Monday, March 17, 2014

Uploading files to a webpage via html/php

Here's the situation. You have a bash script you wrote to analyze a file and save that analysis to some output file. But instead of running this on the command line, you want to have a webpage where someone can go to and upload the file for automatic analysis. Sounds simple, but it took me a little trial and error to get it working right.

To Do List
  1. Have a "Browse" button where someone can search their computer for a file to upload. 
  2. Have a "Submit" button after finding the file to upload.
  3. Have an error if no file is selected (main point is don't run script with an empty file).
  4. Have unique filename used per upload. Why? Because you cannot use static anything since two people may upload files at the same time.
  5. Have webpage redirect to script output once completed (unique url).


 So here's the part for the html for the browse/submit part. You put this in the html page you actually want the buttons to appear in. Essentially this will put a browse and submit button on the page and on clicking submit, it will call up the "upload_file.php" script.

<form action="upload_file.php" method="post"
enctype="multipart/form-data">
<label for="file">File to upload</label>
<input type="file" name="file" id="file"><br><br>
<input type="submit" name="submit" value="Submit">
</form>


After submit is clicked, I needed a bash script to be called and the file passed on to the script. Admittedly this part could probably be better but I sort of messed around with it until I got it working. If no file is selected, it just prints an error and does not run the script. If a file is chosen, it runs the else statement where it calls a script (in the same directory as the page) with the file name as an input variable to the script ($1).

<?php
if ($_FILES["file"]["error"] > 0) 
 {
  echo "Error: " . $_FILES["file"]["error"] . "<br>";
  }
else
  {
  $file = $_FILES["file"]["tmp_name"];
  exec ( "./script.sh $file" );
  $url = 'http://website.corp/OutPutDirectory';

  echo '<META HTTP-EQUIV=Refresh CONTENT="0; URL='.$url.$file.'">';  
    }
?>


By default, any uploaded file is uploaded in to the /tmp directory as something like /tmp/phpgthJhd. In the script above, I set that tmp name to $file so when the script is called it knows what file to run the script against. This random naming has the benefit of php already taking care of unique name too. Each upload will have a different name. Another benefit is that after the php script completes, the /tmp file is deleted. Auto-clean up.

One thing to note in the above are these two lines:

  $url = 'http://website.corp/OutPutDirectory';  
  echo '<META HTTP-EQUIV=Refresh CONTENT="0; URL='.$url.$file.'">'; 

The $url is set to the obvious link, however notice below I added $file. And $file is /tmp/php<random>. Here was my fix for utilizing this built in file path to the unique url. In my output directory, I just added a /tmp directory too. So I can simply have my script output the file to that directory since php is already going to forward to that.

The php redirect to the output will look like this:

http://website.corp/OutPutDirectory/tmp/phpgthJhd

In the script you do something similar:

file=$1
output to /var/www/OutPutDirectory$file.html

In both cases, the / in the file is referencing root but since I'm putting directories in front, it's just another separator.


So you now have a place in a webpage to upload a file, error if no file uploaded, random and unique file names, and the php/bash script are talking with the same random filename. So yeah everything works as needed for now. If you have any issues, a good place to check is the apache error log.



Monday, February 24, 2014

Stacked Histograms in gnuplot

I like to graph things out a lot. In some cases the actual values of the graph don't matter for the most part. I just need a quick view of a system that has been graphed to see if it's normal or not. Specifically in this case, I was looking for an evenly distributed load on some servers.

I chose a stacked histogram because it was easier to see distribution compared to something like a line chart. Likewise it needed to be stacked due to such a large set of data per polling interval. It took a bit of playing around but I finally got it to work how I wanted.


set term png
set output '/var/www/Graph.png'
set terminal png size 1500,400
set boxwidth 0.75 absolute
set style fill solid 1.00 border lt -1
set key outside # < I ended up doing an unset key later due to the size
set style histogram rowstacked
set style data histograms
set xtics norangelimit font ",8"
set xtics rotate by 270
set xlabel "  "
set autoscale
set grid
# The source file has many sections of data for other charts. This histogram was for 32-83 (1 was the time %H:%M). Server names removed.
plot 'gnuplotdata.dat' using 32:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 33:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 34:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 35:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 36:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 37:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 38:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 39:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 40:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 41:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 42:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 43:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 44:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 45:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 46:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 47:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 48:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 49:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 50:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 51:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 52:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 53:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 54:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 55:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 56:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 57:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 58:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 59:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 60:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 61:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 62:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 63:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 64:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 65:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 66:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 67:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 68:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 69:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 70:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 71:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 72:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 73:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 74:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 75:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 76:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 77:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 78:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 79:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 80:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 81:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 82:xtic(1) title 'serverX', \
'gnuplotdata.dat' using 83:xtic(1) title 'serverX'


