| 00:00.10 | PoeticIntensity | I set it to the same encoding as the database from where the data is coming (LATIN1), and it inserted everything just fine. |
| 00:00.25 | carmony | uggg.... some how one of my websites has some xss attacking going on right now |
| 00:00.28 | PoeticIntensity | seems that Postgres is smart, but sometimes it gets confused. |
| 00:00.35 | PoeticIntensity | ouch, really, carmony ? |
| 00:00.51 | carmony | yeah... somehow they are injecting some code at the bottom |
| 00:01.05 | carmony | which downloads a virus disguised as a pdf |
| 00:01.22 | PoeticIntensity | I'd be *SUPER* interested in more info on that one... |
| 00:01.39 | PoeticIntensity | I can't wrap my head around how someone could use XSS to hack my sites... |
| 00:01.52 | PoeticIntensity | not saying they couldn't, but I'm curious on how exactly it works. |
| 00:02.08 | PoeticIntensity | I know the theory behind it, but am having a hard time coming up with real-world examples.. |
| 00:02.21 | PoeticIntensity | and it seems like you might be available to help me out with that.. ;-) |
| 00:02.58 | PoeticIntensity | if you are so inclined, that is. |
| 00:05.24 | PoeticIntensity | jnbek, I just had another thought... |
| 00:05.40 | jnbek | yea? |
| 00:05.42 | PoeticIntensity | Maybe it's not PHP's handling of the code..... |
| 00:05.49 | PoeticIntensity | because phppgadmin is written in PHP. |
| 00:05.56 | PoeticIntensity | heh.. |
| 00:06.08 | PoeticIntensity | so - at least from the angle I was looking at it before... was somewhat skewed. |
| 00:06.27 | PoeticIntensity | not sure. |
| 00:07.52 | PoeticIntensity | the pg_set_client_encoding command worked like a charm, however. |
| 00:08.06 | jnbek | true,yea i was just checking that out |
| 00:08.26 | jnbek | what version of PG are you using? |
| 00:19.15 | carmony | holy shit |
| 00:20.03 | PoeticIntensity | jnbek, 8.2.7 |
| 00:21.05 | carmony | somehow someone got access to our server, scanned for every .html, .htm, .php, and .tpl file. They then scanned for any </html> text, and if they found it, they append a another <html> tags with the javascript exploit |
| 00:21.15 | jnbek | hmm interesting, i'm heading to band practice now, but keep me posted, whatever your results i'll add to my wiki |
| 00:21.46 | PoeticIntensity | hm..... |
| 00:22.01 | PoeticIntensity | jnbek, if that was directed toward me, I've already posted the tip to my blog. |
| 00:22.05 | PoeticIntensity | www.ilovemyjournal.com |
| 00:22.29 | PoeticIntensity | carmony, any idea on how they got access? |
| 00:22.48 | PoeticIntensity | that stuff isn't normally accessible.... Unless you're turning on the indexing in the apache config... |
| 00:23.11 | jnbek | PoeticIntensity: awesome, thanks, I'll link you as well. |
| 00:23.33 | PoeticIntensity | but even then - getting inside each file... I think they'd need like... ssh access or telnet access to do something like that. |
| 00:23.57 | PoeticIntensity | and if that's the case, carmony, then I'd assume your whole box has been compromised. |
| 00:24.30 | PoeticIntensity | search for rootkits, MD5s of the original core files (ls,top,ps,who,w,lastlog,etc...) |
