Archives for May 2016

PHP bug 41655 test failed

By @sskaje
Link: https://sskaje.me/2016/05/php-bug-41655-test-failed/

If you see error below when ‘make test’ after building php

=====================================================================
FAILED TEST SUMMARY
---------------------------------------------------------------------
Bug #41655 (open_basedir bypass via glob()) 1/2 [ext/standard/tests/file/bug41655_1.phpt]
Test glob() function: ensure no platform difference, variation 3 [ext/standard/tests/file/glob_variation5.phpt]
=====================================================================

=====================================================================

FAILED TEST SUMMARY

---------------------------------------------------------------------

Bug #41655 (open_basedir bypass via glob()) 1/2 [ext/standard/tests/file/bug41655_1.phpt]

Test glob() function: ensure no platform difference, variation 3 [ext/standard/tests/file/glob_variation5.phpt]

=====================================================================

Remember: You can build PHP almost everywhere, but you CANNOT make test IF YOU ARE BUILDING UNDER /tmp!

PHP bug 41655 test failed by @sskaje: https://sskaje.me/2016/05/php-bug-41655-test-failed/

VMware XP bypass virtual machine detection

By @sskaje
Link: https://sskaje.me/2016/05/vmware-xp-bypass-virtual-machine-detection/

Turn off your VM and add following to vmx:

monitor_control.virtual_rdtsc = "false"
monitor_control.restrict_backdoor = "true"
isolation.tools.getPtrLocation.disable = "true"
isolation.tools.setPtrLocation.disable = "true"
isolation.tools.setVersion.disable = "true"
isolation.tools.getVersion.disable = "true"
monitor_control.disable_directexec = "true"

monitor_control.virtual_rdtsc = "false"

monitor_control.restrict_backdoor = "true"

isolation.tools.getPtrLocation.disable = "true"

isolation.tools.setPtrLocation.disable = "true"

isolation.tools.setVersion.disable = "true"

isolation.tools.getVersion.disable = "true"

monitor_control.disable_directexec = "true"

Tested on VMware Fusion + Windows XP.

VMware XP bypass virtual machine detection by @sskaje: https://sskaje.me/2016/05/vmware-xp-bypass-virtual-machine-detection/

Install Debian MIPS and Debian PowerPC on OSX

By @sskaje
Link: https://sskaje.me/2016/05/qemu-install-debian-mips-debian-powerpc-on-osx/

I tried MacPorts, but its qemu does not have qemu-system-ppc or qemu-system-mips. Even though, I have qemu installed under macports, if you see any dependency missing, try to port install qemu and then uninstall.

OSX 10.11.5
Xcode

Install QEMU

Download 2.6.0 from Qemu.org, configure and make like:

# ./configure --enable-cocoa --target-list=arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc-softmmu,ppc64-softmmu,x86_64-softmmu
# make -j 8
# make install

# ./configure --enable-cocoa --target-list=arm-softmmu,i386-softmmu,mips-softmmu,mips64-softmmu,ppc-softmmu,ppc64-softmmu,x86_64-softmmu

# make -j 8

# make install

I did not see any error, Google if you see any.

Install Debian MIPS

Debian official installer only have netboot image. All you need is GOOD INTERNET CONNECTION, don’t download iso from debian cd mirror.

Prepare

Download vmlinux and initrd.

Install

Create Image

$ qemu-img create -f qcow2 disk.img 8G 
Formatting 'disk.img', fmt=qcow2 size=8589934592 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16

1 2	$ qemu-img create -f qcow2 disk.img 8G Formatting 'disk.img', fmt=qcow2 size=8589934592 encryption=off cluster_size=65536 lazy_refcounts=off refcount_bits=16

Install

$ qemu-system-mips -hda disk.img -kernel vmlinux-3.16.0-4-4kc-malta -initrd initrd.gz -nographic

1	$ qemu-system-mips -hda disk.img -kernel vmlinux-3.16.0-4-4kc-malta -initrd initrd.gz -nographic

Follow the instructions, almost same as debian x86/x86_64.
You may be asked to configure and mount partition, I picked one partition and choose ext4 and mount to /.