You can't really use a key with this due to the large data set making many of the colors too similar. I decided to 'unset key' after the key was taking up half the image. Again, this wasn't for an exact reference. This was so I could glance and see something was wrong and then go to my not so friendly data file and see what server had what issue. So the below was the chart showing a pretty evenly distributed load. The 'load' itself constantly changes and there is no baseline or reference point due to the nature of the load. So the only reference they have is to each other. Yes there are simpler ways to determine if they are loaded nearly the same all around, but that's not as cool.



Monday, February 10, 2014

Asprox/Kuluoz modules crashing

I finally got a computer infected with Asprox/Kuluoz to monitor it. I had a lot of issues with it crashing. Well it's been running fine for a while but now a process called IenMeramkel Antibibus keeps crashing. In fact, when I checked it after letting it sit over the weekend I probably had about 20 different popups like that from various app names. I assume all of which are just Asprox/Kuluoz modules that may not be working their best on my computer. More annoyingly than all of those, explorer.exe keeps crashing every few seconds as well. Making exploring a pain.

Fortunately it seems like the core infection is still working since I still see it trying to send junk.However, this is not some quiet virus. This system is obviously infected. Constantly popping up with messages about things crashing, explorer.exe hasn't worked in days, and the thing runs like garbage. Subtlety seems like it would be important for most viruses so they can just go undetected. But any level of user would notice something is wrong at this point.


*Edit: A day later, the new process that's crashing is now  IonMeramkel Antibibus. I assume as variations come out, the name will continue to change.

*Edit2: How about I just make a list with some of the crashing programs I see. If for some reason you have stumbled across this page googling these, you very likely are infected with malware and should get that checked out. Some places online are mentioning zbot trojans. This may partially be the case, but the original infection was due to Asprox/Kuluoz . With Asprox/Kuluoz having it's modules, there's no telling what could have been installed later.
  • IenMeramkel Antibibus
  • IonMeramkel Antibibus
  • MapMark Microsoft
  • RobotView
  • JonMeramkul Antibibus
  • UpdateFlashPlayer_<alnum string>.exe
  • Apriori
  • JenMeramkel Antibibus
  • JenMeromkel Antibibus 
  • MyFtp 
Edit3: And I'm done. There's been nothing going on for a while so I have shut my infection down. I may start it back up again if I hear Kuluoz changes significantly again. There are already good writeups on the current one so I may bother with some actual effort if a new one releases. Stay safe.

Sunday, February 2, 2014

SuperBowl lightup beanie

I'm not a sports person and I didn't watch the superbowl. I did see something about some promotion Pepsi beanies that lite up to form a "display" at the half time show. This intrigued me. How do you get thousands of hat-lights synced? What sort of batteries does it have? How could they make so many disposable ones?

I had questions so of course I hopped on over to ebay to see if any were up yet (superbowl wasn't even done.). And yes of course there was one. I started pondering if it would be worth it since it might prove to be cool to hack in to something. After taking a closer look at the hats picture where you could see the LED's, I noticed one of the cutouts was not an LED. It was an IR receiver. Pretty much lost interest at that point since that explains it all. Everyone will be facing forward during the halftime show more than likely. So you get an IR blaster hitting them in the faces to get control. Batteries were probably some CR2032's or something. It only needed to last for the performance. I'm sure the designers tested everything to make sure it all came together. I was hoping for some RF or something. Oh well. Still kind of a cool idea.


Sunday, January 26, 2014

Dream Cheeky email notifier and Linux

As much as email and webpage alerts are useful, sometimes you just need a good old fashioned physical heads up saying something is broken. Enter the Dream Cheeky usb email notifier.

