wordpress post.php blank page: ’sploit!
July 29, 2008 on 8:38 am | In tech stoof | No Commentsin the past week or so, there have been a rash of wordpress ’sploits. i’m writing this up in the interest of saving ’sploitees some recovery time and headaches. i believe all of the exploited blogs were running downrev versions (2.6 is current as of this writing) at the time of exploit.
symptoms include:
- posts go blank or are truncated to random, short-ish lengths (4-5 sentences)
- edit.php returns a blank page on save
- post.php returns a blank page on save/publish
- preview.php returns a blank page
- plugins.php returns a blank page
- theme editor returns a blank page
in this particular sploit, the hackers were able to open a shell through PHP, and use it to find directories on the filesystem which were writable by the (unprivileged) webserver user. they uploaded a set of scripts that attempted to append each valid blog post with pharmaceutical spam, with a keyword of the hackers’ choosing. had everything worked, this would go unnoticed by end users. everything didn’t work.
to find out if this is the case for you, add the following to your wp-config.php:
define(’WP_DEBUG’,true);
if you then load your blog and get a PHP warning/notice about undefined variables, etc, it should barf out the filename of a rogue PHP script, likely to be outside the top-level directory of your blog.
to recover, one would optimally restore from a pre-hack SQL dump. if that isn’t possible or too much data would be lost, perform the following steps:
- back up your database. even if it’s hacked:
$ mysqldump –opt -Q -u user -p -h mysql.hostname dbname > wordpress-yyyymmdd.sql - upgrade to the current wordpress though as of this writing there are still upgrade issues with 2.6. 2.5.1 should suffice.
- back up the wp_options table: (wp_settings i think in earlier WP versions)
$ mysqldump –opt -Q -u user -p -h mysql.hostname dbname wp_options > wp_options.hacked.yyyymmdd.sql - copy the table dump:
$ cp wp_options.hacked.yyyymmdd.sql wp_options.fixed.yyyymmdd.sql - edit the copy in your favorite text editor. you’re looking for the line like:(103,0,’active_plugins’,'a:3:{i:0;s:23:\”../../../video/buzz.php\”;i:1;s:19:\”akismet/akismet.php\”;i:2;s:14:\”lr2Spam.03.php\”;}’,'yes’)in this case, the first entry between brackets is the rogue script. remove it:
(103,0,’active_plugins’,'a:3:{i:1;s:19:\”akismet/akismet.php\”;i:2;s:14:\”lr2Spam.03.php\”;}’,'yes’)
- import the corrected table:
$ mysql -u user -p -h mysql.hostname dbname < wp_options.fixed.yyyymmdd.sql - remove the rogue scripts and/or make them unreadable.
- test test test. removing the call to the rogue script fixed us up. i hope it fixes yours, too.
installing eprints 3.1 on fedora core 9
July 7, 2008 on 2:26 pm | In ramblings | No Commentsthis morning i started playing with eprints to evaluate how well it could get along in our shared environment, behind our load balancer. eprints tries to take over whatever hostname you give it in the apache settings, to it will require at least its own virtual host per install, and i’m not sure how its required indexing service will fare behind our load balancer.
in setting up eprints-3.1.0-rc2 on my rather vanilla fedora 9 box, i found a few steps missing from the fedora 7 documentation at wiki.eprints.org. i know, i should update the wiki page for FC9, but i don’t know them like that, and to make things worse, i’m lazy. so, here are my augmented instructions.
commands are assumed to be run as root as are the instructions on eprints’ wiki, though i did everything with sudo. the below instructions also assume that you have a mysql server installed somewhere, that you know its root password, and that said mysql-server will allow root connections from the host used for the eprints installation - if you’re doing this on a stand-alone box, localhost will do nicely. commands that didn’t need to be run on my stock fedora box are in green to denote them as optional. well, i hope they’re in green; i’m colorblind. finally, i’m installing beneath /var/www/html/eprints3 instead of the default /opt/eprints3.
- yum install gdome2 gdome2-devel (not on FC9 by default)
- yum install tetex-latex ImageMagick (already on FC9 by default)
- yum install antiword (not on FC9 by default)
- yum install xpdf (not on FC9 by default)
- yum install perl-Unicode-String perl-MIME-Lite perl-XML-LibXML perl-XML-Parser (not on FC9 by default)
- yum install perl-CPAN (not on FC9 by default!?!?!?!?)
