UNDERCODE COMMUNITY
2.68K subscribers
1.23K photos
31 videos
2.65K files
80.2K links
πŸ¦‘ Undercode Cyber World!
@UndercodeCommunity


1️⃣ World first platform which Collect & Analyzes every New hacking method.
+ AI Pratice
@Undercode_Testing

2️⃣ Cyber & Tech NEWS:
@Undercode_News

3️⃣ CVE @Daily_CVE

✨ Web & Services:
β†’ Undercode.help
Download Telegram
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁



πŸ¦‘Below we explain sentence by sentence, and give the meaning of each setting, so that everyone can bypass the category, In order to make reasonable settings according to the specific situation of your own FTP server.


1) Format: loginfails [Number of times]
Function: Set the number of times the user is allowed to enter the wrong password when logging in to the FTP server.
Example: loginfails 3: The connection is cut off if the password is entered incorrectly three times.

2) Format: class [class name] [real / guest / anonymous] [IP address]
Function: The function of this command sets the type of user on the FTP server. It can also restrict the client's IP address, allowing access to certain IP addresses or all IP addresses. The users on the FTP server can be basically divided into the following three categories:
real users with legal accounts on the FTP server;
guest anonymous users with records;
anonymous anonymous user
instances with the lowest authority : class local real *: define a name It is a local class, which contains real users who log in anywhere (* represents all IP addresses).
class remote anonymous guest *: Define a class called remote, which contains anonymous users and guest users who log in anywhere.

3) Format: limit [category] [number of people] [time] [file name]
Function: The function of this command is to set the upper limit of the specified number of people allowed to connect in the specified category within the specified time. When the maximum number of people is reached, the content of the specified file is displayed.
Example: limit remote 100 Any /etc/ftpd/toomany.msg: At any time, when the number of remote users reaches 100, the new connection will no longer be allowed. When the 101st client wants to connect, connect Will fail and present the contents of the file /etc/ftpd/toomany.msg like a user.

4) Format: message [file name] [command]
Function: When the user executes the specified command, the system displays the specified file content.
Example: message /etc/ftpd/welcome.msg login: When the user executes the login command, that is, when logging in to the FTP server, the system will display the contents of the file /etc/ftpd/welcome.msg.

5) Format: compress [yes / no] [category]
function: set which category of users can use the compress (compression) function.
Example: compress yes local remote: allows users in both local and remote categories to use the compress function.

6) Format: tar [yes / no] [category]
function: set which category of users can use the tar (archive) function.
Example: tar yes local remote: allows both local and remote users to use the tar function.

7) Format: private [yes / no]
Function: Set whether to support group access to files.
Example: private yes: support group access to files.

8) Format: passwd-check [none / trivial / rfc822] [enforce / warn]
Function: Set the password usage for anonymous users anonymous.
none means no password verification, any password can be logged in;
trival means that as long as the entered password contains the character "@", you can log in;
rfc822 means that the password must comply with the E-Mail format specified in RFC822 to log in;
enfore means input If the password does not conform to the format specified above, you will not be allowed to log in;

written by undercode
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
πŸ¦‘ warn means that when the password does not meet the requirements, only a warning message will appear, and you can still log in:

> Example: passwd-check rfc822 warn: I hope to be able to get the E-Mail as a password, but if not, log in is allowed.

9) Format: log command [real / guest / anonymous]
Function: Set which user's operation after logging is recorded in the file / usr / adm / xferlog.
Example: log command real: When a real user logs in, his operation is recorded. Because other users have lower permissions, the operation will not cause too much security risks, so generally only need to record the operation of the real user.

10) Format: log transfers [real / guest / anonymous] [inbound / outbound]
Function: Set which users' upload (inbound) and download (outbound) operations do logs.
Example: log transfer anonymous guest inbound outbound: For anonymous users to pay more attention to their file operations, so no matter uploading or downloading are recorded.
log transfer real inbound: For legitimate users, only his upload record is recorded.

