Category Archives: Linux

Linux

Weird rectangles on all google sites

Leave a comment

This morning, suddenly I started to see weird rectangles on all google sites I was using, such as gmail, google calendar…etc

Even worse, this was happening on all browsers. Then I tried some other computers, even my mobile phone… All was showing these weird characters instead of icons.

Some pictures below

I wrote to google support about this but nobody replied after 9 hours. So I got crazy and decided to try something else.

I suddenly realized that I am using PIHOLE in my home and that might block some urls. And those URLs might include site specific fonts.

So I changed my DNS address in my NetworkManager settings to 8.8.8.8 instead of Pihole and voila! Issue fixed.

Then I deep dive into pihole logs, and tried to find what is causing this issue. In the Pihole logs, I found that fonts.gstatic.com is blocked. So I added it to whitelist and voila ! Issue fixed.

I am writing this here so that some other people may benefit from it.

Linux

Setting up Wake On Lan on ASROCK Mainboard with Ubuntu

Leave a comment

I recently bought an Asrock B550M-HDV mainboard with onboard Realtek RTL8111H ethernet chip.

In order to setup Wake On Lan we need to do two things:

Changes in the UEFI BIOS:

Changes in Ubuntu:

sudo nmcli connection modify OB-Ethernet 802-3-ethernet.wake-on-lan magic

sudo ethtool -s enp3s0 wol g

But sadly, these are not enough despite of all documentation!!!

When I setup everything like this, wake-on-lan doesn’t work. By the way, I tried to run etherwake but it is not sending packets. I succeeded by using wakeonlan tool and checked if I am receiving packets correctly:

From another linux computer, I send :

wakeonlan a8:a1:59:51:75:63

And from the ASrock PC to be waken up, I run:

sudo ngrep '\xff{6}(.{6})\1{15}' -x port 9

When I send it, it receive some hexadecimal bytes, so I am sure that my another linux computer is sending packet to my ASrock PC correctly.

Next, I checked for LINK LED on my mainboard for Ethernet. Sadly, when the system is powered off, I was expecting that LINK LED to stay ON. This turned out to be a misleading conclusion, see next.

I tried my best to find the reason for about 1 hour. And hen I gave up, and send an email to ASrock. As typical, they replied me by giving instructions for Windows ! Even some of their instructions were totally off the target: Their instruction were telling me to enable some setting in the UEFI BIOS which does not exist on P1.90 firmware of B550M-HDV !

So I deep dive more and more, and after 45 minutes of searching, I found this: https://bbs.archlinux.org/viewtopic.php?id=243461

So I decided to give a try:

echo "NETDOWN=no" | sudo tee /etc/default/halt

Then I powered off my PC. And voila ! It worked.

I checked LINK LED when my PC was powered down, and it was OFF still ! But even in that case, when I send the magic packet, system powers ON, and Link LED turns ON after a while.

Quite weird. But thanks to Arch forums, I have been able to solve this issue. I hope this helps to some other people who are experiencing same issue.

Note: Arch wiki and forums suggest using r8168 driver with s5wol=1 as parameter, but my kernel did not had this driver ( either built-in or as a loadable module ); so I couldn’t try that.

Linux

SSH attack to my server

10 Comments

Today I realised that my home server ( ubuntu 16.04 x86 ) was compromised via ssh, and the attacker got root access.

He put followings on my root crontab:

root@d:~# crontab -l
5 8 * * 0 /root/.configrc/a/upd>/dev/null 2>&1
@reboot /root/.configrc/a/upd>/dev/null 2>&1
5 8 * * 0 /root/.configrc/b/sync>/dev/null 2>&1
@reboot /root/.configrc/b/sync>/dev/null 2>&1
0 0 */3 * * /tmp/.X25-unix/.rsync/c/aptitude>/dev/null 2>&1
root@d:~#


root@d:~# tree -C .configrc/
.configrc/
├── a
│   ├── a
│   ├── bash.pid
│   ├── dir.dir
│   ├── init0
│   ├── kswapd0
│   ├── run
│   ├── stop
│   └── upd
├── b
│   ├── a
│   ├── dir.dir
│   ├── run
│   ├── stop
│   └── sync
├── cron.d
└── dir2.dir

2 directories, 15 files
root@d:~#

Didn’t analyse yet, but looks like crontab runs above files, and add his ssh key to authorized_keys, and runs kswapd.

Please beware !!!

Linux

Armbian Build Virtual Machine

Leave a comment

Here is the link to download from mega.nz:

https://mega.nz/#!H4tyDDoI!lmm94APj7YEMLqCxDMI4wrmed0tCTBwEgtYAGfedvLg

 

This is XUBUNTU 16.04.1 64bit VirtualBox VDI image file.