- cpan Term::ReadKey
- Install XML::GDOME from source (not on FC9 by default)
- useradd -M -d /var/www/html/eprints3 -s /sbin/nologin eprints
- usermod -a -G eprints apache
- download and untar eprints source
- ./configure –with-smtp-server=localhost
- ./install.pl (i edited this to install in /var/www/html/eprints3 instead of /opt/eprints3)
- /var/www/html/bin/generate_apacheconf (missing from instructions)
- echo “Include /var/www/html/eprints3/cfg/apache.conf > /etc/httpd/conf.d/eprints3.conf”
- ln -s /var/www/html/eprints3/bin/epindexer /etc/init.d/epindexer
- /sbin/chkconfig –add epindexer (missing from instructions)
- /sbin/chkconfig –level 345 epindexer on (missing from instructions)
- /etc/init.d/epindexer start
- su -s /bin/sh eprints
- cd /var/www/html/eprints3
- bin/epadmin create
- /etc/init.d/httpd configtest (’cause I’m like that)
- /etc/init.d/httpd restart (if configtest returns OK)
- browse to your installation’s URL(hostname) and have fun!
php-5.2.6 on rhel4
June 26, 2008 on 8:36 pm | In ramblings | No Commentsbuilding php-5.2.6 to our specifications on rhel4 gave me a little trouble, so i thought i’d write up the process here.
build environment: vanilla rhel 4.4/i386 install. httpd-2.0.52, apr- and apr-util-0.9.4.
prerequisites: most of the install- and build requirements are included in rhel, except for pcre and pcre-devel. i grabbed the pcre-7.3 src.rpm from our fedora mirror, compiled and installed.
the mysql AB client gave us some surprises. it installs its own, bundled version of zlib among other things, and i found that php-5.2.6 won’t (for me, anyway) install against the mysql-5.0.51a client or the mysql-5.0.45 client. i had planned on updating the mysql client installs on our web nodes, but i wound up dropping my build box back to mysql-5.0.27. voila, function ‘adler32′ not supported’ errors all gone!
build: i grabbed the php-5.2.6 src rpm from our fedora mirror and installed it.
here is a link to the .spec file i used. i basically commented out the packages not offered under rhel4 (libmcrypt, mhash, libtidy) and the packages we won’t need (mssql, freetds).
i had been working as an unprivileged user privileged with sudo, but php-5.2.6 won’t compile for gcc3, so i was lazy, su’ed, exported CC=gcc4, and continued on as root:
$ rpmbuild -bp /usr/src/redhat/SPECS/php.spec
(satisfy dependencies here)
$ rpmbuild -ba –target=i686 /usr/src/redhat/SPECS/php.spec
i recommend comparing the stock 5.2.6 php.ini against your current php.ini, as there are some new stanzas, some removed, etc. of note is the new allow_url_include directive, which is not in the php.ini file, and defaults to off. this means that any include() statements that attempt to load a url will instead throw an error. we researched this for a bit and discussed the pros and cons of leaving allow_url_include’s set to its default of off versus the disruption it would cause in our contributors’ sites. we decided to leave it off globally, but allow it, per-directory, by request.
in discovering allow_url_include we viewed many of our contributors’ sites today under 5.2.6, and generally found that wordpress, mediawiki, and other software packages that adhere to ‘best practices’ were fine, while older, home-rolled php scripts threw some errors.
work for UNC? here’s how to view your paystub.
June 6, 2008 on 7:47 am | In ramblings, tech stoof | 1 CommentUNC recently stopped sending out paper paystubs, a move which my inner environmentally conscious earth child wholly supports. however, the paystub notification e-mails from finance decline to include a link to the electronic paystubs for security reasons. my co-worker became quite grouchy whilst trying to find his paystub this morning. so, as a service to the UNC community, i am posting instructions for viewing one’s paystub should one work for UNC.
- browse to http://my.unc.edu and login with your OnYEN
- staff: click on the ’staff’ tab. others: i hope you have a tab!
- click ‘See your paystub’, then allow pop-ups and click it again.
- log in with your OnYEN again. welcome to the Payroll Services Pay Stub Application.
- choose a pay period, and click ‘Display Pay Stub’
- allow pop-ups and click ‘Display Pay Stub’ again. whistles will toot and gears will whir, and if you’re running Windows, your browser will present your paystub. if you’re not running Windows, your browser will present a file called ‘displayPayStub.do’ and ask what to do with it.
