SMB-Protocol-Vulnerability_CVE-2017-0144

LAB: ATAQUE AL SISTEMA OPERATIVO WINDOWS BASADO EN LA VULNERABILIDAD DEL PROTOCOLO SMB. 1. DESCRIPCIÓN 2. INTRODUCCIÓN 3. PREPARACIÓN 4. REALIZACIÓN DEL ATAQUE 5. CÓMO PREVENIR 1. DESCRIPCIÓN En este laboratorio usaremos dos computadoras para simular un ataque basado en la vulnerabilidad del...

eternalblue-ms17-010-research

💀 Investigación de Explotación EternalBlue MS17-010 Reproducción controlada de CVE-2017-0144: la vulnerabilidad SMB detrás del brote de ransomware WannaCry ⚠️ Aviso legal: Esta investigación se llevó a cabo en un entorno de laboratorio totalmente aislado y controlado, únicamente con fines...

EthernalBlue_report

Informe EthernalBlue ¿Qué es? Es un exploit desarrollado por la NSA, robado por un grupo de hackers, conocido principalmente por ser utilizado en ataques de ransomware, como WannaCry o NotPetya... ¿Por qué hiciste este informe? Me pidieron que hiciera este informe sobre la sala EthernalBlue de...

smb

root@kitploit: ███████╗███╗ ███╗██████╗ ███║ ██╔════╝████╗ ████║██╔══██╗ ║██║ ███████╗██╔████╔██║██████╔╝ ██║ ██ ║██║ ╚════██║██║╚██╔╝██║██╔══██╗ ╚██╗ ██ ╔╝██║ ███████║██║ ╚═╝ ██║██████╔╝ ╚████╔╝ ██║ ╚══════╝╚═╝ ╚═╝╚═════╝ ╚═══╝ ╚═╝ SMB es un protocolo de red que permite compartir archivos,...

EternalBlue-Exploit-Demonstration-MS17-010

Demostración del Exploit EternalBlue MS17-010 Laboratorio de ciberseguridad que demuestra la explotación de CVE-2017-0144 EternalBlue usando Metasploit contra un sistema Windows 7 vulnerable, obteniendo acceso a nivel SYSTEM a través de Meterpreter. Este proyecto también simula un ataque de...

chef_tissues

Tissues Instala el parche para CVE-2017-0145, también conocido como WannaCry. Más información: https://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Ransom:Win32/WannaCrypt Uso: root@kitploit: "name":"mynode", "runlist": "recipetissues"...

Triage-CVE-2017-0144

Triage: CVE-2017-0144 EternalBlue / SMBv1 — associated with WannaCry spread For this lab, the goal was to triage another well-known real-world vulnerability, this time EternalBlue, the SMBv1 flaw that was famously exploited by the WannaCry ransomware outbreak. Step 1: Open the CVE in NVD I went t...

Blackash-CVE-2017-0144

🌐 CVE-2017-0144 — EternalBlue: Vulnerabilidad de ejecución remota de código en Microsoft Windows SMBv1 "Un exploit. Decenas de familias de malware. Miles de millones en daños." 🔍 Resumen en una línea CVE-2017-0144 es una vulnerabilidad crítica de ejecución remota de código en la implementación de...

Triage-CVE-2017-0144

Triage: CVE-2017-0144 EternalBlue / SMBv1 — im Zusammenhang mit der WannaCry-Verbreitung Für dieses Lab war es das Ziel, eine weitere bekannte reale Schwachstelle zu triagieren, dieses Mal EternalBlue, den SMBv1-Fehler, der bekanntermaßen vom WannaCry-Ransomware-Ausbruch ausgenutzt wurde. Schritt...

wannacry-soc-lab

WannaCry SOC Investigation Lab Overview This project simu...

Exploit for CVE-2017-0144

Lab Guide: Exploatering av CVE-2017-0144 EternalBlue Denna...

Exploit for CVE-2017-0144

This repository is an offensive tool for Windows. It is an implementation of the DoublePulsar backdoor in C/C++. The tool includes a suite of exploits and detectors for various vulnerabilities, including the EternalBlue vulnerability CVE-2017-0144. The tool can be used to upload a DLL to a...

A (somewhat) complete timeline of Talos’ history

A lot has happened in Talos 10 years of existence. And to celebrate our birthday, we wanted to look back on some of the major moments in Talos history. Heres an overview of some of the major events, cyber attacks, research breakthroughs and more that truly make Talos Talos. We hope this walk down...

New Yashma Ransomware Variant Mimics WannaCry in New Attack

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A Vietnamese-origin threat actor employs a Yashma ransomware variant since June 2023, using unique GitHub-based ransom note delivery and mimicking WannaCry. This operation demonstrates the accelerated...

New Yashma Ransomware Variant Targets Multiple English-Speaking Countries

An unknown threat actor is using a variant of the Yashma ransomware to target various entities in English-speaking countries, Bulgaria, China, and Vietnam at least since June 4, 2023. Cisco Talos, in a new write-up, attributed the operation with moderate confidence to an adversary of likely...

K57181937: Multiple Microsoft SMB (Wannacry/Wannacrypt/Petya/Goldeneye) vulnerabilities

Security Advisory Description CVE-2017-0143 The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to...

IoC detection experiments with ChatGPT

ChatGPT is a groundbreaking chatbot powered by the neural network-based language model text-davinci-003 and trained on a large dataset of text from the Internet. It is capable of generating human-like text in a wide range of styles and formats. ChatGPT can be fine-tuned for specific tasks, such a...

CISA issues alert with South Korean government about DPRK's ransomware antics

CISA and other federal agencies were joined by the National Intelligence Service NIS and the Defense Security Agency of the Republic of Korea ROK in releasing the latest cybersecurity advisory in the US government's ongoing StopRansomware effort. This alert highlights continuous state-sponsored...

North Korean Hackers Targeting Healthcare with Ransomware to Fund its Operations

State-backed hackers from North Korea are conducting ransomware attacks against healthcare and critical infrastructure facilities to fund illicit activities, U.S. and South Korean cybersecurity and intelligence agencies warned in a joint advisory. The attacks, which demand cryptocurrency ransoms ...

Microsoft Reclassifies SPNEGO Extended Negotiation Security Vulnerability as 'Critical'

Microsoft has revised the severity of a security vulnerability it originally patched in September 2022, upgrading it to "Critical" after it emerged that it could be exploited to achieve remote code execution. Tracked as CVE-2022-37958 CVSS score: 8.1, the flaw was previously described as an...