Contact Me

kxj@hotmail.com

QQ: 4169996

Build Snort

All Binaries will be installed to /data

export INCLUDE_PATH=/data/include

export LD_LIBRARY_PATH=/data/lib

libpcap:
./configure --prefix=/data/
make

DAQ:
./configure --prefix=/data/ --with-libpcap-includes=/data/include --with-libpcap-libraries=/data/lib
make

Snort:
./configure --prefix=/data/ --with-daq-includes=/data/include --with-daq-libraries=/data/lib --with-libpcre-includes=/data/include --with-libpcre-libraries=/data/lib --with-libpcap-includes=/data/include --with-libpcap-libraries=/data/lib --disable-static-daq
make

Online Malware Analysis

Reverse String and Sentence

#include <stdio.h>
#include <string.h>

#define SPACE 32

//===================================

void SwapInPlace(char * a, char * b){
    if ( *a != *b ){
        *a = *a ^ *b;
        *b = *a ^ *b;
        *a = *a ^ *b;
    }
}

void ReverseInPlace(char* src){
    size_t len, i, m, n;

    len = strlen(src);
    for ( i=0 ; i < len ; ++i ){
        if ( *(src+i) == SPACE )        {
            for ( m=0 ; m <= i-1 ; ++m ){
                for ( n=0 ; n < len-1 ; ++n ){
                    SwapInPlace(src+n, src+(len+n+1)%len);
                }
            }
            len -= i;
            for ( n=0 ; n < len-1 ; ++n )            {
                SwapInPlace(src+n, src+(len+n+1)%len);
            }
            len--;
            i = -1;
        }
    }
}

void ReverseInPlace2(char* src)
{
    size_t i, j, start;
    size_t len = strlen(src);
    for ( i=0 ; i < len/2 ; ++i )
    {
        SwapInPlace(src+i, src+len-1-i);
    }
    start = 0;
    for ( i=0 ; i < len ; ++i )
    {
        if ( *(src+i) == SPACE || i == len-1 )
        {
            if ( i== len-1 ) i++;
            for ( j=0 ; j < (i-start)/2 ; ++j )
            {
                SwapInPlace(src+start+j, src+i-1-j);
            }
            start = i+1;
        }
    }
}
//===================================

void Reverse(char *pBegin, char *pEnd){
    char temp ;

    if(pBegin == NULL || pEnd == NULL) return;

    while(pBegin < pEnd){
        temp = *pBegin;
        *pBegin = *pEnd;
        *pEnd = temp;

        pBegin ++, pEnd --;
    }
}

char* ReverseSentence(char *pData){
    char *pBegin, *pEnd;

    if(pData == NULL) return NULL;

    pBegin = pData;
    pEnd = pData;

    while(*pEnd != '\0')
        pEnd ++;
    pEnd--;

    Reverse(pBegin, pEnd);    // Reverse the whole sentence


    // Reverse every word in the sentence

    pBegin = pEnd = pData;
    while(*pBegin != '\0'){
        if(*pBegin == ' '){
             pBegin ++;
             pEnd ++;
             continue;
        }
        // A word is between with pBegin and pEnd, reverse it

        else if(*pEnd == ' ' || *pEnd == '\0')        {
             Reverse(pBegin, --pEnd);
             pBegin = ++pEnd;
        }
        else{
             pEnd ++;
        }
    }

    return pData;
}
//===================================

void reverse(char *str){
    char tmp;
    int len, i, j;

    len = strlen(str);
    for(i = 0, j = len-1; i < len/2; i++, j--) {
     tmp = str[i];
     str[i] = str[j];
     str[j] = tmp;
    }
}

void composeStrFromArray(const char* str, const unsigned from, const unsigned to, char* tmp){
    const char *i = str+from;
    unsigned j = 0;

    for(; i <= str+to; i++, j++ ){
        tmp[j] = *i;
    }
    tmp[j] = '\0';
}

void printi(const char* str, const unsigned from, const unsigned to){
    unsigned i;
    for(i = from; i <= to; i++ ){
        printf("%c", str[i]);
    }
    printf("\n");
}

void reverseSentence(const char* str, char* tmp){
    unsigned i, sI;
    unsigned notPrinted = 1;    //boolean, not print the word

    char ttt[100] = {'\0'};    

    for(i = 0, sI = 0; i <= strlen(str); i++){
        if( str[i] == ' ' || str[i] == '\t' || str[i] == '\0' ){
            if(! notPrinted) continue;

            composeStrFromArray(str, sI, i-1, ttt);
            reverse(ttt);
            strcat(tmp, ttt);
            
            if(str[i] != '\0')
                strcat(tmp, " ");

            printf("%i %i -> ", sI, i-1);
            printi(str, sI, i-1);
            notPrinted = 0;
        }            
        else{
            if(! notPrinted) {
                sI = i;
                notPrinted = 1;
            }
        }
    }
}

void main(){
    char str[100] = {'\0'};
    char tmp[100] = {'\0'};
    char ttt[100] = {'\0'};
    char a, b;
    int n[] = {1,2,3,4,5};

    gets(str);
    strcpy(tmp, str);
    strcpy(ttt, str);
    printf("original string: %s\n", str);