- save ‘displayPayStub.do’ and rename it to something like paystub-yyyymmdd, changing the extension to ‘.pdf’ so that your computer will know how to open it. my co-worker did a Google search for ‘.do extension’ but Google tried to sell him weave. honest.
best of luck!
microsoft acquires macy’s
April 1, 2008 on 8:46 am | In organ | No Commentsfrom piporg-l:
Sources at Microsoft have confirmed that the corporate giant has
acquired the Macy’s Department Store chain. Bill Gates, Microsoft’s
founder and CEO, has expressed particular interest in the company’s
large Philadelphia store, home to the largest playing pipe organ in the
world. When asked about the organ, Gates reportedly said, “I love organ
music, but that thing wastes an enormous amount of valuable space. I
believe it can be replaced by a Windows-operated modern music system,
and the space now occupied by what amounts to a warehouse of old
plumbing can be used to house a server farm. Customers won’t know the difference.”
the 3rd pipe organ-related april fool’s joke i’ve seen in 12 hours.
Fred Phelp’s Westboro Baptist to protest Eve Carson’s memorial service
March 17, 2008 on 8:38 am | In rants | No CommentsThe University gave them permission to protest in McCorckle place, while the memorial will be at the Dean Dome. Note that their flier advertises the protest location will be at the Dean Dome.
From their promotional flyer:
“God Hates American Colleges.
They are filthy, anti-God, arrogant,
debauched, decadent & depraved.
This victim was student body pres.
We will picket Eve Carson’s
memorial Tue., Mar. 18, ~:30 p.m.
Yes. In religious protest and warning; to wit:
“Be not deceived; God is not mocked.” Gal.
6:7. God Hates Fags! & Fag-Enablers. Ergo,
God hates N. Carolina Univ. It is a cesspool of
iniquity - throughout; top to bottom - staff,
administration, faculty, alumni, student body.
There is no fear of God before their eyes, and
hence they are irreversibly doomed. American
universities are God-defying, Satanic, and vile.”
more of their rabid vomit at http://www.godhatesfags.com/written/fliers/20080311_eve-carson-memorial.pdf
garfield minus garfield
March 6, 2008 on 9:35 am | In ramblings | No Commentsa favorite link from this week’s popbitch:
“Who would have guessed that when you remove Garfield from the Garfield comic strips, the result is an even better comic about schizophrenia, bipolor disorder, and the empty desperation of modern life? Friends, meet Jon Arbuckle. Let’s laugh and learn with him on a journey deep into the tortured mind of an isolated young everyman as he fights a losing battle against lonliness in a quiet American suburb.”
San Francisco, March 1st and 2nd 2008
March 2, 2008 on 10:08 pm | In wanderings | No CommentsNot much happened on the 1st. I woke up earlier than my friends did, Luc went home and Laura accompanied me to a breakfast diner around the corner. I shopped around the upper Haight for a bit, found an excellent embroidered dress shirt, a really cool electronic/ambient double CD in an Asian imports store containing some of the most beautiful and most expensive items I’ve seen for sale, and came back in less than two hours, cold, tired and with a sore throat.
Today I hit the ground running. I checked in at work, grabbed some coffee, and hit the F line to head back up Market. I hopped off to walk a few blocks over to a beautiful Catholic church, but it was fenced in and boarded up
I got back on the F, switched to a cable car at Powell, and wandered around Union Square for a while.
I wound up at Grace Cathedral an hour early, and was greeted on the steps by Michael Gefty, the “indecent docent” of Grace Cathedral. We talked music and travels and church for a while, and I headed in for Holy Eucharist. Did you know that the small, easily passed door in the Narthex leads to a stairwell to the basement? And that instead of having a crypt, Grace Cathedral has a gymnasium, conference center, coffee shop, gift shop, and much more beneath the footprint of the building?
Dean Jones gave an excellent sermon as usual, centering on themes of light and darkness, self worth and priorities. All things I’ve wrestled with personally and recently. I’ve always felt uncomfortable taking communion because all through my childhood people told me I’m a bad person and I took it to heart, so to receive the Host in such a phenomenal setting, from the woman who lead the prayers, brought me to tears during the service.
After the service I rejoined Michael for a fascinating tour of the Cathedral. Paintings I had walked by many times were actually gilt. The silver was platinum, the blue color lapis latchuli. Each item on display in the cathedral had some significance making each a treasured work of art - and so easily passed by the casual visitor! A carved eagle lecturn in the apse is the only carved wooden work by Mount Rushmore sculptor Gutzon Borglum. Somehow I missed the ikon of Dr. Martin Luther King, Jr. A relief portait of the Madonna and Child I had seen, but Michael related an anecdote: they usually don’t let people touch the works, but a blind woman did so. She remarked to her husband: “Dear, isn’t it something how the angel on the left is smiling much more broadly than the one on the right?” I had to take a flash picture of the work and examine it on my camera to even SEE the angels in the background!
