YANZ UPLOAD ANJG
#! /usr/bin/python3
'''
frob: fix something
'''
# see also maintenance/protect
import sys
import os
import glob
import pwd
import stat
import re
import random
import time
import socket
import syslog
ipcs_remove_apache_cmd=""" for i in `ipcs -s | grep nobody | awk '{print $2}'` ; do ipcrm sem $i; done """
def frob():
r = "/usr/local/afribin/frob"
if os.path.exists(r): return r
import inspect
return inspect.getfile(frob)
class CpanelData:
def __init__(self,user=None, verbose=True):
'''Open user file'''
self.verbose=verbose
if not user: user=self.userfromcwd()
self.setuser(user)
def setuser(self,user):
'''Make the user blah'''
self.user=user
self.getcpaneldata()
self.makeapacheconfdir()
def userfromcwd(self):
'''Choose user from current working directory'''
user=os.getcwd().split("/home/",1)[1].split("/",1)[0]
if not user:
print(os.getcwd(),"does not seem to indicate a user")
sys.exit()
return user
def has_site(self,site):
# FIXME: this does not handle site aliases in the userdata files
for key in [ "DNS", "DNS1", "DNS2", "DNS3" ] :
if self.cpanel.get(key,'')==site: return True
if "www."+self.cpanel.get(key,'')==site: return True
return False
def getcpaneldata(self):
'''Read the cpanel data file into self.cpanel[]'''
cpaneldatafile=open("/var/cpanel/users/"+self.user,"r");
self.cpanel={}
for line in cpaneldatafile:
bits=line.split("=",1)
if len(bits)>1: self.cpanel[bits[0].strip()]=bits[1].strip()
cpaneldatafile.close()
return self.cpanel
def setitem(self,item,value):
cpaneldatafile=open("/var/cpanel/users/"+self.user,"r");
out=[]
for line in cpaneldatafile:
if line.startswith(item+"="): continue
out.append(line)
if len(out)>0 and not out[-1].endswith('\n'):
out.append("\n")
cpaneldatafile.close()
out.append(item+'='+value+"\n")
cpaneldatafile=open("/var/cpanel/users/"+self.user,"w");
cpaneldatafile.writelines(out)
cpaneldatafile.close()
return value
def mkdir_p(self,dir):
bits=dir.split("/")
for a in range(1,len(bits)+1):
try:
os.mkdir("/".join(bits[:a]))
except:
pass
def makeapacheconfdir(self):
'''Get the apache dir for configs'''
if not self.cpanel: self.getcpaneldata()
apacheconfbase="/usr/local/apache/conf/userdata/std/2/"+self.user;
apachesslbase ="/usr/local/apache/conf/userdata/ssl/2/"+self.user;
self.mkdir_p(apacheconfbase)
self.mkdir_p(apachesslbase)
apacheconfdir=apacheconfbase+"/"+self.cpanel['DNS']
self.mkdir_p(apacheconfdir)
for dns in ("DNS","DNS1","DNS2","DNS3","DNS4"):
if dns not in self.cpanel: continue
for linkdir in (apacheconfbase,apachesslbase):
linkname = linkdir+"/"+self.cpanel[dns]
if os.path.exists(linkname): continue
os.symlink(apacheconfdir,linkname)
self.apacheconfdir=apacheconfdir
return apacheconfdir
def __update(self):
'''Get '''
self.getcpaneldata()
def get_apachecustomfile(self,filename):
'''Figure out where to put the modsecurity stuff'''
self.makeapacheconfdir()
return self.apacheconfdir+"/"+filename
def get_modsecinifile(self):
'''Figure out where to put the modsecurity stuff'''
self.modsecinifile=self.get_apachecustomfile("modsec.conf")
return self.modsecinifile
def read_modsecinifile(self):
self.get_modsecinifile()
self.modsec={}
self.modsec['SecRuleRemoveById']=[]
if os.path.exists(self.modsecinifile):
f = open(self.modsecinifile,"r")
self.modseclines=f.readlines()
f.close()
else:
self.modseclines=[]
for line in self.modseclines:
line=line.strip();
match=re.search(r'^\s*#',line)
if match: continue
match=re.search(r'SecRuleEngine +(\S+)',line)
if match:
self.modsec['SecRuleEngine']=match.group(1)
match=re.search(r'SecRuleEngine _(\S+)',line)
match=re.search(r'SecRuleRemoveById +(.*)',line)
if match:
self.modsec['SecRuleRemoveById'].extend(match.group(1).split())
def write_modsecinifile(self,reason=''):
self.get_modsecinifile()
nomodsec= \
"""
# %(reason)s
SecRuleEngine %(SecRuleEngine)s
"""
template= \
"""
# Turn off specific rules
SecRuleEngine On
SecRuleRemoveById %(SecRuleRemoveById)s
"""
self.modsec['reason']=reason
if self.modsec.get('SecRuleEngine','')=="Off" \
or len(self.modsec.get("SecRuleRemoveById",[]))==0:
out=nomodsec % dict(
SecRuleEngine=self.modsec.get("SecRuleEngine","On"),
reason=reason,
)
else:
out=template % dict(
SecRuleRemoveById=" ".join(self.modsec.get("SecRuleRemoveById",[])),
reason=reason,
)
f = open(self.modsecinifile,"w")
f.write(out)
f.close()
if self.verbose:
print("Wrote %s -- frob rebuild to rebuild and reload" % self.modsecinifile)
def do_frob(i):
print(r""" If you've got the job, we've got the frob.
___ ______
/__/\ ___/_____/\
\ \ \ / /\\
\ \ \_/__ / \
_\ \ \ /\_____/___ \
// \__\/ / \ /\ \
_______//_______/ \ / _\/______
/ / \ \ / / / /\
__/ / \ \ / / / / _\__
/ / / \_______\/ / / / / /\
/_/______/___________________/ /________/ /___/ \
\ \ \ ___________ \ \ \ \ \ /
\_\ \ / /\ \ \ \ \___\/
\ \/ / \ \ \ \ /
\_____/ / \ \ \________\/
/__________/ \ \ /
\ _____ \ /_____\/
\ / /\ \ / \ \ \
/____/ \ \ / \ \ \
\ \ /___\/ \ \ \
\____\/ \__\/ """)
def fix_ipcs():
# FIXME: this does not handle site aliases in the userdata files
global ipcs_remove_apache_cmd
os.system(ipcs_remove_apache_cmd)
def do_strace(usernames):
"Install (and remove) strace wrapper"
phpexec = "/usr/local/cpanel/cgi-sys/php5"
phpexec_o = phpexec+".orig"
lines = open(phpexec,'r').readlines()
if lines[0].find("#!")!=0:
print("It doesn't look like",phpexec,"is a wrapper file")
return
open(phpexec_o,'w').writelines(lines)
out = []
droplevel=0
for line in lines:
if line.find('exec ')==0 and len(usernames):
userlist='|'.join(usernames)
out.append('USER=`whoami`\n')
out.append('case $USER in\n')
out.append(' %s) mkdir -p /tmp/$USER; chmod 700 /tmp/$USER; exec /usr/bin/strace -f -s 256 -t -o /tmp/$USER/strace-$$ /usr/bin/php "$@" ;;\n' % userlist)
out.append('esac\n')
if line.find("USER=")==0:
droplevel+=1
if droplevel==0:
out.append(line)
if line.find("esac")==0:
droplevel=0
open(phpexec,'w').writelines(out)
def pwtest(username,password):
'submit test via smtp'
import base64
params = dict(
u64 = base64.encodestring(username).strip(" \n\r"),
p64 = base64.encodestring(password).strip(" \n\r"),
helo = 'i.r.testa',
mailfrom = username,
rcptto = 'joe@hostmail.com',
)
test=os.popen("exim -dd -bhc 160.124.1.1",'w')
smtp = """EHLO %(helo)s
AUTH LOGIN
%(u64)s
%(p64)s
MAIL FROM: <%(mailfrom)s>
RCPT TO: <%(rcptto)s>
DATA
From: <%(mailfrom)s>
To: <%(rcptto)s>
Subject: not a real mail
test
.
QUIT
""" % params
print(smtp)
test.write(smtp)
test.close()
def has_fcgi():
# grep '^AddHandler fcgid-script .*\.php' /usr/local/apache/conf/php.conf >& /dev/null || exit
# grep '^Include "/usr/local/apache/conf/php.conf"' /etc/httpd/conf/httpd.conf >& /dev/null || exit
httpdconf=open("/usr/local/apache/conf/httpd.conf",'r')
httpdconf_re = re.compile(r'^\s*Include\s+"/usr/local/apache/conf/php.conf"')
Found=False
for line in httpdconf:
if httpdconf_re.search(line):
Found=True
break
if not Found: return False
phpconf=open("/usr/local/apache/conf/php.conf",'r')
phpconf_re = re.compile(r'^\s*AddHandler\s+fcgid-script\s.*\.php')
Found=False
for line in phpconf:
if phpconf_re.search(line):
Found=True
break
if not Found: return False
# We got it ...
return True
# Functions that do something related to files owned by 'nobody'
def uid_nobody():
'return the uid for nobody'
return pwd.getpwnam("nobody").pw_uid
def nobodyfile(file):
'Is the named file a regular file owned by nobody'
nobody=uid_nobody()
try:
fileinfo = os.stat(file)
if fileinfo.st_uid == nobody and fileinfo.S_ISDIR(stat.st_mode):
return True
except:
pass
return False
def hasnobodyfile(dir):
'Check if there are any nobody files in the directory'
for file in glob.glob(dir+'/*'):
if nobodyfile(file): return True
return False
def hasphpfiles(dir):
'Check if there are any legitimate php files in the directory'
for file in glob.glob(dir+'/*.php'):
return True
return False
def htaccess_patch(htaccessfile):
'Patch a .htaccess file and return directives required for the php.ini'
fd = open(htaccessfile,'r')
lines=[]
phpinidirectives=[]
phpvalue = re.compile(r"""^\s*php_(admin_value|value|flag)\s+['"]?([^"']*)""", re.IGNORECASE)
drupal_disabled_php = re.compile(r"""^\s*SetHandler\s""", re.IGNORECASE)
optionsymlink = re.compile(r"^\s*Option.*(FollowSymLinks)", re.IGNORECASE)
ifmodule = re.compile(r"", re.IGNORECASE)
endifmodule = re.compile(r"", re.IGNORECASE)
modified = False
adding_ifmodule=False
ifmodule_depth=0
isdrupal=False
for line in fd:
if line[-1:] != "\n": line += "\n"
phpvalue_m = phpvalue.search(line.strip())
ifmodule_m = ifmodule.search(line.strip())
endifmodule_m = endifmodule.search(line.strip())
if ifmodule_m:
ifmodule_depth+=1
if endifmodule_m:
ifmodule_depth=max(ifmodule_depth-1,0)
# print ifmodule_depth,adding_ifmodule,line.strip()
if phpvalue_m:
value=phpvalue_m.group(2)
value=value.strip('=\r\n\t \'"')
phpinidirectives.append(value)
if ( not adding_ifmodule ) and ( ifmodule_depth==0):
lines.append("\n")
ifmodule_depth+=1
adding_ifmodule= True
modified = True
lines.append(line)
continue
else:
if adding_ifmodule and len(line.strip())>0:
lines.append("\n")
ifmodule_depth -= 1
adding_ifmodule=False;
if drupal_disabled_php.search(line):
isdrupal = True
optionsymlink_m = optionsymlink.search(line.strip())
if optionsymlink_m and not isdrupal:
lines.append("# FollowSymLinks conflicts with mod_fcgid:\n") # but if we're not doing fcgi anymore then hey
lines.append("## "+line)
modified = True
continue
lines.append(line)
if adding_ifmodule:
lines.append("\n")
adding_ifmodule=False;
fd.close()
if modified:
fd = open(htaccessfile,'w')
fd.writelines(lines)
fd.close()
return phpinidirectives
class phpini:
def __init__(self):
self.cpanel=CpanelData()
self.php_ini = "/home/"+self.cpanel.user+"/php.ini"
self.load()
def load(self):
readfile = self.php_ini
if not os.path.exists(self.php_ini):
readfile="/usr/lib/php.ini"
self.lines = open(readfile,'r').readlines()
def save(self):
open(self.php_ini,'w').writelines(self.lines)
return
# Get a php value
def __getitem__(self,key):
for line in range(0,len(self.lines)):
bits = self.lines[line].split("=",1)
if len(bits)!=2: continue
if bits[0].strip()==key:
return bits[1].strip()
def __setitem__(self,key,value):
'Set a value'
found=None
for line in range(0,len(self.lines)):
bits = self.lines[line].split("=",1)
if len(bits)!=2: continue
if bits[0].strip()==key:
found=line
if found==None:
found=len(self.lines)
self.lines.append('')
before = self.lines[found]
self.lines[found]=key + '='+ value+'\n';
self.save()
def htaccess_fixup():
cpanel = CpanelData()
php_ini = "/home/"+cpanel.user+"/php.ini"
print(php_ini)
phpinidirectives=[]
if not os.path.exists(php_ini):
print(php_ini,"does not exist")
customphpini(rebuild=False)
maxdepth = ' '
if options.number:
maxdepth=' -maxdepth %d ' % options.number
for line in os.popen("find . %s -name .htaccess" % maxdepth,'r').readlines():
htaccess=line.strip();
if not os.path.exists(htaccess): continue
phpinidirectives.extend( htaccess_patch(htaccess) )
directives={}
for m in phpinidirectives:
try:
name,value=m.split(" ",1)
except ValueError:
print("Ignoring directive \"%s\"" % m)
continue
directives[name.strip().lower()]="%s = %s\n" % (name,value)
if len(phpinidirectives)>0:
print("\n".join(phpinidirectives))
ini = open(php_ini,'r')
inilines = ini.readlines()
ini.close()
output=[]
for line in inilines:
if line[-1:] != "\n": line += "\n"
bits=line.split("=",1)
if len(bits)!=2:
output.append(line)
continue
directive=bits[0].strip().lower()
if directive in list(directives.keys()):
output.append("# "+line)
output.append(directives[directive])
directives.pop(directive)
else:
output.append(line)
# put unmatched required directives at the head of php.ini
for k,m in list(directives.items()):
output.insert(0,m);
ini = open(php_ini,'w')
ini.writelines(output)
ini.close()
def mysqllimit(args,max=30):
users=args
if max==0: max=30
if max>100:
print("Too many connections")
sys.exit(1)
for user in users:
cpanel = CpanelData(user=user)
settings=dict(user=cpanel.user, max=max)
if not cpanel.user:
print("Huh? What user %s" % user)
continue
mysqlcmd="""mysql mysql -e "update user set max_user_connections=%(max)d where User like '%(user)s%%'; flush privileges;" """ \
% settings
print(mysqlcmd)
os.system(mysqlcmd)
def subscribe():
print("Subscribing everyone on the box to the INBOX.spam folder")
cmd = """
find /home/*/mail/* -maxdepth 2 -mindepth 2 -name courierimapsubscribed -type f |
while read f; do
grep INBOX.spam "$f" >/dev/null || echo >> "$f" INBOX.spam ;
done
"""
print(cmd)
os.system(cmd)
# Show phpinfo or something like it:
def show_phpinfo():
home = droppriv()
if os.path.exists(home+"/php.ini"):
os.system("php -c $HOME -r 'phpinfo();' &1")
else:
os.system("php -r 'phpinfo();' &1")
# Allow custom php.ini
def customphpini(rebuild=False,disable_functions=False, open_basedir=False, setupfw=''):
cpanel = CpanelData()
data=dict(homedir="/home/"+cpanel.user)
if not os.path.exists("/home/"+cpanel.user+"/php.ini"):
print("Copying /usr/lib/php.ini to homedir")
os.system("cp /usr/lib/php.ini %(homedir)s" % data )
else:
print("/home/"+cpanel.user+"/php.ini already exists.")
