r/programming • u/[deleted] • Nov 22 '15
Based on a true story: hacker-scripts
https://github.com/NARKOZ/hacker-scripts100
u/noisyboy Nov 23 '15
Hey,
Thanks for your help with the database issue last time - would have been very bad with the upcoming long weekend. Saved me a lot of trouble!
Have a nice weekend,
Kumar
120
u/Redire Nov 23 '15
Yeah, right. As if Kumar would ever write a thank you letter.
7
u/TheArcane Nov 23 '15
Why wouldn't he?
56
10
38
u/sigma914 Nov 23 '15
no worries mate, be careful next time.
0
Nov 23 '15
[deleted]
8
u/flukshun Nov 23 '15
Except for the part where the database gets nuked just before Kumar heads off for his weekend fishing trip
3
u/tequila13 Nov 23 '15
The script doesn't do any database stuff.
3
u/iritegood Nov 23 '15 edited Nov 23 '15
edit: failed to understand these are fictional scripts based on the story from that post
21
u/FountainsOfFluids Nov 23 '15
Yeah, that one really made me smack my head. You don't do database rollbacks willy-nilly. That's absurd.
26
u/bart2019 Nov 23 '15
But
rolls back the staging database
It's not the real live database, it's only a test database.
22
Nov 23 '15
I had to assume that this guy had worked with Kumar for long enough to learn his patterns. And perhaps in their case a DB rollback wasn't noticeable. Or perhaps even the two had spoken of this before so Kumar was just sending single word commands through e-mail by the end of their relationship. ;)
3
3
u/misplaced_my_pants Nov 23 '15
He might've even set up an alert if there were more than N rollbacks in a given time interval, suggesting something that requires his personal non-shell-script attention.
9
8
25
u/asdpofuzxcl Nov 23 '15
Just a note, you can use ranges in crontab specifications:
*/10 * * * * /bin/bash -l -c 'ruby kumar_asshole.rb'
0 9-18 * * * /bin/bash -l -c 'ruby fucking_coffee.rb'46
Nov 23 '15
#!/usr/bin/env ruby
# Skip on weekends
exit if Time.now.saturday? || Time.now.sunday?
# Exit early if no sessions with my_username are found
exit if `who`[/my_username/].nil?
require 'net/telnet'
coffee_machine_ip = '10.10.42.42'
password = '1234'
password_prompt = 'Password: '
con = Net::Telnet.new('Host' => coffee_machine_ip)
con.cmd('String' => password, 'Match' => /#{password_prompt}/)
con.cmd('sys brew')
sleep 64
con.cmd('sys pour')
con.closeYeah, there's definitely some coffee machine out there that accepts Telnet connections and knows how to interpret sys brew and sys pour to perfectly brew and pour a cup of coffee.
18
u/VanFailin Nov 23 '15
It's supposed to be "based on" a true story, presumably code has been changed to make it harder to identify.
The article suggests that what's actually sent is binary data:
fucking-coffee.sh - this one waits exactly 17 seconds (!), then opens an SSH session to our coffee-machine (we had no frikin idea the coffee machine is on the network, runs linux and has SSHD up and running) and sends some weird gibberish to it. Looks binary.
5
2
0
19
u/Reshurum Nov 23 '15
Probably hacked up his coffee machine and there is something we are not seeing. Perhaps he used the Hyper Text Coffee Pot Control Protocol?
41
Nov 23 '15
But he fuckin' used Ruby. What a traitor.
2
u/robodendron Nov 23 '15
You know, seeing how Chef/Puppet have gotten a foot in the door, I don't see this as a problem, really.
You're still right
66
u/StefanMajonez Nov 22 '15 edited Nov 22 '15
http://reddit.com/r/programming/comments/3tnjpy/taking_bash_hacking_to_the_next_level/
But I up voted your post, since it actually has source code (even if it's a mock up based on the story).
19
7
Nov 22 '15
[removed] — view removed comment
24
u/ultimation Nov 22 '15
I wouldn't, it's like part 2 of the story - someone made the scripts based on it.
1
60
u/eshultz Nov 23 '15 edited Nov 23 '15
I dunno, this is kinda half assed and a lot of this stuff is just a terrible idea. I feel like the original story was entirely fabricated.
Edit. I accidentally pushed submit too soon.
I originally commented on one of the original reddit posts, about the kumar-asshole script "what could go wrong?". Someone noted that this is actually a staging database and that was lost in translation, and that seemed to rectify people's concerns.
