HN user

DanOWar

11 karma
Posts4
Comments12
View on HN
Exec($_GET 12 years ago

Example from the Github search:

     <?php
          $result=shell_exec("cat ".$_GET['name'].".txt");
          echo $result;
     ?>
How to abuse:
     $_GET['name'] = "/dev/null; rm -rf /; echo ";

I've had this issue with an iPhone 2 and 4, and was able to permanently fix it in both cases by applying acetone to a cotton swab (Q-Tip) and cleaning the home button with it (allowing a small amount of acetone to enter into the seam). In both instances, the home button worked like new afterwards, for years. Your results may vary, but to maximize your chances, I'd suggest using a high grade acetone (e.g. from a home improvement store) as opposed to nail polish.

Facebook's HHVM (HipHop VM) compiles webpages into native machine code that can be executed directly on the processor. People often confuse HHVM with HPHPc, also made by Facebook. HPHPc came first; it was a converter that converted all the PHP files in a folder into individual C++ files. In other words, you would end up uploading the C++ files to the server, not PHP files. Facebook abandoned HPHPc early on for multiple reasons (it was actually developed by a single developer as a tool for one-time use to convert all of Facebook's existing PHP files into C++, back when Facebook was considering rewriting the website in C++ for improving performance). While the idea for HHVM was loosely based on HPHPc, the approach is much different. HHVM is a standalone replacement for the PHP engine. It has almost 100% support with the native PHP language, up to PHP 5.5, and even (intentionally) reproduces the various bugs in the PHP language, to maintain compatibility. HHVM only replaces PHP, not Apache or anything else in your stack. It is really, really easy to replace it via their FastCGI handler.

Was fail2ban even working? After a reformat, did you install fail2ban manually, or from a repo? Are you using syslog or rsyslog? Each's log format is slightly different, meaning you have to edit the filter to accomodate. The base install filter didn't even work correctly for me on a fresh CentOS re-image. Also, the latest version on the website is v0.8.7.1, but on CentOS epel it's v0.8.4.