11) Format: shutdown [file name]
Function: The time when the FTP server is shut down can be set in the file specified later. When the set time is up, you cannot log in to the FTP server. To recover, only delete this file. This file must be generated by the command / bin / ftpshut.
Example: shutdown /etc/ftpd/shut.msg

12) Format: delete [yes / no] [real / anonymous / guest]
Function: Set whether to allow the specified user to delete files using the delete command. The default is allow.
Example: delete no anonymous, guest: In order to better manage the FTP server, under normal circumstances, we do not allow anonymous users to execute the delete command.

13) Format: overwrite [yes / no] [real / anonymous / guest]
Function: Set whether to allow the specified user to overwrite the file with the same name. The default is allow.
Example: overwrite no anonymous, guest: In order to better manage the FTP server, under normal circumstances, we do not allow anonymous users to overwrite files with the same name.

14) Format: rename [yes / no] [real / anonymous / guest]
Function: Set whether to allow the specified user to rename the file using the rename command. The default is allow.
Example: delete no anonymous: In order to better manage the FTP server, under normal circumstances, we do not allow anonymous users to execute the rename command to change the file name. Anonymous users with records are appropriately relaxed to allow them to use the rename command.

15) Format: chmod [yes / no] [real / anonymous / guest]
Function: Set whether to allow specified users to change file permissions using chmod command. The default is allow.
Example: delete no anonymous, guest: In order to better manage the FTP server, in general, we do not allow anonymous users to execute the chmod command to change file permissions.

16) Format: umask [yes / no] [real / anonymous / guest]
Function: Set whether to allow the specified user to use the umask command. The default is allow.
Example: delete no anonymous: In order to better manage the FTP server, under normal circumstances, we do not allow anonymous users to execute the umask command.

17) Format: upload [root directory] [upload directory] [yes / no] [user] [permissions] [dirs / nodirs]
Function: make more detailed settings for directories that can be uploaded.
Example: upload / home / ftpd * no: indicates that uploading is not allowed under the subdirectory / home / ftpd;
upload / home / ftpd / bin no: indicates that uploading is not allowed under the subdirectory / home / ftpd / bin;
upload / home / ftpd / etc no: indicates that uploading is not allowed in the subdirectory / home / ftpd / etc;
upload / home / ftpd / pub yes real 0644 dirs: allows legal users on the server to be in the subdirectory / home / ftpd / pub directory You can upload files with permission 0644 (that is, -rw-r--r--), and you can create new subdirectories under this directory.

>
πŸ¦‘ now lets configure a anonymous dirs on ftp
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘ upload / home / ftpd / incoming yes real guest anonymous 0644 dirs:

1) Allow all users to upload files with permissions 0644 in the subdirectory / home / ftpd / incoming, and in this directory can create a new subdirectory.

2) Format: alias [directory alias] [directory name]
Function: set an alias for the specified directory, you can use a shorter directory alias when switching directories.
Example: alias inc: / incoming: set an alias inc: for the subdirectory incoming.

3) Format: email [guest's E-Mail address]
Function: As long as certain E-Mail addresses are set in this place, then when these users log in to the FTP server, his identity will be guest, and the general authority is lower than real, than anonymous high.
Example: email guest@xxx.net email guest@yyy.net: This is just an example, in fact, it can contain multiple E-Mail addresses that meet the specifications.

4) Format: deny [IP address / domain name] [description file]
Function: This setting can restrict users whose IP addresses or domain names cannot log in to the FTP server.
Example: deny * .com.tw /etc/ftpd/deny.msg: Set any domain name whose domain name ends with ".com.tw" to prohibit its access. The content of /etc/ftpd/deny.msg is displayed to the user.

5) Set / etc / ftpuser to prohibit certain users from logging in
Sometimes we need to prohibit some users from using FTP services. In fact, this setting is very simple, only need to write the user account to be banned to the file / etc / ftpuser. Due to the security of the system, we generally do not want users with too much authority and some users with the same command name to enter the FTP server. So in the default configuration, generally the following users have been added to the "blacklist".

root
uucp
news
bin
adm
nobody
lp
sync
shutdown
halt
mail

6) Set / etc / ftphosts to prohibit certain logins from specified machines. If you need to refuse logins from certain hosts, one way is to set them in / etc / ftpaccess The deny command, another simpler method is to write the IP address or domain name of the host you want to ban in / etc / ftphosts.