Now, you have to wait for a long long time…

Then:

   ┌─────────────────┤ [!] Continue without boot loader ├──────────────────┐
   │                                                                       │
   │                       No boot loader installed                        │
   │ No boot loader has been installed, either because you chose not to or │
   │ because your specific architecture doesn't support a boot loader yet. │
   │                                                                       │
   │ You will need to boot manually with the /vmlinux kernel on partition  │
   │ /dev/sda1 and root=/dev/sda1 passed as a kernel argument.             │
   │                                                                       │
   │                              <Continue>                               │
   │                                                                       │
   └───────────────────────────────────────────────────────────────────────┘

┌─────────────────┤ [!] Continue without boot loader ├──────────────────┐

│ │

│ No boot loader installed │

│ No boot loader has been installed, either because you chose not to or │

│ because your specific architecture doesn't support a boot loader yet. │

│ │

│ You will need to boot manually with the /vmlinux kernel on partition │

│ /dev/sda1 and root=/dev/sda1 passed as a kernel argument. │

│ │

│ <Continue> │

│ │

└───────────────────────────────────────────────────────────────────────┘

Just continue.

Run

qemu-system-mips -hda disk.img -kernel vmlinux-3.16.0-4-4kc-malta -append "root=/dev/sda1" -nographic

1	qemu-system-mips -hda disk.img -kernel vmlinux-3.16.0-4-4kc-malta -append "root=/dev/sda1" -nographic

!!!REMEMBER!!!
NO -initrd
-append “root=/dev/sda1”
!!!/REMEMBER!!!

If you want to exit qemu under nographic:
press ctrl+a, then c (no ctrl), type quit, hit enter.

root@debian-mips-jessie:~# lscpu 
Architecture:          mips
Byte Order:            Big Endian
CPU(s):                1
On-line CPU(s) list:   0
Thread(s) per core:    1
Core(s) per socket:    1
Socket(s):             1


root@debian-mips-jessie:~# php -r "var_dump(bin2hex(pack('f', 236)));"
string(8) "436c0000"

root@debian-mips-jessie:~# lscpu

Architecture: mips

Byte Order: Big Endian

CPU(s): 1

On-line CPU(s) list: 0

Thread(s) per core: 1

Core(s) per socket: 1

Socket(s): 1

root@debian-mips-jessie:~# php -r "var_dump(bin2hex(pack('f', 236)));"

string(8) "436c0000"

Install Debian PowerPC

Similar to MIPS, but debian provides cdrom installer.

vmlinux, initrd.gz

So,

Install:

 qemu-system-ppc  -kernel vmlinux -initrd initrd.gz -cdrom debian-8.4.0-powerpc-CD-1.iso -hda disk.img

1	qemu-system-ppc -kernel vmlinux -initrd initrd.gz -cdrom debian-8.4.0-powerpc-CD-1.iso -hda disk.img

Run:

You may see similar error message above saying quik loader failed to install, just ignore it.
And, for PowerPC, no -kernel and no -append is required.
You can also forward ssh to local loopback.

qemu-system-ppc -hda disk.img  -net user,hostfwd=tcp::10022-:22 -net nic -m 256

1	qemu-system-ppc -hda disk.img -net user,hostfwd=tcp::10022-:22 -net nic -m 256

root@debian:/home/sskaje# lscpu 
Architecture:          ppc
CPU op-mode(s):        32-bit
Byte Order:            Big Endian
CPU(s):                1
On-line CPU(s) list:   0
Thread(s) per core:    1
Core(s) per socket:    1
Socket(s):             1
Model:                 Power Macintosh
BogoMIPS:              33.37
L1d cache:             32K
L1i cache:             32K
root@debian:/home/sskaje# php -r "var_dump(bin2hex(pack('f', 236.0)));"
string(8) "436c0000"

root@debian:/home/sskaje# lscpu

Architecture: ppc

CPU op-mode(s): 32-bit

Byte Order: Big Endian

CPU(s): 1

On-line CPU(s) list: 0

Thread(s) per core: 1

Core(s) per socket: 1

Socket(s): 1

Model: Power Macintosh

BogoMIPS: 33.37

L1d cache: 32K

L1i cache: 32K

root@debian:/home/sskaje# php -r "var_dump(bin2hex(pack('f', 236.0)));"

string(8) "436c0000"

Install Debian MIPS and Debian PowerPC on OSX by @sskaje: https://sskaje.me/2016/05/qemu-install-debian-mips-debian-powerpc-on-osx/

FishEye and Mariadb

By @sskaje
Link: https://sskaje.me/2016/05/fisheye-mariadb/

FishEye is official not compatible with Mariadb, but it is by:

ALTER DATABASE fisheye CHARACTER SET utf8 COLLATE utf8_bin;

1	ALTER DATABASE fisheye CHARACTER SET utf8 COLLATE utf8_bin;

FishEye and Mariadb by @sskaje: https://sskaje.me/2016/05/fisheye-mariadb/

Click Button and Read Text from Other Program on Windows

By @sskaje
Link: https://sskaje.me/2016/05/click-button-read-text-program-windows/

I have a protected application on windows, normally my clients have to run that program, click a button, copy some text from another text control, upload to somewhere…

I need to find a solution simulate button click and read the text control.