if open("/etc/httpd/conf/php.conf",'r').read().find("runphp")>=0:
print("This system uses runphp, so we don't change the apache config")
rebuild = False
else:
apacheconfdir=cpanel.makeapacheconfdir()
fcgiphpconf=apacheconfdir+"/phpini.conf"
if os.path.exists(fcgiphpconf):
print("# There is already a file "+fcgiphpconf+" with the contents below:")
print(open(fcgiphpconf,'r').read())
print("# There is already a file "+fcgiphpconf+" with the contents above")
return
try:
f = open(fcgiphpconf,'w')
print("Writing",fcgiphpconf)
template = """
# Allow custom php.ini
FCGIWrapper "/usr/local/cpanel/cgi-sys/php5 -c %(homedir)s" .php5
FCGIWrapper "/usr/local/cpanel/cgi-sys/php5 -c %(homedir)s" .php
"""
f.write(template % data )
f.close()
except IOError:
print("(Not writing", fcgiphpconf,")")
rebuild=False
php = phpini()
if disable_functions:
badfunctions=[
'shell_exec',
'apache_get_modules',
'apache_get_version',
'apache_getenv',
'apache_note',
'apache_setenv',
'dl',
'escapeshellarg',
'escapeshellcmd',
'exec',
'get_current_user',
'getmyi',
'ini_alter',
'link',
'mysql_list_dbs',
'openlog',
'pass_thru',
'passthru',
'pclose',
'popen',
'pcntl_exec',
'pcntl_fork',
'pcntl_signal',
'pcntl_waitpid',
'pcntl_wexitstatus',
'pcntl_wifexited',
'pcntl_wifsignaled',
'pcntl_wifstopped',
'pcntl_wstopsig',
'pcntl_wtermsig',
'pfsockopen',
'posix_kill',
'posix_mkfifo',
'proc_close',
'proc_get_status',
'proc_nice',
'proc_open',
'proc_terminate',
'show_source',
'socket_bind',
'socket_create',
'socket_create_listen',
'socket_create_pair',
'symlink',
'syslog',
'system',
'virtual',
]
php['disable_functions'] = ','.join(badfunctions)
php['enable_dl'] = 'Off'
php['expose_php'] = 'Off'
if setupfw:
php['auto_prepend_file'] = '/usr/local/afribin/apache/php/'+setupfw;
print("expose_php =", php['expose_php'])
print("disable_functions =", php['disable_functions'])
print("enable_dl =", php['enable_dl'])
print("auto_prepend_file =", php['auto_prepend_file'])
if open_basedir:
php['open_basedir'] = '/home/'+cpanel.user+'/public_html:/tmp:/usr/lib/php:/usr/local/lib/php:/usr/local/afribin/apache'
print("open_basedir =", php['open_basedir'])
if rebuild:
print("Running /scripts/rebuildhttpdconf")
os.system("/scripts/rebuildhttpdconf")
return
# File frobbers ...
def redirect(title,url):
stiff = dict(title=title,url=url)
template="""
%(title)s
"""
print("Writing a frame redirect to %(url)s with page title %(title)s" % stiff)
index=open("index.html","w")
index.write(template % stiff);
index.close()
os.system("chown --reference=. index.html; chmod 644 index.html")
def mysql_sessiontable_repair():
list=glob.glob("/var/lib/mysql/*/*session*.MYI")
for tablefile in list:
bits=tablefile.split("/")
table=bits[-1]
database=bits[-2]
table=table[:table.find(".MYI")];
print("mysqlcheck -r %s %s" % (database,table))
os.system( "mysqlcheck -r %s %s" % (database,table))
def safe(dir):
print("Removing write acess for directories in %s" % dir)
ocwd=os.getcwd()
os.chdir(dir)
os.system("find . -type d -print0 | xargs -0 chmod go-wr")
print("Removing write acess for files in %s" % dir)
os.system("find . -type f -print0 | xargs -0 chmod go-w")
if has_fcgi():
print("Removing read acess for php files in %s" % dir)
os.system(r"find . -type f -name \*.php\* -print0 | xargs -0 chmod go-r")
os.chdir(ocwd)
def do_images(dirname,no_act=False):
ocwd=os.getcwd()
os.chdir(dirname)
if os.path.exists(".htaccess"):
fd=open(".htaccess",'r')
htaccess = fd.read()
fd.close()
if re.search('# Added ',htaccess):
print("%s already protected" % dirname)
os.chdir(ocwd)
return False # already added
if no_act:
print("%s looks unprotected (permits script execution)" % dirname)
os.chdir(ocwd)
return False
print("setting %s as restrictive images directory" % dirname)
cmd = r"""
touch .htaccess
DATE=`date +%Y%m%d`
if ! grep '^# Added' .htaccess ; then
cat >> .htaccess <
php_flag engine off
Options -ExecCGI
Order deny,allow
Deny from all
EOF
fi
chown root .htaccess 2>/dev/null
chmod 644 .htaccess
"""
os.system(cmd)
os.chdir(ocwd);
return True
def do_script(scriptname,params):
"Pass parameters through to a script"
paramstring = ' '.join(map(shellquote,params))
os.system('%s %s' % (os.path.dirname(frob())+'/'+scriptname, paramstring))
def do_fcgiauthheaders(params):
"Pass FCGI auth paramters for basic auth"
cpanel = CpanelData()
fcgiauthfile = cpanel.get_apachecustomfile('fcgiauth.conf');
fd=open(fcgiauthfile,'w')
fd.write("""# Pass Authorization header so Basic Auth can work
# Date: %(date)s
FcgidPassHeader Authorization
""" % dict(
date=time.strftime("%Y-%m-%d"),) )
print("# Wrote", fcgiauthfile)
print("frob rebuild # will get this loaded up -- run it")
def do_generosity(reason, processes=4):
"Be generous"
if not reason:
print("No reason to be generous. Give me a reason.")
return
cpanel = CpanelData()
generosityfile = cpanel.get_apachecustomfile('generosity.conf');
fd=open(generosityfile,'w')
fd.write("""# More generous process limits
# Date: %(date)s Reason: %(reason)s
DefaultMaxClassProcessCount %(processes)d
MaxRequestLen 90485760
FcgidMaxRequestLen 90485760
""" % dict(
date=time.strftime("%Y-%m-%d"),
reason=reason,
processes=processes, ) )
print("# Wrote", generosityfile)
print("frob rebuild # will get this loaded up")
def modsecurity_onoff(status,reason=''):
"Turn mod_security on or off"
cpanel = CpanelData()
cpanel.read_modsecinifile()
if status:
cpanel.modsec['SecRuleEngine'] = 'On'
else:
cpanel.modsec['SecRuleEngine'] = 'Off'
cpanel.write_modsecinifile(reason=reason)
def modsecurity_addrules(rules):
"Add a list of bypass rules to mod_security"
cpanel = CpanelData()
cpanel.read_modsecinifile()
changed = False
for r in rules:
try:
cpanel.modsec['SecRuleRemoveById'].find(r)
except:
cpanel.modsec['SecRuleRemoveById'].append(r)
changed = True
if changed:
cpanel.write_modsecinifile()
return changed
def modsecurity_autorule():
"Figure out what broke, and allow it"
cpanel = CpanelData()
cpanel.read_modsecinifile()
error_log=open("/usr/local/apache/logs/error_log","r")
violation={}
violationline=''
after_reload=False
for line in error_log:
if line.find("Graceful restart requested")>=0 or \
line.find("module security2_module is already loaded")>=0 or \
line.find("resuming normal operations")>=0:
after_reload=False
continue
if not line.find(" ModSecurity: ")>=0: continue
# [Tue Jul 07 06:55:25 2009] [error] [client 196.210.168.36]
# ModSecurity: Access denied with code 500 (phase 2). Pattern match
# "\\.php(3|4|5)?(\\?|&).*=(ht|f)tps?:/" at REQUEST_URI. [file
# "/usr/local/afribin/apache/mod_security/apache2/rules.conf"] [line
# "158"] [id "300040"] [rev "1"] [msg "Generic PHPcode injection
# protection in URI"] [severity "CRITICAL"] [hostname "chns.co.za"]
# [uri "/Home/index.php"] [unique_id "SlLVPcQh44YAADidNL4AAAAM"]
bits=line.strip().split("] [");
tags=dict(hostname='',uri='',msg='')
for bit in bits[1:]:
try:
(tag,value)=bit.split(" ",1)
except:
tag=bit
value=bit
tags[tag]=value.strip('"[] \t\r\n')
after_reload=True
if not cpanel.has_site(tags.get("hostname")):
continue
if "id" not in tags: continue
tags['timestamp']=bit[0][1:]
violation=tags
violationline=line
print(violation)
if after_reload:
print("This hit was after the latest reload:")
print("Last violation: %(id)s (%(msg)s) at http://%(hostname)s%(uri)s" % tags)
#for r in rules:
# cpanel.modsec['SecRuleRemoveById'].append(tags['id'])
#cpanel.write_modsecinifile()
return modsecurity_addrules([tags['id']])
def cronfix():
'''Frob all the crontabls to have a random thingy'''
for file in glob.glob("/var/spool/cron/*"):
user=file.split("/")[:-1]
if user == "root" : continue
cronfile=open(file,"r");
crondata=[]
modified=0
for line in cronfile:
if line[:2]=='* ':
line=('%d-59/15 '+line[2:]) % (random.randrange(14)+1 )
modified=1
crondata.append(line)
cronfile.close()
if modified:
print("Wrote modified",file)
cronfile=open(file,"w");
for line in crondata:
cronfile.write(line)
cronfile.close()
def dcpumonview():
cmd = "/usr/local/cpanel/bin//dcpumonview | sed 's/<[^>]*>/ /g'"
os.system(cmd)
def domlogs():
sys.stderr.write("files modified in last 10 minutes\n")
cmd = "find /usr/local/apache/domlogs -maxdepth 1 ! -name '*_*' -mmin -10"
os.system(cmd)
def killall():
global ipcs_remove_apache_cmd
cmd="""
echo "# We are killing everything because we are panicky";
echo "# Killing httpd and php processes";
killall -9 httpd php php5 ;
echo "# Making rdiff-backup, dovecot and exim nice"
renice 19 -p `pidof -x rdiff-backup rrdtool`
renice 15 -p `pidof -x dovecot imap courier-tcpd pop3 `
renice 12 -p `pidof -x exim`
echo "# Restarting mysqld (to stop all processes)"
service mysql restart;
echo "# Killing apache IPC entries"
%(ipcs_remove_apache_cmd)s
echo "# Cleaning up /usr/local/apache/logs/fcgidsock"
"rm" -r /usr/local/apache/logs/fcgidsock
mkdir /usr/local/apache/logs/fcgidsock
chown nobody /usr/local/apache/logs/fcgidsock
chmod 700 /usr/local/apache/logs/fcgidsock
echo "# Starting httpd again"
service httpd start;
echo "# Running DDOS termination"
if pidof -x ddos.py | grep . ; then
echo "Already running"
else
/usr/local/afribin/ddos.py -v
fi
""" % dict(ipcs_remove_apache_cmd=ipcs_remove_apache_cmd)
os.system(cmd)
def apachectlgraceful(build=True):
if build:
print("Rebuilding httpd.conf and reloading config in apache")
cmd="/scripts/rebuildhttpdconf && /usr/local/apache/bin/apachectl graceful"
else:
print("Reloading config in apache")
cmd="/usr/local/apache/bin/apachectl graceful"
print(cmd)
os.system(cmd)
def takedown(target, taken_down='taken-down'):
'Password protect the directory'
os.chdir(target)
target=os.getcwd()
if os.path.exists(taken_down):
print(target+" taken down already")
return
n = target.find("/public_html")
if n==-1:
print(target+" does not include '/public_html'")
return
file_list=os.listdir('.')
os.mkdir(taken_down,0o700)
for file in file_list:
os.rename(file,taken_down+'/'+file)
open('.htaccess','w').write("""
RewriteEngine On
RewriteRule ^ index.php
""")
open('index.php','w').write("""
Site unavailable
Site unvailable
This site is not available.
""");
os.system('chmod 711 . ; chown --reference=%(taken_down)s .' % {'taken_down': taken_down } );
def hacking(target):
'Password protect the directory'
droppriv(target=target)
os.chdir(target)
target=os.getcwd()
n = target.find("/public_html")
if n==-1:
print("Cannot find '/public_html' in "+target)
return
htpasswd_dir= target[:n]+"/.htpasswd"+target[n:];
params = {
'password': easypassword(),
'htaccess': target+"/.htaccess",
'htpasswd_dir': htpasswd_dir,
'htpasswd_file': htpasswd_dir+"/passwd",
'target': target,
}
cmd="""
if grep -i '^Require valid-user' '%(htaccess)s' > /dev/null 2>&1; then
echo "Basic auth already set up in %(htaccess)s."
else
#echo n | cp -i '%(htaccess)s' '%(htaccess)s.orig' > /dev/null 2>&1
cat >> '%(htaccess)s' < /dev/null 2>&1
echo 'The password for %(target)s is user "user", password "%(password)s"'
fi
""" % params
os.system(cmd)
def remove_evil_lines(evils,filename):
''' Exclude evil lines '''
fc = open(filename,'r')
filecontent=[]
fixes=0
for line in fc:
for evil in evils:
if evil.search(line):
line=''
fixes+=1
break # ooh, efficiency
filecontent.append(line)
fc.close()
if fixes == 0:
return []
fc = open(filename,'w');
fc.writelines(filecontent)
fc.close()
return [ filename, ]
def cleanup_htaccess(args):
"Cleanup a htaccess injection"
evils = (
re.compile(r'^(\s+$|\s{10}).*\n'),
)
fixes=[]
for filename in args:
if filename.find('htaccess')>=0:
fixes.extend( remove_evil_lines(evils,filename) )
return fixes
def remove_evils(evils,filename):
''' Removing matching part of evil regex '''
fixes=0
fc = open(filename,'r')
filecontent = fc.read()
fc.close()
for evil in evils:
newcontent=evil.sub('',filecontent)
if newcontent!=filecontent: fixes+=1
filecontent=newcontent
if fixes:
fc = open(filename,'w');
fc.write(filecontent);
fc.close()
return [ filename, ]
return []
def cleanup_eval(args):
"Cleanup an eval injection"
evils = (
re.compile(r'<\?php\s+.*strto.*\[\d\].*\?>'),
re.compile(r'<\?php\s+(eval|preg_replace)\([^;]*\);\s*\?>'), # php segment consisting entirely of eval or equivalent
re.compile(r'(eval|echo)\(base64.*?;'),
re.compile(r'<\?php\s*\?>\s*|/\*\*/ *',re.I),
);
fixes=[]
for filename in args:
fixes.extend(remove_evils(evils,filename))
return fixes
def cleanup_iframe(args):
evils = (
re.compile(r'echo "";\s*',re.I),
re.compile(r'',re.I),
re.compile(r']*style=[^>]*?(display:\s*none|visibility:\s*hidden|left:\s*-\d\d\d\d).*?href="?http://.*?',re.I | re.S),
re.compile(r']*style=[^>]*?(display:\s*none|visibility:\s*hidden|left:\s*-\d\d\d\d|(width|height):\s*0|overflow:\s*hidden).*?href="?http://.*?', re.I | re.S),
re.compile(r']*style=[^>]*?(display:\s*none|visibility:\s*hidden|left:\s*-\d\d\d\d).*?href="?http://.*?', re.I | re.S),
re.compile(r'', re.I | re.S),
re.compile(r'', re.I | re.S),
re.compile(r'', re.I | re.S),
re.compile(r'', re.I | re.S),
re.compile(r'\s*', re.I),
re.compile(r'\s*',re.S),
re.compile(r'\s*', re.I | re.S),
re.compile(r'.*?(\%[0-9a-f][0-9a-f]){40}.*?\s*', re.I | re.S),
re.compile(r'(/\*.*?\*/ )?try.*?document.body.appendChild.*?\s*', re.I),
re.compile(r'.*?', re.I | re.S),
re.compile(r'![]()
', re.I | re.S),
)
fixes=[]
for filename in args:
fixes.extend(remove_evils(evils,filename))
return fixes
def notify_ftp(args):
cpanel = CpanelData()
cmd="""
echo "%(domain)s security :"
echo ""
echo "Please notify the owner of %(domain)s that we have detected suspicious activity"
echo "on their account %(user)s on `hostname`."
echo ""
echo "The client should check their desktop systems for spyware, and change their FTP"
echo "password."
echo ""
echo "Here are the log messages:"
echo ""
cat /var/log/messages* | grep '%(vargs)s'
echo
"""
settings = dict(
vargs= "' '".join(args),
user=cpanel.user,
domain=cpanel.cpanel['DNS'])
os.system( cmd % settings )
def dbaccess_openx(path):
res={}
res['file']= path
res['app']= 'openx'
f=open(path,'r')
heading_re = re.compile(r"""^\[(.*)\]""")
define_re = re.compile(r"""^\s*(\S+)\s*=(.+)""")
part=''
for line in f:
h= heading_re.search(line)
if h: part=h.group(1)
if part=='database':
d= define_re.search(line)
if d:
key=d.group(1).lower()
value=d.group(2)
if key=='host': res['host']=value.strip('"\'')
if key=='username': res['user']=value.strip('"\'')
if key=='password': res['pass']=value.strip('"\'')
if key=='name': res['db']=value.strip('"\'')
if 'db' in res:
return res
def dbaccess_wordpress(path):
res={}
res['prefix']= ''
res['file']= path
res['app']= 'wordpress'
f=open(path,'r')
# define('DB_NAME', 'idols4ci_wrdp1'); // The name of the database
# define('DB_USER', 'idols4ci_wrdp1'); // Your MySQL username
# define('DB_PASSWORD', 'rmcd'); // ...and password
# define('DB_HOST', 'localhost'); // 99% chance you won't need to change this value
define_re = re.compile(r"""define\s*\(\s*['"](.*?)['"]\s*,\s*['"](.*?)['"]\s*\)""")
for line in f:
# if line.find("define") >=0: sys.stdout.write( line)
definebits=define_re.search(line.strip())
if definebits:
res[definebits.group(1)]=definebits.group(2)
f.close()
if 'DB_NAME' not in res:
return None
res['db']= res.get('DB_NAME')
res['user']= res.get('DB_USER')
res['pass']= res.get('DB_PASSWORD')
res['host']= res.get('DB_HOST')
return res
def dbaccess_moodle(path):
res={}
res['prefix']=''
res['file']= path
res['app']= 'moodle'
f=open(path,'r')
# $CFG->dbhost = 'localhost' ;
# $CFG->dbname = 'learnnkv_mdle1' ;
# $CFG->dbuser = 'learnnkv_mdle1' ;
# $CFG->dbpass = '{eB9';
define_re = re.compile(r"""->\s*([a-z]+)\s*=\s*['"](.*?)['"]""")
for line in f:
# if line.find("define") >=0: sys.stdout.write( line)
definebits=define_re.search(line.strip())
if definebits:
res[definebits.group(1)]=definebits.group(2)
f.close()
if 'dbname' not in res:
return None
res['db']= res.get('dbname')
res['user']= res.get('dbuser')
res['pass']= res.get('dbpass')
res['host']= res.get('dbhost')
return res
def dbaccess_phpbb(path):
res={}
res['prefix']=''
res['file']= path
res['app']= 'phpbb'
#$dbhost = 'localhost';
#$dbname = 'sapanhnr_dtbase1';
#$dbuser = 'sapanhnr_devon';
#$dbpasswd = 'HWD5';
#$table_prefix = 'phpbb_';
f=open(path,'r')
define_re = re.compile(r"""\$(db[a-z]+)\s*=\s*['"](.*?)['"]\s*;""")
for line in f:
# if line.find("define") >=0: sys.stdout.write( line)
definebits=define_re.search(line)
if definebits:
res[definebits.group(1)]=definebits.group(2)
f.close()
if 'dbname' not in res:
return None
res['db']= res.get('dbname')
res['user']= res.get('dbuser')
res['pass']= res.get('dbpasswd')
res['host']= res.get('dbhost')
# print res
return res
def randompassword(length=9):
'Generate a 9 character password of sorts'
import string
import random
return ''.join( random.Random().sample(string.ascii_letters+string.digits, length) )
def easypassword(length=8):
'Generate an easy 8 character password of sorts'
import string
import random
word = ''.join( random.Random().sample(string.ascii_letters, length*4) )
word=word.lower()
word=re.sub("([^aeoiu]{2})[^aeiou]+","\\1",word)
word=re.sub("([aeoiu]{2})[aeiou]+","\\1",word)
word=re.sub("([^aeoiu]{2})[^aeiou]+","\\1",word)
word=word[:length]
return word
def joomlacrackformat(line):
'Format joomla passwords for john'
u,p=tuple ( line.strip('\n').split('\t') )
i = p.find(':')<0
if i<0:
return u+':$dynamic_0$'+p
return u+':md5_gen(1)'+p.replace(":","$");
def do_crack(res):
# show passwords for application for cracking
found=0
if res['app'].startswith('joomla'):
# Joomla 2.5:
for sql in (""" # joomla 2.x
SELECT users.username,users.password FROM jos_usergroups groups, jos_user_usergroup_map map, jos_users users WHERE groups.title LIKE 'Super%' AND map.group_id=groups.id and users.id=map.user_id
""", """ # joomla 1.5
SELECT users.username,users.password FROM jos_core_acl_groups_aro_map map, jos_core_acl_aro aro, jos_users users WHERE map.aro_id=aro.id and aro.value=users.id and map.group_id=25;
""","""
SELECT users.username,users.password FROM jos_users users order by id limit 5;
""") :
res['sql'] = sql.replace('jos_',res['prefix'])
fd = os.popen('''%(mysql)s -N -B -e "%(sql)s" 2>/dev/null ''' % res , 'r');
for line in fd:
print(joomlacrackformat(line))
found+=1
if found: break;
if res['app'].startswith('wordpress'):
cmd=r'''%(mysql)s -N -B -e "select concat(u.user_login,':',u.user_pass) from %(prefix)susers u left join %(prefix)susermeta m on u.ID=m.user_id and m.meta_key='%(prefix)scapabilities' where m.meta_value like '%%admin%%' " ''' % res
if options.verbose:
sys.stderr.write("%s\n" % cmd);
os.system(cmd);
def do_upgrade_wordpress(res):
"""
Upgrade wordpress by clobbering files in the current dir with the distribution version
Does it work??