7) Make the new configuration take effect
So far, we have been able to make necessary modifications and adjustments to the FTP server configuration according to our needs. And after we reconfigure, we must make it effective. In general, the configuration of / etc / ftpaccess is directly applied to the next FTP service process after setting. For others, restart the inetd process.

> Use of some other commands related to wu-ftp
>Connection count command ftpcount
We can use the ftpcount command to clearly count the number of users currently connected to the FTP server, and also list the upper limit. The command output is as follows:

8) Service class local 0 Users (20maximum)
Service class remote 5 Users (100maximum)

> Online user view command ftpwho
We can use the ftpwho command to clearly list the details of the currently connected users.
5.4.2 FTP shutdown file generation command ftpshut
We can use the ftpshut command to generate a shutdown.msg file set in / etc / ftpaccess for shutdown settings. The format of the ftpshut command is:

9) Ftpshut <-l min> <-d min> time <Description>

-l This parameter sets how many minutes before closing the FTP server function to stop the user's connection;
-d This parameter is set to close FTP How many minutes before the server function to disconnect the user connection;
time specifies the time to close the FTP server. For example, 6:20 points are written as 0620;

written by undercode
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Download files from ftp server via script any distro <? php by undercode :


/ **
* function name php_ftp_download
* function download file from ftp server
* entry parameter
* filename the name of the file to be downloaded, including the path
* /
function php_ftp_download ($ filename) {
$ phpftp_host = "ftplocalhost"; // server Address
$ phpftp_port = 21; // server port
$ phpftp_user = "name"; // username
$ phpftp_passwd = "passwrd"; // password
$ ftp_path = dirname ($ filename). "/"; // get path
$ select_file = basename ($ filename); // Get the file name

$ ftp = ftp_connect ($ phpftp_host, $ phpftp_port); // Connect to the ftp server
if ($ ftp) {
if (ftp_login ($ ftp, $ phpftp_user, $ phpftp_passwd)) { // Login
if (@ftp_chdir ($ ftp,$ ftp_path)) {// Enter the specified path
$ tmpfile = tempnam (getcwd (). "/", "temp"); // Create unique temporary file
if (ftp_get ($ ftp, $ tmpfile, $ select_file, FTP_BINARY)) {// Download the specified file to File
ftp_quit ($ ftp); // Close the connection
header ("Content-Type: application / octet-stream");
header ("Content-Disposition: attachment; filename =". $ Select_file);
readfile ($ tmpfile);
unlink ($ tmpfile); // delete temporary file
exit;
}
unlink ($ tmpfile);
}
}

written by undercode
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘Kernel technology-Error compiling kernel module tip :
t.me/undercodeTesting

> a simple LINUX KERNEL MODULE program and the following error occurred during compilation: / usr / include / linux /modversions.h:1:2: #error Modules should never use kernel-hea ders system headers, /usr/include/linux/modversions.h:2:2: #error but rather headers from an appropri ate kernel-source package

> . /usr/include/linux/modversions.h:3:2: #error Change -I / usr / src / linux / include (or similar) to /usr/include/linux/modversions.h:4:2: # error -I / lib / modules / $ (uname -r) / build / in clude /usr/include/linux/modversions.h:5:2: #error to build against the currently-runn ing kernel. 1. cp / boot / vmlinuz.version.h /usr/src/linux/include/linux/version.h 2. cp /boot/vmlinux.autoconf.h /usr/src/linux/include/linux/autoconf.h

written by undercode
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁



πŸ¦‘ a Summary of escape charactersIn writing bbs recently, I encountered a problem with transcoding. It took a long time to find a more complete solution, which can completely restore the original text php
fb.com/undercodeTesting


System: linux + php4 + oracle8i

<?
// --- title, name and other fields into the library processing (remove the leading and trailing spaces)
function trans_string_trim ($ str) {
$ str = trim ($ str);
$ str = eregi_replace ("'" , "" ", $ str);
$ str = stripslashes ($ str);
return $ str;
}

// --- article storage, namely textarea field;
function trans_string ($ str) {
$ str = eregi_replace (" '","' '",$ str);
$ str = stripslashes ($ str);
return $ str;
}

// --- displayed from the library in the form; in text to trans conversion, in textarea, no Conversion, display directly

