2019-01-22: Andrew Howden (MageChat #security) shared some references:
-
Fuzzing https://github.com/minimaxir/big-list-of-naughty-strings
-
RCE Backdoors -- PHP https://github.com/bartblaze/PHP-backdoors
-
Techniques -- DNS
| <?php | |
| require_once 'app/Mage.php'; | |
| Mage::setIsDeveloperMode(true); | |
| Mage::app(); | |
| $credis = new Cm_RedisSession_Model_Session(); |
| # Curl manual: https://curl.haxx.se/docs/manpage.html | |
| URL="https://www.example.org/" | |
| HTTP_AUTH="-u name:passwd" | |
| CURL_OPT="--trace -" | |
| CURL_OUT="-o /dev/null" | |
| curl -s ${HTTP_AUTH} ${CURL_OPT} ${CURL_OUT} -w "%{http_code} - ${URL}\n" "${URL}" | |
| URL="https://www.example.org/"; HTTP_AUTH=""; CURL_OPT=""; CURL_OUT="-o /dev/null"; \ |
| <?php | |
| # You can store a specific cache type separately from the default object cache storage | |
| return [ | |
| 'cache' => [ | |
| 'frontend' => [ | |
| 'default' => [ | |
| 'backend' => 'Cm_Cache_Backend_Redis', |
| <?php | |
| # Find Magento crontab configs | |
| # redis-cli -p 6379 KEYS \* | grep -i CONFIG_GLOBAL_CRONTAB | |
| # redis-cli -p 6379 hget zc:k:c62_CONFIG_GLOBAL_CRONTAB d | |
| # Find config value from redis object store | |
| # redis-cli -p 6379 KEYS \* | grep -i CONFIG_GLOBAL | |
| # redis-cli -p 6379 HGET zc:k:c62_CONFIG_GLOBAL d |
| #!/usr/bin/env bash | |
| set -eu | |
| ######################################## | |
| ## Introduction | |
| ######################################## | |
| HELP_INFO=$(cat <<'CONTENTS_HEREDOC' | |
| input_filter v0.1 |
| # Connect via socket | |
| echo 'stats' | nc -U /var/run/memcached-multi/example.com_sessions.sock | |
| # Connect via TCP port | |
| echo 'stats' | nc localhost 11211 | |
| # Get max memory usage limit from stats | |
| echo 'stats' | nc -U /var/run/memcached-multi/example.com_sessions.sock \ | |
| | grep ' limit_maxbytes ' \ | |
| | cut -d" " -f3 |
2019-01-22: Andrew Howden (MageChat #security) shared some references:
Fuzzing https://github.com/minimaxir/big-list-of-naughty-strings
RCE Backdoors -- PHP https://github.com/bartblaze/PHP-backdoors
Techniques -- DNS
| select @@secure_file_priv; | |
| select @@local_infile; | |
| CREATE TABLE load_data_local_infile ( | |
| file_id int unsigned not null auto_increment primary key, | |
| content text not null | |
| ); | |
| CREATE TABLE load_file ( | |
| file_id int unsigned not null auto_increment primary key, | |
| file_name varchar(255) not null, |
| # Get Solr system info | |
| curl -s http://127.0.0.1:8983/solr/admin/system?wt=json | jq . | |
| # Create tunnel to remote server, and separately send request | |
| ssh -L 8983:127.0.0.1:8983 server_host | |
| curl -s http://127.0.0.1:8983/solr/admin/system?wt=json | jq . | |
| # Create temporary (10 seconds) tunnel in backgorund, then send web request | |
| ssh -f -o ExitOnForwardFailure=yes -L 8983:127.0.0.1:8983 server_host sleep 10 | |
| curl -s http://127.0.0.1:8983/solr/admin/system?wt=json | jq . |
| # Get package information -qip | |
| rpm -qip https://www.percona.com/downloads/percona-release/redhat/0.1-6/percona-release-0.1-6.noarch.rpm | |
| rpm -qip percona-release | |
| # List files in the package | |
| rpm -qlp https://www.percona.com/downloads/percona-release/redhat/0.1-6/percona-release-0.1-6.noarch.rpm | |
| rpm -qlp percona-release | |
| # Install RPM from URL | |
| yum install https://www.percona.com/downloads/percona-release/redhat/0.1-6/percona-release-0.1-6.noarch.rpm |