"""
if res['app']!='wordpress':
return
# if not os.path.exists("wp-content"): return
print("Running wordpress upgrade")
droppriv();
res['url']='http://wordpress.org/latest.tar.gz';
# res['url']='http://answers.afrihost.com/updates/wordpress.php';
#res['url']='http://answers.afrihost.com/updates/wordpress.php';
os.system("""
umask 022
echo Downloading and extracting wordpress update ... 1>&2
wget -O - %(url)s | tar -zvx --strip-components=1 2>&1 | tail
""" % res)
do_wp(['core','update-db']);
sys.stderr.write("Done\n")
def do_certs():
os.system(r"""
curl http://curl.haxx.se/ca/cacert.pem -o /etc/pki/tls/certs/ca-bundle.crt
""")
def runphpinstall():
os.system(r"""
make -C /usr/local/afribin/src ;
find /usr/local/apache/conf/userdata/std/2/ -name phpini.conf | while read x; do mv $x $x.DEPRECATED; done
echo '
# Fastcgi configuration for PHP5
LoadModule fcgid_module modules/mod_fcgid.so
MaxRequestsPerProcess 500
# 10Mb upload limit
MaxRequestLen 90485760
AddHandler fcgid-script .php5 .php4 .php .php3 .php2 .phtml
#FCGIWrapper /usr/local/cpanel/cgi-sys/php5 .php5
#FCGIWrapper /usr/local/cpanel/cgi-sys/php5 .php4
#FCGIWrapper /usr/local/cpanel/cgi-sys/php5 .php
#FCGIWrapper /usr/local/cpanel/cgi-sys/php5 .php3
#FCGIWrapper /usr/local/cpanel/cgi-sys/php5 .php2
#FCGIWrapper /usr/local/cpanel/cgi-sys/php5 .phtml
# End of autogenerated PHP configuration.
FCGIWrapper "/usr/local/cpanel/cgi-sys/runphp /usr/local/cpanel/cgi-sys/php5" .php5
FCGIWrapper "/usr/local/cpanel/cgi-sys/runphp /usr/local/cpanel/cgi-sys/php5" .php4
FCGIWrapper "/usr/local/cpanel/cgi-sys/runphp /usr/local/cpanel/cgi-sys/php5" .php
FCGIWrapper "/usr/local/cpanel/cgi-sys/runphp /usr/local/cpanel/cgi-sys/php5" .php3
FCGIWrapper "/usr/local/cpanel/cgi-sys/runphp /usr/local/cpanel/cgi-sys/php5" .php2
FCGIWrapper "/usr/local/cpanel/cgi-sys/runphp /usr/local/cpanel/cgi-sys/php5" .phtml
IdleTimeout 60
ProcessLifeTime 600
MaxProcessCount 400
DefaultMinClassProcessCount 0
DefaultMaxClassProcessCount 3
IPCConnectTimeout 8
IPCCommTimeout 600
BusyTimeout 600
' > /etc/httpd/conf/php.conf;
# Fixup wrapper if it it php without parameters
egrep 'exec /usr/bin/php ?("\$@")? *$' /usr/local/cpanel/cgi-sys/php5 && {
perl -p -i -e 's{^exec /usr/bin/php *("\$\@")?}{exec /usr/bin/php "\$\@"}' /usr/local/cpanel/cgi-sys/php5
mkdir -p /var/cpanel/conf/apache/wrappers
cp -a /usr/local/cpanel/cgi-sys/php5 /var/cpanel/conf/apache/wrappers/php5
}
/scripts/rebuildhttpdconf && /usr/local/apache/bin/apachectl graceful ;
""")
def do_upgrade():
# Various upgrades
res=dbaccess(show=False)
if res and 'app' in res:
do_upgrade_drupal(res)
do_upgrade_mybb(res)
do_upgrade_joomla(res,do_upgrade=True,do_password=False)
do_upgrade_joomla16(res,do_upgrade=True);
do_upgrade_wordpress(res)
else:
print("No application")
def do_upgrade_drupal(res):
if res['app']!='drupal':
return
do_drush(['up'])
def do_upgrade_mybb(res):
if res['version'] > '1.6' or res['app']!='MyBB':
# return "%(app)s version %(version)s not supported by this MyBB upgrade" % res
return
droppriv()
print("Upgrading to MyBB some other version")
os.system("""
mkdir mybb_upgrade_files
cd mybb_upgrade_files || exit
curl -O http://www.mybb.com/download/139
unzip 139
[ -f ../images/logo.gif ] && rm Upload/images/logo.gif
tar -C Upload -c . | tar -C .. -x
cd ..
rm -r mybb_upgrade_files
""")
def do_upgrade_joomla16(res,do_upgrade=True):
# Joomla 1.6 to 2.2 upgrade to current or something
'upgrade joomla installation in the current dir'
if res['app'] != 'joomla-2.x-series' or res['version'][:1] > '2':
# print "%(app)s version %(version)s not supported by joomla 1.6+ upgrade" % res
return
configuration=res['file']
print("# application=%(app)s configfile=%(file)s prefix=%(prefix)s" % res)
update_joomla_config_file(configuration, 'secret', easypassword());
res['url']="http://joomlacode.org/gf/download/frsrelease/17410/76012/Joomla_2.5.7-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/17715/77262/Joomla_2.5.8-Stable-Full_Package.zip";
res['url']="http://joomlacode.org/gf/download/frsrelease/17968/78430/Joomla_2.5.9-Stable-Full_Package.zip";
res['url']="http://joomlacode.org/gf/download/frsrelease/18322/80354/Joomla_2.5.11-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/18624/83477/Joomla_2.5.14-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/18858/91472/Joomla_2.5.16-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/19145/157516/Joomla_2.5.18-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/19754/161033/Joomla_2.5.25-Stable-Full_Package.zip"
res['url']="http://answers.afrihost.com/updates/Joomla_2.5.14-Stable-Full_Package.zip"
res['url']="http://answers.afrihost.com/updates/Joomla_2.5.18-Stable-Full_Package.zip"
res['url']="http://answers.afrihost.com/updates/Joomla_2.5.22-Stable-Full_Package.zip"
res['url']="http://answers.afrihost.com/updates/Joomla_2.5.24-Stable-Full_Package.zip"
res['url']="http://answers.afrihost.com/updates/Joomla_2.5.25-Stable-Full_Package.zip"
res['url']="http://answers.afrihost.com/updates/Joomla_2.5.27-Stable-Full_Package.zip"
res['url']="http://answers.afrihost.com/updates/Joomla_2.5.28-Stable-Full_Package.zip"
# res['version']="2.5.11"
if do_upgrade:
res['version']=res['url'].split('_')[1].split('-')[0];
print("Downloading Joomla %(version)s" % res)
res['downloadfilecache']=os.environ['HOME']+'/'+os.path.basename(res['url']);
res['downloadfile']='./'+os.path.basename(res['url']);
os.system("""
find %(downloadfilecache)s -mtime -1 | grep -q . ||
(
rm -f %(downloadfilecache)s
wget -O %(downloadfilecache)s %(url)s
touch %(downloadfilecache)s
)
cp %(downloadfilecache)s %(downloadfile)s
""" % res );
# Set non-runnable properties all over
do_secure(res)
print("Making autologin script")
url = autologin_joomla16(show=False,timeout=7200)
print("Dropping privileges")
droppriv()
print("Moving templates to templates.preserve in case you hacked the default template..." % res)
os.system("[ -d templates.preserve ] || mv templates templates.preserve" % res)
print("Extracting Joomla %(version)s" % res)
os.system("unzip -o %(downloadfile)s 2>&1 | tail" % res)
print("Removing installation directory")
os.system("rm -rf installation")
os.system("if [ -d templates -a -d templates.preserve ] ; then rm -rf templates ; mv templates.preserve templates; fi" % res)
print("Random 1.6 to 2.x patches")
os.system(r"""
find templates -name \*.php -print0|
xargs -0 egrep -lZ 'mainframe-|_component->user' |
xargs -0 sed -i '
s/\$mainframe-/JFactory::getApplication()-/g;
s/\$this->_component->user->/JFactory::getUser()->/g;
' 2>/dev/null
FILE=plugins/system/jat3/jat3/core/joomla/modulehelper.php
if [ -f $FILE ] ; then
echo "jat3 update"
perl -p -i -e 's/new JDatabaseQuery/\$db->getQuery(true)/g' $FILE
fi
""")
print("")
url_dbfix=url.split('/administrator/')[0]+'/administrator/?option=com_installer&view=database&task=database.fix';
print("If the automatic thingy doesn't work, you must run the extension manager database update MANUALLY: Extension Manager | Database | Fix now:")
print("\x1b[31m"+url_dbfix+"\x1b[0m")
print("Trying it:")
os.system("""curl -s -L -c $HOME/.cj '%(url)s' | wc -l ;
curl -s -L -b $HOME/.cj -c $HOME/.cj '%(url_dbfix)s' | wc -l ;
rm $HOME/.cj
""" % {'url':url,'url_dbfix':url_dbfix} );
#
def php_str_escape(value):
return value.replace('\\','\\\\').replace('\'','\\\'');
#define('AUTH_KEY', 'f7sXx[2wbB@LBwlxS{A56y>+[DL9b3FJbvVZXz iq\\Ms}?(;_a#ypoR5\'3wFL~1X');
#define('SECURE_AUTH_KEY', '-\"r642fed3E1d>}MdGFlh@tR!QPU%/!S_6;CjO0}^>6T[DL9b3FJbvVZ+ OG2,,J{?w}G*b $LEds-JWc;0:&0!<=|=IB6BT2M);_');
# define('NONCE_KEY', 'D2/S-d>4UI&{Vw9P+<-/:s]$;E1( ~0FL{BR+-&/&AmjXL');
alphabet = '`^~<=>|_-,;:!?/.()[]{}@$*&#%+0123456789aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqrRsStTuUvVwWxXyYzZ'
return ''.join(random.Random().sample(alphabet, 64))
def refresh_wordpress_keys(configuration_file):
newvalues = {
'AUTH_KEY': generate_wordpress_key(),
'SECURE_AUTH_KEY': generate_wordpress_key(),
'LOGGED_IN_KEY': generate_wordpress_key(),
'NONCE_KEY': generate_wordpress_key(),
}
update_wordpress_configuration_file(configuration_file, newvalues)
def update_wordpress_configuration_file(configuration_file, newvalues):
"Write values to wordpress configuration"
changed=[]
fd=open(configuration_file,'r')
lines=[]
define_re = re.compile(r"define\('([A-Z_]+)',\s*'(.*)'\);\s*$");
for line in fd:
m = define_re.search(line)
if m and m.group(1) in list(newvalues.keys()):
configuration_key=m.group(1)
newvalue=newvalues[configuration_key];
line = "define('%s', '%s');\n" % (configuration_key, php_str_escape(newvalue))
changed.append(configuration_key)
lines.append(line)
fd.close()
if len(changed):
print("Updating "+configuration_file+" setting new "+(' '.join(changed)))
st = os.stat(configuration_file);
os.chmod(configuration_file,0o600); # unwriteable files are a pain ...
fd=open(configuration_file,"w");
fd.writelines(lines)
fd.close()
os.chmod(configuration_file, st.st_mode & 0o777); # reset the mode as it was
return changed
#
def update_joomla_config_file(configuration_file, configuration_key, newvalue):
changed=0
fd=open(configuration_file,'r')
lines=[]
define_re = re.compile(r"""(var|public) \$([a-z]+)\s*=\s*['"](.*?)['"]\s*;""")
for line in fd:
m = define_re.search(line)
if m and m.group(2)==configuration_key:
replace = {
'vartype': m.group(1),
'key': m.group(2),
'value': newvalue, }
line=" %(vartype)s $%(key)s = '%(value)s';\n" % replace;
changed+=1
lines.append(line)
fd.close()
if changed:
print("Setting new "+configuration_key+" in "+configuration_file)
st = os.stat(configuration_file);
os.chmod(configuration_file,0o600); # unwriteable files are a pain ...
fd=open(configuration_file,"w");
fd.writelines(lines)
fd.close()
os.chmod(configuration_file, st.st_mode & 0o777); # reset the mode as it was
return changed
def do_upgrade_joomla(res,do_upgrade=True,do_password=True):
'upgrade joomla installation in the current dir'
configuration=res['file']
if not res['app'] in ('joomla',):
# print "%(app)s version %(version)s not supported by this joomla upgrade" % res
return
# Decide what we're putting in its place:
res['newdbpassword'] = randompassword()
res['adminpassword'] = randompassword()
if do_password:
os.system("""mysql --host=%(host)s --password='%(newdbpassword)s' --user=%(user)s %(db)s -e 'UPDATE %(prefix)susers SET password=md5("%(adminpassword)s") WHERE usertype LIKE "%%dministrator%%";' """ % res);
print(("The new administrator password is %(adminpassword)s") % res)
print("Old connection command: mysql --host=%(host)s --password='%(pass)s' --user=%(user)s %(db)s" % res)
print("Setting new db password" % res)
rc = os.system(""" mysql --host=%(host)s --password='%(pass)s' --user=%(user)s %(db)s -e 'SET password=PASSWORD("%(newdbpassword)s"); ' """ % res);
if rc==0:
print("Updating configuration to use new password, and setting new secret")
update_joomla_config_file(configuration, 'password', res['newdbpassword']);
update_joomla_config_file(configuration, 'secret', easypassword());
print(("The database password is now %(newdbpassword)s" ) % res)
#res['com_fabrik']="http://answers.afrihost.com/updates/com_fabrik_2.1.1.zip"
res['version']="1.5.26"
res['url']="http://joomlacode.org/gf/download/frsrelease/12610/53421/Joomla_1.5.20-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/12975/56086/Joomla_1.5.21-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/13105/57240/Joomla_1.5.22-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/14506/63460/Joomla_1.5.23-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/15898/68914/Joomla_1.5.24-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/16026/69665/Joomla_1.5.25-Stable-Full_Package.zip"
res['url']="http://joomlacode.org/gf/download/frsrelease/16890/73390/Joomla_1.5.26-Stable-Full_Package.zip"
res['url']="http://answers.afrihost.com/updates/Joomla_1.5.26-Stable-Full_Package.zip"
if do_upgrade:
if not res['version'].startswith('1.5.') or res['app']!='joomla':
# print "%(app)s version %(version)s not supported by this joomla upgrade" % res
return
print("Downloading Joomla %(version)s" % res)
res['downloadfilecache']=os.environ['HOME']+'/'+os.path.basename(res['url']);
res['downloadfile']='./'+os.path.basename(res['url']);
os.system("""
find %(downloadfilecache)s -mtime -1 | grep -q . ||
(
rm -f %(downloadfilecache)s
wget -O %(downloadfilecache)s %(url)s
touch %(downloadfilecache)s
)
cp %(downloadfilecache)s %(downloadfile)s
""" % res );
print("Dropping privileges")
droppriv()
print("Moving templates to templates.preserve in case you hacked the default template..." % res)
os.system("[ -d templates.preserve ] || mv templates templates.preserve" % res)
print("Extracting Joomla %(version)s" % res)
os.system("unzip -o %(downloadfile)s 2>&1 | tail" % res)
print("Removing installation directory and zip file")
os.system("if [ -d templates -a -d templates.preserve ] ; then rm -rf templates ; mv templates.preserve templates; fi" % res)
os.system("rm -rf installation %(downloadfile)s" % res)
# Upgrade vulnerable stuff too
# com_fabrik does not like being upgraded:
#if os.path.exists('components/com_fabrik'):
# print "Downloading com_fabrik %(version)s" % res
# os.system("wget --continue %(com_fabrik)s -O com_fabrik.zip; unzip -o com_fabrik.zip" % res)
## We don't do this, because we dropped privileges
#print "Changing ownership of extracted zip files (this won't work on BSD - please do it manually!)"
