exist)

#petya #petrWrap #notPetya

Win32/Diskcoder.Petya.C Ransomware attack.

Got new info? Email at isox@vulners.com or @isox_xx Some wrong info? Leave the comment, we will fix it!

Research list

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

  • Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
  • Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
  • Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
  • Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
  • Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

@ekojs
ekojs / jekyll-and-liquid.md
Created May 2, 2017 02:07 — forked from magicznyleszek/jekyll-and-liquid.md
Jekyll & Liquid Cheatsheet

Jekyll & Liquid Cheatsheet

A list of the most common functionalities in Jekyll (Liquid). You can use Jekyll with GitHub Pages, just make sure you are using the proper version.

Running

Running a local server for testing purposes:

@ekojs
ekojs / instag.rb
Created April 20, 2017 07:17 — forked from nikushi/instag.rb
A Liquid tag for Jekyll sites that allows embedding image file on Instagram.
# Title: A Liquid tag for Jekyll sites that allows embedding image file on
# Instagram.
# Authors: Nobuhiro Nikushi https://twitter.com/#!/niku4i
# Description: Easily embed image file on Instagram page.
#
# Syntax {% instag [class name(s)] http://instagr.am/p/IYYs5bo0jd/ [width [height]] [title text | "title text" ["alt text"]] %}
#
# Examples:
# {% instag http://instagr.am/p/IYYs5bo0jd/ %}
# {% instag left half http://instagr.am/p/IYYs5bo0jd/ my title %}
@ekojs
ekojs / changepassword.php
Last active August 29, 2015 14:24 — forked from mattrude/changepassword.php
Change Password for LDAP
<?php
/**
* LDAP PHP Change Password Webpage
* @author: Matt Rude <http://mattrude.com>
* @website: http://technology.mattrude.com/2010/11/ldap-php-change-password-webpage/
*
*
* GNU GENERAL PUBLIC LICENSE
* Version 2, June 1991