| 00:24.33 | jnbek | register_globals on? |
| 00:24.46 | jnbek | @ carmony |
| 00:25.23 | carmony | nope |
| 00:25.36 | carmony | looks like its all been a bunch of Layered Tech servers |
| 00:25.42 | carmony | like their ticket system got comprimised |
| 00:26.04 | PoeticIntensity | using a canned ticketing system? |
| 00:27.19 | carmony | well, I think its home brewed |
| 00:27.20 | carmony | but I dunno |
| 00:27.30 | PoeticIntensity | is the site publically accessible? |
| 00:27.35 | PoeticIntensity | er.. publicly. |
| 00:27.44 | PoeticIntensity | (I hate that word... I always type it wrong first) |
| 00:28.52 | carmony | I think so |
| 00:35.48 | Jacob_Kerr | teehee |
| 00:44.10 | PoeticIntensity | what up, Jacob_Kerr ? |
| 00:44.20 | Jacob_Kerr | Not much how are you? |
| 00:44.34 | PoeticIntensity | I'm actually doing quite good, all things considered... :) |
| 00:44.48 | Jacob_Kerr | I have been working at solution stream ( solutionstream.com) which is totaly window based.. It sux... |
| 00:45.00 | PoeticIntensity | oh, man... |
| 00:45.11 | Jacob_Kerr | Yeah windows makes things way to complicated. |
| 00:45.27 | PoeticIntensity | not so sure how it'll fair in the future, but for the past 5 or so jobs I've had, it was a requirement for me to work on a Linux box in order for me to even consider the job. |
| 00:45.50 | PoeticIntensity | heh... I don't even know if I could use windows anymore. |
| 00:45.55 | PoeticIntensity | I've never worked on a Vista box. |
| 00:46.05 | PoeticIntensity | I rarely even see it. |
| 00:46.10 | Jacob_Kerr | Yeah I think I will prob. be moving onto another job sometime in the next few months. |
| 00:46.16 | Jacob_Kerr | That's good.. |
| 00:46.18 | Jacob_Kerr | Vista sux! |
| 00:46.32 | PoeticIntensity | heh... From what I hear, that's true. |
| 00:46.35 | Jacob_Kerr | Try writing XMAL for it, that sux even more.. |
| 00:46.47 | PoeticIntensity | XMAL, or XML? |
| 00:46.50 | Jacob_Kerr | XAML |
| 00:47.00 | PoeticIntensity | I've never heard of XAML. |
| 00:47.02 | Jacob_Kerr | Extended Application Markup Lang. |
| 00:47.08 | PoeticIntensity | interesting. |
| 00:47.20 | Jacob_Kerr | it's code that talks to Windows Presentation Foundation.. |
| 00:47.22 | Jacob_Kerr | WPF. |
| 00:47.33 | Jacob_Kerr | eh it's a bunch of windows crap.. |
| 00:48.39 | Jacob_Kerr | Have you seen my first application :) I built it all by meself.. http://www.halecentretheatre.org/rental/ |
| 00:48.57 | PoeticIntensity | heh.. that's why I've never heard of it. |
| 00:48.58 | Jacob_Kerr | PHP / MySQL.. The thing is OOP |
| 00:49.05 | PoeticIntensity | rock on! |
| 00:49.21 | Jacob_Kerr | The whole thing* |
| 00:50.10 | Jacob_Kerr | My first advanced search and recursive functions for the cat add/edit and view etc.. |
| 00:50.47 | Jacob_Kerr | LOL and if I do not find another job it maybe my last for awhile.. |
| 00:50.52 | PoeticIntensity | beautiful, bro! |
| 00:52.57 | PoeticIntensity | it looks great in IE... |
| 00:52.57 | Jacob_Kerr | Thanx :) |
| 00:53.13 | PoeticIntensity | But in Firefox... The little flash diddy in the upper left-hand corner has a black-background... |
| 00:53.15 | PoeticIntensity | kinds looks hokey. |