Now Michael revealed his having earned the name of indecent docent. One of the murals featured Sir Francis Drake among indiginous natives. Michael explained how the artist used Chinese and Hispanic models for the natives, then pointed out that his partner was Peruvian.
“The Chinese have a saying - that there are three sides to every story. My side, your side, and the honorable side. So with a Peruvian partner, understanding how the artist could feature this son of a bitch in a church is beyond me. We call them Conquistadors, but they destroyed entire civilizations and sent entire cultures down the drain. They robbed, they raped, they sunk the Spanish navy, hell, that’s what the Queen paid him to do, and we reward the bastard for it by featuring him in a mural!”
That’s as close to verbatim as I can remember properly. I had snuck away from the tour to watch Christoph Tietze practice for his 4pm organ recital, so I missed his rant on the Church’s misogeny but I’ve heard many of these rants before. Where would we be without women. Magdalane bankrolled Jesus and the disciples. So why do we still commonly accept the bullshit notion that she was a prostitute? I could listen to Michael go on all day
I attended Choral Evensong at 3, Christoph Tietze’s organ recital at 4, and was back in my Bed and Breakfast by 6. I was planning on taking MUNI back up to Masonic and Fell to try out Hukilau, but frankly the menu didn’t look that interesting (I wanted poi and ‘ava ‘ava but they serve burgers and chicken sandwiches. Coconut pudding isn’t enough to drag me up there) so when Dion offered to cook me dinner right in the Bed n Breakfast, I took him up on it. We’re going food shopping in a bit, but he won’t let me help clean the kitchen to speed things along. I may walk around the street a bit, but I’m definitely taking things easy tonight. Tomorrow will be a long day of sitting on a plane doing nothing! I have yet to understand why that takes it out of me so.
San Francisco, February 29th 2008
March 1, 2008 on 7:59 pm | In wanderings | No CommentsI got up *very* early to be sure I’d be on time for the OpenLibrary meeting at the Presidio. Not as early as the patrons at the Mix bar next to my Bed and Breakfast - which opens daily at 6:00 a.m. The conference was wonderful as I expected, I was in over my head and couldn’t have been happier. I took 53KB worth of notes for my boss (all text!) and got some great group shots when the conference was over.
My friend Laura drove up for the evening, and craziness ensued. She made new friends, I made new friends, and she actually wound up crashing on the couch in the parlor of my Bed and Breakfast. whoops!
San Francisco, February 28th 2008
March 1, 2008 on 7:47 pm | In wanderings | No CommentsThursday was a wonderful day to be in San Francisco! The weather was warm and sunny, I got off to an early start, and I saw most of the areas of the city that I wanted to see before Choral Evensong at Grace Cathedral. I actually went to Grace Cathedral first, then to St. Mary’s to see the Ruffatti, and in following my nose towards a great dome that I thought would be a basilica (City Hall) I stumbled upon the San Francisco Asian Art Museum.
The Asian Art Museum was simply amazing. Floor after floor and room after room of jade carvings, ornate weapons, embroidered robes, carved gods and goddesses, fine furniture, and more from China, Japan, Indonesia, Tibet, Thailand, and India. My jaw dropped many times at the sheer beauty of the collections, and I filled my camera’s 1GB SD card by the time I left.
In the afternoon I headed down to Chinatown looking for street food, then on to Little Italy and North Beach. Along the way I stopped in several churches and ran across L’Osteria del Forno, which advertised pumpkin ravioli, but only on Fridays and Saturdays. I walked on to the Marina district and headed back up Van Ness, on track for 5:15 evensong at Grace Cathedral.
Evensong was amazing as always. It’s webcast - listen for some poor gentleman’s hearing aid going crazy during the improvised prelude. The sun went down during evensong and I nearly froze waiting for the bus afterwards. Standing in a hoodie and shorts on top of Nob Hill in February! Evensong lasted longer than I had anticipated, otherwise I would have been in fine shape.
I turned in early to get my rest for the OpenLibrary conference the next day. After a day of traipsing all over the city, not even the noise from the bar next door could keep me from sleep.
Powered by WordPress with Pool theme design by Borja Fernandez.
Entries and comments feeds.
Valid XHTML and CSS. ^Top^