    //my test

    reverse(str);
    printf("reversed string: %s\n\n", str);

    tmp[0] = '\0';
    reverseSentence(str, tmp);
    printf("reversed words: %s ->length: %i\n\n", tmp, strlen(tmp));

    //sample code 1

    ReverseSentence(tmp);
    printf("Reversed words: %s\n\n", tmp);

    //sample code 2

    printf("SRC: %s\r\n", ttt);
    ReverseInPlace(ttt);
    printf("DES: %s\r\n", ttt);
    ReverseInPlace2(ttt);
    printf("SRC: %s\n\n", ttt);

    // << multiple 2 and >> divide 2

    printf("shift left << %d\n", 9 << 1 );
    printf("shift right << %d\n", 9 >> 1 );

    a = 'a';
    b = 'b';
    SwapInPlace(&a, &b);
    printf("use XOR to swap a b : %c %c\n\n", a, b);
}

Online Tools

http://hilite.me	Online Source Code Formatting
http://pixlr.com/editor	Online Picture Editor
http://www.iconspedia.com	ICON
RegexPalRegexPal	A JavaScript RegEx Tester

SMTP Status Codes

See rfc2821 for the basic specification of SMTP; see also rfc1123 for important additional information.
See rfc1893 and rfc2034 for information about enhanced status codes.
Check the RFC index for further mail-related RFCs.

Reply codes in numerical order

Code	Meaning
200	(nonstandard success response, see rfc876)
211	System status, or system help reply
214	Help message
220	<domain> Service ready
221	<domain> Service closing transmission channel
250	Requested mail action okay, completed
251	User not local; will forward to <forward-path>
354	Start mail input; end with <CRLF>.<CRLF>
421	<domain> Service not available, closing transmission channel
450	Requested mail action not taken: mailbox unavailable
451	Requested action aborted: local error in processing
452	Requested action not taken: insufficient system storage
500	Syntax error, command unrecognised
501	Syntax error in parameters or arguments
502	Command not implemented
503	Bad sequence of commands
504	Command parameter not implemented
521	<domain> does not accept mail (see rfc1846)
530	Access denied (???a Sendmailism)
550	Requested action not taken: mailbox unavailable
551	User not local; please try <forward-path>
552	Requested mail action aborted: exceeded storage allocation
553	Requested action not taken: mailbox name not allowed
554	Transaction failed

Reply codes grouped by command

Command	Code	Description
connect
	220	<domain> Service ready
	421	<domain> Service not available, closing transmission channel
HELO
	250	Requested mail action okay, completed
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	504	Command parameter not implemented
	521	<domain> does not accept mail [rfc1846]
	421	<domain> Service not available, closing transmission channel
EHLO
	250	Requested mail action okay, completed
	550	Not implemented
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	504	Command parameter not implemented
	421	<domain> Service not available, closing transmission channel
MAIL
	250	Requested mail action okay, completed
	552	Requested mail action aborted: exceeded storage allocation
	451	Requested action aborted: local error in processing
	452	Requested action not taken: insufficient system storage
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	421	<domain> Service not available, closing transmission channel
RCPT
	250	Requested mail action okay, completed
	251	User not local; will forward to <forward-path>
	550	Requested action not taken: mailbox unavailable
	551	User not local; please try <forward-path>
	552	Requested mail action aborted: exceeded storage allocation
	553	Requested action not taken: mailbox name not allowed
	450	Requested mail action not taken: mailbox unavailable
	451	Requested action aborted: local error in processing
	452	Requested action not taken: insufficient system storage
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	503	Bad sequence of commands
	521	<domain> does not accept mail [rfc1846]
	421	<domain> Service not available, closing transmission channel
DATA
	354	Start mail input; end with <CRLF>.<CRLF>
	451	Requested action aborted: local error in processing
	554	Transaction failed
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	503	Bad sequence of commands
	421	<domain> Service not available, closing transmission channel
received data
	250	Requested mail action okay, completed
	552	Requested mail action aborted: exceeded storage allocation
	554	Transaction failed
	451	Requested action aborted: local error in processing
	452	Requested action not taken: insufficient system storage
RSET
	200	(nonstandard success response, see rfc876)
	250	Requested mail action okay, completed
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	504	Command parameter not implemented
	421	<domain> Service not available, closing transmission channel
SEND
	250	Requested mail action okay, completed
	552	Requested mail action aborted: exceeded storage allocation
	451	Requested action aborted: local error in processing
	452	Requested action not taken: insufficient system storage
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	502	Command not implemented
	421	<domain> Service not available, closing transmission channel
SOML
	250	Requested mail action okay, completed
	552	Requested mail action aborted: exceeded storage allocation
	451	Requested action aborted: local error in processing
	452	Requested action not taken: insufficient system storage
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	502	Command not implemented
	421	<domain> Service not available, closing transmission channel
SAML
	250	Requested mail action okay, completed
	552	Requested mail action aborted: exceeded storage allocation
	451	Requested action aborted: local error in processing
	452	Requested action not taken: insufficient system storage
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	502	Command not implemented
	421	<domain> Service not available, closing transmission channel
VRFY
	250	Requested mail action okay, completed
	251	User not local; will forward to <forward-path>
	550	Requested action not taken: mailbox unavailable
	551	User not local; please try <forward-path>
	553	Requested action not taken: mailbox name not allowed
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	502	Command not implemented
	504	Command parameter not implemented
	421	<domain> Service not available, closing transmission channel
EXPN
	250	Requested mail action okay, completed
	550	Requested action not taken: mailbox unavailable
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	502	Command not implemented
	504	Command parameter not implemented
	421	<domain> Service not available, closing transmission channel
HELP
	211	System status, or system help reply
	214	Help message
	500	Syntax error, command unrecognised
	501	Syntax error in parameters or arguments
	502	Command not implemented
	504	Command parameter not implemented
	421	<domain> Service not available, closing transmission channel
NOOP
	200	(nonstandard success response, see rfc876)
	250	Requested mail action okay, completed
	500	Syntax error, command unrecognised
	421	<domain> Service not available, closing transmission channel
QUIT
	221	<domain> Service closing transmission channel
	500	Syntax error, command unrecognised
TURN
	250	Requested mail action okay, completed
	502	Command not implemented
	500	Syntax error, command unrecognised
	503	Bad sequence of commands

