SMB-Protocol-Vulnerability_CVE-2017-0144

LAB: ATTACKING THE WINDOWS OPERATING SYSTEM VIA THE SMB PROTOCOL VULNERABILITY. 1. DESCRIPTION 2. GENERAL INTRODUCTION 3. PREPARATION 4. PERFORMING THE ATTACK 5. HOW TO PREVENT 1. DESCRIPTION In this lab, we will use two computers to simulate an attack based on a vulnerability in the SMB...

eternalblue-ms17-010-research

💀 EternalBlue MS17-010 Exploitation Research Controlled reproduction of CVE-2017-0144 — the SMB vulnerability behind the WannaCry ransomware outbreak ⚠️ Disclaimer: This research was conducted in a fully isolated, controlled lab environment for academic and educational purposes only. No production...

EthernalBlue_report

EthernalBlue レポート それは何ですか？ これはNSAによって開発され、ハッカーグループに盗まれたエクスプロイトで、主にWannaCryやNotPetyaなどのランサムウェア攻撃に使用されたことで知られています... なぜこのレポートを作成したのですか？ TryhackmeのEthernalBlueルームについて、しかしこのルームの主目的であるMetasploitを使用せずにレポートを作成するよう依頼されました。 詳細情報？ EthernalBlueについて詳しく知りたい場合は、以下のリソースを参照してください： Wikipedia Microsoft Youtube -...

smb

root@kitploit: ███████╗███╗ ███╗██████╗ ███║ ██╔════╝████╗ ████║██╔══██╗ ║██║ ███████╗██╔████╔██║██████╔╝ ██║ ██ ║██║ ╚════██║██║╚██╔╝██║██╔══██╗ ╚██╗ ██ ╔╝██║ ███████║██║ ╚═╝ ██║██████╔╝ ╚████╔╝ ██║ ╚══════╝╚═╝ ╚═╝╚═════╝ ╚═══╝ ╚═╝ SMB is a network protocol that allows sharing files, printers an...

Triage-CVE-2017-0144

分类分析：CVE-2017-0144（永恒之蓝 / SMBv1 — 与 WannaCry 传播相关） 对于本实验，目标是分析另一个众所周知的真实世界漏洞，这次是永恒之蓝（EternalBlue），即 SMBv1 缺陷，它曾被 WannaCry 勒索软件爆发大规模利用。 第 1 步：在 NVD 中打开 CVE 我访问了国家漏洞数据库（NVD）并检索了该 CVE： root@kitploit: https://nvd.nist.gov/vuln/search/nvd/home?resultType=records 我搜索了 CVE-2017-0144 并打开了结果页面。 第 2...

EternalBlue-Exploit-Demonstration-MS17-010

EternalBlue Exploit Demonstration MS17-010 Cybersecurity lab demonstrating exploitation of CVE-2017-0144 EternalBlue using Metasploit against a vulnerable Windows 7 system, achieving SYSTEM-level access via Meterpreter. This project also simulates a WannaCry-style ransomware attack SAFE DEMO and...

Blackash-CVE-2017-0144

🌐 CVE-2017-0144 — EternalBlue：Microsoft Windows SMBv1 远程代码执行漏洞 "一个漏洞利用。数十种恶意软件家族。数十亿美元的损失。" 🔍 一句话总结 CVE-2017-0144 是 Microsoft Windows 中 SMBv1 服务器实现的一个严重远程代码执行漏洞。被称为 EternalBlue 的利用程序利用了这个漏洞，并用于高影响攻击（特别是 WannaCry）。 🔥 使用 EternalBlue 的十大恶意软件（详细）...

chef_tissues

Tissues 安装针对 CVE-2017-0145（又名 WannaCry）的补丁。 更多信息：https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/WannaCrypt 用法： root@kitploit: "name":"mynode", "runlist": "recipetissues"...

Triage-CVE-2017-0144

Triage: CVE-2017-0144 EternalBlue / SMBv1 — im Zusammenhang mit der WannaCry-Verbreitung Für dieses Lab war es das Ziel, eine weitere bekannte reale Schwachstelle zu triagieren, dieses Mal EternalBlue, den SMBv1-Fehler, der bekanntermaßen vom WannaCry-Ransomware-Ausbruch ausgenutzt wurde. Schritt...

wannacry-soc-lab

WannaCry SOC Investigation Lab Overview This project simu...

Exploit for CVE-2017-0144

Lab Guide: Exploatering av CVE-2017-0144 EternalBlue Denna...

Exploit for CVE-2017-0144

This repository is an offensive tool for Windows. It is an implementation of the DoublePulsar backdoor in C/C++. The tool includes a suite of exploits and detectors for various vulnerabilities, including the EternalBlue vulnerability CVE-2017-0144. The tool can be used to upload a DLL to a...

A (somewhat) complete timeline of Talos’ history

A lot has happened in Talos 10 years of existence. And to celebrate our birthday, we wanted to look back on some of the major moments in Talos history. Heres an overview of some of the major events, cyber attacks, research breakthroughs and more that truly make Talos Talos. We hope this walk down...

New Yashma Ransomware Variant Mimics WannaCry in New Attack

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A Vietnamese-origin threat actor employs a Yashma ransomware variant since June 2023, using unique GitHub-based ransom note delivery and mimicking WannaCry. This operation demonstrates the accelerated...

New Yashma Ransomware Variant Targets Multiple English-Speaking Countries

An unknown threat actor is using a variant of the Yashma ransomware to target various entities in English-speaking countries, Bulgaria, China, and Vietnam at least since June 4, 2023. Cisco Talos, in a new write-up, attributed the operation with moderate confidence to an adversary of likely...

K57181937: Multiple Microsoft SMB (Wannacry/Wannacrypt/Petya/Goldeneye) vulnerabilities

Security Advisory Description CVE-2017-0143 The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to...

IoC detection experiments with ChatGPT

ChatGPT is a groundbreaking chatbot powered by the neural network-based language model text-davinci-003 and trained on a large dataset of text from the Internet. It is capable of generating human-like text in a wide range of styles and formats. ChatGPT can be fine-tuned for specific tasks, such a...

CISA issues alert with South Korean government about DPRK's ransomware antics

CISA and other federal agencies were joined by the National Intelligence Service NIS and the Defense Security Agency of the Republic of Korea ROK in releasing the latest cybersecurity advisory in the US government's ongoing StopRansomware effort. This alert highlights continuous state-sponsored...

North Korean Hackers Targeting Healthcare with Ransomware to Fund its Operations

State-backed hackers from North Korea are conducting ransomware attacks against healthcare and critical infrastructure facilities to fund illicit activities, U.S. and South Korean cybersecurity and intelligence agencies warned in a joint advisory. The attacks, which demand cryptocurrency ransoms ...

Microsoft Reclassifies SPNEGO Extended Negotiation Security Vulnerability as 'Critical'

Microsoft has revised the severity of a security vulnerability it originally patched in September 2022, upgrading it to "Critical" after it emerged that it could be exploited to achieve remote code execution. Tracked as CVE-2022-37958 CVSS score: 8.1, the flaw was previously described as an...