chef_tissues

Tissues Instalar patch para CVE-2017-0145, também conhecido como WannaCry. Mais informações: https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/WannaCrypt Uso: root@kitploit: "name":"mynode", "runlist": "recipetissues"...

smb

root@kitploit: ███████╗███╗ ███╗██████╗ ███║ ██╔════╝████╗ ████║██╔══██╗ ║██║ ███████╗██╔████╔██║██████╔╝ ██║ ██ ║██║ ╚════██║██║╚██╔╝██║██╔══██╗ ╚██╗ ██ ╔╝██║ ███████║██║ ╚═╝ ██║██████╔╝ ╚████╔╝ ██║ ╚══════╝╚═╝ ╚═╝╚═════╝ ╚═══╝ ╚═╝ SMB è un protocollo di rete che consente di condividere file,...

EternalBlue-Exploit-Demonstration-MS17-010

Dimostrazione dell'Exploit EternalBlue MS17-010 Laboratorio di cybersecurity che dimostra lo sfruttamento della CVE-2017-0144 EternalBlue utilizzando Metasploit contro un sistema Windows 7 vulnerabile, ottenendo accesso a livello SYSTEM tramite Meterpreter. Questo progetto simula inoltre un attac...

Blackash-CVE-2017-0144

🌐 CVE-2017-0144 — EternalBlue: Vulnerabilidade de Execução Remota de Código no SMBv1 do Microsoft Windows "Um exploit. Dezenas de famílias de malware. Bilhões em danos." 🔍 Resumo em uma linha CVE-2017-0144 é uma vulnerabilidade crítica de execução remota de código na implementação do servidor SMB...

Triage-CVE-2017-0144

Triage: CVE-2017-0144 EternalBlue / SMBv1 — im Zusammenhang mit der Verbreitung von WannaCry Für diese Übung bestand das Ziel darin, eine weitere bekannte reale Schwachstelle zu triagieren, diesmal EternalBlue, den SMBv1-Fehler, der bekanntermaßen beim WannaCry-Ransomware-Ausbruch ausgenutzt wurd...

SMB-Protocol-Vulnerability_CVE-2017-0144

LAB: ATTACCO AL SISTEMA OPERATIVO WINDOWS BASATO SULLA VULNERABILITÀ DEL PROTOCOLLO SMB. 1. DESCRIZIONE 2. INTRODUZIONE GENERALE 3. PREPARAZIONE 4. ESECUZIONE DELL'ATTACCO 5. MISURE DI PREVENZIONE 1. DESCRIZIONE In questo laboratorio useremo due computer per simulare un attacco basato sulla...

EthernalBlue_report

EthernalBlue-Bericht Was ist das? Dies ist ein vom NSA entwickelter Exploit, der von einer Hackergruppe gestohlen wurde und vor allem für den Einsatz bei Ransomware-Angriffen wie WannaCry oder NotPetya bekannt ist... Warum hast du diesen Bericht erstellt? Ich wurde gebeten, diesen Bericht über de...

eternalblue-ms17-010-research

💀 EternalBlue MS17-010 Ricerca sullo Sfruttamento Riproduzione controllata di CVE-2017-0144 — la vulnerabilità SMB dietro l'epidemia del ransomware WannaCry ⚠️ Disclaimer: Questa ricerca è stata condotta in un ambiente di laboratorio completamente isolato e controllato, esclusivamente per scopi...

Triage-CVE-2017-0144

Triage: CVE-2017-0144 EternalBlue / SMBv1 — im Zusammenhang mit der WannaCry-Verbreitung Für dieses Lab war es das Ziel, eine weitere bekannte reale Schwachstelle zu triagieren, dieses Mal EternalBlue, den SMBv1-Fehler, der bekanntermaßen vom WannaCry-Ransomware-Ausbruch ausgenutzt wurde. Schritt...

wannacry-soc-lab

WannaCry SOC Investigation Lab Overview This project simu...

Exploit for CVE-2017-0144

Lab Guide: Exploatering av CVE-2017-0144 EternalBlue Denna...

Exploit for CVE-2017-0144

This repository is an offensive tool for Windows. It is an implementation of the DoublePulsar backdoor in C/C++. The tool includes a suite of exploits and detectors for various vulnerabilities, including the EternalBlue vulnerability CVE-2017-0144. The tool can be used to upload a DLL to a...

A (somewhat) complete timeline of Talos’ history

A lot has happened in Talos 10 years of existence. And to celebrate our birthday, we wanted to look back on some of the major moments in Talos history. Heres an overview of some of the major events, cyber attacks, research breakthroughs and more that truly make Talos Talos. We hope this walk down...

New Yashma Ransomware Variant Mimics WannaCry in New Attack

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A Vietnamese-origin threat actor employs a Yashma ransomware variant since June 2023, using unique GitHub-based ransom note delivery and mimicking WannaCry. This operation demonstrates the accelerated...

New Yashma Ransomware Variant Targets Multiple English-Speaking Countries

An unknown threat actor is using a variant of the Yashma ransomware to target various entities in English-speaking countries, Bulgaria, China, and Vietnam at least since June 4, 2023. Cisco Talos, in a new write-up, attributed the operation with moderate confidence to an adversary of likely...

K57181937: Multiple Microsoft SMB (Wannacry/Wannacrypt/Petya/Goldeneye) vulnerabilities

Security Advisory Description CVE-2017-0143 The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to...

IoC detection experiments with ChatGPT

ChatGPT is a groundbreaking chatbot powered by the neural network-based language model text-davinci-003 and trained on a large dataset of text from the Internet. It is capable of generating human-like text in a wide range of styles and formats. ChatGPT can be fine-tuned for specific tasks, such a...

CISA issues alert with South Korean government about DPRK's ransomware antics

CISA and other federal agencies were joined by the National Intelligence Service NIS and the Defense Security Agency of the Republic of Korea ROK in releasing the latest cybersecurity advisory in the US government's ongoing StopRansomware effort. This alert highlights continuous state-sponsored...

North Korean Hackers Targeting Healthcare with Ransomware to Fund its Operations

State-backed hackers from North Korea are conducting ransomware attacks against healthcare and critical infrastructure facilities to fund illicit activities, U.S. and South Korean cybersecurity and intelligence agencies warned in a joint advisory. The attacks, which demand cryptocurrency ransoms ...

Microsoft Reclassifies SPNEGO Extended Negotiation Security Vulnerability as 'Critical'

Microsoft has revised the severity of a security vulnerability it originally patched in September 2022, upgrading it to "Critical" after it emerged that it could be exploited to achieve remote code execution. Tracked as CVE-2022-37958 CVSS score: 8.1, the flaw was previously described as an...