Oracle Commands

sqlplus  system/manager@172.25.11.252/dlporacle11

sqlplus  scott/tiger@172.25.11.252/dlporacle11

select count(1) from dba_users;

select * from V$INSTANCE

SHOW USER;

select * from all_users;"

ALTER USER SCOTT ACCOUNT UNLOCK;

select count(1) from user_objects where object_type = 'TABLE';
select count(1) from tabs;
select table_name, partitioned from user_tables;

select * from dict;
select TABLE_NAME from ALL_ALL_TABLES;

CREATE USER jkang IDENTIFIED BY mcafee123
DEFAULT TABLESPACE users
TEMPORARY TABLESPACE temp
PROFILE DEFAULT;

GRANT RESOURCE TO jkang;
GRANT CONNECT TO jkang;
ALTER USER jkang DEFAULT ROLE ALL;
GRANT UNLIMITED TABLESPACE TO jkang;

CREATE TABLE "DDM_1000"
(    "SSN"        VARCHAR2(11 BYTE),
     "FIRST_NAME" VARCHAR2(20 BYTE),
     "LAST_NAME"  VARCHAR2(20 BYTE)
) SEGMENT CREATION IMMEDIATE
PCTFREE 10 PCTUSED 40 INITRANS 1 MAXTRANS 255 NOCOMPRESS LOGGING
STORAGE(INITIAL 65536 NEXT 1048576 MINEXTENTS 1 MAXEXTENTS 2147483645
PCTINCREASE 0 FREELISTS 1 FREELIST GROUPS 1 BUFFER_POOL DEFAULT FLASH_CACHE DEFAULT CELL_FLASH_CACHE DEFAULT)
TABLESPACE "USERS" ; 

Clipboard Copy and Paste in vSphere

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1026437

To be able to copy and paste between the guest operating system and the remote console, you must enable the Copy and Paste options using the vSphere Client. Alternatively, you can use RDP (Remote Desktop Protocol) to connect to the Windows virtual machines.
To enable this option for a specific virtual machine:

Note: VMware Tools must be installed for Copy and Paste to work.

1. Log in to a vCenter Server system using the vSphere Client and power off the virtual machine.
2. Select the virtual machine and click the Summary tab.
3. Click Edit Settings.
4. Navigate to Options > Advanced > General and click Configuration Parameters.
5. Click Add Row.
6. Type these values in the Name and Value columns:
   
                               Name                                                Value
   
   
   • isolation.tools.copy.disable    false
   • isolation.tools.paste.disable   false
   Note: These options override any settings made in the VMware Tools control panel of the guest operating system.
   
   
7. Click OK to close the Configuration Parameters dialog, and click OK again to close the Virtual Machine Properties dialog.
8. Power on the virtual machine.

Note: If you vMotion a virtual machine to a host where the isolation.tools.*="FALSE" is already set, the copy and paste options are automatically activated for that virtual machine.
To enable this option for all the virtual machines in the ESX/ESXi host:

1. Log in to the ESX/ESXi host as a root user.
2. Take a backup of the /etc/vmware/config file.
3. Open the /etc/vmware/config file using a text editor.
4. Add these entries to the file:
   
   vmx.fullpath = "/bin/vmx"
   isolation.tools.copy.disable="FALSE"
isolation.tools.paste.disable="FALSE"
   
   
5. Save and close the file.
   
   The Copy and Paste options are only enabled when the virtual machines restart or resume the next time or shutdown and power-on the virtual machine for changes to take effect.  This must be done on the virtual machine side, not the guest OS side.

Note: These options do not persist after the host upgrade. If you upgrade to a newer version after enabling these options, the changes are lost and you may have to re-enable them.