+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: How Did The WannaCry Worm Spread Initially (Outside of LAN)? (/showthread.php?tid=5633071)
How Did The WannaCry Worm Spread Initially (Outside of LAN)? - Noah Hawrysko - May 27, 2017
Hey HackForums,
Has there been an analysis of commonalities of entry points into networks, or traces back to specific sources of the infections? I'd be very interested in learning exactly how WannaCry got into these LAN's that they used ETERNALBLUE on.
* - Faith Connors - May 27, 2017
(May 27, 2017 11:09 AM)Noah Hawrysko Wrote: Hey HackForums,
Has there been an analysis of commonalities of entry points into networks, or traces back to specific sources of the infections? I'd be very interested in learning exactly how WannaCry got into these LAN's that they used ETERNALBLUE on.
it would scan IPs for the open smb port and the implant. once it compromised one computer on the network it could spread to more. thats p much it.
* - Noah Hawrysko - May 28, 2017
(May 27, 2017 12:07 PM)Faith Connors Wrote: it would scan IPs for the open smb port and the implant. once it compromised one computer on the network it could spread to more. thats p much it.
Got it, they're just using a shotgun method to hit all IP's to port-scan them, then it spreads from there.
I remember seeing you on this forum many months ago, and it sounded like you didn't know much and were still learning. How has that gone for you? Also, would you recommend being active on HF to increase knowledge in areas of technical exploitation, or is this forum more of one where all the good content has been written and now you just look back on it to learn from it?
* - Flaws. - May 28, 2017
(May 28, 2017 09:16 AM)Noah Hawrysko Wrote: Got it, they're just using a shotgun method to hit all IP's to port-scan them, then it spreads from there.
I remember seeing you on this forum many months ago, and it sounded like you didn't know much and were still learning. How has that gone for you? Also, would you recommend being active on HF to increase knowledge in areas of technical exploitation, or is this forum more of one where all the good content has been written and now you just look back on it to learn from it?
If your looking for extremely blackhat type things, dont hang around here, if your looking for people with brains and good knowledge, you can find a fair few. Just had a nice conversation with someone on here about bug bountys and the user really knew what he was doing. Honestly this is a nice community to hang around and learn from, thats what i did.
* - Faith Connors - May 28, 2017
(May 28, 2017 09:16 AM)Noah Hawrysko Wrote: Got it, they're just using a shotgun method to hit all IP's to port-scan them, then it spreads from there.
I remember seeing you on this forum many months ago, and it sounded like you didn't know much and were still learning. How has that gone for you? Also, would you recommend being active on HF to increase knowledge in areas of technical exploitation, or is this forum more of one where all the good content has been written and now you just look back on it to learn from it?
a bit of both honestly, ive gotten better myself, i stick around to (sometimes) help out and shitpost. there is some good content but a lot of it is still sub-par to other sources or proprietary courses. it's a great starting point but don't expect anything indepth.