| 00:53.21 | Jacob_Kerr | LOL |
| 00:53.30 | PoeticIntensity | kinds = kind of |
| 00:53.48 | Jacob_Kerr | Hmm not in my mozilla 3.0.3 |
| 00:53.55 | PoeticIntensity | I'm not using FF 3.0 |
| 00:53.58 | PoeticIntensity | I'm using 2.15 |
| 00:54.10 | PoeticIntensity | er.. 2.0.0.17 |
| 00:54.19 | Jacob_Kerr | but I just did the backend on this thing :) |
| 00:54.34 | PoeticIntensity | oh! So... the display you didn't do... |
| 00:54.40 | Jacob_Kerr | the only class I used that I did not write myself was an image class.. |
| 00:54.41 | PoeticIntensity | I remember you saying you did the whole thing.. |
| 00:54.51 | PoeticIntensity | gotcha.. |
| 00:54.55 | PoeticIntensity | anyway... just thought I'd point it out. |
| 00:54.59 | Jacob_Kerr | Oh yeah sorry the whole backend :) |
| 00:55.09 | PoeticIntensity | wow... |
| 00:55.11 | PoeticIntensity | almost 7:00 |
| 00:55.12 | PoeticIntensity | I've gotta jet. |
| 00:55.20 | Jacob_Kerr | K, c u l8er. |
| 00:55.23 | Jacob_Kerr | Take care. |
| 00:55.28 | PoeticIntensity | good luck with your hacks, carmony. |
| 00:55.32 | PoeticIntensity | talk to ya'll tomorrow. |
| 00:56.15 | carmony | k, here is a newb question, but how do I chaneg the root password on a linux server? |
| 01:04.49 | *** join/#uphpu Utah_Dave (n=David@38.110.1.105) |
| 01:04.49 | *** mode/#UPHPU [+o Utah_Dave] by ChanServ |
| 01:08.03 | *** join/#uphpu carmony_ (n=justinca@c-67-164-249-224.hsd1.ut.comcast.net) |
| 01:27.02 | *** join/#uphpu carmony_ (n=justinca@c-67-164-249-224.hsd1.ut.comcast.net) |
| 01:32.29 | *** join/#uphpu carmony (n=justin@c-67-164-249-224.hsd1.ut.comcast.net) |
| 01:46.27 | *** join/#uphpu cro (n=cro@c-67-186-228-90.hsd1.ut.comcast.net) |
| 02:00.52 | *** join/#uphpu eggyknap_ (n=eggyknap@ip67-88-113-150.z113-88-67.customer.algx.net) |
| 02:13.59 | *** join/#uphpu mrkrow (n=chad@c-76-27-25-249.hsd1.ut.comcast.net) |
| 02:13.59 | *** mode/#UPHPU [+v mrkrow] by ChanServ |
| 03:02.44 | *** join/#uphpu wps (n=wps@208.53.47.251) |
| 03:02.44 | *** mode/#UPHPU [+o wps] by ChanServ |
| 03:21.42 | *** join/#uphpu mrkrow (n=chad@c-76-27-25-249.hsd1.ut.comcast.net) |
| 03:21.42 | *** mode/#UPHPU [+v mrkrow] by ChanServ |
| 03:52.42 | *** join/#uphpu josephscott (n=josephsc@75-169-242-107.slkc.qwest.net) |
| 03:52.42 | *** mode/#UPHPU [+v josephscott] by ChanServ |
| 04:35.43 | *** join/#uphpu mgeary (n=mgeary@69.169.142.45.provo.static.broadweave.net) |
| 04:35.43 | *** mode/#UPHPU [+v mgeary] by ChanServ |
| 04:46.46 | tonedevf | carmony: sudo passwd root |
| 05:10.22 | *** join/#uphpu tonedevf (n=dave@post.tonedb.org) |
| 06:15.37 | carmony | uuuuuuuuuuuuuuuuggggggg what a nightmare |
| 07:02.03 | *** part/#uphpu mgeary (n=mgeary@69.169.142.45.provo.static.broadweave.net) |
| 07:03.02 | *** join/#uphpu mrkrow (n=chad@c-76-27-25-249.hsd1.ut.comcast.net) |
| 07:03.02 | *** mode/#UPHPU [+v mrkrow] by ChanServ |
| 14:05.57 | *** join/#uphpu redroy (n=redroy@69.169.153.60) |
| 14:23.37 | *** join/#uphpu gibba (n=gibbz@SLKCUTSODS0AE02.mcleodusa.net) |
| 15:06.11 | *** join/#uphpu fungus (n=olsonl@bromine.sosstaffing.com) |
| 15:06.11 | *** mode/#UPHPU [+o fungus] by ChanServ |