There are two buttons, generate and exit, and a text control.

Here is what I did in C++, build under Windows XP + Visual C++ 6.0/7.0 in CLI.

1 Run the program.

	STARTUPINFO si;
	PROCESS_INFORMATION pi;
	ZeroMemory(&si, sizeof(si));
	ZeroMemory(&pi, sizeof(pi));
	
	if (!CreateProcess(
		NULL,
		(LPTSTR)  "GetResult.exe",
		NULL,
		NULL,
		false,
		CREATE_NO_WINDOW,
		NULL,
		NULL,
		&si,
		&pi
	)) {
		DWORD errval = GetLastError();
		cout << "CreateProcess Failed: " << errval << endl;
		return 2;
	}

	Sleep(500);

STARTUPINFO si;

PROCESS_INFORMATION pi;

ZeroMemory(&si, sizeof(si));

ZeroMemory(&pi, sizeof(pi));

if (!CreateProcess(

NULL,

(LPTSTR) "GetResult.exe",

NULL,

false,

CREATE_NO_WINDOW,

NULL,

&si,

&pi

)) {

DWORD errval = GetLastError();

cout << "CreateProcess Failed: " << errval << endl;

return 2;

}

Sleep(500);

Sleep is required here, to ensure that you can find correct control.

2 Find controls

	int ctrlBtnGet = 0x01;
	int ctrlTxtResult = 0x03e8;
	int ctrlBtnExit = 0x02;

	HWND wGetWindow = FindWindow(0, "Window Title");	
	HWND wBtnGet = GetDlgItem(wGetWindow, ctrlBtnGet);
	HWND wBtnExit = GetDlgItem(wGetWindow, ctrlBtnExit);	
	HWND wTxtResult = GetDlgItem(wGetWindow, ctrlTxtResult);

int ctrlBtnGet = 0x01;

int ctrlTxtResult = 0x03e8;

int ctrlBtnExit = 0x02;

HWND wGetWindow = FindWindow(0, "Window Title");

HWND wBtnGet = GetDlgItem(wGetWindow, ctrlBtnGet);

HWND wBtnExit = GetDlgItem(wGetWindow, ctrlBtnExit);

HWND wTxtResult = GetDlgItem(wGetWindow, ctrlTxtResult);

These CtrlID can be read by many *Spy app on windows.

3 Perform click and read from text control

In my case, Sleep is also required after BM_CLICK was sent to target program, otherwise I may have to click more than once.
So, I wrote a loop

	int max_retry = 5;
	
	int retry = 0;
	
	int length;
	char buf[2048] = {0};
	
	do {
		SendMessage(wBtnGet, BM_CLICK, 0, 0);
		Sleep(300);
	
		length = (int) SendMessage(wTxtResult, WM_GETTEXTLENGTH, 0, 0);
		
		if (length > 0) {
			SendMessage(wTxtResult, WM_GETTEXT, sizeof(buf) / sizeof(buf[0]), (LPARAM) buf);
			printf("%s\n", buf);
			break;
		}
		
	} while (++retry < max_retry);

int max_retry = 5;

int retry = 0;

int length;

char buf[2048] = {0};

do {

SendMessage(wBtnGet, BM_CLICK, 0, 0);

Sleep(300);

length = (int) SendMessage(wTxtResult, WM_GETTEXTLENGTH, 0, 0);

if (length > 0) {

SendMessage(wTxtResult, WM_GETTEXT, sizeof(buf) / sizeof(buf[0]), (LPARAM) buf);

printf("%s\n", buf);

break;

}

} while (++retry < max_retry);

I tried GetDlgItemText and GetWindowText, neither of these two works to get text from the control.
WM_GETTEXTLENGTH and then WM_GETTEXT is the best choice so far as I know.

4 Click Exit

	SendMessage(wBtnExit, BM_CLICK, 0, 0);

1	SendMessage(wBtnExit, BM_CLICK, 0, 0);

Click Button and Read Text from Other Program on Windows by @sskaje: https://sskaje.me/2016/05/click-button-read-text-program-windows/