Skip to content

Commit 5f0b92f

Browse files
author
Luke Jennings
committed
Adding author details
1 parent 8d3123c commit 5f0b92f

File tree

2 files changed

+5
-1
lines changed

2 files changed

+5
-1
lines changed

README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
Author: Luke Jennings ([email protected] - @jukelennings)
2+
Company: Countercept (@countercept)
3+
Website: https://countercept.com
4+
15
A python2 script for sweeping a list of IPs for the presence of the DOUBLEPULSAR SMB implant that was released by the Shadow Brokers. Supports both single IP checking and a list of IPs in a file with multi-threading support.
26

37
This is a very early release in the interests of allowing people to find compromises on their network now that these exploits are in the wild and no doubt being used to target organizations. It re-implements the ping command of the implant, which can be used remotely without authentication, in order to determine if a system is infected or not.

detect_doublepulsar.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
trans2_session_setup = binascii.unhexlify("0000004eff534d4232000000001807c00000000000000000000000000008fffe000841000f0c0000000100000000000000a6d9a40000000c00420000004e0001000e000d0000000000000000000000000000")
1515

1616
# Arguments
17-
parser = argparse.ArgumentParser(description='Detect present of DOUBLEPULSAR implant')
17+
parser = argparse.ArgumentParser(description="Detect present of DOUBLEPULSAR implant\n\nAuthor: Luke Jennings\nWebsite: https://countercept.com\nTwitter: @countercept", formatter_class=argparse.RawTextHelpFormatter)
1818
group = parser.add_mutually_exclusive_group(required=True)
1919
group.add_argument('--ip', help='Single IP address to check')
2020
group.add_argument('--file', help='File containing a list of IP addresses to check')

0 commit comments

Comments
 (0)