EternalBlueC

EternalBlueC C/C++로 재구성된 EternalBlue 스위트이며 다음을 포함합니다: MS17-010 익스플로잇 DoublePulsar 포함 EternalBlue/MS17-010 취약점 탐지기 DoublePulsar 탐지기 DoublePulsar DLL 업로드 DoublePulsar 셸코드 업로드 SMB 구조를 이용한 DoublePulsar DLL 업로드 SMB 구조를 이용한 DoublePulsar 셸코드 업로드 DLL 내부에 포함된 DoublePulsar EXE 업로드 프로젝트 성과 셸코드 업로드 - 완료 및 작동...

doublepulsar-c2-traffic-decryptor

著者: Luke Jennings [email protected] - @jukelennings 会社: Countercept @countercept ウェブサイト: https://countercept.com PCAPファイルからDOUBLEPULSAR...

doublepulsar-usermode-injector

DOUBLEPULSAR-usermode-injector 著者: Matt Hillman [email protected] - @sp1nl0ck 会社: Countercept @countercept ウェブサイト: https://countercept.com DOUBLEPULSARペイロードのユーザーモードシェルコードを利用して、任意のDLLを別のプロセスにリフレクティブにロードするユーティリティです。検知技術のテストやその他のセキュリティ研究を目的としています。 背景 Shadow...

doublepulsar-detection-script

저자: Luke Jennings [email protected] - @jukelennings 회사: Countercept @countercept 웹사이트: https://countercept.com 이것은 Shadow Brokers에 의해 유출된 DOUBLEPULSAR 임플란트의 SMB 및 RDP 버전의 존재 여부를 스캔하기 위한 python2 스크립트 세트입니다. 단일 IP 확인 및 멀티스레딩 지원이 포함된 파일 내 IP 목록을 지원합니다. SMB 버전은 또한 @zerosum0x0에 의해 리버스된 opcode...

Eternalblue-Doublepulsar-Metasploit

This is a Metasploit module to exploit the EternalBlue-Doublepulsar vulnerability. The module is designed to target Windows systems and uses the Doublepulsar backdoor to install a DLL into a user mode process. The module can be used to perform various operations, including outputting the install...

Exploit for CVE-2017-0144

This repository is an offensive tool for Windows. It is an implementation of the DoublePulsar backdoor in C/C++. The tool includes a suite of exploits and detectors for various vulnerabilities, including the EternalBlue vulnerability CVE-2017-0144. The tool can be used to upload a DLL to a...

MS17-010 SMB Remote Code Execution Detection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'MS17-010 SMB RCE Detection', 'Description' = %q Uses information disclosure to determine if MS17-010 has been patched or not. Specifically, it...

Perkiler malware turns to SMB brute force to spread

Researchers at Guardicore have identified a new infection vector being used by the Perkiler malware where internet-facing Windows machines are breached through SMB password brute force. Perkiler is a complex Windows malware with rootkit components that is dropped by the Purple Fox exploit kit EK...

EternalBlueC - EternalBlue Suite Remade In C/C++ Which Includes: MS17-010 Exploit, EternalBlue Vulnerability Detector, DoublePulsar Detector And DoublePulsar Shellcode & DLL Uploader

EternalBlue suite remade in C which includes: MS17-010 Exploit, EternalBlue/MS17-010 vulnerability detector, DoublePulsar detector and DoublePulsar UploadDLL & Shellcode ms17vulnstatus.cpp - This program sends 4 SMB packets. 1 negociation packet and 3 requests. This program reads the NTSTATUS...

Exploit for CVE-2017-0144

PoC exploit for CVE-2017-0144, also known as Eternalblue-Doublepulsar. This Metasploit module exploits the vulnerability to install a Doublepulsar backdoor on a Windows system. The module targets the SMB protocol, specifically the Ring 0 SMB TCP 445 backdoor. The exploit is designed to run on...

Self-Propagating Lucifer Malware Targets Windows Systems

Security experts have identified a self-propagating malware, dubbed Lucifer, that targets Windows systems with cryptojacking and distributed denial-of-service DDoS attacks. The never-before-seen malware initially tries to infect PCs by bombarding them with exploits in hopes of taking advantage of...

Exploit for CVE-2017-0144

PoC exploit for CVE-2017-0144 Eternalblue-Doublepulsar. The target product/service is Windows operating system, specifically the SMB Server Message Block protocol. The vulnerability class/vector is a remote code execution RCE vulnerability, which allows an attacker to execute arbitrary code on th...

Exploit for CVE-2017-0144

PoC exploit for CVE-2017-0144 EternalBlue using the Doublepulsar backdoor, implemented as a Metasploit module. The target product/service is Windows, and the vulnerability class is RCE Remote Code Execution. The probable entry point is the Metasploit module, and the notable dependency is the...

RDP DOUBLEPULSAR Remote Code Execution Exploit

This Metasploit module executes a Metasploit payload against the Equation Group's DOUBLEPULSAR implant for RDP. While this module primarily performs code execution against the implant, the "Neutralize implant" target allows you to disable the implant. This module requires Metasploit:...

RDP DOUBLEPULSAR Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'RDP DOUBLEPULSAR Remote Code Execution', 'Description' = %q This module executes a Metasploit payload against the Equation Group's DOUBLEPULSAR...

SMB DOUBLEPULSAR Remote Code Execution Exploit

This Metasploit module executes a Metasploit payload against the Equation Group's DOUBLEPULSAR implant for SMB as popularly deployed by ETERNALBLUE. While this module primarily performs code execution against the implant, the "Neutralize implant" target allows you to disable the implant. This...

SMB DOUBLEPULSAR Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SMB DOUBLEPULSAR Remote Code Execution', 'Description' = %q This module executes a Metasploit payload against the Equation Group's DOUBLEPULSAR...

DOUBLEPULSAR (x64) - Hooking srv!SrvTransactionNotImplemented in srv!SrvTransaction2DispatchTable

DOUBLEPULSAR x64 - Hooking srv!SrvTransactionNotImplemented in srv!SrvTransaction2DispatchTable EDB Download https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/47685.zip...

DOUBLEPULSAR (x64) - Hooking 'srv!SrvTransactionNotImplemented' in 'srv!SrvTransaction2DispatchTable'

EDB Download https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47685.zip...

DOUBLEPULSAR - Payload Execution and Neutralization Exploit

This Metasploit module executes a Metasploit payload against the Equation Group's DOUBLEPULSAR implant for SMB as popularly deployed by ETERNALBLUE. While this module primarily performs code execution against the implant, the "Neutralize implant" target allows you to disable the implant. This...