Shadow Brokers EQGRP Lost in Translation resources - work in progress

scrapped from @x0rz,@etlow,@Dinosn,@hackerfantastic,@highmeh,@cyb3rops and others

Repositories

• https://github.com/x0rz/EQGRP_Lost_in_Translation
• https://github.com/fuzzbunch/fuzzbunch

Analysis

• A quick analysis of the latest Shadow Brokers dump https://labs.nettitude.com/blog/a-quick-analysis-of-the-latest-shadow-brokers-dump/
• Timestamps https://gist.github.com/Te-k/66b1fc143f12987bea7a71a39db9af30
• Shadow Brokers Exploit Reference Table https://docs.google.com/spreadsheets/d/1sD4rebofrkO9Rectt5S3Bzw6RnPpbJrMV-L1mS10HQc/edit#gid=1602324093

Tutorials/Demos

• HOW 2 SETUP + INSTALL FUZZBUNCH & DANDERSPRITZ https://gist.github.com/thomhastings/4cddfc1d00c43e1b0b60bd6076c6c0a3
• From git clone to Pwned - Owning Windows with DoublePulsar and EternalBlue (Part 1) http://www.pwn3d.org/posts/1721872-from-git-clone-to-pwned-owning-windows-with-doublepulsar-and-eternalblue-part-1
• A quick look at the NSA exploits & Dander Spiritz trojan https://hackernoon.com/a-quick-look-at-the-nsa-exploits-dander-spiritz-trojan-1b5428b0ee65
• Fuzzbunch on kali via wine: https://github.com/knightmare2600/ShadowBrokers/blob/master/Lost_In_Translation/FUZZBUNCH_linux.txt
• MS17-010 exploit with ELEGANTBLUE in FUZZBUNCH for implant DLL deployment using kernel DOUBLEPULSAR https://twitter.com/hackerfantastic/status/853536831056596992

Metasploit modules

• Microsoft Windows MS17-010 SMB Remote Code Execution https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/smb/smb_ms17_010.rb