//-display on WEB page, filter HTML code; including link address
function trans ($ string) {
$ string = htmlspecialchars ($ string);
$ string = ereg_replace (chr (10), "

$ string = ereg_replace (chr (32), "", $ string);
return $ string;
}

// --- displayed on the WEB page without filtering HTML code;
function trans_web ($ string) {
$ string = ereg_replace (chr ( 10), "
", $ string);
$ string = ereg_replace (chr (32), "", $ string);
return $ string;
}

// --- displayed on the WEB page, filter HTML code and head and tail spaces, mainly Used to display user nickname
function trans_trim ($ string) {
$ string = trim ($ string);
$ string = htmlspecialchars ($ string);
$ string = ereg_replace (chr (10), "
", $ string);
$ string = ereg_replace (chr (32), "", $ string);
return $ string;
}

// --- displayed in span;
function trans_span ($ string) {
$ string = ereg_replace (chr (10), "\ n", $ string);
$ string = ereg_replace (chr (32), "", $ string);
$ string = ereg_replace ('"'," "", $ string);
return $ string;
}

// --- display cookies on WEB, filter HTML
function trans_cookie ($ STR) {
$ STR = Trans ($ STR);
$ STR = stripslashes ($ STR);
$ STR = eregi_replace ( " ''", " '", $ STR);
return $ STR;
}
? >

written by undercode
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
πŸ¦‘those tutorial for hackers with little bit advanced
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘ PHP can also be used as Shell ScriptPHP :



1) popular. Recently, PHP (Personal Hypertext Preprocessor) seems to have become the most widely used web processing language on Linux / Unix in the past two years. Its convenience, powerful functions and OpenSource features make it gradually eroded to Traditional CGI and even the market of MicroSoft ASP (Active Server Page), almost all major websites recruit talents with PHP as a basic condition.

2) PHP does have this qualification and can be so
popular for the following reasons: PHP is OpenSource software, which is completely free and can be distributed freely, so it attracts a lot of people to use, and because of this, it attracts commercial companies to develop better. Engine and optimization software

3) PHP itself is very simple and easy to understand, simple command syntax, plus some basic object-oriented processing capabilities, so that novices are enough to learn in the shortest time.


4) PHP provides a lot of functions, including mathematical processing, string processing, network-related functions, various database support, image processing functions, and a large number of developers are developing various new functions for PHP. Sex is excellent.


5) PHP is very easy to combine with Apache. It is used as an Apache module. The installation is quite simple. Because Apache currently occupies 60% of the Web Server market worldwide, PHP naturally becomes the best match for Apache.


6) However, this time the topic to be addressed is not the application of PHP in web design, but the application of PHP in Shell Script. The commonly known Shell Script is about tcsh, bash, perl or python. I want Talking about using PHP as Shell Script.
πŸ¦‘ SO PHP CAN USED AS SHEL SCRIPTING LET S SEND AN EXAMPLE
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁

πŸ¦‘ Installation of PHP executable files :



1) Generally, PHP as a webpage processing language is compiled into Apache modules. Of course, it is not done here, so it is very simple to compile. Just perform the following actions as root:

> unlock php-3.0.xx. After tar.gz

> cd php

> configure

> make is

2) compiled, there is an executable file in the php directory, the file name is php, copy it to / usr / local / bin. Note that if the file is too large, you can use the strip command to remove unnecessary information in php mode, so that the file will be much smaller.

πŸ¦‘ The first program
begins to write our first PHP Shell Script program. This example prints "Hello world!":
#! / Usr / local / bin / php -q
<?
Echo "Hello, world!";
?>

1) Note that PHP was originally used in web applications, so it will send HTML HEADER by default, but here we are going to use PHP as Shell Script, "-q"

2) In this example, / usr / local / bin / php means to execute PHP under / usr / local / bin / because we just installed it there. The echo command prints out "Hello, world!", where the "" character is a newline character.