| 15:08.21 | *** join/#uphpu mrkrow (n=chad@166.70.178.114) |
| 15:08.21 | *** mode/#UPHPU [+v mrkrow] by ChanServ |
| 15:09.30 | *** join/#uphpu carmony (n=justin@c-67-164-249-224.hsd1.ut.comcast.net) |
| 15:14.41 | carmony | good morning |
| 15:15.26 | orsonj | mornin' |
| 15:37.47 | *** join/#uphpu thebigdog (n=thebigdo@70.103.91.98) |
| 15:37.47 | *** mode/#UPHPU [+o thebigdog] by ChanServ |
| 15:52.34 | tonedevf | gooood morning |
| 15:54.00 | DexterTheDragon | ~friday |
| 15:54.01 | jbot | ! ! ! F R I D A Y ! ! ! |
| 15:58.20 | tonedevf | w3wts |
| 16:04.45 | *** join/#uphpu josephscott (n=josephsc@75-169-242-107.slkc.qwest.net) |
| 16:04.45 | *** mode/#UPHPU [+v josephscott] by ChanServ |
| 16:10.35 | *** join/#uphpu mindjuju (n=mindjuju@76.8.222.130) |
| 16:10.35 | *** mode/#UPHPU [+o mindjuju] by ChanServ |
| 16:16.45 | carmony | sup mindjuju |
| 16:18.08 | *** join/#uphpu itimber (n=itimber@c-98-202-102-189.hsd1.ut.comcast.net) |
| 16:18.08 | *** mode/#UPHPU [+v itimber] by ChanServ |
| 16:19.33 | itimber | morning guys |
| 16:20.10 | orsonj | mornin' |
| 16:20.11 | carmony | moring |
| 16:25.19 | mindjuju | sup gents |
| 16:25.31 | mindjuju | heck of a day... heck of a day |
| 16:26.07 | mindjuju | but..., i might actually be up macnewbold's way later this afternoon, maybe should game dexterthedragon and other CG boys a little halo 3 |
| 16:26.17 | mindjuju | if theys playing, that is |
| 16:26.26 | DexterTheDragon | mindjuju: bring it |
| 16:26.35 | mindjuju | :) |
| 16:27.38 | mindjuju | dexterthedragon, what time do ya'll game on fridays? |
| 16:27.41 | mindjuju | after 5? |
| 16:28.05 | DexterTheDragon | usually somewhere between 4-5 |
| 16:30.23 | macnewbold | mindjuju: no worries - we've got some game time planned anyway :) |
| 16:30.42 | macnewbold | with so many that leave for the train right at 5pm, game time is usually before that. |
| 16:31.22 | mindjuju | :) |
| 16:34.37 | carmony | ssh main.manager |
| 16:34.42 | carmony | bah |
| 16:35.39 | *** join/#uphpu bigdog_ut (n=thebigdo@70.103.91.98) |
| 16:35.39 | *** mode/#UPHPU [+o bigdog_ut] by ChanServ |
| 16:36.27 | *** join/#uphpu synic (n=squish@pdpc/supporter/student/synic) |
| 16:36.27 | *** mode/#UPHPU [+v synic] by ChanServ |
| 16:36.47 | *** join/#uphpu mgeary (n=mgeary@166.70.44.49) |
| 16:36.47 | *** mode/#UPHPU [+v mgeary] by ChanServ |
| 16:39.01 | *** join/#uphpu synic (n=squish@pdpc/supporter/student/synic) |
| 16:39.01 | *** mode/#UPHPU [+v synic] by ChanServ |
| 16:41.59 | mgeary | carmony: what happened? |
| 16:42.22 | mgeary | hey, anyone know how to pull hardware info (cpu, ram, etc) from an old machine running Windows Server 2000? |
| 16:43.36 | carmony | mgeary: somehow someone gained access to our server, edited every .php & .html file that had a "</html>" in it, and appended a mallicious javascript attack to upload viruses to our users PC |
| 16:43.43 | tonedevf | astra32?... do they still have a free version of that? |
| 16:43.47 | *** join/#uphpu synic (n=squish@pdpc/supporter/student/synic) |
| 16:43.47 | *** mode/#UPHPU [+v synic] by ChanServ |
| 16:44.08 | tonedevf | ...for mgeary |
| 16:45.04 | tonedevf | ...i'm assuming Device Manager isn't giving you enough information, mgeary. did you already look in there? |
| 16:49.12 | fungus | IIRC right click "My Computer" and choose properties |
| 16:49.31 | fungus | That shows overall Windows version, CPU type/speed, and RAM |
| 16:50.56 | tonedevf | that's right. and right-clicking on My Computer and choosing Manage, then picking Device Manager from the left panel will provide more information about the hardware |
| 16:56.39 | mgeary | thanks, that helped |
| 16:56.45 | mgeary | certified poc |
| 16:56.57 | mgeary | carmony: dang, sorry to hear that |
| 16:57.03 | mgeary | how'd they get in? ssh? |
| 16:59.14 | mgeary | and how can viewing a javascript get a virus onto a PC? Auto-download a self-running file? |
| 17:00.15 | tonedevf | usually the javascript has the browser visit an external baddy CGI script |
| 17:06.51 | carmony | ssh |
| 17:07.01 | carmony | exploit in adobe readers PDF file |
| 17:09.10 | mgeary | huh? |
| 17:09.45 | carmony | they basically had some javascript that appends an iframe at the bottom of the html file |
| 17:10.02 | mgeary | someone opened a tainted PDF on the server and it created a ssh user? |
| 17:10.10 | carmony | aahhh no |
| 17:10.46 | carmony | we think our access was compromised by the ticket system our host was using was compromised, and a ticket containing our login info was in it |
| 17:11.01 | mgeary | ah |
| 17:11.21 | carmony | and what the hackers did was to infect all of our web documents to serve a virus |
| 17:11.23 | mgeary | sorry to hear that. That'll ruin your day |
| 17:11.28 | carmony | tell me about it |
| 17:11.45 | carmony | and my boss's, cause this is a side client and I had to take the day off to re-load the server |
| 17:13.27 | tonedevf | sorry to hear it carmony. good luck getting it all cleaned up |
| 17:15.33 | *** join/#uphpu beandog (n=steve@gentoo/developer/beandog) |
| 17:15.33 | *** mode/#UPHPU [+v beandog] by ChanServ |
| 17:19.28 | carmony | well, it could be a lot worse |
| 17:20.01 | carmony | we had plan on doing a migration to a new grid-based solution, so we're just changing the schedule and doing the migration today |
| 17:23.11 | *** part/#uphpu mindjuju (n=mindjuju@76.8.222.130) |
| 17:42.45 | *** join/#uphpu eggyknap_ (n=eggyknap@ip67-88-113-150.z113-88-67.customer.algx.net) |
| 18:51.02 | *** join/#uphpu mindjuju (n=mindjuju@76.8.222.130) |
| 18:51.02 | *** mode/#UPHPU [+o mindjuju] by ChanServ |
| 20:14.27 | mindjuju | ~USA++ |
| 20:14.32 | mindjuju | Americans have drastically altered driving habits, if they are driving at all, amid a severe economic downturn. They have cut discretionary trips, and are carpooling and using public transportation more. |
| 20:42.22 | mindjuju | fungus, you around? |
| 20:44.36 | fungus | yup |
| 20:45.40 | mindjuju | so in virtualbox, there are these things called snapshots |
| 20:45.54 | mindjuju | well, i think i want to clonevdi a snapshot |
| 20:46.17 | mindjuju | the reason i want to do that is whtat i want to be able to have a couple virtual machines based on the same generic setup |
| 20:46.38 | mindjuju | now, normally, i htink that would be no prob, but i'm runnign into one |
