Skip to content

Instantly share code, notes, and snippets.

View ekojs's full-sized avatar
🏠
Working from home

Eko Junaidi Salam ekojs

🏠
Working from home
View GitHub Profile
@ekojs
ekojs / changepassword.php
Last active August 29, 2015 14:24 — forked from mattrude/changepassword.php
Change Password for LDAP
<?php
/**
* LDAP PHP Change Password Webpage
* @author: Matt Rude <http://mattrude.com>
* @website: http://technology.mattrude.com/2010/11/ldap-php-change-password-webpage/
*
*
* GNU GENERAL PUBLIC LICENSE
* Version 2, June 1991
@ekojs
ekojs / sample.py
Created March 22, 2017 07:19
Sample Program using TKInter Python
from Tkinter import *
from tkMessageBox import *
from tkSimpleDialog import *
class Application(Frame):
def say_hi(self):
try:
with open("list_nama.txt", "r") as f:
for x in f:
print "Hallo %s!" %(x.replace("\n","") if x != "" else "everyone");
@ekojs
ekojs / instag.rb
Created April 20, 2017 07:17 — forked from nikushi/instag.rb
A Liquid tag for Jekyll sites that allows embedding image file on Instagram.
# Title: A Liquid tag for Jekyll sites that allows embedding image file on
# Instagram.
# Authors: Nobuhiro Nikushi https://twitter.com/#!/niku4i
# Description: Easily embed image file on Instagram page.
#
# Syntax {% instag [class name(s)] http://instagr.am/p/IYYs5bo0jd/ [width [height]] [title text | "title text" ["alt text"]] %}
#
# Examples:
# {% instag http://instagr.am/p/IYYs5bo0jd/ %}
# {% instag left half http://instagr.am/p/IYYs5bo0jd/ my title %}
@ekojs
ekojs / jekyll-and-liquid.md
Created May 2, 2017 02:07 — forked from magicznyleszek/jekyll-and-liquid.md
Jekyll & Liquid Cheatsheet

Jekyll & Liquid Cheatsheet

A list of the most common functionalities in Jekyll (Liquid). You can use Jekyll with GitHub Pages, just make sure you are using the proper version.

Running

Running a local server for testing purposes:

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

  • Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
  • Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
  • Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
  • Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
  • Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

#petya #petrWrap #notPetya

Win32/Diskcoder.Petya.C Ransomware attack.

Got new info? Email at isox@vulners.com or @isox_xx Some wrong info? Leave the comment, we will fix it!

Research list

@ekojs
ekojs / Cerber 422 file ext
Created July 3, 2017 08:31
234 jenis tipe file yang akan diserang oleh ransomware ini...
*.contact
*.dbx
*.doc
*.docx
*.jnt
*.jpg
*.mapimail
*.msg
*.oab
*.ods

Buka Win + Run, kemudian ketik secpol.msc sebagai Administrator.

Pilih menu Software Restriction Policies kemudian klik kanan lalu pilih New Software Restriction Policies Pilih menu Additional Rules kemudian klik kanan lalu pilih New Path Rule.

Masukkan rule path seperti dibawah, kemudian pilih Security Level ke Disallowed

%AppData%\*.exe
%AppData%\*\*.exe
@ekojs
ekojs / install_gearman.sh
Last active March 17, 2020 13:02
Install Gearman in Centos 7
#!/bin/sh
# Auto update
yum update
# Install the required packages
yum install libgearman-devel gcc
yum install gcc gcc-c++ make bison flex autoconf libtool memcached libevent libevent-devel uuidd libuuid-devel boost boost-devel libcurl-dev libcurl curl gperf
@ekojs
ekojs / install_gearman_ubuntu.sh
Last active September 4, 2017 18:31
Install Gearman Daemon dan Worker di Ubuntu
#!/bin/sh
sudo apt-get update
sudo apt-get install gperf gcc autoconf bison flex libtool make libboost-all-dev libcurl4-openssl-dev curl libevent-dev uuid-dev
#Persistence Queue dg MySQL:
#sudo apt-get install libmysqlclient-dev
#Persistence Queue dg MariaDB:
#sudo apt-get install libmariadbclient-dev