  1. Login automatically as root.
  2. root password is 1234
  3. Virtualbox addons are installed.
  4. Armbian build directory is in /root/ARMBIAN
  5. terminator is installed, and hotkey is CTRL+SHIFT+K
  6. This image is zipped, its size is around 7Gbyte. You must unzip it. When extracted, it is around 30Gbyte VDI file.
Linux

Use arp-scan to find devices in your local network

Leave a comment

arp-scan is an extremely useful tool to find devices connected to your local area network.
For installation, just use apt-get install arp-scan
and then, run as root:

root@i3-c753 ~ # arp-scan -l
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 65536 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.0.160 00:0b:82:6f:6a:92 Grandstream Networks, Inc.
192.168.1.1 00:90:27:ed:9d:c1 INTEL CORPORATION
192.168.1.5 00:0b:82:68:65:69 Grandstream Networks, Inc.
192.168.1.4 5c:8a:38:5c:63:8f (Unknown)
192.168.1.7 f0:92:1c:65:76:d1 (Unknown)
192.168.1.8 f8:b1:56:ac:16:03 (Unknown)
192.168.1.12 90:1b:0e:08:c7:9e (Unknown)
192.168.1.17 00:0b:82:6f:66:d6 Grandstream Networks, Inc.
192.168.1.23 ec:a8:6b:ae:64:56 (Unknown)
192.168.1.31 00:04:a3:e6:c2:9c Microchip Technology, Inc.
192.168.1.38 00:14:53:b5:bc:db ADVANTECH TECHNOLOGIES CO.,LTD

Very fast, right? Unfortunately, as you noticed, some MAC addresses are displayed as “(unknown)” because default MAC database lookup table is not updated in default installation.
For this issue, authors of arp-scan gave us a very beautiful python script: “get-oui”
Here is how we can update the database (The server is slow, pls wait a few mins):

root@i3-c753 ~ # get-oui
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
root@i3-c753 ~ # ll ieee-oui.txt
-rw-r--r-- 1 root root 667448 May 29 23:35 ieee-oui.txt
root@i3-c753 ~ # cp ieee-oui.txt /usr/share/arp-scan/
ieee-iab.txt ieee-oui.txt mac-vendor.txt
root@i3-c753 ~ # cp ieee-oui.txt /usr/share/arp-scan/
root@i3-c753 ~ #

After that here is the result:

root@i3-c753 ~ # arp-scan -l
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 65536 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.1 00:90:27:ed:9d:c1 Intel Corporation
192.168.1.5 00:0b:82:68:65:69 Grandstream Networks, Inc.
192.168.1.4 5c:8a:38:5c:63:8f Hewlett Packard
192.168.1.7 f0:92:1c:65:76:d1 Hewlett Packard
192.168.1.8 f8:b1:56:ac:16:03 Dell Inc.
192.168.1.12 90:1b:0e:08:c7:9e Fujitsu Technology Solutions GmbH
192.168.1.17 00:0b:82:6f:66:d6 Grandstream Networks, Inc.
192.168.1.23 ec:a8:6b:ae:64:56 Elitegroup Computer Systems Co.,Ltd.
192.168.1.31 00:04:a3:e6:c2:9c Microchip Technology Inc.
192.168.1.38 00:14:53:b5:bc:db ADVANTECH TECHNOLOGIES CO.,LTD

As a final small note, if you want to find the Vendor of an unknown MAC address, you can use my small script:

cat /usr/bin/macfind.sh
#!/bin/bash

curl --data-urlencode "mac=$1" http://api.macvendors.com/

Linux

ZTE H168N Reboot remotely using expect script

Leave a comment

My ZTE H168N ADSL/VDSL modem has telnet server on it.

Sometimes, I need to reboot it. But it need to go there, and press its ON/OFF switch… takes time.

In order to reboot it remotely over telnet, there are some steps need to be followed.

To achieve this goal, I wrote a very simple expect script. First, you must install expect. I use Linux Mint, but I saw expect has windows port too 🙂

For linux: sudo apt-get install expect

And write this script:

#!/usr/bin/expect
spawn telnet 192.168.2.1
expect “Username:”
send “admin\r”
expect “Password:”
send “ttnet\r”
expect “>”
send “enable\r”
expect “Password:”
send “zte\r”
expect “#”
send “shell\r”
expect “Login:”
send “root\r”
expect “Password:”
send “root\r”
expect “#”
send “reboot\r”
expect “#”
sleep 5

After you execute, your H168 will reboot in 10 seconds, voila !