Salim S. tykkz

First install Virtualbox

sudo pico /etc/apt/sources.list.d/virtualbox.list
Add deb http://download.virtualbox.org/virtualbox/debian saucy contrib non-free
wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc -O- | sudo apt-key add -
sudo apt-get update
sudo apt-get install dkms unzip
sudo apt-get install virtualbox-4.3 --no-install-recommends
wget http://download.virtualbox.org/virtualbox/4.3.6/Oracle_VM_VirtualBox_Extension_Pack-4.3.6.vbox-extpack
sudo VBoxManage extpack install Oracle_VM_VirtualBox_Extension_Pack-4.3.6.vbox-extpack

My router has been hacked. Here's what I know:

I'm unaware of how my router became infected, but the password has definitely been changed. I admittedly had not done any firmware updates in quite some time, which could be related to the infection.

The router was setting a custom DNS for google-analytics.com, which pointed to their apparently malicious server. Unfortunately, I did not realize it was DNS manipulation before I reset my router (I thought google-analytics.com was an invalid domain), so I did not get the original IP address. It servers up the script that spearheads this whole thing. The source for that script at the time of writing can be found in the file google-analytics.js

Once google-analytics runs, it inserts an iFrame that directs to http://storage.com/storage.html. The ad serving script is clever in that it will only serve you ads so many times in a given period, so that you won't be able to debug and you might not really think anything is wrong. It stores timed cookies on the storage.com

Intercepts HTTPs Traffic with Python & mitmproxy

Introduction

Modern applications usually make use of back-end API servers to provide their services. With a non-transparent HTTPs proxy, which intercepts the communication between clients and servers (aka the man-in-the-middle scheme), you can easily manipulate both API requests and responses.

This manual helps you create your own proxy with Python and mitmproxy/libmproxy. Mitmproxy ships with both a standalone command-line tool (mitmproxy) and a Python library (libmproxy).

	# Ways to execute a shell script in Ruby
	# Example Script - Joseph Pecoraro

	cmd = "echo 'hi'" # Sample string that can be used

	# 1. Kernel#` - commonly called backticks - `cmd`
	# This is like many other languages, including bash, PHP, and Perl
	# Synchronous (blocking)
	# Returns the output of the shell command
	# Docs: http://ruby-doc.org/core/classes/Kernel.html#M001111

	#See: http://daringfireball.net/2010/07/improved_regex_for_matching_urls
	import re, urllib

	GRUBER_URLINTEXT_PAT = re.compile(ur'(?i)\b((?:https?://\|www\d{0,3}[.]\|[a-z0-9.\-]+[.][a-z]{2,4}/)(?:[^\s()<>]+\|\(([^\s()<>]+\|(\([^\s()<>]+\)))\))+(?:\(([^\s()<>]+\|(\([^\s()<>]+\)))\)\|[^\s`!()\[\]{};:\'".,<>?\xab\xbb\u201c\u201d\u2018\u2019]))')

	for line in urllib.urlopen("http://daringfireball.net/misc/2010/07/url-matching-regex-test-data.text"):
	print [ mgroups[0] for mgroups in GRUBER_URLINTEXT_PAT.findall(line) ]

	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
	"http://www.w3.org/TR/html4/strict.dtd">
	<html>
	<head>
	<title>PhoneGap Back Button Example</title>

	<script type="text/javascript" charset="utf-8" src="phonegap.0.9.5.js"></script>
	<script type="text/javascript" charset="utf-8">

	// Call onDeviceReady when PhoneGap is loaded.

	#!/bin/bash
	decode() {
	to_decode='s:%([0-9A-Fa-f][0-9A-Fa-f]):\\x\1:g'
	printf "%b" `echo $1 \| sed 's:&:\n:g' \| grep "^$2" \| cut -f2 -d'=' \| sed -r $to_decode`
	}
	data=`wget http://www.youtube.com/get_video_info?video_id=$1\&hl=pt_BR -q -O-`
	url_encoded_fmt_stream_map=`decode $data 'url_encoded_fmt_stream_map' \| cut -f1 -d','`
	signature=`decode $url_encoded_fmt_stream_map 'sig'`
	url=`decode $url_encoded_fmt_stream_map 'url'`
	test $2 && name=$2 \|\| name=`decode $data 'title' \| sed 's:+: :g;s:/:-:g'`

	# pip install requests
	import requests
	import json

	url_template = 'https://api.foursquare.com/v2/users/self/checkins?limit=250&oauth_token={}&v=20131026&offset={}'

	# If you navigate to https://developer.foursquare.com/docs/explore, Foursquare
	# will generate an OAuth token for you automatically. Cut and paste that token
	# below.
	token = ""

	"""
	setup:
	pip install requests
	pip install requests[socks]

	super helpful:
	- http://packetforger.wordpress.com/2013/08/27/pythons-requests-module-with-socks-support-requesocks/
	- http://docs.python-requests.org/en/master/user/advanced/#proxies

	"""

	nginx/
	!nginx/.gitkeep
	!nginx/logs/.gitkeep

	src/

	tmp/