3) Note that after saving this program as a file, chmod must be made executable (chmod + x file name) before it can be executed.
Advanced use of I

4) Sometimes we need to send some parameters when the program is executed, such as the ls command, which can be added with the -l parameter. PHP Shell Script also supports this usage, with two special variables: $ argc records the number of parameters sent later, and the parameters stored in the $ argv [] array parameters are the contents of the parameters. For example, I now want to design a program that calculates the sum of two numbers:
#! / Usr / local / bin / php -q
<?
$ Sum = 0;
$ sum = $ sum + $ argv [1] + $ argv [2] ;
echo $ sum;
?>
Assuming this program is named sum.php3, execute sum.php3 1 2 Press enter and 3 will be printed.
If you want to calculate the sum of an unspecified number of parameters, then you have to use the special variable $ argc:
#! / Usr / local / bin / php -q
<?
$ Sum = 0;
for ($ t = 1; $ t <= $ argc; $ t ++)
$ sum = $ sum + $ argv [$ t];
echo $ sum;
?>
πŸ¦‘ Assuming this program is named bigsum.php3, execute bigsum.php3 1 2 3 4 5 Press enter to print out 15, execute bigsum.php3 1 2 3 4 5 6 Press enter Print out 21.

> Sometimes we need to input data during program execution, but PHP is originally used for web design, and the data input on the web page is naturally input by FORM, so this problem comes when PHP is used as Shell Script. In PHP, there is a function to open files, and under Linux / Uinx, input (input) can be done by opening a file. We want to open the device file / dev / stdin (stdin is Means standard input), the procedure is as follows:
#! / Usr / local / bin / php -q
<?
$ Fp = fopen ("/ dev / stdin", "r");
$ inputstr = fgets ($ fp, 100 );
fclose ($ fp);

echo "\ n ---------------------- \ n";
echo $ inputstr;
?>
where fgets ($ fp , 100) refers to the file from $ fp (that is, "/ dev / stdin" ) To read 100 bytes of data, the program will stop at this line and wait for our input. After we press enter, the program will print out the data we just entered.
Advanced Use II
Although it can already handle input, such a function is obviously too simple to cope with larger applications. For example, I need a function to remove HTML from a stream of data (data stream). To deal with the ability of input and output steering, we can first design the program as follows:
#! / Usr / local / bin / php -q
<?
$ Fp = fopen ("/ dev / stdin", "r");

while (! Feof ( $ fp)) {
$ c = fgetc ($ fp);
$ inputstr = $ inputstr. $ c;
};

fclose ($ fp);

echo $ inputstr;
?>
Assuming this program is named filt.php3, if you directly When this program is executed, it will wait for you to enter it until you press Ctrl + D to print your input data. We can execute it like this :
more filt.php3 | filt.php3
This method is to filt The .php3 program is shown with more and turned to the filt.php3 program. The filt.php3 will continue to receive data (in fact, the filt.php3 program code itself), and finally print it out.
We can add HTML filtering to it:
#! / Usr / local / bin / php -q
<?
$ Fp = fopen ("/ dev / stdin", "

while (! feof ($ fp)) {
$ c = fgetc ($ fp);
$ inputstr = $ inputstr. $ c;
};

fclose ($ fp);

$ inputstr = ereg_replace ("<([^ <>] * )> "," ", $ inputstr);

echo $ inputstr;
?>
πŸ¦‘ Assuming that this program is named filt2.php3, so that the filtering function is completed, do n’t believe it, please take an HTML file to try:
more xxx.html | filt2.php3
You will see the deleted HTML TAG file.

πŸ¦‘ SO PHP CAN USED AS SHELL HACKING SCRIPTING ?


> PHP used as Shell Script is actually quite easy to use, because PHP itself is very easy to learn, and it supports a variety of databases, after you have often used PHP to design your website, absolutely do not like to use other Shell Script language to deal with other parts that must be non-web pages. At this time, the benefits of using PHP as Shell Script will be revealed. You can develop the entire system in a consistent manner without having to use PHP and then use it. Perl / Python or C.

> The domestic PHP atmosphere is already very prosperous. LinuxFab on this site has been developed entirely with PHP and MySQL. In fact, there are many magical uses of PHP. There are opportunities to introduce it in the future. If readers need information about PHP, welcome to this site Participate in more discussions on the PHP forum.
& nbs

written by undercode
▁ β–‚ β–„ ο½•π•Ÿπ”»β’Ίπ«Δ†π”¬π““β“” β–„ β–‚ ▁
πŸ¦‘ ANY DOUBT FEEL FREE TO ASK @UNDERCODE_Testing