thesamesam

FAQ on the xz-utils backdoor (CVE-2024-3094)

This is a living document. Everything in this document is made in good faith of being accurate, but like I just said; we don't yet know everything about what's going on.

Background

On March 29th, 2024, a backdoor was discovered in xz-utils, a suite of software that

h4sh5

apikey="xxx"
echo "$(tput setaf 7)Uploading $1 to VirusTotal$(tput sgr0)"
vt_hash=$(curl -X POST 'https://www.virustotal.com/vtapi/v2/file/scan' --form apikey=$apikey --form file=@"$(realpath $1)" | grep -o '"[0-9|a-f]{64}"' | head -1 | sed 's/"//g')
echo done: $(sha256sum $1)

godofgrunts

#!/bin/zsh
#Copyright 2019 Ryan 'GodofGrunts' Whited
#Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

#The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

#THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 

AlexanderProd

#!/usr/bin/env bash
#
# Backup selected directories to a Backblaze B2 bucket
#
# If youre encountering errors running the script you probably need Bash 4.0 
#
# You need to login to your b2 account once with b2 authorize-account [<accountId>] [<applicationKey>] before running it.
#
# Example daily cron running script.sh in home directory:
# @daily /usr/local/bin/bash ~/script.sh

rise-worlds

for 4.2.4 or higher, 4.2.5,4.2.6,4.3.7, it's works, this is the way which makes Always in evaluation mode.

1. open Terminal, go to the dir : cd /Applications/Beyond Compare.app/Contents/MacOS
2. change the name BCompare to BCompare.bak: mv BCompare BCompare.bak
3. touch a file name BCompare , and chmod a+ux BCompare : touch BCompare && chmod a+ux BCompare
4. open BCompare with text editor, insert the script :

#!/bin/bash
rm "/Users/$(whoami)/Library/Application Support/Beyond Compare/registry.dat"
"`dirname "$0"`"/BCompare.bak $@

pyroscope

d.is_meta
directory.watch.added
group.seeding.ratio.max
group.seeding.ratio.max.set
group.seeding.ratio.min
group.seeding.ratio.min.set
group.seeding.ratio.upload
group.seeding.ratio.upload.set
group.seeding.view
group.seeding.view.set

onedr0p

#!/bin/sh

#
# INFO
#

# This works if sonarr and radarr are set up to have a Category of sonarr and radarr respectively 
# If you are using other Categories to save your automated downloads, update the script where you see:
#    "radarr"|"sonarr")
# This script will not touch anything outside those Categories

donaldsteele

####
# Install magneticod go-rewrite on a brand new scaleway ubuntu 16.04 instance
####
apt-get update && apt-get -y upgrade 
apt-get install -y software-properties-common python-software-properties git trickle
add-apt-repository ppa:gophers/archive
apt update
apt-get -y install golang-1.9-go
mkdir -p $HOME/go/src
cd $HOME/go/src

LucasBonafe

NetLimiter 3
Registration name:  Peter Raheli
Registration code:  C99A2-QSSUD-2CSBG-TSRPN-A2BEB

NetLimiter 4
Registration Name:  Vladimir Putin #2
Registration Code:  XLEVD-PNASB-6A3BD-Z72GJ-SPAH7

https://www.netlimiter.com/download
# Netlimiter Full Netlimiter Activated Netlimiter cracked Netlimiter Full Version Netlimiter Serial Netlimiter keygen Netlimiter crack Netlimiter 4 serial Netlimiter 4 Crack Netlimiter 4 register Netlimiter 4 patch Netlimiter full Full version Netlimiter 4 Activated Netlimiter 4 Cracked Netlimiter Pro

rain-1

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

• Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
• Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
• Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
• Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
• Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru