OSCommerce Hacked, Eval Base64 Decode attack

Recently one of my OSCommerce site is being banned by Google as malicious and harmful for your computer so I was forced to take a look at the code.  I had experience with Drupal and Joomla, but not too much with OSCommerce, this was a site that a friend of mine had setup and now it is kinda in my hands.  It was also a site that had a lot of customization and it was setup on shared hosting, so there were a lot of unknowns for me.  I found that part of the code that were trying to load malicious code was in fact based on a Eval Base64 command that can be easily found by using either UltraEdit or PSPad.  Just try to find 'base64' in the whole directory and it will be quite obvious which ones are legit and which ones are not.

However, the problem comes when similar code keeps poping up in my header.php file day after day.  So I had to look at my site again.  I then later found out that in my catalog/image/ and /catalog/admin/image directory there are a few suspected php, and looking into them shows signature of hackers claiming "... was here".  So it was again quite obvious,  since you probably don't expect anyone to put php files into image directory.

As after this I have implemented a few of the steps listed here .  It is recommended in the previous listed article about the base64 that you should at least change the admin path, install a few security add-ons for my site.  I hope I will never find those attack on my site ever again.

Hope this helps anyone out there who is having the same problem.

How to add Google Analytics to Diferior Torrent Tracker CMS.

Diferior is a new breed of Open Source Tracker Content Management System(CMS).  It has built in support for Blog,Forum,Tracker and User Management, basically all you need to get your own Torrent site going.  You can also incorporate different Tracker configuration based on your needs, it is easy to setup and very powerful.  I got the site up and running but one thing is missing, it is not as straight forward to get Google analytic working with it.  The main reason is because this is not a simple CMS with the use of HTML and PHP, it uses a template system called Smarty.  This makes installation of the Google Analytics script non-function if you install it as other websites. 
There is workaround for that.  Simply goto the template file of index.tpl.php and add the normal google code, but make sure the code is wrap around by the tag
{literal}
Google Code
{/literal}

and you are good to go.

Zotac H55ITX-A-E Snow Leopard 10.6.4 Install Guide Using tonymacx86 iBoot and MultiBeast 2.0

This is a Guide that shows how to install Snow Leopard on Zotac, H55ITX-A-E.  This is the perfect setup for a MiniHack Pro.  This board supports up to i7 of the 1136 socket, depending on what kind of case you are getting, it is possible that this setup can out perform some of the current generation Mac Pro.   On the other hand you can install a low power consumption i3, with dual boot into W7 it can take advantage of the Intel HD graphics.  The current generation i3 can match the Atom CPU power consumption in idle, making it a great setup for a HTPC in your living room.

Advantage of using a Zotac H55ITX-A-E
- Small form factor, Mini-ITX size board
- Lots of positive review on the build quality and versatility of this board.
- 10 USB 2.0 port (H55ITX-C-E has USB 3.0 support)
- Built-in Wireless card (US version gets the Atheros chipset which works out of the box, for with the RALink chip, it supports with kext, but not in n mode)
- Has an extra PCIe slot for a medium to high-end Video card, then you have yourself a decent gaming system.
- SpeedStep, LAN, Sound and Wifi all works in snow leopard, refer to TonyMac's general guide on how to install.
- Sleep doesn't quite work

Thanks to TonyMac and InsanelyMac this guide provides the most comprehensive instruction on the installation of Snow Leopard on Zotac's board.  This is indeed one of the best board on all builds of SL.


Neil's Post in Insanelymac should be the best place to ask further question.

How to fix 'suexec command was not found on your system.' in Virtualmin

I ran into this error message in Virtualmin when I want to disable Bind and Mail for Domain, I searched around for answers and I couldn't find it.  Finally I found out that Suexec was not installed correctly, so I reinstalled again with the command

apt-get install apache2-suexec-custom

And then it changed to another error message, where it shows.

The Suexec command on your system is configured to only run scripts under /var/www, but the Virtualmin base directory is /home. CGI and PHP scripts run as domain owners will not be executed.

 The above  link also shows the solution to that problem.

Enjoy.

How to install webmin for Ubuntu 10.04 LTS Server

It is actually very easy to install webmin on the new Ubuntu 10.04 LTS Server.  Here is what you will need to type

Login to your server and update your server

apt-get update
apt-get upgrade
apt-get dist-upgrade

Then you can get the and install webmin

wget http://downloads.sourceforge.net/project/webadmin/webmin/1.510/webmin_1.510-2_all.deb
sudo dpkg -i webmin_1.510-2_all.deb

Then if there are errors then type the following commands

sudo apt-get install -f

Then you are good to go.  Make sure you have noted your IP address so that you can login from your browser at 


http://yourip:10000/


Enjoy

SOLVED: Http 500 error caused by .htaccess in CMS Ubuntu

A recent move of my server from a public server to a self hosted server in Ubuntu had turned into a problem solving challenge.  I had build a new Ubuntu server with webmin as a hosting manager.  A current live version of Joomla was moved over to this server, and all of a sudden the SEF stopped working.  I am currently a user of SH404 with JoomFish, and everything worked before.  Now I got 500 error even in the admin screen.  I made sure the naming convention is right, .htaccess was typed correctly.  The main error was that by default apache does not turn on mod_rewrite, to do that in a Ubuntu or Redhat server all you have to do is type

sudo a2enmod rewrite

 

and restart the apache server by typing 

sudo /etc/init.d/apache2 restart

This should fix all those errors when migration a CMS to a new Ubuntu server.

Enjoy

How to load MYSQL Database from Command Line in Linux and XAMPP

To load a Mysql file from the command line to a certain database you can use the following command


mysql -u root -p joomla < backup.mysql


This works in linux environment where joomla is your database name.  Best to be in the same directory as the mysql file and you can load it without typing the path to the file.


If you are hosting in your own Xampp in Windows, there is also a way to load your mysql file from the command line, in my example I would assume that you have installed Xampp in 


c:\Xampp,


 thus the directory for mysqld would be


c:\Xampp\mysql\bin


then if you put your mysql file in the same directory, you can load it directory from that directory if you haven't had your path set.  Type


mysql --user root --password joomla < backup.mysql


It will prompt you for a password then your mysql will be loaded depending on how big your backup is. you could add a -f flag if your database is very big, it will prevent it from stopping if there is error. 


mysql -f --user root joomla < backup.mysql


Enjoy

How to connect to Tomato VPN in Windows 7 and Vista

I have recently upgrade my main laptop from XP to windows 7, I was updating my Tomato OpenVPN setup as well.  My recent blog entry shows instructions on how to setup OpenVPN server from the tomato router.  A lot has changed since then.  For me now it's Windows 7 and OpenVPN windows installer now comes with a GUI, you don't have to install it yourself.  The installation went well, however after I set everything up and I tried to connect I got this error message.

The requested operation requires elevation.

ERROR: Windows route add command failed [adaptive]: system() returned 

I can connect to my server, however I can't add the route to my Tomato router, therefore my traffic does not route through the Tomato VPN server.  


For those who are experiencing the same error, I found it on requires a simple fix.  First you have to configure the GUI such that it works with your ovpn and your static.key file.  Instead of using the connect.ovpn file from anywhere, you can connect by using the GUI which came with the installer.  The trick is to run the GUI as administrator, this can fix this error and I can connect to the VPN server.  


One trick is to run OpenVPN as a service and run as administrator, you can also make your computer connect automatically each time you logon. 

The Suexec command on your system is configured to only run scripts under /var/www, but the Virtualmin base directory is /home. CGI and PHP scripts run as domain owners will not be executed.

I had my system running Ubuntu 9.10 Server and after installing Webmin and Virtualmin I came across this problem

The Suexec command on your system is configured to only run scripts under /var/www, but the Virtualmin base directory is /home. CGI and PHP scripts run as domain owners will not be executed.

If you installed using the script provided by virtualmin then you might not have this problem, but when you see this error it is already too late.  The script was only available for Ubuntu LTS, and obviously I didn't install that variation of the OS.  For me to uninstall and try it is too time consuming, thus I have found some easy solutions to fix this error. No compiling involved.

1. Disable Suexec in Virtualmin

1. Use the Virtualmin framed layout;

2. On the left top; click on Virtualmin;

3. Open the + on "System settings";

4. Click "Server Templates";

5. On the right screen; click "Default Settings";

6. On the select box "Edit template section" choose "Apache website";

7. Find the radio button: "Automatically add appropriate SuExec directive" 

8. Choose "no", scroll down and "save"

2. Create a temporary mount between the 2 directories by typing the following command

mount --bind /var/www /home

3. Create a symlink between the 2 directories, similar solution as #2, but a different command.  You first have to move the original /var/www directory, then create the link

rm -fr /var/www

ln -s /home /var/www

Enjoy

How to change hostname in Ubuntu (for Virtualmin)

In Ubuntu you can check your hostname with the command

hostname -f

And for the purpose of installing webmin, you would need a hostname that is searchable and resolve to your IP address.  Therefore you can set it by editing

sudo pico /etc/hostname
sudo pico /etc/host

and replacing the OLDNAME with the NEWNAME in these files. This will take effect after a reboot.  However to set it immediately, you can simply type

sudo hostname NEWNAME

this should fix your hostname, and it will be much easier to install Virtualmin

boot0: error

When ever one tries to install a multiboot OSX Window box, you are most likely to run into the boot0:error, or a b0 error. what this means is that the partition that you intend to boot into did not have the active flag set.  Most of these errors arise after you have installed 2 systems and it wouldn't boot into either or both.  This can be easily fixed by the following steps

1. Boot with mac OSX boot disc
2. Goto Utilities and enter Terminal
3. in the terminal type

  diskutil list


Make a note of which disk has the partitions(rdisk0, rdisk1, etc)

4. type

  fdisk -e /dev/rdisk0


you might see the MBR error, don't worry about it.

5. type

  p


and you should see all your partitions.  At this point you would want to figure out which partitions you want to boot into first.  If you have 2 partitions then flag the one you want to be primary last.

For example, you have 2 partitions, 1 and 2.Partition 2 holds windows 7 and 1 holds OSX Snow Leopard.  You want to boot into OSX boot loader to choose which parition to boot, in this case you want to flag the windows partition active first, then flag the OSX partition active,

6. so you would type

   f 2
  write
  y
  f 1
  write
  y
  exit


This would fix your problem, eject your CD and reboot.

Kapow: Creating DataModel and Database Link

Kapow: Creating DataModel and Database Link

Kapow robosuite 6.4 works with many database, in this example I will use mysql.For mysql, you need to download and install this file

mysql-connector-java5.0.5-bin.jar

Make sure you have set this up properly.  Google is your friend.  

Create a database in  your mysql.  To do that, I log into my xamp and I did it in phpmyadmin.

After you have done that, open Kapow Settings then goto database Connection Add your database by selecting 

    Name 

    Host

    Database Type

    Name and Password

  if using utf8

    goto advanced and type "utf8" in the Character Encoding Field

    I would also add this line when creating database at the end 

        DEFAULT CHARACTER SET utf8 COLLATE utf8_unicode_ci;

  Click on "test Connection" to see if it works

Start Robomanger and it will ask if you want to add the new database into use, answer yes and all basic data type will be added to that database.

If it doesn't get added automatically, then select Database->Select Database to use and find the database you recently added. This will trigger the program to check if the required tables are there, if not you will be asked and the tables will be added automatically.

In Kapow you have to have a Data Model before you can load anything.  You need to create a Data model, similar idea to a Class in the C language.  Make sure you have data model ready or use existing ones.  You can do that in Kapow ModelMaker 

Then goto Tools -> Create Database Table, you should now be able the choose the new database you just created.

If your robomaker is opened, save you work and close the program.  Restart the program and now you will be able to choose your data model as the output type or use your database as storage in debug mode.  Warning: Without restarting robomaker won't be able to see the newly added database.

How to update Kext in Macs

Mac Kext are like drivers for the Windows platform. You need them to get your hardware device working.  In Mac the device drivers are mostly from Apple, therefore unless a third party is willing to give support, unsupport hardware is very difficult to co-exist with the mac os.  This is a way to update kext manually from the terminal. 




To update a kext:

cd /path/to/new/kext (put your downloaded kext path here)

cp -R KextName.kext /System/Library/Extensions

next you need to fix permissions so the kext can be executed by OS user (root/system)

cd /System/Library/Extensions

chmod -R 755 KextName.kext

chown -R 0:0 KextName.kext   (this will set the ownership on files to system user (root))

rm /System/Library/Extensions.mkext   (this will reset all kext caching done by OSX)


Another way with GUI is to use the Kext Utility, by downloading this and using it, it will fix kext automatically.  If you want to install kext, you can drag the kext onto the program directly, the program will install and update the Extensions.mkext file.

Enjoy

Asus w7j OSX86 settings

Asus w7j OSX86 settings 10.5.7

These are the settings used to install IPC distro on my Asus w7J.

Video: NvDarwin 256MB (QE/CI enabled), dual monitor doesn't work out of the box, but I know some change will make it work, but in that instance QE/CI doesn't work.

Chipset: ICHX

Audio: ALC861

Ethernet:Realtek R1000

Fix: PS2/keyboard

PowerMgmt: all

Video Card:Nvidia Geforce Go 7400
Wifi (3945): works with new driver for Snowleopard only.


These few links might be useful read for further study (will update)
Basics of Kext and installation of it (drivers for Mac)

Dual boot

Video Chameleon fix boot0

Snow leopard 10.6.2

For the Asus W7J, the SnowOSX Universal v.3.6 works out of the box, the Wifi doesn't work because it is one of the Intel Chipset.  Sound needs a little support, just draw the Voodoo from the ATools folder to the Kext Utility Icon.  Graphics is still a problem.  I found the following solutions, but I have yet to try them out.

Solution 1
Solution 2
Solution 3 - The simple line of Graphicsenabler=yes would suffice.

Seems like in 10.6.2 there is a problem with the VoodooHDA.kext and NVInject.kext

Chromium OS install and boot from USB from Windows or Mac

Google had recently released the source code for their much hyped Chromium Operating System. Google had positioned itself to be the king of cloud computing, everything from email, spreadsheet, writing documents and doing everything you need on the web. This particular OS can be installed to old and new computers alike, and it is basically a stripped down version of the Linux OS. There is currently a Vmware version which you can install and run using Vmware or VirtualBox. However, most review shows that it is really slow and it is no fun in running it in visualization. This article will show you how to install Chromium OS onto a USB drive. Then you can keep your old OS, and boot from this usb drive anytime if you want to. It is also a breeze to install and it won't touch any of your current file system.
This is what you will need

Computer that can boot with USB thumb drive
USB with 4GB of space, new version only requires a 1 GB drive.


A version of pre build Chromium OS - I will show you where to find it.

Preparation - This instruction will show you how to use a pre build version of the Chromium OS, thus you won't need a linux machine to build it from source. You can start by downloading a pre-build version of the Chromium OS. There is a version online made by Hexxus which is good to go and easy to install on any USB drive.  Use the Windows Version or Mac  instructions to write that image to your USB drive.

Caution - Major issue with Chromium OS is that the hardware drivers are still in development stage.  Therefore it might be hard to get a few hardware to function, most errors reported were sound device or wifi drivers.  If there are any keyboard or Mouse problems, try to connect a USB version of it.

Boot up - Chromium requires your computer to be able to boot from USB, and once in the OS, it would ask for a username and password.  The default for Hexxus's image is facepunch/facepunch.  That is for the initial offline login, if you have internet connection you can try it with your usual gmail login.

Navigator - It is fairly easy to use the chromium OS, as there is only a browser and some simple settings of the machine.  Most noticeably is the use of the F8 command.  This command shows a translucent version of your keyboard, and the shortcuts available when hitting any of the combination of and shift.  I think it is great, you can even use it as a guide to know the keyboard shortcut to your normal chrome browser.  Since Chromium was built (strip down) from Linux, there is a way to bring out a prompt to by pressing - T.  This way you would have better access to most of the basics of your computer. 

Have fun hacking.

64bit boot for Snow Leopard

How do you know if your Snow Leopard upgrade is booting in 64 bit?  Try these commands

ioreg -l -p IODeviceTree | grep firmware-abi

This command will check if your EFI is 32 bit or 64 bit the EFI can make or break for your 64 bit hardware running in 32 bit.  There is a list of not too old Macs not being able to run in 64 bits because they have a dated version of the EFI.

To check if you are running the 64 bit Kernel, Type


uname -v

in terminal and if your response contains the string x86_64 in the output that means you are in luck.

How to use your Iphone and Tomato to turn on your computer remotely without going to the app store

So you think you know all the uses of an Iphone? Well try this, making an adhoc version of a remote computer switch with your Iphone without visiting the Apple app store. So here is what you need

• A Router with Tomato Firmware installed
• A computer with a LAN card that supports Wake-On-Lan
• Iphone/Ipod Touch or any phone with Wifi and a web browser ( I haven't tested others yet)

     Ok, since you have landed on this blog, I assume that you are already familiar with the Tomato firmware. It is a free custom Linux based firmware written especially for most Boardcom chipset based routers. It can easily turn your $30 router to a $300 router if you know how to install it. You can easily search Google to find out if your router supports it, and you can also Google instructions on how to install it. There is a large community on custom firmwares that try to make it do different things everyday. Ok so after you have installed the Tomato firmware, you would automatically notice that tomato supports WOL automatically. Basically it is the use of a network card to turn on the computer when you have access to the network. When you want to turn on a computer, a magic packet is broadcast on the network to reach your target computer. However it is mostly a pain to enable that feature on your computer. I am using Asrock M3A790GXH/128M for this exercise. So here are the steps.

1. Install and configure tomato to work properly

2. Enable WOL on your computer. In my case, you have to goto BIOS and enable "PCI device Power On" in the power menu. This might be different for your setup, but the principle is the same. Try to Google your specific motherboard/LAN card for instructions.

3. Boot into windows/Mac/Linux and note down the Mac address of your network card. Also note the name of the computer you want to turn on, in my case it is "server". Then turn it off.

4.If you have used this computer extensively on your tomato router, it should remember the Mac address of your computer.

5.Now here is the fun part, use your iphone on the same network on your computer and goto the Safari browser. Goto the IP address of the Tomato router and goto the admin menu. In there you can see the WOL option which looks something like below.

6. Click on the target computer with the name "server" or the one with your target computer name. If it is not on the list, then you can enter it manually in the space below.

Wait for your computer to Beep and turn on right in front of you.  Now you can turn on your computer from the comfort of your sofa simply because you don't want to walk that extra distance or if you want to brag about it(I know I will) or just because you know that you can.  Now image what you can do with DDNS, VPN setup on the tomato, you can go anywhere and turn on your computer with the tip of your finger.

How to setup a web server with Ubuntu

Here shows a really nice picture walk through tutorial on how to setup a web server.

The basic walk through is to install ubuntu server, setup the web services with LAMP. LAMP stands for Linux, Apache, Mysql and PHP, basically all the free stuff.

This tutorial also goes on to show you how to harden your system by installing a firewall, and hiding some of your information from the public.

Some of the basic stuff such as Sudo are talking about, also how to upload your website, and some of the basics of port forwarding are talked about. Great tutorial for beginners

How to access mysql from outside of localhost 127.0.0.1 in Xampp

Xampp is a great tool if you want to setup a mock web server in your local computer. You don't have to go through the hassle of downloading and installing all the server in this great little mash up. For me personally, it was more than enough for local testing. However recently I have expanded some of my boundaries and now I require to have multiple access of a single database in my local network. This is how you do it.

Navigate to your Xampp installation directory, then goto the mysql/bin directory, in my case it is
C:\xampp\mysql\bin

open the file

my.cnf


Then find the line bind-address:127.0.0.1
If it is not there then add it, and replace 127.0.0.1 with the ip address of the computer you want to access the database from. You should now be able to access your mysql server from another computer than other localhost.