#os.system("find . -user root -print0 | xargs -0 chown --reference=.")
if do_upgrade:
print("We have updated the Joomla installation to version %(version)s" % res)
if do_password:
print(("The new administrator password is %(adminpassword)s") % res)
print(("The database access password is now %(newdbpassword)s for phpmyadmin" ) % res)
def dbaccess_joomla(path):
res={}
res['prefix']= ''
res['file']= path
res['app']= 'joomla'
#var $password = 'Scr';
#var $host = 'localhost';
#var $user = 'fairlkrj_gilan';
#var $db = 'fairlkrj_fairleads';
f=open(path,'r')
define_re = re.compile(r"""var \$([a-z]+)\s*=\s*['"](.*?)['"]\s*;""")
for line in f:
# if line.find("define") >=0: sys.stdout.write( line)
definebits=define_re.search(line)
if definebits:
res[definebits.group(1)]=definebits.group(2)
f.close()
if 'db' not in res:
return None
res['prefix']= res.get('dbprefix','')
res['db']= res.get('db')
res['user']= res.get('user')
res['pass']= res.get('password')
res['host']= res.get('host')
res['version'] = version_of_joomla()
return res
def parsephpfile(filename,res,already={}):
# print "filename =",filename
if (not os.path.exists(filename)): return;
f=open(filename,'r');
include_re = re.compile(r"""(include|require|include_once|require_once)\s*\(['"](.*?)['"]\s*\)""")
assign_re = re.compile(r"""(\$\S+?)\s*=\s*['"](.*?)['"]""")
connect_re = re.compile(r"""mysql_p?connect\s*\(\s*(\S+)\s*,\s*(\S+)\s*,\s*(\S+)\s*\)""")
select_re = re.compile(r"""mysql_select_db\s*\(\s*(\S+?),""")
for line in f:
m=include_re.search(line)
if m:
include_file = m.group(2)
if include_file not in already:
already[include_file]=True
parsephpfile(include_file,res,already=already)
m=assign_re.search(line)
if m:
res[m.group(1)]=m.group(2)
m=connect_re.search(line)
if m:
res['host']=m.group(1).strip('"\'')
res['user']=m.group(2).strip('"\'')
res['pass']=m.group(3).strip('"\'')
if res['host'] in res: res['host']=res[res['host']]
if res['user'] in res: res['user']=res[res['user']]
if res['pass'] in res: res['pass']=res[res['pass']]
res['file']= filename
m=select_re.search(line)
if m:
res['db']=m.group(1).strip('"\'');
if res['db'] in res: res['db']=res[res['db']]
f.close()
def dbaccess_guess(path):
'parse a php app to see what its database is'
res={}
res['prefix']= ''
res['app']= 'some application'
res['file']= path
parsephpfile(path,res)
# print "res.keys() =", ",".join(res.keys())
return res
def urldecode(data):
import urllib.request, urllib.parse, urllib.error
data= urllib.parse.unquote_plus(data)
return data
def dbaccess_other(dummyfilename,verbose=False):
applications = [
{
'app': 'drupal',
'configfile': 'sites/default/settings.php',
'assignments': [ re.compile(r"^\s*'([^']+)'\s*=>\s*'([^']*)'"), ],
'map': { 'db': 'database', 'user': 'username', 'pass': 'password', 'host': 'host', 'prefix': 'prefix', },
#'debug': True
},
{
'app': 'drupal',
'configfile': 'sites/default/settings.php',
'regexlist': {
re.compile(r'''^\s*\$.*= *'mysqli?://(\S+):(\S+)@(\S+)/(\S+)['"]'''): [ 'user','pass','host','db' ],
re.compile(r"\$db_prefix\s*=\s*'(.*?)'") : ['prefix'],
},
'map': { 'db': 'db', 'user': 'user', 'pass': 'pass', 'host': 'host'},
'pass_postprocess': urldecode,
},
{
'app': 'joomla-2.x-series',
'configfile': 'configuration.php',
'assignments': [ re.compile(r"""public \$([a-z]+)\s*=\s*'(.*?)'\s*;""") ],
'map': { 'db': 'db', 'user': 'user', 'pass': 'password', 'host': 'host', 'prefix': 'dbprefix'},
},
{
'app': 'joomla-1.ancient',
'configfile': 'configuration.php',
'assignments': [re.compile(r"""mosConfig_(\S+)\s*=\s*["'](\S+?)["']""")],
'map': { 'db':'db', 'user':'user', 'pass':'password', 'host':'host', 'prefix': 'dbprefix', },
},
{
'app': 'vtiger',
'configfile': 'config.inc.php',
'assignments': [ re.compile(r'''\$dbconfig\['([a-z_]+)'\] *= *'(.*?)';'''), ] ,
'map': { 'db': 'db_name', 'user': 'db_username', 'pass': 'db_password', 'host': 'db_server'},
},
{
'app': 'b2evolution',
'configfile': 'conf/_basic_config.php',
'assignments': [ re.compile(r"'([^']+)' *=> *'([^']+)'"), ],
'map': { 'db': 'name', 'user': 'user', 'pass': 'password', 'host': 'host'},
'regexlist': { re.compile(r"\$tableprefix\s*=\s*'(.*?)'") : ['prefix'], },
},
{
'app': 'symfony',
'configfile': 'config/databases.yml',
'regexlist': {
re.compile(r"'mysql:host=(.*?);dbname=(.*?)'") : ['host','db'],
},
'assignments': [ re.compile(r""" (\S+): (\S+)""") ],
'map': { 'user': 'username', 'pass': 'password' } ,
},
{
'app': 'cubecart',
'configfile': 'includes/global.inc.php',
'assignments': [ re.compile(r"\['([^']+)'\s*\] *= *'([^']*)'"), ],
'map': { 'db': 'dbdatabase', 'user': 'dbusername', 'pass': 'dbpassword', 'host': 'dbhost', 'prefix': 'dbprefix'},
#'debug': True,
},
# $CONFIG->dbuser = 'whereduw_elgguse';
# $CONFIG->dbpass = 'bhhgbk13463';
# $CONFIG->dbname = 'whereduw_elggdb';
# $CONFIG->dbhost = 'localhost';
# $CONFIG->dbprefix = 'elgg_';
{
'app': 'elgg',
'configfile': [ 'engine/settings.php', ],
'assignments': [ re.compile(r"\$CONFIG->(\w+) = '(.*?)';"), ],
'map': { 'db': 'dbname', 'user': 'dbuser', 'pass': 'dbpass', 'host': 'dbhost', 'prefix': 'dbprefix'},
},
{
'app': 'indexhibit.org',
'configfile': [ 'ndxz-studio/config/config.php', 'config/config.php', ],
'assignments': [ re.compile(r"\['([^']+)'\] *= *'([^']*)'"), ],
'map': { 'db': 'db', 'user': 'user', 'pass': 'pass', 'host': 'host'},
},
{
'app': 'webSpell.org',
'configfile': '_mysql.php',
'assignments': [ re.compile(r'''\$([a-z]+)\s*=\s*['"]([^'"]+)['"]'''), ],
'map': { 'db': 'db', 'user': 'user', 'pass': 'pwd', 'host': 'host'},
},
{
'app': 'e107',
#'debug': True,
'configfile': 'e107_config.php',
'assignments': [ re.compile(r'''\$(mySQL[a-z]+)\s*=\s*['"]([^'"]+)['"]'''), ],
'map': { 'db': 'mySQLdefaultdb', 'user': 'mySQLuser', 'pass': 'mySQLpassword', 'host': 'mySQLserver', 'prefix': 'mySQLprefix'},
},
{
'app': 'hesk helpdesk',
'configfile': 'hesk_settings.inc.php',
'assignments': [ re.compile(r"\['([^']+)'\] *= *'([^']+)'"), ],
'map': { 'db': 'db_name', 'user': 'db_user', 'pass': 'db_pass', 'host': 'db_host'},
},
{
'app': 'eticketsupport.com',
'configfile': 'settings.php',
'assignments': [re.compile(r"""\$(\S+)\s*=\s*["']?(\S+?)["']?;""")],
'map': { 'db': 'db_name', 'user': 'db_user', 'pass': 'db_pass', 'host': 'db_host', 'prefix': 'db_table_prefix', 'version': 'version'}
},
{
# #pixelpost_db_host = "localhost"; // database host, often "localhost"
# #pixelpost_db_user = "gavinjwd_pp"; // database user
# #pixelpost_db_pass = "A5S"; // database user password
# #pixelpost_db_pixelpost = "gavinjwd_pixelpost"; // database
'app': 'pixelpost.org',
'configfile': 'includes/pixelpost.php',
'assignments': [re.compile(r"""\$(\S+)\s*=\s*["']?(\S+?)["']?;""")],
'map': { 'db': 'pixelpost_db_pixelpost', 'user': 'pixelpost_db_user', 'pass': 'pixelpost_db_pass', 'host': 'pixelpost_db_host', }
},
{
'app': 'phplist',
'configfile': 'config/config.php',
'assignments': [ re.compile(r"\['([^']+)'\] *= *'([^']+)'"), ],
'map': { 'db': 'database_name', 'user': 'database_user', 'pass': 'database_password', 'host': 'database_host'},
},
{
'app': 'simbarsk',
'configfile': 'config.local.php',
'assignments': [ re.compile(r"\['([^']+)'\] *= *'([^']+)'"), ],
'map': { 'db': 'db_host', 'user': 'db_user', 'pass': 'db_password', 'host': 'db_host'},
},
{
'app': 'cake',
'configfile': 'config/database.php',
'assignments': [ re.compile(r"'([^']+)' *=> *'([^']+)'"), ],
'map': { 'db': 'database', 'user': 'login', 'pass': 'password', 'host': 'host'},
},
# DB["server"] = 'localhost';
# DB["user"] = 'propemkx_qafaq';
# DB["password"] = '!+X61$GI(xq';
# DB["db"] = 'propemkx_faq';
# DB["prefix"] = '';
# DB["type"] = 'mysql';
{
'app': 'phpmyfaq',
'configfile': 'config/database.php',
'assignments': [ re.compile(r'''\$DB\["([a-z]+)"\] *= *'(.*?)';'''), ] ,
'map': { 'db': 'db', 'user': 'user', 'pass': 'password', 'host': 'server', 'prefix': 'prefix'},
},
{
'app': 'bidbutler',
'configfile': 'config/config.php',
'assignments': [ re.compile(r"'([^']+)' *=> *'([^']+)'"), ],
'map': { 'db': 'database', 'user': 'login', 'pass': 'password', 'host': 'host'},
},
{
'app': 'SMF forum',
'configfile': 'Settings.php',
'assignments': [re.compile(r"""\$(db_\S+)\s*=\s*["']?(\S+?)["']?;""")],
'map': { 'db':'db_name', 'user':'db_user', 'pass':'db_passwd', 'host':'db_server'},
},
{
'app': 'kayako',
'configfile': 'config/config.php',
'assignments': [re.compile(r'''^\$_DB\["([a-z]*)"\] *= *"(.*?)"''')],
'map': { 'db':'name', 'user':'username', 'pass':'password', 'host':'hostname'},
},
{
'app': 'expressionengine',
'configfile': 'siteadmin/expressionengine/config/database.php',
# $db['expressionengine']['hostname'] = "localhost";
'assignments': [re.compile(r'''^\$db\[['"a-z]*\]\[['"]([a-z]*)['"]\] *= *['"](.*?)['"]''')],
'map': { 'db':'database', 'user':'username', 'pass':'password', 'host':'hostname'},
},
{
'app': 'MODx',
'configfile': [ 'core/config/config.inc.php', 'manager/includes/config.inc.php', ],
'assignments': [re.compile(r'''\$([a-z_]+)\s+=\s+'`?(.*?)`?';''')],
'map': { 'db':'dbase', 'user':'database_user', 'pass':'database_password', 'host':'database_server', 'prefix': 'table_prefix', },
},
{
'app': 'lifetype',
'configfile': 'config/config.properties.php',
# $config['db_host'] = 'localhost';
'assignments': [re.compile(r"""\[['"]([^'"]+)['"]\s*\]\s*=\s*["']?(\S+?)["']?;""")],
'map': { 'db':'db_database', 'user':'db_username', 'pass':'db_password', 'host':'db_host'},
},
{
'app': 'Comdev One Admin',
'configfile': 'config.php',
'assignments': [re.compile(r"""\[['"]([^'"]+)['"]\s*\]\s*=\s*["']?(\S+?)["']?;""")],
'map': { 'db':'used', 'user':'user', 'pass':'pass', 'host':'host'},
},
{
'app': 'vbullettin',
'configfile': 'includes/config.php',
'assignments': [re.compile(r"""\[['"]([^'"]+)['"]\s*\]\s*=\s*["']?(\S+?)["']?;""")],
'map': { 'db':'dbname', 'user':'username', 'pass':'password', 'host':'servername'},
},
{
'app': 'sugarcrm',
'configfile': 'config.php',
'assignments': [ re.compile(r"'([^']+)' *=> *'([^']+)'"), ],
'map': { 'db':'db_name', 'user':'db_user_name', 'pass':'db_password', 'host':'db_host_name'},
},
{
'app': 'interspire email marketer',
'configfile': 'admin/includes/config.php',
'assignments': [re.compile(r"""define\s*\(\s*['"](.*?)['"]\s*,\s*['"](.*?)['"]\s*\)""")],
'map': { 'db':'SENDSTUDIO_DATABASE_NAME', 'user':'SENDSTUDIO_DATABASE_USER', 'pass':'SENDSTUDIO_DATABASE_PASS', 'host':'SENDSTUDIO_DATABASE_HOST', 'prefix': 'SENDSTUDIO_TABLEPREFIX'},
},
{
'app': 'interspire shopping cart',
'configfile': 'config/config.php',
'assignments': [re.compile(r"""\$GLOBALS\['ISC_CFG'\]\["(\S+)"\] *= *'(\S+)'""")],
'map': { 'db':'dbDatabase', 'user':'dbUser', 'pass':'dbPass', 'host':'dbServer', 'prefix': 'tablePrefix'},
# $GLOBALS['ISC_CFG']["dbUser"] = 'beechwor_jodieg';
# $GLOBALS['ISC_CFG']["dbPass"] = 'e2otjodf';
# $GLOBALS['ISC_CFG']["dbDatabase"] = 'beechwor_shop2';
# $GLOBALS['ISC_CFG']["tablePrefix"] = 'isc_';
},
{
'app': 'oxwall',
'configfile': 'ow_includes/config.php',
'assignments': [re.compile(r"""define\s*\(\s*['"](.*?)['"]\s*,\s*['"](.*?)['"]\s*\)""")],
'map': { 'db':'OW_DB_NAME', 'user':'OW_DB_USER', 'pass':'OW_DB_PASSWORD', 'host':'OW_DB_HOST', 'prefix': 'OW_DB_PREFIX'},
},
{
# define('DB_HOST', 'localhost'); // database host
# define('DB_USER', 'thewenwt_kenneth'); // username
# define('DB_PASS', 'k3nn3th'); // password
# define('DB_NAME', 'thewenwt_onlineshop'); // database name
'app': 'wordpress',
'configfile': 'wp-config.php',
'assignments': [re.compile(r"""^\s*define\s*\(\s*['"](.*?)['"]\s*,\s*['"](.*?)['"]\s*\)""")],
'map': { 'db':'DB_NAME', 'user':'DB_USER', 'pass':'DB_PASSWORD', 'host':'DB_HOST'},
'regexlist': {
re.compile(r"\$table_prefix\s*=\s*'(.*?)'") : ['prefix'],
},
},
{
'app': 'CodeIgniter',
'configfile': 'config.php',
'assignments': [re.compile(r"""engine_config\['db'\]\[\'(.*?)'\]\s*=\s*'(.*?)';""")],
'map': { 'db':'database', 'user':'username', 'pass':'password', 'host':'hostname'},
},
{
# define('DB_DRIVER', 'mysql');
# define('DB_HOSTNAME', 'localhost');
# define('DB_USERNAME', 'phenoelc_cube');
# define('DB_PASSWORD', 'ant1fr33z3');
# define('DB_DATABASE', 'phenoelc_cubecart');
# define('DB_PREFIX', 'phenoelc_');
'app': 'OpenCart',
'configfile': 'config.php',
'assignments': [re.compile(r"""define\s*\(\s*['"](.*?)['"]\s*,\s*['"](.*?)['"]\s*\)""")],
'map': { 'db':'DB_DATABASE', 'user':'DB_USERNAME', 'pass':'DB_PASSWORD', 'host':'DB_HOSTNAME', 'prefix': 'DB_PREFIX'},
},
{
# define('_DB_NAME_', 'pcgatlfy_pcg');
# define('_MYSQL_ENGINE_', 'InnoDB');
# define('_DB_SERVER_', 'localhost');
# define('_DB_USER_', 'pcgatlfy_pcg');
# define('_DB_PREFIX_', 'ps_');
# define('_DB_PASSWD_', 'nUTh');
'app': 'prestashop',
'configfile': 'config/settings.inc.php',
'assignments': [re.compile(r"""define\s*\(\s*['"](.*?)['"]\s*,\s*['"](.*?)['"]\s*\)""")],
'map': { 'db':'_DB_NAME_', 'user':'_DB_USER_', 'pass':'_DB_PASSWD_', 'host':'_DB_SERVER_', 'prefix': '_DB_PREFIX_'},
},
{
# define('DB_HOST', 'localhost'); // database host
# define('DB_USER', 'thewenwt_kenneth'); // username
# define('DB_PASS', 'k3nn3th'); // password
# define('DB_NAME', 'thewenwt_onlineshop'); // database name
'app': 'shop-script free',
'configfile': 'cfg/connect.inc.php',
'assignments': [re.compile(r"""define\s*\(\s*['"](.*?)['"]\s*,\s*['"](.*?)['"]\s*\)""")],
'map': { 'db':'DB_NAME', 'user':'DB_USER', 'pass':'DB_PASS', 'host':'DB_HOST'},
},
{
# define('DB_TYPE', 'mysql');
# define('DB_HOST', 'localhost');
# define('DB_USERNAME', 'ssidhvcc_admin');
# define('DB_PASSWORD', 'pw4admin');
# define('DB_NAME', 'ssidhvcc_ssinov2010');
'app': 'bake',
'configfile': 'config.php',
'assignments': [re.compile(r"""define\s*\(\s*['"](.*?)['"]\s*,\s*['"](.*?)['"]\s*\)""")],
'map': { 'db':'DB_NAME', 'user':'DB_USERNAME', 'pass':'DB_PASSWORD', 'host':'DB_HOST'},
},
{
'app': 'magento',
'configfile': 'app/etc/local.xml',
'assignments': [re.compile(r"""<([a-z]+)>> /etc/sysctl.conf
done
echo '# Setting sysctls'
sysctl -p
echo '# Values after frob'
sysctl -a | grep panic
""")
# kernel.modules_disabled was here ... it should probably be used in the firewall setup ..
def droppriv(target=".", quiet=False):
"Drop root privileges"
import posix,pwd
stat = os.stat(target)
uid = stat.st_uid
if os.getuid==uid:
return # job's done already
# gid = stat.st_gid
gid = pwd.getpwuid(uid).pw_gid
try:
posix.setgroups([])
posix.setgid(gid)
posix.setuid(uid)
posix.seteuid(uid)
except:
if not quiet:
sys.stderr.write("We are already unprivileged :)\n")
if uid==0:
raise Exception.create("Oops - we dropped privilege to root: that's probably wrong");
os.environ['HOME'] = pwd.getpwuid(uid).pw_dir
os.environ['PS1'] = '\\u@\\h [\\w]\\$ '
return os.environ['HOME']
def list_myips():
if_re = re.compile(r'^([^ :]+)');
inet_re = re.compile(r'inet addr:(\d\S+)')
ifconfig=os.popen("ifconfig",'r')
d={'eth': 'eth0'}
for line in ifconfig:
m = if_re.search(line)
if m: d['eth']=m.group(1)
m = inet_re.search(line)
if m:
d['ip']=m.group(1)
yield d
def arping():
print("# Sending arping -U for each configured IP address shown by ifconfig:")
for d in list_myips():
if d['ip'].startswith('127.') or d['eth']=='lo': continue
cmd = "arping -U -I %(eth)s -c 2 %(ip)s" % d
print(cmd)
os.system(cmd)
# root@foreverresortssouthafrica [~]# ifconfig | grep -o 'addr:[^ ]\+' | cut -f 2 -d : | while read x; do arping -U $x -I eth1 -c 3; done
def mv(src,dst):
params = dict(src=src,dst=dst,nice='ionice -c 3 nice -n 19')
if not os.path.exists(src):
print("# ERROR: source does not exist")
return
if os.path.exists(dst):
print("# ERROR: destination already exists")
return
if src==dst:
print("# ERROR: src==dst: crazy")
return
os.system("""
[ -d '%(src)s' ] || {
echo "# ERROR: %(src)s is not a directory"
exit
}
echo "# INFO: Making dest dir %(dst)s"
mkdir -p %(dst)s
echo "# INFO: Doing nice initial copy to %(dst)s"
%(nice)s cp -au %(src)s/. %(dst)s/.
