Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

How Did The WannaCry Worm Spread Initially (Outside of LAN)?

Hey HackForums,

Has there been an analysis of commonalities of entry points into networks, or traces back to specific sources of the infections? I'd be very interested in learning exactly how WannaCry got into these LAN's that they used ETERNALBLUE on.
(May 27, 2017 11:09 AM)Noah Hawrysko Wrote:  Hey HackForums,

Has there been an analysis of commonalities of entry points into networks, or traces back to specific sources of the infections? I'd be very interested in learning exactly how WannaCry got into these LAN's that they used ETERNALBLUE on.

it would scan IPs for the open smb port and the implant. once it compromised one computer on the network it could spread to more. thats p much it.
humble rubyist in a world of pythonistas
(May 27, 2017 12:07 PM)Faith Connors Wrote:  it would scan IPs for the open smb port and the implant. once it compromised one computer on the network it could spread to more. thats p much it.

Got it, they're just using a shotgun method to hit all IP's to port-scan them, then it spreads from there.

I remember seeing you on this forum many months ago, and it sounded like you didn't know much and were still learning. How has that gone for you? Also, would you recommend being active on HF to increase knowledge in areas of technical exploitation, or is this forum more of one where all the good content has been written and now you just look back on it to learn from it?
(May 28, 2017 09:16 AM)Noah Hawrysko Wrote:  Got it, they're just using a shotgun method to hit all IP's to port-scan them, then it spreads from there.

I remember seeing you on this forum many months ago, and it sounded like you didn't know much and were still learning. How has that gone for you? Also, would you recommend being active on HF to increase knowledge in areas of technical exploitation, or is this forum more of one where all the good content has been written and now you just look back on it to learn from it?

If your looking for extremely blackhat type things, dont hang around here, if your looking for people with brains and good knowledge, you can find a fair few. Just had a nice conversation with someone on here about bug bountys and the user really knew what he was doing. Honestly this is a nice community to hang around and learn from, thats what i did.
evening chaps
(May 28, 2017 09:16 AM)Noah Hawrysko Wrote:  Got it, they're just using a shotgun method to hit all IP's to port-scan them, then it spreads from there.

I remember seeing you on this forum many months ago, and it sounded like you didn't know much and were still learning. How has that gone for you? Also, would you recommend being active on HF to increase knowledge in areas of technical exploitation, or is this forum more of one where all the good content has been written and now you just look back on it to learn from it?

a bit of both honestly, ive gotten better myself, i stick around to (sometimes) help out and shitpost. there is some good content but a lot of it is still sub-par to other sources or proprietary courses. it's a great starting point but don't expect anything indepth.
humble rubyist in a world of pythonistas


Possibly Related Threads...
Thread / Author Replies Views Last Post
by OmniscientMay 22, 2025 10:09 PM 5 284 May 22, 2025 10:09 PM
Last Post: Phantom_NiNja
by 1543135912Aug 1, 2021 04:40 AM 2 239 Aug 1, 2021 04:40 AM
Last Post: 1543135912
by scamb8rsMay 27, 2020 01:13 PM 6 362 May 27, 2020 01:13 PM
Last Post: scamb8rs