 


It's designed to hook up to a pc and light up any color you want when you get emails in. I stumbled across this and thought this is perfect for using it in Linux for monitoring. But like most things, no official linux support. After some digging though, I found some instructions on how to get it to work with Linux (https://github.com/daniel-git/usblamp).So I got mine from amazon yesterday and it works like a charm.

Some quick commands to get it up and running:

sudo apt-get install g++
sudo apt-get install libusb-dev
wget https://github.com/daniel-git/usblamp/tarball/master --no-check-certificate
tar xzf master
cd daniel-git-usblamp*/src
make
sudo make install


And that's it. You control it via the command "usblamp". Works great in bash scripts. Some examples include:

usblamp green
usblamp '#8258FA'
usblamp off

The switching time keeps up with as fast as the system can change the color (did a while loop to test). I'm sure this could be physically hacked to so it's not a little envelope sitting on a server. You could probably take it a part and do other stuff with it. But for under $20, it's hard to beat.

Friday, January 24, 2014

Dual y axis in gnuplot

Yeah there are resources out there n this but I had to do some playing around to get what I wanted out of this so I figured I'd post it here. I needed to graph free ram, free swap, and 5 minutes avg load in one graph. Given that the ram and swap were in MB and the cpu avg was going to be in a 0-100 scale, it called for the use of two axis'. So here's the script for it.

#! /bin/bash
# mark hamsel 1/24/14
# Script for plotting free ram, free swap, and 5 min cpu load

## Gnuplot config
#set term png
#set output '/var/www/freemem.png'
#set terminal png size 1500,400
#set ylabel "Megabytes" #left hand y axis label
#set y2label "CPU 5 min Avg" #righthand y axis label
#set xlabel "  " #using an obvious time so no xlabel
#set xtics rotate by 270
#set key outside
#set grid
#unset colorbox
#set yrange [0:4200] #Only had 4 gigs on the machine and I'm measuring in MB
#set y2range [0:100] #Utilization is a percent so 0-100
#set y2tics autofreq  norangelimit #This makes it so you can see the 0-100 tics
#set terminal png truecolor # Needed this to use transparent filledcurves
#set style fill transparent solid 0.50 noborder #Set the default plot style
## 1 is memory and 2 is swap
#plot '/home/mark/scripts/freemem.dat' using 3:xticlabel(1) w filledcurves x1 lc rgb '#630595' title 'Swap' axes x1y1, \
#'/home/mark/scripts/freemem.dat' using 2:xticlabel(1) w filledcurves x1 lc rgb '#00995E' title 'Ram' axes x1y1, \
#'/home/mark/scripts/freemem.dat' using 4:xticlabel(1) w lines lw 3 lc rgb '#DC6022' title 'CPU' axes x2y2



### This part gathers the data ###
date=$(date +%H:%M)
#This gets the free memory and swap values
values=$(free -mo|grep -v total|awk '{print $4}')
#This gets the 5 min load avg
fivenimloadavg=$(cat /proc/loadavg |awk '{print $2}')
#This gets the free mem/swap, load avg, and time in to a file for source data
echo $values $fivenimloadavg|sed "s/^/$date /" >> /home/mark/scripts/freemem.dat
#File cleanup so I only have the most recent 60 samples
for file in `echo /home/mark/scripts/freemem.dat`
do
DATALINES=$(wc -l $file|awk '{print $1}')
while [[ $DATALINES -gt 60 ]]
do
sed -i '1 d' $file
DATALINES=$(wc -l $file|awk '{print $1}')
done
done
#Plot it
gnuplot /home/mark/scripts/gnuplotfreemem.cfg



Some malware at a Microsoft owned IP

Had a link in a spam message of hxxp://compra-da-sorte-cielo.com. That redirected to hxxp://137.135.200.64/Cadastro.




This page was wanting you to sign up and hand over some info. But if you went straight to the 137.135.200.64 IP, you get prompted save an exe directly. The scan can be found HERE. Interestingly, that IP belongs to Microsoft as well (http://whois.arin.net/rest/net/NET-137-135-0-0-1/pft).

Running the malware shows it reaches out to hxxp://playshows.com.br/12/googletalk.zip and downloads it. But it turns out it's password protected. Need to do more digging.