echo "# INFO: Doing nice rsync --delete to %(dst)s"
%(nice)s rsync -a --delete %(src)s/. %(dst)s/.
echo "# INFO: Renaming source, and making link to dest"
mv %(src)s %(src)s.orig
ln -s %(dst)s %(src)s
chown -h --reference=%(dst)s %(src)s
echo "# INFO: Sleeping ..."
sleep 15
echo "# INFO: Doing additional rsync without nice or --delete (possible duplicate mails)"
rsync -a %(src)s.orig/. %(dst)s/.
echo "# TODO: Check that everything is working, and remove the source like this:"
echo "%(nice)s rm -r '%(src)s.orig'"
""" % params)
def do_dbaccess(operation,args):
res=dbaccess()
shellargs=''
for arg in args: shellargs+= " '" + (arg.replace("'",r"'\''")) + "'"
if not res:
print("Unknown application")
return
if operation=='mysql':
os.system(res['mysql']+shellargs)
elif operation=='mysqldump':
os.system(res['mysqldump']+shellargs)
elif operation=='grant':
fd=os.popen("mysql",'w')
fd.write(res['grant'])
fd.close()
def do_dbpass(operation,args):
res=dbaccess()
res['newdbpassword']=randompassword(12)
print("Rewriting db password from %(pass)s to %(newdbpassword)s" % res)
# Change database password
fd = os.popen(res['mysql'],'w')
fd.write('SET PASSWORD=PASSWORD("%(newdbpassword)s");' % res)
fd.close()
# Rewrite the config file
fd=open(res['file'],'r')
configfile=fd.read()
fd.close()
configfile=configfile.replace(res['pass'],res['newdbpassword'])
fd=open(res['file'],'w')
fd.write(configfile)
fd.close()
def do_nocomment():
# Remove evil components
res=dbaccess()
cmd='';
if res['app'].startswith('joomla'):
# cmd = """%(mysql)s -e 'update %(prefix)scomponents set enabled=0 where `option` in ("com_fabrik","com_remository");' """ % res
cmd = """
echo '
truncate table %(prefix)srem_review; # delete all comments
alter table %(prefix)srem_review modify id int(11); # change from autoincrement to int
insert into %(prefix)srem_review (id) values (0); # add a bogus non-comment comment
truncate table %(prefix)sk2_comments; # delete all comments
alter table %(prefix)sk2_comments modify id int(11); # change from autoincrement to int
insert into %(prefix)sk2_comments (id) values (0); # add a bogus non-comment comment
drop table %(prefix)skunena_messages_text; # delete all comments and break the application: it cannot even index its primary key
truncate table %(prefix)sudjacomments; # delete all comments
alter table %(prefix)sudjacomments modify id int(11); # change from autoincrement to int
insert into %(prefix)sudjacomments (id) values (0); # add a bogus non-comment comment
truncate table %(prefix)skunena_messages; # delete all comments
alter table %(prefix)skunena_messages modify id int(11); # change from autoincrement to int
insert into %(prefix)skunena_messages (id) values (0); # add a bogus non-comment comment
' | %(mysql)s -f
""" % res
if res['app'].startswith('MODx'):
# cmd = """%(mysql)s -e 'update %(prefix)scomponents set enabled=0 where `option` in ("com_fabrik","com_remository");' """ % res
cmd = """
echo '
truncate table %(prefix)sjot_content ;
alter table %(prefix)sjot_content change column id `id` int(10) NOT NULL;
insert into %(prefix)sjot_content (id) values (0); # add a bogus non-comment comment
' | %(mysql)s -f
""" % res
if cmd:
print(cmd)
os.system(cmd);
print("# Done")
else:
print("Eish, nocomment not available for this application")
def php_version():
# Returns 0x050317 for php 5.3.17
fd = os.popen('php -v','r')
for line in fd:
m = re.search(r'(\d+)\.(\d+)\.(\d+)', line)
if m:
return int(m.group(1)) * 0x10000 + \
int(m.group(2)) * 0x00100 + \
int(m.group(3)) * 0x00001 ;
m = re.search(r'(\d+)\.(\d+)', line)
if m:
return int(m.group(1)) * 0x10000 + \
int(m.group(2)) * 0x00100 ;
return 0
def do_autocleanup(parameters):
os.system(r"""
pwd | grep -q public_html || exit 1
/usr/local/afribin/maintenance/linkfarmscan.py -N /dev/null --limit 999999 . -n php -l | /usr/local/afribin/quarantine
""")
def do_jce():
"Fix com_jce hack with do_secure and clean up common hacks"
do_secure()
os.system(r"""
cd $( echo $PWD | sed 's/public_html.*/public_html/' )
find ../.htaccess . -name .htaccess -print0| xargs -0 perl -p -i -e 'if (m/^\s+$|^\s{10}/) { $_=""; }'
find images -name \*.php\* -print0|xargs -0 %(frob)s disable
find . -type l -print0|xargs -0 rm
find . -name \*.old.php -print0|xargs -0 quarantine
find . -name x.txt -print0| xargs -0 quarantine
for FILENAME in \
components/com_user/views/reset/mod.php \
components/com_banners/models/mod.php \
components/com_remository_files \
media/sok.php \
media/mod.php \
_vti_pvt/service.pwd \
modules/mod.php \
images/stories/pageinfo.php \
images/stories/error_log \
images/stories/ll.php \
images/stories/semi.php \
images/stories/kabe.php ; do
[ -f "$FILENAME" ] || continue
quarantine "$FILENAME"
done
""" % dict(frob=frob()));
class Slurp:
def __init__(self):
self.data=[]
def write(self,line):
self.data.append(line)
def __repr__(self):
return ''.join(self.data);
def do_john(res, no_act=False, verbose=0,guesses=[]):
path = os.path.dirname(frob())+'/andrew-scripts';
if not os.path.exists(path): path='/usr/local/afribin/andrew-scripts';
sys.path.append(path);
import john
slurp=Slurp()
john.guesses.extend(guesses)
john.find_vulnerable_installations(user=res['db'], stdout=slurp, res=res, verbose=verbose);
for line in slurp.data:
if verbose: sys.stdout.write(line)
if not line.startswith("#"): continue
print("Vulnerable password: "+line.strip())
if not no_act:
fd=os.popen('/bin/bash -v','w')
fd.writelines(slurp.data);
fd.close()
def check_jce(no_act=False):
# Joomla: Remove jce plugin
if not os.path.exists('plugins/editors/jce.xml'):
return
xml = open('plugins/editors/jce.xml','r').read()
version=re.search(r'(.*)',xml)
if not version: return
version=version.group(1)
if version > '2.2.':
return
if no_act:
print("We found a vulnerable installation of JCE (joomla content editor), version %s" % version)
return
print("Removing jce joomla content editor version %s" % version)
os.system("rm -r plugins/editors/jce{,.xml,.php} administrator/components/com_jce/jce.xml");
print("Installing files of another random version of jce")
os.system("curl http://answers.afrihost.com/updates/jce-files.tar.gz | %s su -- tar -zx ." % frob()); # droppriv after fork
def do_secure(res=None, no_act=False, quick=False):
# Remove evil components
if not res:
res=dbaccess(show=False, unknown_application='an unknown application')
if no_act:
print("Checking application security for %(app)s %(version)s:" % res)
else:
print("Setting up application security for %(app)s %(version)s:" % res)
if res['app'].startswith('joomla'):
# Joomla: Evil / stupid components
res['sql']='select distinct `option` from %(prefix)scomponents where enabled=1;' % res
res['sql']=res['sql'].replace("'","'\\''")
cmd = """%(mysql)s -Ne '%(sql)s' 2>/dev/null """ % res
p = os.popen(cmd,'r')
for bad_component in p:
res['component']=bad_component.strip()
if res['component'] not in ('com_fabrik','com_remository',): continue
print("Vulnerable %(app)s component %(component)s found" % res)
if no_act: continue
print("Disabling %(app)s component %(component)s by setting 'enabled' to false" % res)
res['sql']='update %(prefix)scomponents set enabled=0 where `option` = "%(component)s";' % res
res['sql']=res['sql'].replace("'","'\\''")
cmd = """%(mysql)s -Ne '%(sql)s' """ % res
print(cmd)
os.system(cmd);
if os.path.exists('components/com_smartformer/smartformer.php'):
code = open('components/com_smartformer/smartformer.php','r').read()
m = re.search(r'@version (\d\S+)',code)
if m and m.group(1) < '2.4.1':
print("Upgrading com_smartformer version "+m.group(1))
upgrade = r'curl http://answers.afrihost.com/updates/com_smartformer-files.tar.gz | %s su -- tar -xz' % sys.argv[0];
os.system(upgrade);
check_jce(no_act)
# Protect image directories
writeable_dirs = [ 'images','uploads','media','wp-content/uploads',
'upload','cache','tmp','logs','wp-content/flagallery',
'components/com_smartformer/files',
'sobi2_downloads','phocadownload',
'components/com_jnews/includes/openflashchart/tmp-upload-images',
]
for imagedir in writeable_dirs:
if os.path.exists(imagedir):
do_images(imagedir,no_act)
# Check for guessable passwords
if 'db' in res:
do_john(res, no_act=no_act)
# Find
# TODO: ./wp-content/themes/*/framework/_scripts/valums_uploader/php.php
p=os.popen(r'find . -iname \*thumb\*.php -o -iname \*upload\*.php -o -iname \*process-form.php','r')
for line in p:
fn=line.strip('\n');
if not os.path.exists(fn): continue
if not os.path.isfile(fn): continue
basename=line.split('/')[-1].lower()
files=[fn, ]
if basename.find('thumb')>=0:
do_patch_timthumb(files ,no_act=no_act);
elif basename.find('upload')>=0 or basename.find('form')>=0:
do_patch_upload(files,no_act=no_act);
# done
if not no_act and res['app'].startswith('wordpress') and php_version() >= 0x050300:
print("%(app)s: setting new secrets" % res)
refresh_wordpress_keys('wp-config.php');
do_wp(None) # Install
print("%(app)s: Installing cookies for comments and force-strong-password" % res)
cmd = """
echo "Deleting inactive plugins ..."
$HOME/bin/wp plugin delete `$HOME/bin/wp plugin list | awk '($2 == "inactive"){print $1}' `
echo "Updating plugins ..."
$HOME/bin/wp plugin update --all
echo "Updating themes ..."
$HOME/bin/wp theme update --all
echo "Installing cookies-for-comments plugin"
$HOME/bin/wp plugin install cookies-for-comments --activate
echo "Installing force-strong-passwords plugin"
$HOME/bin/wp plugin install force-strong-passwords --activate
"""
s = cmd.replace(r"'",r"'\''")
droppriv(quiet=True)
os.system(cmd)
def dbaccess(show=True,unknown_application=None):
try:
if unknown_application: unknown_application={'app': unknown_application, 'version':''}
res = None
cmsconfigs=[
dict(getconfigfunc=dbaccess_joomla, files=["configuration.php"], ),
dict(getconfigfunc=dbaccess_moodle, files=["config.php"], ),
dict(getconfigfunc=dbaccess_phpbb, files=["config.php"], ),
#dict(getconfigfunc=dbaccess_wordpress, files=["wp-config.php"], ),
dict(getconfigfunc=dbaccess_openx, files=glob.glob('var/*.conf.php'), ),
dict(getconfigfunc=dbaccess_other, files=[""], ),
dict(getconfigfunc=dbaccess_guess, files=["index.php"], ),
]
res=None
for cmsconfig in cmsconfigs:
for filename in cmsconfig['files']:
if filename and not os.path.exists(filename):
continue
res = cmsconfig['getconfigfunc'](filename)
if res:
break
if res:
break
if res:
res.setdefault('prefix','')
if 'version' not in res:
res['version'] = version_of_application(res.get('app','None')).replace(",","\\,")
try:
res['mysql'] = "mysql --host=%(host)s --password='%(pass)s' --user=%(user)s %(db)s" % res
res['mysqldump'] = "mysqldump --host=%(host)s --password='%(pass)s' --user=%(user)s %(db)s --skip-ext --skip-lock-tables" % res
res['grant'] = "GRANT ALL on `%(db)s`.* to '%(user)s'@'localhost' IDENTIFIED BY '%(pass)s';" % res
if show and sys.stderr.isatty() and sys.stdout.isatty() and sys.stdin.isatty():
sys.stderr.write( (
"# application=%(app)s version=%(version)s configfile=%(file)s prefix=%(prefix)s\n"
"mysql --host=%(host)s --password='%(pass)s' --user=%(user)s %(db)s\n"
"mysqldump --host=%(host)s --password='%(pass)s' --user=%(user)s %(db)s --skip-ext --skip-lock-tables|less\n"
"# GRANT ALL on `%(db)s`.* to '%(user)s'@'localhost' IDENTIFIED BY '%(pass)s';\n"
) % res
)
except KeyError:
if show:
print("Application unknown. Please report if you know what it is.")
if 'prefix' in res: res.pop('prefix');
if 'version' in res: res.pop('version');
if len(res):
if show:
print(res.__repr__()[:80])
else:
res['user']= pwd.getpwuid(os.stat(".").st_uid).pw_name
if show:
print("# egrep -1 \"%(user)s_[0-9A-Za-z]*\" {.,inc*,conf*}/*.php" % res)
os.system("bash -c 'egrep -1 --color=ALWAYS \"%(user)s_[0-9A-Za-z]*\" {.,inc*,conf*}/*.php 2>/dev/null | head -n 20'" % res)
#raise
pass
if res==None: unknown_application;
return res
res=unknown_application
except AttributeError:
return None
return res
def version_of_anything(filenames,regex, group=1, debug=0):
if type(regex)==str: regex =re.compile(regex)
if type(filenames)==str: filenames=[filenames,]
for fn in filenames:
if debug: print(fn)
if not os.path.exists(fn): continue
if debug: print(fn)
fd = open(fn,'r')
for line in fd:
m = regex.search(line)
if m:
if debug: print(line)
if debug: print('---'.join(m.groups()))
return m.group(group)
return ''
def version_of_phplist():
return version_of_anything("admin/connect.php",r'define\("VERSION","(\S+)"\);')
def version_of_application(app):
if app=='joomla':
return version_of_joomla()
if app=='joomla-2.x-series':
return version_of_anything("administrator/manifests/files/joomla.xml",r'(.*?)')
if app=='joomla-1.ancient':
return version_of_anything("includes/version.php",r"var \$RELEASE\s*=\s*'(.*)'")
if app=='vtiger':
return version_of_anything("vtigerversion.php",r"vtiger_current_version\s*=\s*'(.*?)'");
if app=='phplist':
return version_of_anything("admin/connect.php",r'define\("VERSION","(\S+)"\);')
if app=='wordpress':
return version_of_anything("wp-includes/version.php",r'''\$wp_version\s*=\s*["'](.*?)["']''');
if app=='oxwall':
return version_of_anything("ow_version.xml",r'''(.*?)''');
if app=='OpenCart':
return version_of_anything("index.php",r'''define\('VERSION', '(.*?)'\);''');
if app=='MODx':
if os.path.exists('core/docs/changelog.txt'):
return version_of_anything("core/docs/changelog.txt",r"MODx Revolution\s+(.*?\(.*,.*\))");
if os.path.exists('changelog.txt'):
return version_of_anything("changelog.txt",r"\d+/\d+/\d+: Version\s+([^\r\n]*)");
if app=='oscommerce':
return version_of_anything("includes/application_top.php", r"define\('PROJECT_VERSION', *'(.*?)'\)")
if app=='cubecart':
return version_of_anything("ini.inc.php",r"""\$ini\['ver'\]\s*=\s*'(.*?)'""")
