Exploit for CVE-2017-0144

This is a PoC exploit for CVE-2017-0144, also known as the EternalBlue vulnerability, which is a remote code execution vulnerability in the Windows SMBv1 protocol. The exploit is implemented as a Metasploit module, and it targets the Double Pulsar backdoor. The target product/service is the Windo...

Indexsinas SMB Worm Campaign Infests Whole Enterprises

The Indexsinas SMB worm is on the hunt for vulnerable environments to self-propagate into, researchers warned – with a particular focus on the healthcare, hospitality, education and telecommunications sectors. Its end goal is to drop cryptominers on compromised machines. Indexsinas, aka...

2021. The age of the super vulnerability?

I don’t know about you, but to me it seems that every week we are seeing another vulnerability that not only grants significant access to the vulnerable system but also more widely internally. This last week we have seen the latest round of Microsoft Exchange vulnerabilities. The April 2021 updat...

Perkiler malware turns to SMB brute force to spread

Researchers at Guardicore have identified a new infection vector being used by the Perkiler malware where internet-facing Windows machines are breached through SMB password brute force. Perkiler is a complex Windows malware with rootkit components that is dropped by the Purple Fox exploit kit EK...

Rapid7 Releases Q2 2020 Quarterly Threat Report

It’s hard to believe it’s already the end of September, and with it comes Rapid7’s Q2 2020 Quarterly Threat Report. As in previous quarters, our Rapid7 research team produced this report by analyzing the data from our internet telemetry-gathering systems Project Sonar and Project Heisenberg, as...

MS17-010

This repository is a collection of exploits and tools for the MS17-010 vulnerability, also known as the EternalBlue exploit. The vulnerability is a remote code execution RCE bug in the SMBv1 protocol, which was used by the WannaCry ransomware in 2017. The repository contains various exploits and...

EternalBlueC - EternalBlue Suite Remade In C/C++ Which Includes: MS17-010 Exploit, EternalBlue Vulnerability Detector, DoublePulsar Detector And DoublePulsar Shellcode & DLL Uploader

EternalBlue suite remade in C which includes: MS17-010 Exploit, EternalBlue/MS17-010 vulnerability detector, DoublePulsar detector and DoublePulsar UploadDLL & Shellcode ms17vulnstatus.cpp - This program sends 4 SMB packets. 1 negociation packet and 3 requests. This program reads the NTSTATUS...

Exploit for CVE-2017-0144

PoC exploit for CVE-2017-0144, also known as Eternalblue-Doublepulsar. This Metasploit module exploits the vulnerability to install a Doublepulsar backdoor on a Windows system. The module targets the SMB protocol, specifically the Ring 0 SMB TCP 445 backdoor. The exploit is designed to run on...

Self-Propagating Lucifer Malware Targets Windows Systems

Security experts have identified a self-propagating malware, dubbed Lucifer, that targets Windows systems with cryptojacking and distributed denial-of-service DDoS attacks. The never-before-seen malware initially tries to infect PCs by bombarding them with exploits in hopes of taking advantage of...

InvisiMole Hackers Target High-Profile Military and Diplomatic Entities

Cybersecurity researchers today uncovered the modus operandi of an elusive threat group that hacks into the high-profile military and diplomatic entities in Eastern Europe for espionage. The findings are part of a collaborative analysis by cybersecurity firm ESET and the impacted firms, resulting...

Microsoft June Patch Tuesday Fixes 129 Flaws in Largest-Ever Update

Microsoft has released patches for 129 vulnerabilities as part of its June Patch Tuesday updates – the highest number of CVEs ever released by Microsoft in a single month. Within the blockbuster security update, 11 critical remote code-execution flaws were patched in Windows, SharePoint server,...

Looking at Big Threats Using Code Similarity. Part 1

Today, we are announcing the release of KTAE, the Kaspersky Threat Attribution Engine. This code attribution technology, developed initially for internal use by the Kaspersky Global Research and Analysis Team, is now being made available to a wider audience. You can read more about KTAE in our...

Exploit for CVE-2017-0144

PoC exploit for CVE-2017-0144 Eternalblue-Doublepulsar. The target product/service is Windows operating system, specifically the SMB Server Message Block protocol. The vulnerability class/vector is a remote code execution RCE vulnerability, which allows an attacker to execute arbitrary code on th...

Exploit for CVE-2017-0144

PoC exploit for CVE-2017-0144 EternalBlue using the Doublepulsar backdoor, implemented as a Metasploit module. The target product/service is Windows, and the vulnerability class is RCE Remote Code Execution. The probable entry point is the Metasploit module, and the notable dependency is the...

Exploit for CVE-2017-0144

PoC exploit for CVE-2017-0144, a remote code execution vulnerability in SMBv1. The exploit targets Windows 7 and 2008 R2 systems. The probable entry point is the eternalblue.py script, which is a Python implementation of the NSA EternalBlue SMB exploit. Not specified how it is typically invoked...

MS17-010

This repository is for public analysis of the MS17-010 vulnerability. The repository contains various scripts and exploits for demonstrating the vulnerability, including EternalBlue, Eternalchampion, and Eternalromance. The exploits are designed to target Windows systems and can be used to gain...

MTN Group: Disclosure of internal information using hidden NTLM authentication leading to an exploit server

By using a request get on the url http://www.mtncongo.net/fr/Pages/ of the blog. we collect sensitive information from blogs step Typically, when visiting a website http://www.mtncongo.net/ or directory http://www.mtncongo.net/fr/Pages/ requiring privileged access, the server will initiate a logi...

Q&A: Insights from the Red Canary 2020 Threat Detection Report

In light of the latest update to the MITRE ATT&CK framework, Red Canary has developed a Threat Detection Report uncovering the top techniques attackers use to target your organization. To understand the significance of the report, we turned to two of VMware Carbon Black’s top threat experts, Greg...

Microsoft Patch Tuesday March 2020: a new record was set, SMBv3 “Wormable” RCE and updates for February goldies

SMBv3 "Wormable" RCE Without a doubt, the hottest Microsoft vulnerability in March 2020 is the "Wormable" Remote Code Execution in SMB v3 CVE-2020-0796. The most commonly used names for this vulnerability are EternalDarkness, SMBGhost and CoronaBlue. There was a strange story of how it was...

New Lemon Duck Malware Campaign Targets IoT, Large Manufacturers

Printers, smart TVs and automated guided vehicles that depend on Windows 7 have become the latest juicy targets for cybercriminals leveraging a “self-spreading” variant of the malware Lemon Duck. In a report released Wednesday by TrapX Security, researchers warn manufacturers dependent on IoT...