Skip to content

Instantly share code, notes, and snippets.

View taganaka's full-sized avatar
🎯
Focusing

Francesco Laurita taganaka

🎯
Focusing
  • Citadel LLC
  • San Francisco, CA
View GitHub Profile

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

  • Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
  • Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
  • Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
  • Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
  • Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

@cjbottaro
cjbottaro / overlay.sh
Last active November 13, 2018 15:06
Convert ECS Optimized AMI to use overlay/overlay2
set -e
# Stop the docker daemon
/etc/init.d/docker stop
# Configure ECS Agent
# http://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-agent-config.html
# http://docs.aws.amazon.com/AmazonECS/latest/developerguide/automated_image_cleanup.html
cat > /etc/ecs/ecs.config << "EOF"
ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION=1h
@dnozay
dnozay / _Jenkins+Script+Console.md
Last active May 3, 2024 09:33
jenkins groovy scripts collection.
@tomriley
tomriley / mongiod_mysql_migrator.rb
Created April 10, 2014 17:24
Migrate a Mongoid / MongoDB database to an ActiveRecord based SQL one. One method to convert the schema, another to migrate data. Copes with most basic data types. Some hacks to infer TEXT columns. Converts embeds_one relationships to AR aggregations. I wrote this for a one-time migration. It could be a good starting point for someone doing the …
# Migrate schema and data from Mongoid to MySQL ActiveRecord
class MongoidMysqlMigrator
def randomize_auto_increment_values(source_models, from=5500, to=10500)
source_models.each do |model|
value = rand(from-to)+from
sql = %(ALTER TABLE #{model.name.tableize} AUTO_INCREMENT=#{value})
puts sql
ActiveRecord::Base.connection.execute(sql)
end
@errordeveloper
errordeveloper / Unicorn_and_Upstart.md
Last active February 9, 2022 09:21
Upstart config for a Rails app using Unicorn HTTP server

Using Unicorn with Upstart

This configuration works with Upstart on Ubuntu 12.04 LTS

The reason why it needs to be done this way (i.e. with the pre-start and post-stop stanzas), is because Upstart is unable to track whever Unicorn master process re-execs itself on hot deploys. One can use it without hot-deploys and run Unicorn in foreground also, it then only needs one exec stanza.

This presumes you are not using RVM, so no voodoo dances.

@nateware
nateware / haproxy.conf
Created October 31, 2012 15:36
HAProxy sample config for EC2
#
# This config file is a combination of ideas from:
# http://www.37signals.com/svn/posts/1073-nuts-bolts-haproxy
# http://www.igvita.com/2008/05/13/load-balancing-qos-with-haproxy/
# http://wiki.railsmachine.com/HAProxy
# http://elwoodicious.com/2008/07/15/nginx-haproxy-thin-fastcgi-php5-load-balanced-rails-with-php-support/
# http://upstream-berlin.com/2008/01/09/using-haproxy-with-multiple-backends-aka-content-switching/
# http://wiki.railsmachine.com/HAProxy
# http://gist.github.com/raw/25482/d39fb332edf977602c183194a1cf5e9a0b5264f9
#
@gudbergur
gudbergur / README.markdown
Created February 19, 2012 23:49
Bootstrap's Typeahead plugin extended (allowing for AJAX functionality) among other things

This is a fork of Bootstrap Typeahead that adds minimal but powerful extensions.

For example, process typeahead list asynchronously and return objects

  # This example does an AJAX lookup and is in CoffeeScript
  $('.typeahead').typeahead(
    # source can be a function
    source: (typeahead, query) ->
 # this function receives the typeahead object and the query string