if app=='elgg':
return version_of_anything("CHANGES.txt",r"""Version (\d.*)""")
if app=='Comdev One Admin':
return version_of_anything("readme.txt",r"""Comdev One Admin (\d+\..*)""")
if app=='drupal':
v=version_of_anything("modules/system/system.module",r"""define\('VERSION', *'(.*?)'\)""")
if not v: v=version_of_anything('./includes/bootstrap.inc',r"""define\('VERSION', *'(.*?)'\)""")
return v
if app=='e107':
# e107_admin/ver.php:$e107info['e107_version'] = "0.7.25";
return version_of_anything("e107_admin/ver.php",r'''\['e107_version'\]\s*=\s*"(.*?)"''', group=1, debug=0);
if app=='WebCalendar':
return version_of_anything("includes/config.php",r'''PROGRAM_VERSION\s*=\s*['"]v?(.+?)["']''', group=1, debug=0);
if app=='hesk helpdesk':
return version_of_anything("hesk_settings.inc.php",r"""hesk_settings\['hesk_version'\]='(.*?)';""")
if app=='magento':
return version_of_anything("RELEASE_NOTES.txt",r"""==== ([^=]*?) ====""")
if app=='coppermine photo gallery 1.x':
return version_of_anything("admin.php",r"""Coppermine version:\s+(\d+\S*)""")
if app=='MyBB':
return version_of_anything("calendar.php",r""" \* MyBB\s+(\d+\.\S*)""")
if app=='phpmyfaq':
return version_of_anything("docs/CHANGELOG",r"""phpMyFAQ (\d+\.[0-9.]+)""")
if app=='interspire shopping cart':
return version_of_anything("lib/init.php",r"""define\('PRODUCT_VERSION', *'(.*?)'\)""")
if app=='xoops':
return version_of_anything("include/version.php",r"""define\('XOOPS_VERSION', *'[XOOPS ]*(.*?)'\)""")
if app=='Gallery2.3':
return version_of_anything("./modules/core/module.inc", r"""this->setGalleryVersion\('(.*?)'\);""");
return ''
def version_of_joomla():
changelogfile="CHANGELOG.php"
if not os.path.exists(changelogfile): return 'unknown';
cl = open(changelogfile,'r')
version_re=re.compile(r"------ (\d+\.\d+\.\d+[^\[-]*) ")
for line in cl:
m = version_re.search(line)
if m:
return m.group(1)
return 'unknown'
def nocommentspam():
# FIXME show create table x; drop table x; create table x s/AUTOINCREMENT//
jos_joomgallery_comments = """
drop table jos_joomgallery_comments;
CREATE TABLE `jos_joomgallery_comments` (
`cmtid` int(11) NOT NULL,
`cmtpic` int(11) NOT NULL default '0',
`cmtip` varchar(15) NOT NULL default '',
`userid` int(11) unsigned NOT NULL default '0',
`cmtname` varchar(50) NOT NULL default '',
`cmttext` text NOT NULL,
`cmtdate` varchar(20) default NULL,
`published` tinyint(1) NOT NULL default '0',
`approved` tinyint(1) NOT NULL default '1',
PRIMARY KEY (`cmtid`),
KEY `idx_cmtpic` (`cmtpic`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1
"""
def show_autologin(content,prefix='',show=True,url=None,base_url=None):
filename=prefix+'autologin-%s.php' % easypassword();
fd=open(filename,'w')
fd.write(content);
fd.close()
if base_url:
if not base_url.endswith('/'): base_url+='/';
url=base_url+filename
if not url:
url = os.popen('url "%(filename)s"' % dict(filename=filename),'r').read().strip()
meh = dict(filename=filename,url=url);
os.system(r'''
chmod 644 %(filename)s
chown --reference=index.php %(filename)s''' % meh )
if show:
os.system(r'''
echo Autologin URL is:
echo
echo %(url)s
echo
read -t 120 -p "Press Enter to remove %(filename)s ..." || echo
\rm -f %(filename)s
''' % meh)
return url;
def autologin_joomla():
autologin_php = """1200) { die('Expired'); }
setcookie("RFC3514","1",time()+604800,'/');
// Set flag that this is a parent file
define( '_JEXEC', 1 );
define('JPATH_BASE', dirname(__FILE__) );
define('DS', DIRECTORY_SEPARATOR);
require_once( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once( JPATH_BASE .DS.'includes'.DS.'framework.php' );
require_once( JPATH_BASE .DS.'includes'.DS.'helper.php' );
require_once( JPATH_BASE .DS.'includes'.DS.'toolbar.php' );
$mainframe =& JFactory::getApplication('administrator');
$mainframe->initialise(array( 'language' => $mainframe->getUserState( "application.lang", 'lang' )));
JPluginHelper::importPlugin('system');
// trigger the onAfterInitialise events
$mainframe->triggerEvent('onAfterInitialise');
########## BEGIN BACKDOOR #########
$db =& JFactory::getDBO();
$query = 'SELECT username,email from #__users WHERE usertype like "Super administrator%" LIMIT 1';
$db->setQuery($query);
$rows = $db->loadObjectList();
foreach ($rows as $row) {
$credentials=array('username'=> $row->username, 'password'=> rand());
break;
}
require_once( JPATH_BASE .DS.'..'.DS.'libraries'.DS.'joomla'.DS.'user'.DS.'authentication.php' );
#jimport( 'joomla.user.authentication');
$response = new JAuthenticationResponse();
$response->type='backdoor';
$response->username=$credentials['username'];
$response->fullname=$credentials['username'];
$response->password=$credentials['password'];
#$session = &JFactory::getSession();
#$session->fork();
#$mainframe->_createSession($session->getId());
JPluginHelper::importPlugin('user');
#$results = $mainframe->triggerEvent('onLoginUser', array((array)$response, array()));
$results = $mainframe->triggerEvent('onLoginUser', array($credentials, array()));
########## END BACKDOOR #########
$mainframe->route();
$mainframe->triggerEvent('onAfterRoute');
$option = JAdministratorHelper::findOption();
$mainframe->dispatch($option);
$mainframe->triggerEvent('onAfterDispatch');
$mainframe->render();
$mainframe->triggerEvent( 'onAfterRender' );
echo JResponse::toString($mainframe->getCfg('gzip'));
"""
show_autologin(autologin_php,'administrator/')
def autologin_joomla16(show=True,timeout=1200):
autologin_php = """"""+str(timeout)+""") { die('Expired'); }
setcookie("RFC3514","1",time()+604800,'/');
// Set flag that this is a parent file
define( '_JEXEC', 1 );
define('JPATH_BASE', dirname(__FILE__) );
define('DS', DIRECTORY_SEPARATOR);
require_once( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once( JPATH_BASE .DS.'includes'.DS.'framework.php' );
require_once( JPATH_BASE .DS.'includes'.DS.'helper.php' );
require_once( JPATH_BASE .DS.'includes'.DS.'toolbar.php' );
$app =& JFactory::getApplication('administrator');
$app->initialise(array( 'language' => $app->getUserState('application.lang')));
JPluginHelper::importPlugin('system');
$app->triggerEvent('onAfterRoute');
$app->triggerEvent('onAfterDispatch');
// trigger the onAfterInitialise events
$app->triggerEvent('onAfterInitialise');
########## BEGIN BACKDOOR #########
$db =& JFactory::getDBO();
#$query = 'SELECT username,email from #__users WHERE usertype REGEXP "Super administrator|Super User" LIMIT 1';
$query = 'SELECT username,email from #__users ORDER by id LIMIT 1';
$db->setQuery($query);
$rows = $db->loadObjectList();
foreach ($rows as $row) {
$credentials=array('username'=> $row->username, 'password'=> rand());
break;
}
require_once( JPATH_BASE .DS.'..'.DS.'libraries'.DS.'joomla'.DS.'user'.DS.'authentication.php' );
#jimport( 'joomla.user.authentication');
$response = new JAuthenticationResponse();
$response->type='backdoor';
$response->username=$credentials['username'];
$response->fullname=$credentials['username'];
$response->password=$credentials['password'];
# JAUTHENTICATE_STATUS_SUCCESS is defined by joomla 1.6
if (defined('JAUTHENTICATE_STATUS_SUCCESS')) $response->status=JAUTHENTICATE_STATUS_SUCCESS; else $response->status=JAuthentication::STATUS_SUCCESS;
JPluginHelper::importPlugin('user');
$results = $app->triggerEvent('onUserLogin', array($credentials, array()));
########## END BACKDOOR #########
# Render something
$app->route();
$app->triggerEvent('onAfterRoute');
$app->dispatch();
$app->triggerEvent('onAfterDispatch');
$app->render();
$app->triggerEvent( 'onAfterRender' );
echo $app;
"""
return show_autologin(autologin_php,'administrator/',show=show)
def do_login(show=True):
"Get login link for current application (e.g. wordpress)"
res=dbaccess(show=False, unknown_application='Unknown application')
sys.stderr.write("autologin %(app)s %(version)s...\n" % res);
if res['app']=='joomla':
return autologin_joomla()
elif res['app']=='joomla-2.x-series':
return autologin_joomla16(show=show)
elif res['app']=='wordpress':
return autologin_wordpress()
else:
print("Not implemented")
def do_software_list(dirlist):
if len(dirlist)==0:
dirlist = glob.glob('/home/*/public_html')
dirlist.sort()
cwd = os.getcwd()
for directory in dirlist:
if not os.path.isdir(directory): continue
os.chdir(cwd)
os.chdir(directory)
res=dbaccess(show=False)
if not res or not res['app'] or res['app']=='some application': continue
res['directory'] = directory
dirname=sys.argv[0]
dirname=dirname[ :dirname.rfind('/')+1 ]
if dirname.startswith('.'): dirname=cwd+'/'+dirname
res['url']=os.popen(dirname+'url','r').read().strip();
res['pad']=' '* (32 - len(res['app']) - len(res['version']) )
print("%(app)s %(version)s %(pad)s%(directory)-30s %(url)s" % res)
sys.stdout.flush();
def wordpress_option(option,default=''):
if os.getuid()==0:
droppriv()
php=r'''=0:
return default; # probably some error
return rc.strip()
def autologin_wordpress():
autologin_php=r"""get_row("SELECT users.* FROM $wpdb->users users, $wpdb->usermeta users_meta where users.id=users_meta.user_id and users_meta.meta_key like '%capabilities' and users_meta.meta_value like '%administrator%' ORDER BY ID limit 1")) {
$u=$wpdb->get_row("SELECT * FROM $wpdb->users ORDER BY ID limit 1");
}
$user=$u->user_login;
wp_setcookie($user,rand(),false,"","","");
do_action('wp_login',$user);
wp_redirect('wp-admin/'); }
"""
show_autologin(autologin_php,base_url=wordpress_option('siteurl'));
def do_wp(parameters):
home = droppriv(quiet=True)
res=dbaccess(show=False)
if not res or res['app'] != 'wordpress':
sys.stderr.write("ERROR: No wordpress here. (?!)... continuing anyway ...\n")
do_download=1
try:
wp_time = os.stat(home+'/bin/wp' )
if wp_time.st_mtime > time.time()-365*86400 and wp_time.st_size not in ( 817983, 5616279 ) :
do_download=False
except:
pass
if do_download:
cmd='''
echo "Downloading wp-cli.phar to $HOME/bin/wp"
mkdir -p $HOME/bin
wget -O $HOME/bin/wp http://answers.afrihost.com/updates/wp-cli.phar
chmod 755 $HOME/bin/wp
'''
os.system(cmd);
if parameters:
cmd='''
$HOME/bin/wp %s
'''
os.system(cmd % (' '.join(map(shellquote,parameters))))
return home
def do_drush(parameters):
droppriv()
res=dbaccess(show=False)
if res['app']!='drupal':
print("No drupal here. (?)")
return
if not os.path.isdir("../drush"):
os.system(r""" curl http://ftp.drupal.org/files/projects/drush-7.x-5.9.tar.gz | tar -C .. -xz """)
if not os.path.exists("../drush/php.ini"):
os.system(r""" sed 's/^memory_limit.*/memory_limit = 256M/' < $( php -r 'echo php_ini_loaded_file();' ) > ../drush/php.ini """)
os.system("../drush/drush %s" % ' '.join(parameters))
def drupal():
res=dbaccess(show=False)
if res['app']!='drupal':
print("No drupal here. (?)")
return
mysql = "mysql -f --host=%(host)s --password='%(pass)s' --user=%(user)s %(db)s" % res
print("Hacking %(app)s as configured in %(file)s" % res)
fd = os.popen(mysql,'w')
cmds="""
UPDATE system SET status='0' WHERE name='tellafriend';
UPDATE system SET status='0' WHERE name='forward';
UPDATE system SET status='0' WHERE name='syslog';
UPDATE system SET status='0' WHERE name='forum';
"""
fd.write(cmds)
fd.close();
def shellquote(name):
return "'" + ( name.replace("'","'\\''") ) + "'"
def do_patch_ereg_replace(files,no_act=False):
match=re.compile(r"""\b(ereg_replace)\b""");
already_done=re.compile(r'deprecated_ereg_replace');
patch=r"""""";
for filename in files:
if not os.path.exists(filename):
sys.stderr.write("'%s' does not exist.\n" % filename)
continue
fd=open(filename,'r');
content=fd.read();
if not match.search(content): continue;
if already_done.search(content):
sys.stderr.write("%s: ereg_replace already patched\n" % filename)
continue;
if no_act:
sys.stderr.write("%s is an ereg_replace script that requires a patch\n" % filename)
return
content=content.replace('ereg_replace','deprecated_ereg_replace');
content=patch+content;
fd=open(filename,'w');
fd.write(content)
fd.close()
sys.stderr.write("ereg_replace patched %s\n" % filename)
def do_patch_upload(files,no_act=False):
# match=re.compile(r"""""", re.DOTALL );
patch=r"""""";
for filename in files:
if not os.path.exists(filename):
sys.stderr.write("'%s' does not exist.\n" % filename)
continue
fd=open(filename,'r');
content=fd.read();
# if not match.search(content): continue; # this takes too long on bigger files ...
i = content.find('""";
match=r"""preg_match('/\.php/i',$_REQUEST['src'])""";
check="""TimThumb"""
for filename in files:
if not os.path.exists(filename):
sys.stderr.write("'%s' does not exist.\n" % filename)
continue
fd=open(filename,'r');
content=fd.read();
if content.find(match)>=0: continue;
if content.find(check)<0: continue;
content=patch+content;
if no_act:
print("We found a vulnerable installation of timthumb, which requires a patch %s\n" % filename);
else:
st = os.stat(filename);
fd=open(filename,'w');
fd.write(content)
fd.close()
os.utime(filename,(st.st_atime, st.st_mtime) ); # ctime changes instead
sys.stderr.write("Vulnerable copy of tim thumb patched, %s\n" % filename)
def remail(files):
emailre=re.compile(r'[a-zA-Z0-9+_\-\.]+@[0-9a-zA-Z][.-0-9a-zA-Z]*.[a-zA-Z]+')
for filename in files:
recipients=[]
fd=open(filename,'r')
while True:
line = fd.readline()
if line.strip()=='': break
if not line.startswith('Envelope-to: '): continue
recipients = emailre.findall(line)
line = fd.readline()
while line.startswith(' ') or line.startswith('\t'):
recipients.extend( emailre.findall(line) )
line = fd.readline()
break
fd.close()
if len(recipients):
recipientparams = ' '.join(map(shellquote,recipients))
sys.stdout.write('sendmail %s < %s\n' % (recipientparams, shellquote(filename)) )
else:
sys.stdout.write('sendmail -t -i < %s\n' % (shellquote(filename)) )
def do_limit(mailsperhour):
cpanel = CpanelData()
cpanel.setitem("MAX_EMAIL_PER_HOUR",str(mailsperhour))
os.system("/usr/local/cpanel/scripts/update_email_limits '%s'" % cpanel.user)
def suspend():
cpanel = CpanelData()
r={'user': cpanel.user, }
os.system("""
/scripts/suspendacct %(user)s
""" % r )
def unsuspend():
cpanel = CpanelData()
r={'user': cpanel.user, }
os.system("""
/scripts/unsuspendacct %(user)s
""" % r )
def lockout():
cpanel = CpanelData()
r={'user': cpanel.user, }
print("HARD suspend to lock out account %(user)s for 1 week" % r)
os.system("""
[ -f /usr/bin/at ] || yum -y install at && service atd start
chattr -i /var/cpanel/users/%(user)s
/scripts/suspendacct %(user)s
chattr +i /var/cpanel/users/%(user)s
chattr +i /home/%(user)s/public_html/.htaccess
echo "chattr -i /var/cpanel/users/%(user)s /home/%(user)s/public_html/.htaccess" | at now + 2 days
""" % r )
def unlockout():
sys.stderr.write(" frob unlockout auth token:");
r=sys.stdin.readline()
if not r.startswith(chr(32)+chr(32)): # auth token is
print(" Incorrect auth token")
return
cpanel = CpanelData()
r={'user': cpanel.user, 'taken_down': 'taken-down'}
os.system("""
if [ -d '%(taken_down)s' ] ; then
echo "Undoing takedown"
rm .htaccess index.php
mv %(taken_down)s/* %(taken_down)s/.* .
rmdir %(taken_down)s
chown --reference=.. .
chgrp nobody .
chmod 710 .
fi
chattr -i /var/cpanel/users/%(user)s
chattr -i /home/%(user)s/public_html/.htaccess
""" % r )
def do_slow_query_log(parameters):
username = pwd.getpwuid(os.stat(".").st_uid).pw_name
userprefix='# User@Host: '+username+'_'
r = os.popen( "tail -c 2000000 /var/log/mysql_slow_query_log", 'r');
printy=False
for line in r:
if line.startswith('# User@'): printy=False
if line.startswith(userprefix): printy=True
if printy:
sys.stdout.write(line);
pass
def do_corrupt(parameters):
for filename in parameters:
junkpos=64
junklength=64
if not os.path.exists(filename): continue
fd=open(filename,'r+b')
fd.seek(0,2)
length = fd.tell()
fd.seek(min(junkpos,length),0)
fd.write(open('/dev/urandom','r').read(junklength))
fd.close()
pass
def lockmailbox_exim(username):
m = re.match(r'(\S+)@(\S+.\S+)',username);
if not m:
sys.stderr.write("%s: invalid mailbox\n" % username);
return {'locked': False }
user,domain = m.groups()
user=user.lower()
domain=domain.lower()
exim_bt = os.popen("exim -d -bt %s 2>&1" % shellquote(username),'r')
passwd_file = ''
passwd_re=re.compile(r'(/(\S*/)?home/\S*/etc/\S+\.\S+/(passwd|quota))\b')
for line in exim_bt:
m = passwd_re.search(line)
if not m: continue
passwd_file =m.group(1)
if not passwd_file:
userdomains = get_userdomains()
account=userdomains.get(domain,'')
homedir = pwd.getpwnam(account).pw_dir
f = homedir+'/etc/'+domain+'/passwd'
if os.path.exists(f):
passwd_file=f
if not passwd_file:
sys.stderr.write("%s: No password file" % username);
return {'locked': False }
if not os.path.exists(passwd_file):
sys.stderr.write("%s: does not exist" % passwd_file);
return {'locked': False }
shadow_file = ('/'.join(passwd_file.split('/')[:-1]))+'/shadow'
if not os.path.exists(shadow_file):
sys.stderr.write("%s: does not exist" % passwd_file);
return {'locked': False }
result={}
result['filename']=shadow_file
result['locked'] = lock_mailbox_shadow_file(shadow_file,user);
return result
def getcontactaddress(filename, there_can_only_be_one=False):
'Figure out who to notify about this file'
from maintenance import config
more_contacts = config.option('notify_list','support@afrihost.com').split()
contacts = []
bits = filename.split('/')
home_index = bits.index('home')
homedir='/'.join(bits[:home_index+2])
contactemailfile = homedir+'/.contactemail'
if os.path.exists(contactemailfile):
contacts.append(open(contactemailfile,'r').readline().strip())
if not there_can_only_be_one:
contacts.extend(more_contacts);
return contacts
def notify(contacts, info):
# info['subject']
# info['body']
info['hostname'] = socket.gethostname()
info['email'] = '>, <'.join(contacts[1:])
info['email0'] = contacts[0]
headerlines=[]
headerlines.append( "From: %(app)s Notifier \n" )
headerlines.append( "To: <%(email0)s>\n" )
if info.get('email'):
headerlines.append( "Bcc: <%(email)s>\n" )
headerlines.append( "Subject: %(subject)s\n" )
template = ''.join(headerlines)+ \
"\n"+ \
"Hi %(email0)s,\n"+ \
"\n" + \
info['body'] + "\n"
sys.stderr.write(template % info)
fd = os.popen('/usr/sbin/sendmail -t -i','w')
fd.write(template % info)
fd.close()
def do_newpassword(parameters,force=0):
# Returns 0 if something went right
import posix,pwd
import ftpsetrandompasswd
stat = os.stat('.')