| 20:46.43 | fungus | Then you would use the clone functionality, and ignore the snapshot functionality. |
| 20:47.05 | fungus | Build one machine, set it up, power it off, clone it many times, turn them on. |
| 20:47.16 | mindjuju | i'm in my userfolder, virtualbox, vdi |
| 20:47.38 | mindjuju | and i have cloned that vdi there, but when i launch that virtualmachine |
| 20:47.44 | mindjuju | it isn't all the way updated |
| 20:48.09 | mindjuju | now, i found there is another set of vdi that has a name like {9238423789-92830blah-210938923}.vdi |
| 20:48.11 | mindjuju | something like that |
| 20:48.15 | mindjuju | is that the one i want? |
| 20:48.31 | fungus | Are you cloning it manually, or using the GUI to clone it? |
| 20:49.03 | mindjuju | uh cloning manually, i couldn't find that function in the gui |
| 20:49.28 | fungus | Hrm, I only played with virtualbox once a while ago, and don't remember the specifics. |
| 20:50.03 | fungus | the VDI is the disk, not the whole machine. |
| 20:50.11 | fungus | clone the whole machine (folder) |
| 21:04.33 | fungus | Snapshots usually cause a new file to be created which contains changes to the disk since the snapshot. So with an active snapshot, copying the original disk to a new machine will cause all changes since the snapshot to be ignored. |
| 21:05.15 | fungus | Therefore by copying the whole folder, disk, snapshot, and everything, you are sure to get the whole thing, including the snapshot. |
| 21:10.00 | *** join/#uphpu Guest85766 (n=justin@c-67-164-249-224.hsd1.ut.comcast.net) |
| 21:17.38 | thebigdog | mindjuju, are you doing it in the virtual disk manager? |
| 21:27.55 | *** join/#uphpu Trevyn (i=42f120a0@gateway/web/ajax/mibbit.com/x-99f50ce6bf8c6285) |
| 21:28.14 | mindjuju | sup Trevyn |
| 21:28.26 | Trevyn | Chillin :) Anyone feeling a dip in work recently? |
| 21:28.42 | mindjuju | yeah, fewer contracts |
| 21:28.47 | Trevyn | Things are going well, just curiouse if things are slowing down with the economy |
| 21:30.18 | Trevyn | mindjuju: what are your marketing methods? |
| 21:31.13 | mindjuju | reply wasn't from me, but from some business owners who had mentioned that business was slowing |
| 21:35.18 | mindjuju | interestingly enough though, mcdonalds seems to be taking a hit from the market downturn - http://consumerist.com/5068390/recession-watch-mcdonalds-cracks-down-on-sauce-scofflaws |
| 21:37.47 | mindjuju | :) |
| 21:45.43 | *** join/#uphpu tonedevf (n=dave@post.tonedb.org) |
| 21:59.30 | mgeary | good ol' Trevyn |
| 21:59.47 | mgeary | that's like 2 or 3 visits he's had now where he hasn't riled anyone up |
| 22:04.19 | *** join/#uphpu mrkrow (n=chad@166.70.178.114) |
| 22:04.19 | *** mode/#UPHPU [+v mrkrow] by ChanServ |
| 22:07.25 | orsonj | well, with this economy you have to be more polite to get business |
| 22:20.50 | itimber | Trevyn: I'm busier than normal |
| 22:48.51 | itimber | I'm out guys.... later |
| 23:07.49 | mgeary | Tim *must* be busier than normal, he's stayed what, a whole hour later than usual today? ;) |
| 23:16.47 | mgeary | and with that note, i'm off as well! |
| 23:16.51 | *** part/#uphpu mgeary (n=mgeary@166.70.44.49) |
| 23:19.53 | beandog | slackers |