Author Archives: zam

Shell hiding in image files

One day, we noticed strange GET request towards our JBoss server:

From the request above, you’ll quickly noticed that this attack leveraging Apache Struts vulnerability from CVE-2017-5638.

The request tried to execute command below:

“-O” : writes the documents to file.
“-” : if is used as file, documents will be printed to standard output, disabling link conversion.
“-q” : quiet (no output)

As you see, it tried to fetch image (jpeg file) from 91.230.47.41. Seems normal right?
We fetch the file & take a look at the jpg file:

ASCII?? Not JPEG?? hmm..
Here’s whats inside the “logo.jpg” file:

We noticed there are several other file fetched; possibly a config file & bin file.
Let’s fetch those file!

Here is the config file:
http://91.230.47.41/pics/kworker.conf

Not sure it is. Maybe bin file to run a process:
http://91.230.47.41/pics/kworker

Lets see if the file is packed:

Yup. So lets unpacked the file using UPX:

http://91.230.47.41/pics/kworker_na

Overall, looks like the attacker want to hack our servers & turn it into his own crypto currency mining machine.
Typical behavior of attack we see in this time where the crypto currency is rising. People hack to make profit. 🙂

Here the MD5 for file above:

Configure Cisco switch from Mac OS X through console port

Recently, I was searching for rollover cable that use to connect your PC/laptop to your switch via console port. It took me for a while searching this kind of cable in Low Yat Plaza, KL. Here, you can find variety of electronics stuff from PC hardware to servers stuffs.

But, it was hard for me to find this cable. After several visit to Low Yat, I managed to find the cable together with DB9 to USB converter. As you know, the rollover cable is using serial to ethernet cable. So, this post will guide you on how to install the driver and connect your rollover cable to your switch from Mac OS X.

So, for the first step, you should have rollover cable that looks like this:

Rollover to DB9/serial cable

Rollover to DB9/serial cable

And the DB9 to USB 2.0 converter. The one that I’m using is like this:
http://www.vztec.com.my/?sec=product&type=connect&sub=5&id=13776589936053

For my Mac OS X version, I’m using Mac OS X Yosemite 10.10.5 on MacBook Pro (13-inch, Early 2011). You’ll need the driver for the cables that you can download at here:
http://www.prolific.com.tw/UserFiles/files/PL2303_MacOSX_1_6_1_20160309.zip

After you’ve done downloading and extracting the driver, just click at .pkg file and proceed to install the driver. Reminder, make sure you restarted you machine after installing the driver in order for system to take effect:

DB9 to USB Converter driver

DB9 to USB Converter driver

Then, connect/plug-in the rollover cable to DB9 to USB converter. Then connect the converter USB to you Mac. After all has been connected, click on Apple logo on top left menu bar, click About This Mac, on Overview tabs, click System Report. Ensure that you DB9 converter is connected:

Mac OS X System Info

Mac OS X System Info

After restart, you can verify if the driver has successfully installed and loaded to the system by using this command:

or

Now finally, you need an application which will talk to the serial port. We’ll using Terminal app on Mac OS X. On Mac, the file which maps to the port is /dev/cu.usbserial. Once all the cable has been connected, run this command to start connecting to you switch:

Flatten a Nested Directory & File Hierarchy from Command Line of OS X

Lets say you have this kind of file/folder structure:

You can take all the *.jpg file or any file type, and move it into one folder.
Here are the command to use:

Upgrade Python packages at using pip

As you read in the title above; to update your python packages via pip:

for Linux/*nix:

p/s: you may need to run as sudo. Probably.

for Windows:

Credit: http://stackoverflow.com/questions/2720014/upgrading-all-packages-with-pip

Fixing wp_termmeta doesn’t exist error

One day, I open my mailbox and see bunch of error mail written something like this:

Upon diving in Google ocean, I found this solution that may solve the problem:

Use this SQL query to add manually the wp_termmeta table in your WordPress database if there is the wp_termmeta table doesn’t exist in your DB.

Credit: http://zanca.it/tutorials/wp_termmeta-doesnt-exist-error-solved/

Install more command line utils for Terminal app in IOS

In case you wonder how to use command line utils like ifconfig or netstat in you IOS devices (iPhone), install this package via Cydia:

adv-cmds – finger, fingerd, last, lsvfs, md, ps
diskdev-cmds – mount, quota, fsck, fstyp, fdisk, tunefs
network-cmds – arp, ifconfig, netstat, route, traceroute
shell-cmds – killall, mktemp, renice, time, which
file-cmds – chflags, compress, ipcrm, ipcs, pax
system-cmds – iostat, login, passwd, sync, sysctl
basic-cmds – msg, uudecode, uuencode, write

Credit : http://forums.whirlpool.net.au/archive/1718105

Shell script fails: Syntax error: “(” unexpected

The error when executing the bash code:

The script does not begin with a shebang line, so the kernel executes it with /bin/sh. On Ubuntu, /bin/sh is dash, a shell designed for fast startup and execution with only standard features. When dash reaches the line, it sees a syntax error: that parenthesis doesn’t mean anything to it in context.

Since dash (like all other shells) is an interpreter, it won’t complain until the execution reaches the problematic line. So even if the script successfully started at some point in your testing, it would have aborted once the problematic line was reached.

The shebang line must be the very first thing in the file. Since you use bash features, the first line of the file must be #!/bin/bash or #!/usr/bin/env bash.

Credit: http://unix.stackexchange.com/questions/45781/shell-script-fails-syntax-error-unexpected

Python Error – InsecurePlatformWarning

There is one time I see this kind of error:

If you’re on ubuntu, you may run into trouble installing pyopenssl, you’ll need these dependencies:

You only need to install the security package extras:

or, install them directly:

Requests will then automatically inject pyopenssl into urllib3

Credit: http://stackoverflow.com/questions/29134512/insecureplatformwarning-a-true-sslcontext-object-is-not-available-this-prevent

Python Error – ImportError: No module named pkg_resources

There is one time I tried to install some python package via pip install requirement. But I encountered some error like this:

To fix the issue, run the setup script for setuptools:

Yeah. it solve my problem. Probably. XD

Credit: http://stackoverflow.com/questions/7446187/no-module-named-pkg-resources