uid = stat.st_uid
pwent = pwd.getpwuid(stat.st_uid)
username = pwent.pw_name
r = ftpsetrandompasswd.setrandompassword(username)
contacts = getcontactaddress(os.getcwd(), there_can_only_be_one=True)
r['hostname' ] = socket.gethostname()
info = {
'app':'Security',
'subject':r['sitename']+' password change, user '+username,
'username': username,
'body': (
'The system administrator has set a new password for the account\n'
'%(username)s on %(hostname)s.\n'
'\n'
'The new credentials for %(sitename)s are now:\n'
'\n'
' user name: %(username)s\n'
' password : %(newpassword)s\n'
'\n'
'This message has been semi-automatically generated. Please ensure\n'
'that you use SSL when using this password, to prevent interception.\n'
'Do not use this password from a desktop system that has viruses or\n'
'other security problems.\n'
'\n'),
}
info.update(r);
rc = notify(contacts,info)
return rc
def do_spamming(parameters,force=0):
# Returns 0 if something went right
rc = 1
for username in parameters:
results = lockmailbox_exim(username)
filename=results.get('filename')
locked=results.get('locked')
os.system('eximanage --demail %s' % shellquote(username));
if not filename or not locked:
continue
rc = 0 # something went well
contacts = getcontactaddress(filename)
if locked:
has_been_locked = '\nThe password for the mailbox '+username+' has been locked\n'
else:
has_been_locked = ''
info = {
'app':'Mail system',
'subject':':: MAIL SECURITY ALERT :: Mailbox password locked. '+username,
'username': username,
'has_been_locked': has_been_locked,
'body': (
'The mailbox %(username)s has been either sending spam, or has triggered a\n'
'high vulnerability alert in the form of creation attempts of highly suspect interception\n'
'filters to facilitate fraudulent activities.\n'
'\n'
'This means that the email password is known to spammers or fraudsters,\n'
'and your domain is being targeted.\n'
'\n'
'The password has been locked, and domain is safe.\n'
'\n'
'Reset your password to something new and complex to remain safe,\n'
'it is suggested that you update email passwords of all email accounts,\n'
'and be vigilant in regards to unknown forwardres and unusual email activity.\n'
'\n'
'Your password could have been attained due to one of the following:\n'
'\n'
' 1. a poor choice of password (e.g. p@55w0rd!@#)\n'
' 2. a desktop virus\n'
' 3. failure to use SSL when retrieving mail\n'
' 4. Phishing scam\n'
'%(has_been_locked)s\n'
'\n'
'Please check the user systems for viruses, enable SSL and then\n'
'set a new password (not the same password!). Also check other\n'
'mailboxes and systems that may have the same password scheme,\n'
'virus or security problems.\n'
'\n'
'We also suggest you check your email filters and forwarders to ensure no filters or forwarders,\n'
'have been created in an attempt to intercept mail.\n'
'https://help.afrihost.com/topic/domains-and-hosting/how-to-manage-email-filters-in-cpanel\n'
'https://help.afrihost.com/topic/security/how-to-protect-yourself-from-email-interception-fraud\n'
'Visit http://www.icode.org.za/ for help with desktop security.\n'
'\n'),
}
hostname = socket.gethostname()
if hostname.endswith('.au') or hostname.find('ewsprou')>0 or username.endswith('.au'):
info['body'] = info['body'].replace('http://www.icode.org.za/','http://www.icode.net.au/')
notify(contacts,info)
return rc
def do_notify(parameters,force=0):
# Send a nastygram to the client
rc = 1
contacts = getcontactaddress('.')
info = {
'app':'System notification',
'subject':'Notification '+username,
'username': username,
'body': (
'Hello,\n'
'\n'
'Please take note of the following notification\n'
'\n' +
(' '.join(parameters) ) + '\n'
'\n'
'Thank you\n'
'\n'),
}
hostname = socket.gethostname()
notify(contacts,info)
return rc
def quasiurlparse(quasiurl=''):
i=quasiurl.find('//')
if i>=0:
vhost, fileuri = quasiurl[i+2:].split('/',1)
fileuri=fileuri.lstrip('/');
else:
vhost='localhost'
fileuri = quasiurl
if fileuri.find('?')>=0:
filepart,querystring=fileuri.split('?',1)
questionmark='?'
else:
filepart=fileuri
querystring='';
questionmark=''
if not os.path.exists('../public_html'):
cwd=os.getcwd();
public_html = '/public_html/'
i=cwd.find(public_html);
if i>0:
filepart=cwd[i+len(public_html):]+'/'+filepart.lstrip('/')
url = 'http://'+vhost+'/'+filepart+questionmark+querystring
filename='index.php'
bits = filepart.split('/');
#path_info = filepart
is_dir = False
for r in range(0,len(bits)):
somefile = '/'.join(bits[:r+1])
if not somefile:
somefile='.'
is_dir = True
if os.path.isfile(somefile+'/index.php'):
filename = somefile+'/index.php'
is_dir = True
if os.path.isfile(somefile):
filename = somefile;
is_dir = False
if is_dir:
filepart = filepart.rstrip('/')+'/'
return {
'url': 'http://'+vhost+'/'+filepart+questionmark+querystring,
'request_uri': '/'+filepart+questionmark+querystring,
#'path_info': path_info,
'vhost': vhost,
'filepart': filepart,
'uri': filepart+questionmark+querystring,
'querystring': querystring,
'questionmark': questionmark,
'filename': filename,
}
def do_phptest(quasiurls):
for quasiurl in quasiurls:
for line in phptest(quasiurl):
sys.stdout.write(line)
def linkfarmscan(filenames):
import subprocess
cmd = [ '/usr/local/afribin/maintenance/linkfarmscan.py', '-N', '/dev/null','--limit','999999' ]
cmd.extend(filenames)
rc = subprocess.call(cmd, shell=False)
def find_html_urls(line, base_url, urls=[]):
'''Nasty regex parser to find html urls'''
'''base_url is like http://site/fir/index.php'''
re_href=re.compile(r'\ ]{1,})',re.I);
for m in re_href.finditer(line):
relative_url = m.group(1)
protocol = relative_url.find('//')
if protocol>=1 and protocol < 5:
if relative_url.startswith(base_url):
urls.append(relative_url) # same site
continue
if relative_url.startswith('/'):
bits=base_url.split('/')
urls.append('/'.join(bits[:3])+relative_url)
continue
i=base_url.rfind('/') # okay, so this is sucky, since it assumes get parameters don't contain /, but hey
urls.append(base_url[:i]+'/'+relative_url)
return urls
def do_rfc3514(quasiurls):
droppriv()
disabledcodeprefix='Reached disabled code in ';
# Also disabled code:
filenames = []
rfc3514fd=open('.rfc3514','a')
# Try running directly:
for quasiurl in quasiurls:
for iteration in range(0,10000):
foundsomething = False
for line in phptest(quasiurl):
i=line.find(disabledcodeprefix)
if i<0: continue
filename=line[i+len(disabledcodeprefix):].strip()
do_undisable([filename,])
filenames.append(filename)
rfc3514fd.write(filename+'\n');
rfc3514fd.flush() # don't buffer please
foundsomething=True
if not foundsomething:
break
pass
# Try running through curl:
for url in quasiurls:
if url.find('://')<0: continue
for iteration in range(0,1000):
foundsomething = False
for line in rfc3541_with_curl(url):
i=line.find(disabledcodeprefix)
if i<0: continue
filename=line[i+len(disabledcodeprefix):].strip()
do_undisable([filename,])
filenames.append(filename)
rfc3514fd.write(filename+'\n');
rfc3514fd.flush() # don't buffer please
foundsomething=True
if not foundsomething:
break
pass
if len(filenames):
linkfarmscan(filenames)
def rfc3541_with_curl(url):
fd = os.popen('curl --cookie RFC3541=1 \'%s\'' % url.replace("'","'\\''"),'r')
for line in fd:
yield(line)
fd.close();
def phptest(quasiurl):
"Run the PHP code, and return its output"
quasiurlinfo = quasiurlparse(quasiurl);
if not os.path.exists(quasiurlinfo['filename']):
return
phpcode = r"""0:
line0 = re.sub(r'<\?php .* /\*.* disabled for security \*/ \?>\s*','',lines[0]);
if line0.strip()=='': line0='';
if line0==lines[0]:
sys.stderr.write('frob undisable: %s: no change\n' % filename);
continue # no change to this file
lines[0]=line0
changes += 1
st = os.stat(filename);
fd = open(filename,'w')
fd.writelines(lines);
fd.close()
os.utime(filename,(st.st_atime, st.st_mtime) );
sys.stdout.write(filename+'\n');
return changes
#def do_disable(files,no_act=False, die=''):
def do_disable(files,no_act=False,die=r''):
"""Hack a disable into a file """
for filename in files:
p = { 'file': filename.replace("'","'\\''"), # shellquote
'die': die,
'timestamp': time.strftime("%Y-%m-%d %H:%M:%S"), }
if not os.path.exists(filename):
sys.stderr.write("%s not found\n" % filename);
continue
if not os.path.isfile(filename):
sys.stderr.write("%s not a regular file\n" % filename);
continue
if filename.find(".php")<0:
if open(filename,'r').read().find("\n' % p);
if no_act:
print("frob disable: %s: not disabling" % filename)
else:
fd=open(filename,'w');
fd.writelines(file_lines);
fd.close()
os.utime(filename,(st.st_atime, st.st_mtime) );
sys.stderr.write(filename+"\n");
def get_userdomains():
r={}
u = open('/etc/userdomains','r')
for line in u:
bits=line.split(": ")
if len(bits)!=2: continue
r[bits[0].strip()]=bits[1].strip(); # r[domain.co.za] = domaixnq
u.close()
return r
def lockmailbox(mailbox):
'Returns filename locked and true/false'
name,domain=mailbox.split("@",1)
userdomains = get_userdomains()
account=userdomain.get(domain,'')
if not account:
print("No account for "+mailbox)
return
homedir = pwd.getpwnam(account).pw_dir
shadow_file = homedir+'/etc/'+domain+'/shadow'
if not os.path.exists(shadow_file):
print(shadow_file+' not present')
return
return shadow_file, lock_mailbox_shadow_file(shadow_file,name);
def lock_mailbox_shadow_file(shadow_file,name):
'Lock the user in the shadow file: returns True if a change was made'
mailboxshadows=open(shadow_file,'r').readlines()
mod=False
out=[]
for mailboxshadow in mailboxshadows:
mb_user,mb_crypt,mb_more=mailboxshadow.split(":",2)
if mb_user==name:
if mb_crypt[:1] in ('X','*','!'):
sys.stderr.write( shadow_file+' already has locked user '+name+'\n');
return False
else:
mb_crypt='X'+mb_crypt;
mod=True
out.append(":".join( (mb_user,mb_crypt, mb_more) ))
if not mod:
sys.stderr.write( shadow_file+' does not contain user '+name+'\n');
return None
print("locking "+name+" in "+shadow_file)
open(shadow_file,'w').writelines(out)
os.system('killall pop3-login imap-login') # kill cached users
return True
def lockmailboxes(mailbox):
for mailbox in mailboxes:
lockmailbox(mailbox)
# VERY basic yml getter
def ymlread(filename, parameter):
fd = open(filename,'r');
for line in fd:
if line.startswith(parameter+': '):
fd.close()
return line[line.find(': ')+2:].strip()
fd.close()
# VERY basic yml setter
def ymlwrite(filename, parameter, value):
fd = open(filename,'r');
out=[]
for line in fd:
if line.startswith(parameter+': '):
out.append(parameter+': '+value+'\n');
else:
out.append(line)
fd.close()
fd=open(filename,'w');
fd.writelines(out);
fd.close()
def do_codesniffer(params):
os.system('''
[ -d /usr/local/lib/php/PHP/CodeSniffer ] ||
pear install PHP_CodeSniffer
''');
droppriv()
os.system('''
phpcs --extensions=php,phtml --standard=/usr/local/lib/php/PEAR/PHPCompatibility '%s'
''' % os.getcwd())
def tailfile(filename, tail=200000):
if not os.path.isfile(filename):
return
fd = open(filename,'r')
fd.seek(0,2)
length = fd.tell()
fd.seek(max(0,length-tail),0)
drop = fd.readline();
for line in fd:
yield(line);
fd.close
def tailmmin1domlogs(seconds=60, tail=200000):
dirlist = glob.glob('/usr/local/apache/domlogs/*')
time0 = time.time();
for domlogfile in dirlist:
if domlogfile.find('_')>0:
continue
st=os.stat(domlogfile)
if abs(time0 - st.st_mtime) > seconds:
continue
for line in tailfile(domlogfile, tail):
yield line
def trawl_log_files_for_evilips(additionalregex=[], tail=200000, seconds=60):
"Trawl the log files for brute force attempts"
evilips={}
reasons={}
accesslog_evil_re = re.compile(r'POST .*(login| (500|40[34]) |administrator/[^/]* )')
accesslog_evil_re = re.compile(r'POST .*((login|administrator).* HTTP/1\.." (500|40[34]))')
rip_re = re.compile(r'rip=(\d+\.\d+\.\d+\.\d+),')
smtp_evil_re = re.compile(r'authenticator failed for')
smtp_rip_re = re.compile(r'\[(\d+.\d+\.\d+\.\d+)\]:\d+')
smtp_good_re = re.compile(r' A=dovecot_');
messages_evil_re = re.compile(r'Authentication failed for')
messages_ip_re = re.compile(r'@(\d+.\d+\.\d+\.\d+)\)')
additionalregex_re = list(map(re.compile,additionalregex))
r_0_255=r'(0|[1-9]\d?|1\d\d|2[0-4]\d|25[0-5])';
any_ip_re = re.compile(r'\b' + r_0_255 + r'\.' + r_0_255 + r'\.' + r_0_255 + r'\.' + r_0_255 + r'\b' );
ipwhitelist = []
for ipinfo in list_myips():
ipwhitelist.append(ipinfo['ip'])
# Attack of the cloned code:
# HTTP ATTACKS -- this goes first, since we might consider the thing less evil later
for line in tailmmin1domlogs(tail=tail, seconds=seconds):
if accesslog_evil_re.search(line):
ip=line.split(' ')[0]
evilips[ip]=evilips.get(ip,0)+1
reasons[ip]='http brute force'
# SMTP ATTACKS
for line in tailfile('/var/log/messages',tail=2000000):
# Nov 14 12:55:43 porkypig pure-ftpd: (?@91.109.5.130) [WARNING] Authentication failed for user [hendrikvanheerden]
if messages_evil_re.search(line):
m=messages_ip_re.search(line)
if m:
ip = m.group(1)
evilips[ip]=evilips.get(ip,0)+1
reasons[ip]='ftp brute force'
for r in additionalregex_re:
for ip in any_ip_re.finditer(line):
if ip in ipwhitelist: continue
ip = m.group(1)
reason='messages abuse'
evilips[ip]=evilips.get(ip,0)+1
reasons[ip]=reason
break
# SMTP ATTACKS
for line in tailfile('/var/log/exim_mainlog',tail=2000000):
for r in additionalregex_re:
for ip in any_ip_re.finditer(line):
if ip in ipwhitelist: continue
ip = m.group(1)
reason='exim_mainlog abuse'
evilips[ip]=evilips.get(ip,0)+1
reasons[ip]=reason
break
# 2014-11-14 12:28:21 dovecot_login authenticator failed for (WIN-7IEAI6D9UC9) [188.190.118.90]:54400: 535 Incorrect authentication data (set_id=laurel)
if smtp_evil_re.search(line):
m=smtp_rip_re.search(line)
if m:
ip = m.group(1)
evilips[ip]=evilips.get(ip,0)+1
reasons[ip]='smtp brute force'
# 2014-11-14 12:24:51 1XpE3d-0003ik-C1 <= jimmy@jsengineering.co.za H=ti-227-166-130.telkomadsl.co.za (jimmy) [105.227.166.130]:2594 P=esmtpa A=dovecot_login:jimmy@jsengineering.co.za S=103252 id=A4AF717B0E524DA3A3B383ED58EFA129@jimmy T="Estimate from JS Engineering # quotation no: 45437" for sachin.teeka@unilever.com
if smtp_good_re.search(line):
m=smtp_rip_re.search(line)
if m:
ip = m.group(1)
if ip in evilips: evilips.pop(ip)
# POP3 ATTACKS
for line in tailfile('/var/log/maillog',tail=2000000):
i=line.find('-login: Login: ');
if i>0:
m = rip_re.search(line)
if m:
ip=m.group(1)
if ip in evilips: evilips.pop(ip)
continue
i=line.find('auth failed,')
if i>0:
m = rip_re.search(line)
if m:
ip = m.group(1)
evilips[ip]=evilips.get(ip,0)+1
reasons[ip]='pop/imap brute force'
for r in additionalregex_re:
for ip in any_ip_re.finditer(line):
if ip in ipwhitelist: continue
ip = m.group(1)
reason='maillog abuse'
evilips[ip]=evilips.get(ip,0)+1
reasons[ip]=reason
break
return evilips,reasons
ddos_times = 0
ddos_blocked_ips = {}
syslog_program = '';
def send_syslog(program, message, priority=syslog.LOG_ERR):
global syslog_program
if syslog_program!=program:
syslog.openlog(program, syslog.LOG_PID, syslog.LOG_DAEMON)
syslog_program=program
syslog.syslog(priority,message)
def nullroute_blocker(r):
return "ip route add prohibit %(ip)s # antibruteforce: %(n)d hits, %(reason)s" % r
def do_antibruteforce(params, seconds=60, maximum_conections=8192, blocker=nullroute_blocker):
# number of hits in t
filecount = 0
global ddos_blocked_ips
global ddos_times
if ddos_times==0:
fd = os.popen('ip route ls','r')
prohibit_re = re.compile(r'prohibit (\d+\.\d+\.\d+\.\d+)\s*$')
for line in fd:
m=prohibit_re.search(line)
if not m: continue
ip=m.group(1)
ddos_blocked_ips[ip]=True
fd.close()
if len(ddos_blocked_ips) > maximum_conections:
send_syslog('ddos','Dropping %d host null routes' % len(ddos_blocked_ips) )
os.system('''
echo 1>&2 "Too many hosts prohibited: dropping ALL host prohibit routes"
ip route ls | grep 'prohibit [0-9.]* *$' | while read RULE ; do ip route del $RULE; done
''')
ddos_blocked_ips={}
ips,reasons = trawl_log_files_for_evilips(seconds=seconds)
remaining = 64
cmds=[]
for ip in sorted(ips, key=ips.get, reverse=True):
if ip in ddos_blocked_ips:
continue
if ip.startswith('127.'):
continue
n = ips[ip]
if n<75:
break
r = { 'ip': ip, 'n': ips[ip], 'reason': reasons[ip]}