SnowOSX Universal v3.6 (10.6.2)

UPDATE: On the russian site, it cites support for AMD, ATOM 330, Pentium 4 (D), Celeron CPUs, this is great news.
Also support for Samsung R-560 (R-310, R-610... etc.)
I got this to work on my Asus W7J, installed on a 16GB USB thumb drive.   Running 64 Bit EFI Kernel too.


The new version of the assembly for single-layer DVD, which is built on the basis of Retail Snow Leopard 10.6 Update 10.6.2 Safari 4.04. An assembly can be installed on GUID, and at the Mbr. In the assembly immediately included Russian localization.

Extras. information: from the assembly removed all packages with drivers for printers, AdditionalSpeechVoices, other languages

The contents of the folder Customise
- PC EFI 9.4 - boot-9-4 by Netkas
or choice
- PC EFI 10.5 - Chameleon 2 RC3 (r658) PC EFI 10.5 by Netkas
- NullCPUPM - blocker (disabler) for IntelCPUPowerManagement
- PlatformUUID - Error 35 fix
- FakeSMC
- IOATA Kernel Panic fix - 32/64-bit IOATAFamily.kext from Leo 10.5.8 (compiled by Slice)
- EvOreboot - Restart and Shutdown fix
- EvOSpeedStep - Power Management for Core i7
- EvOenabler - ATI video injector
- SMBIOSResolver - only for PC EFI 9.4!!!
- Legacy AHCI - 32/64-bit Legacy kext for Intel AHCI (SATA)
- Legacy ATA - 32/64-bit Legacy kext for Intel ATA (IDE)
- Legacy JMicron ATA - 32/64-bit Legacy kext for JMicron ATA (IDE)
- PS / 2 - kekst interface PS / 2
- Rosetta - support for legacy applications
- ATools - a folder with a set of office utilities and drivers

System requirements: PC with a processor Intel SSSE3 (not to be confused with SSE3!)
Year: 2009
Version: 3.6
Platform: PC
Language: English Russian
Tabletka: Not required
Size: 4.71 Gb
Checksum:
MD5: 5d76a853b7d76d99e48f0fa1762933fd

Read more

Currently not on the bay or the nova.

Download from these links below. Apparently the other sites included were either not available or it is a paying download service.

http://hotfile.com/dl/18438462/9060fd3/SnowOSX3.6.part01.rar.html
http://hotfile.com/dl/18438637/72892f3/SnowOSX3.6.part02.rar.html
http://hotfile.com/dl/18438908/230262f/SnowOSX3.6.part03.rar.html
http://hotfile.com/dl/18439140/81b3032/SnowOSX3.6.part04.rar.html
http://hotfile.com/dl/18439356/b585762/SnowOSX3.6.part05.rar.html
http://hotfile.com/dl/18438428/a5a1c8e/SnowOSX3.6.part06.rar.html
http://hotfile.com/dl/18438588/3a02c05/SnowOSX3.6.part07.rar.html
http://hotfile.com/dl/18438860/2a2e7b1/SnowOSX3.6.part08.rar.html
http://hotfile.com/dl/18439183/a6f7460/SnowOSX3.6.part09.rar.html
http://hotfile.com/dl/18439408/2037804/SnowOSX3.6.part10.rar.html
http://hotfile.com/dl/18438383/2b0146a/SnowOSX3.6.part11.rar.html
http://hotfile.com/dl/18438657/b33517f/SnowOSX3.6.part12.rar.html
http://hotfile.com/dl/18438938/c0f3eea/SnowOSX3.6.part13.rar.html
http://hotfile.com/dl/18439150/98ef300/SnowOSX3.6.part14.rar.html
http://hotfile.com/dl/18439360/2cd8681/SnowOSX3.6.part15.rar.html
http://hotfile.com/dl/18438577/27d052b/SnowOSX3.6.part16.rar.html
http://hotfile.com/dl/18438844/8563e23/SnowOSX3.6.part17.rar.html
http://hotfile.com/dl/18439054/cd757f5/SnowOSX3.6.part18.rar.html
http://hotfile.com/dl/18439182/05d7168/SnowOSX3.6.part19.rar.html