send_syslog('ddos','null routing %(ip)s, %(n)s %(reason)s' % r)
ddos_blocked_ips[ip]=True
cmds.append ( blocker(r) )
remaining -= 1
if remaining==0:
break
if len(cmds):
print('\n'.join(cmds));
os.system( '\n'.join(cmds) )
if ddos_times==0:
print("# DDOS first time complete")
ddos_times += 1
return cmds
def do_php54ini(params):
for phpini in params:
ini = open(phpini,'r').read()
if not re.search(r'allow_call_time_pass_reference|magic_quotes_gpc|register_globals|ioncube_loader_lin_5',ini,re.I) and \
not re.search(r'display_errors\s*=\s*(on|true)',ini,re.I):
continue
sys.stderr.write(phpini+"\n");
os.system(r'''
sed -i '
/allow_call_time_pass_reference\|magic_quotes_gpc\|register_globals/ d;
s/ioncube_loader_lin_5...so/ioncube_loader_lin_5.4.so/;
s/^display_errors.*/display_errors = Off/;
' ../php.ini
'''.replace('../php.ini','%s') % shellquote(phpini) )
def do_active_mailboxes(params):
cmd = 'find /home/*/mail -mindepth 3 -maxdepth 3 -name cur -mtime -92 -type d'
fd = os.popen(cmd,'r')
for cur in fd:
cur=cur.strip('\n')
parent = cur[:cur.rfind('/')]
try:
# new_mtime = os.stat(parent+'/new').st_mtime
cur_mtime = os.stat(cur).st_mtime
parent_mtime = os.stat(parent).st_mtime
except:
continue
if abs(cur_mtime - parent_mtime) < 86400*21: # three weeks of operation on this mailbox please
continue # unused
print(cur)
fd.close()
def serveralias(names):
"Add a server alias to the site, all cpanel like"
cpanel = CpanelData()
cpanelinfo = dict(
user=cpanel.user,
domain=cpanel.cpanel['DNS'])
userdatafile='/var/cpanel/userdata/%(user)s/%(domain)s' % cpanelinfo
if not os.path.exists(userdatafile):
print("User datafile "+userdatafile+" does not exist");
return False
serveraliases_in=ymlread(userdatafile,'serveralias');
aliases=serveraliases_in.split()
for name in names:
if not (name in aliases):
aliases.append(name)
serveraliases_out = ' '.join(aliases)
if serveraliases_out != serveraliases_in:
ymlwrite(userdatafile,'serveralias',serveraliases_out);
apachectlgraceful(build=True)
print(serveraliases_out)
def do_vmwaretools(params):
os.system('''
set -x
set -e
cd
rm -rf vmware-tools-distrib VMwareTools-*
curl -k https://answers.afrihost.com/updates/VMwareTools-latest.tar.gz | tar -xz
vmware-tools-distrib/vmware-install.pl -d
vmware-toolbox-cmd timesync enable
''')
def do_syslog(params):
if len(params)==1:
program='frob'
else:
program=params.pop(0)
message=' '.join(params)
send_syslog(program, message);
def previewalias(usernames):
"Add preview aliases for a list of user names"
if len(usernames)==0:
usernames=[ CpanelData().user, ]
mod=False
for username in usernames:
i=username.rfind('/')
username=username[i+1:] # whole name or something
if not os.path.exists('/var/cpanel/users/'+username): continue
cpanel = CpanelData(username)
cpanelinfo = dict(
hostname=socket.gethostname(),
user=cpanel.user,
domain=cpanel.cpanel['DNS'])
userdatafile='/var/cpanel/userdata/%(user)s/%(domain)s' % cpanelinfo
if not os.path.exists(userdatafile):
sys.stderr.write("User datafile %s does not exist\n" % userdatafile)
continue
serveralias='%(user)s.%(hostname)s' % cpanelinfo
serveraliases_in=ymlread(userdatafile,'serveralias');
aliases=serveraliases_in.split()
if not (serveralias in aliases):
aliases.append(serveralias)
serveraliases_out = ' '.join(aliases)
if serveraliases_out != serveraliases_in:
ymlwrite(userdatafile,'serveralias',serveraliases_out);
mod=True
print(('%(user)s: %(domain)s : ' % cpanelinfo) + serveraliases_out)
if mod:
apachectlgraceful(build=True)
if __name__=="__main__":
dircmd=None
import optparse
parser=optparse.OptionParser()
parser.add_option("-n","--number", dest="number", action="store", type='int', default=0, help="How many")
parser.add_option("-v","--verbose", dest="verbose", action="count", default=0, help="How verbose")
(options,args) = parser.parse_args()
rc = 0
operation=''
parameters=[]
if len(args)>0:
operation=args[0]
parameters=args[1:]
if operation == "complete":
source = open(sys.argv[0], 'r').read()
for operation in re.findall(r'''if\s+operation\s*==\s*["'](.*?)['"]''',source):
if operation not in ('complete',): print(operation)
sys.exit();
send_syslog('frob','%s' % (' '.join(args)),priority=syslog.LOG_ERR)
if operation == "safe": dircmd=safe
if operation == "images": dircmd=do_images
if dircmd:
cwd = os.getcwd()
for wd in parameters:
dircmd(wd)
elif operation=="sessions":
mysql_sessiontable_repair()
elif operation=="cronfix":
cronfix()
elif operation=="mysqllimit":
mysqllimit(parameters, options.number)
elif operation=="redirect":
redirect(url=parameters[0],title=parameters[1])
elif operation=="disable":
do_disable(parameters)
elif operation=="undisable":
do_undisable(parameters)
elif operation=="subscribe":
subscribe()
elif operation=="fcgiphpini":
customphpini(rebuild=True)
elif operation=="phpinfo":
show_phpinfo()
elif operation=="securephp":
customphpini(disable_functions=True, open_basedir=True, setupfw='fw.php')
elif operation=="limit":
do_limit(int(parameters[0]))
elif operation=="suspend":
suspend()
elif operation=="unsuspend":
unsuspend()
elif operation=="lockout":
# Lock out a site which is too easily unsuspended
lockout()
elif operation=="unlockout":
# Un-Lock out a site which is too easily unsuspended
unlockout()
elif operation=="phishing":
print("WARNING: INPUT POSTED TO THIS SITE WILL BE CORRUPTED!!!")
print("WARNING: INPUT POSTED TO THIS SITE WILL BE CORRUPTED!!!")
print("WARNING: INPUT POSTED TO THIS SITE WILL BE CORRUPTED!!!")
customphpini(disable_functions=True, open_basedir=True, setupfw='checksum.php')
do_limit(25);
print("WARNING: INPUT POSTED TO THIS SITE WILL BE CORRUPTED!!!")
print("WARNING: INPUT POSTED TO THIS SITE WILL BE CORRUPTED!!!")
print("WARNING: INPUT POSTED TO THIS SITE WILL BE CORRUPTED!!!")
elif operation=="htaccess":
htaccess_fixup()
elif operation=="modsec":
modsecurity_onoff(True)
elif operation=="nomodsec":
print("Dude. Solve the problem. This is not a troubleshooting step. Solve the problem. Start with the error log.")
#elif operation=="nomodsec":
# if len(parameters)==0 or parameters[0].find("//")<0:
# print "MISSING INFORMATION: Please supply the URL which produces an error when mod_security intrusion prevension is enabled"
# else:
# #print "Checking for timthumb and patching it it found..."
# #os.system("find . -name '*thumb*php' -print0|xargs -0 %s timthumb" % frob() )
# modsecurity_onoff(False,reason=parameters[0])
elif operation=="modsecrule":
modsecurity_addrules(parameters)
elif operation=="modsecauto":
if not modsecurity_autorule() :
print("No change")
else:
# build with new rules
apachectlgraceful(build=True)
elif operation=="killall":
if not parameters: killall()
elif operation=="rebuild":
apachectlgraceful(build=True)
elif operation.find("dcpu")==0:
dcpumonview()
elif operation=="domlogs":
domlogs()
elif operation=="graceful":
apachectlgraceful(build=False)
elif operation=="hacking":
if len(parameters)==0: parameters=['.']
for dir in parameters:
hacking(dir)
elif operation=="takedown":
if len(parameters)==0: parameters=['.']
for dir in parameters:
takedown(dir)
elif operation=="sanitise":
f=[]
for do_cleanup in (cleanup_eval, cleanup_iframe, cleanup_htaccess) :
f.extend(do_cleanup(parameters))
print('\n'.join(f))
elif operation=="autocleanup":
do_autocleanup(parameters)
elif operation=="iframe":
cleanup_iframe(parameters)
elif operation=="uneval":
cleanup_eval(parameters)
elif operation=="spamming":
rc=do_spamming(parameters)
elif operation=="newpassword":
rc=do_newpassword(parameters)
elif operation=="unhtaccess":
cleanup_htaccess(parameters)
elif operation=="notify_ftp":
notify_ftp(parameters)
elif operation=="drupal":
drupal()
elif operation=="drush":
do_drush(parameters)
elif operation=="phptest":
do_phptest(parameters)
elif operation=="rfc3514":
do_rfc3514(parameters)
elif operation=="Reached":
do_rfc3514(parameters)
elif operation=="login":
do_login()
elif operation=="strace":
do_strace(parameters)
elif operation=="pwtest":
pwtest(parameters[0],parameters[1])
elif operation in ("db", 'mysql','mysqldump','grant'):
do_dbaccess(operation,parameters)
elif operation in ("dbpass", ):
do_dbpass(operation,parameters)
elif operation=="secure":
do_secure()
elif operation=="check":
do_secure(no_act=True)
elif operation=="jce":
do_jce()
elif operation=="nocomment":
do_nocomment()
elif operation=="crack":
res=dbaccess(show=False)
do_crack(res)
elif operation=="mv":
mv(parameters[0],parameters[1])
elif operation=="arping":
arping()
elif operation=="su":
droppriv()
if len(parameters):
cmdline=[]
for a in parameters: cmdline.append("'"+a.replace("'","'\\''")+"'")
os.system(' '.join(cmdline))
else:
import tempfile
tmp=tempfile.NamedTemporaryFile('w')
tmp.write( "PS1='\\u@\\h [\\w]\\$ '\n" )
tmp.flush()
os.system("bash --rcfile "+tmp.name+" -i")
elif operation=="panic":
panic()
elif operation=="crack2":
john_dump()
elif operation=="john":
res=dbaccess(show=False, unknown_application='an unknown application')
do_john(res,options.verbose,guesses=parameters)
elif operation=="nice":
niceness = int(options.number)
if not niceness:
niceness=14
if niceness>19:
ionice="ionice -c 3 ; "
else:
ionice='true';
if len(parameters)==0:
parameters = ['rdiff-backup','cpanellogd','rrdtool', 'logrunner','analog', ]
pids=[]
programs_list=[]
for n in parameters:
if n[:1] in '0123456789':
pids.append(n)
else:
programs_list.append(n)
programs=' '.join(programs_list)
pidof=os.popen("pidof -x "+programs,'r').readline().strip().split()
pids.extend(pidof)
if len(pids):
params = dict(
ionice = ionice,
pids = ' '.join(pids),
niceness = niceness)
print("# nicing these PIDs to prio %(niceness)s: %(pids)s" % params)
os.system("%(ionice)s %(pids)s; renice %(niceness)s %(pids)s; ps %(pids)s" % params )
else:
print("# found nothing to nice")
elif operation=="upgrade":
do_upgrade()
# do_upgrade_joomla(do_upgrade=True,do_password=False)
elif operation=="joomla_password":
res=dbaccess(show=False)
do_upgrade_joomla(res,do_upgrade=False)
elif operation=="ipcs":
fix_ipcs()
elif operation=="certs":
do_certs() # update the certificates on this box
elif operation=="runphpinstall":
runphpinstall()
elif operation=="ereg_replace":
do_patch_ereg_replace(parameters)
elif operation=="patch":
do_patch_ereg_replace(parameters)
do_patch_upload(parameters)
do_patch_timthumb(parameters)
elif operation=="timthumb":
do_patch_timthumb(parameters)
elif operation=="remail":
remail(parameters)
elif operation=="lockmailbox":
lockmailboxes(parameters)
elif operation=="generosity":
do_generosity(parameters)
elif operation=="previewalias":
previewalias(parameters)
elif operation=="serveralias":
serveralias(parameters)
elif operation=="software":
do_software_list(parameters)
elif operation=="fcgiauthheaders":
do_fcgiauthheaders(parameters)
elif operation=="quarantine":
do_script('quarantine',parameters)
elif operation=="rblcheck":
do_script('rblcheck',parameters)
elif operation=="slow_query_log":
do_slow_query_log(parameters)
elif operation=="corrupt":
do_corrupt(parameters)
elif operation=="antibruteforce":
do_antibruteforce(parameters)
elif operation=="active_mailboxes":
do_active_mailboxes(parameters)
elif operation=="codesniffer":
do_codesniffer(parameters)
elif operation=="php54ini":
do_php54ini(parameters)
elif operation=="vmwaretools":
do_vmwaretools(parameters)
elif operation=="frob":
do_frob(parameters)
elif operation=="wp":
do_wp(parameters)
elif operation=="syslog":
do_syslog(parameters)
else:
print("Usage:")
print("Misc tools:")
print(" frob fcgiphpini # Set up link to custom php.ini in the user's home directory")
print(" frob htaccess # Fix up htaccess in the current dir to work with fcgi (EXPERIMENTAL)")
print(" frob sessions # Check and fix all mysql 'sessions' tables")
print(" frob redirect url title # Write an embedded frame redirect for the site")
print(" frob disable files... # Disable php files by adding at the head")
print(" frob undisable files... # Make php files work by removing die() in the first line")
print(" frob serveralias domain.test.afrihost.com # Add a host header for this site")
print("Mod security:")
# print " frob nomodsec 'url' # Turn off mod_security"
print(" frob modsecrule 123 456 # Turn off specific mod_security rules")
print(" frob modsec # Turn on mod_security again")
print(" frob modsecauto # Experimental: show most recent site mod_sec violation, bypass and reload")
print("Big hammer:")
print(" frob rebuild # Enter rules into httpd.conf and reload apache")
print(" frob graceful # Just reload apache")
print(" frob killall # kill apache, php and restart mysql, run ddos.py")
print("User behaviour cluebats:")
print(" frob cronfix # Don't allow user cron jobs more frequently than 15 minutes")
print(" frob mysqllimit user -n 30 # Set a limit of 30 sql connections for each user")
print(" frob hacking # Block access to current dir: set a password for user, password denied123")
print(" frob takedown # Take this site down due to a violation, e.g. ISPA")
print(" frob notify_ftp ... # Write up a warning message for the user about domain in /var/log/messages*")
print(" frob drupal # Hack evil modules out of drupal")
print(" frob remail new/* | sh # Remail mail in the new/ directory to whoever it was to")
print(" frob generosity 'reason' # Set generous limits for this user")
print(" frob fcgiauthheaders # Pass Authorization header through to PHP for basic auth")
print("Troubleshooting:")
print(" frob strace user # Hack /usr/local/cpanel/cgi-sys/php5 to strace PHP for user")
print(" frob strace # Remove strace hack from /usr/local/cpanel/cgi-sys/php5")
print(" frob slow_query_log # Find slow queries for this user")
print(" frob pwtest user pass # Test the password and print debugging")
print(" frob ipcs # Kill ipcs semaphores left lying around")
print(" frob panic # Configure this system to panic easily")
print(" frob nice ... # Make processes be nice - by default rdiff-backup and stuff")
print(" frob mv src dst # move a live dir src to dest and leave a link")
print(" frob arping # announce our IP addresses with arping -U")
print(" frob vmwaretools # install vmware tools")
print("Security:")
print(" frob su [ -- command ] # Drop privileges and be the user of the current directory")
print(" frob upgrade # Upgrade joomla and change the passwords, or wordpress")
print(" frob joomla_password # Change the database passwords for joomla 1.5")
print(" frob safe dir ... # Set 755, 644 permissions")
print(" frob images dir ... # Set noscript in directory in .htaccess file")
print(" frob securephp # set safer php settings for insecure users (assumes /home/user/php.ini is used)")
print(" frob software # List installed software")
print(" frob sanitise # remove evil iframes, evals and htaccess bits from the files listed")
print(" frob iframe ... # remove evil iframes from the files listed")
print(" frob uneval ... # remove eval code from the files listed")
print(" frob spamming u@dom # kill a spamming mailbox and its mail")
print(" frob newpassword # set a new password for this account and send it to the contact e-mail")
print(" frob corrupt file... # corrupt a problematic file ")
print(" frob antibruteforce # null route hosts that are trying brute force logins")
print("PHP randoms:")
print(" frob db|mysql[dump]|grant# Show mysql parameters for the current application")
print(" frob dbpass # Set new DB password")
print(" frob login # Print a URL to log in to the web app")
print(" frob codesniffer # check php compatibility")
print(" frob phpinfo # Show phpinfo on the console for the current user")
print(" frob php54ini # set php.ini configuration settings for php 5.4")
print(" frob drush ... # run drush for a drupal site")
print(" frob wp .. . # run wpcli for a wordpress site")
print(" frob phptest file.php # run a php in browser style")
print(" frob rfc3514 http://url/k # remove disabled code so that the possibly evil code runs - do a manual review")
print("Pass through:")
print(" frob rblcheck [ip ...] # See if this computer is listed in a DNSBL")
print(" frob quarantine file... # Move files, directories to quarantine")
sys.exit(rc)