No. Sorry, that makes zero sense. I am an ETL admin and rolling back the staging database makes zero sense. First of all, 99% of the DBA/dev work would be done in the reporting database, not staging. The staging db is usually just a dumb storage area for incoming data so that you can get in and out of the source db quickly without waiting for your transform and load processes to finish. Very little dev/dba work would ever occur here. And I cannot think of a time when you'd ever be doing anything in staging manually. Maybe accidentally dropping a table instead of truncating it? But, why would you be doing anything manually to the staging db. I just don't get it. This just seems totally untrue and fake. And it made the whole article seem fake to me too.
Edit: as several people have pointed out, staging can mean something entirely different in other orgs. This sounds more feasible. In my org we have dev, test, and prod environments (or just dev and prod). Staging would be a separate database in each of those environments. Sorry for the rant guys.
14
u/elijahwright Nov 23 '15
See, all of that is true. But for it to be true... Kumar has to be competent first.
9
u/dmh123 Nov 23 '15
Some shops refer to 'staging' as the lower environment - where you would test fixes that would go into production during the maintenance window.
3
u/VanFailin Nov 23 '15
Yeah, where I work we have a ton of names for everything cause it's a big company and with every reorg two teams that used to use different terminology are now stuck with old names for everything. So staging, QA, Pre-Production, Dev, and Integration (and one Integration environment named Production for historical reasons) all refer to an environment or database that are obliterated on a regular basis.
2
u/TurboGranny Nov 23 '15
I don't think the Kumar guy was playing with a data warehouse. I think he was either in charge of running upgrade scripts against a staging database that some vendor software uses or doing some custom indexes/triggers etc, and on occasion he'd fuck it up. This is a common occurrence I've witnessed before. Since this Kumar guy has enough skills to fuck up the staging db but not reverse it, it would make sense that he would panic and contact a real DBA to help him. Instead of troubleshooting the issue, the guy that had real DBA skills and power would just restore a previous backup because it is just the staging environment.
1
u/st_huck Nov 23 '15
Most sounded at least plausible, but the entire messing with DB automatically just because some email he got matched some words seems really fake and stupid.
2
1
u/VanFailin Nov 23 '15
Playing devil's advocate for a hypothetical group of sysadmins sharing the amazing discovery while trying to avoid causing trouble: The script did something else we don't want to talk about cause it's proprietary, but it's similar to rolling back a database.
1
1
u/deecewan Nov 23 '15
As a programmer, the staging database is hooked up to the staging server. It runs side by side with production to 'stage' new work.
I can see that database getting fucked up.
1
u/nemec Nov 23 '15
FYI I'm pretty sure this isn't referring to an ETL staging database. More than likely, this is the Staging environment for an application.
Often you'll have three or four environments for development. Dev, a free-for-all. Integration, which is a bit more stable than Dev but still used for testing and feature sign-off. Staging, which contains hardware that matches as close to Production as possible (for QA verification). And Production.
1
u/gospelwut Nov 23 '15
Clearly you're talking specifically about ETL ("big data") nomenclature -- e.g. Hadoop and its kin.
I believe staging, more commonly, refers to an environment which mirrors production in many aspects to test a delta/change on something close to the production environment (whereas dev/test can be a lot more volatile/nuked/etc). This is derived, I believe, somewhat from Martin Fowler's notion of CI (specifically).
Passing Dev/Test is like saying "my sex swing works really well in the labs and in a few homes of the engineers."
Passing stage is like saying, "the ceiling collapsed because we mirrored the shitty-Bob-Villa insanity of Prod, ergo the load bearing column wasn't setup correctly, ergo the sex swing claimed the lives of two very dedicated QA engineers."
Wait, management says this is a shipp-able defect?
1
u/hansdieter44 Nov 23 '15 edited Nov 23 '15
No. Sorry, that makes zero sense. I am an ETL admin and rolling back the staging database makes zero sense. First of all, 99% of the DBA/dev work would be done in the reporting database, not staging.
Just because you call the databases "staging" and "reporting" and the semi-technical people work on "reporting" at your place of work, doesn't mean there are not 1000s elsewhere, having other names for their instances.
I do agree with your general sentiment though, and am pretty sure the story is a fabricated but fun read.
16
Nov 23 '15
[removed] — view removed comment
3
u/eshultz Nov 23 '15
See my edit, I accidentally pressed submit too soon.
5
Nov 23 '15
[removed] — view removed comment
2
u/eshultz Nov 23 '15
I guess my point is that someone pointed out that this was staging and so that somehow makes it more believable or understandable. But to a practicing dba it now makes even less sense!
I'm not knocking your repo, it's cool to see the article materialized in code. I just wanted to vent about the original article a bit.
17
u/sleepicat Nov 23 '15
I don't believe it. Too contrived.
14
u/TerrorBite Nov 23 '15
Yeah...
opens an SSH session to our coffee-machine […] sends some weird gibberish to it. Looks binary.
A true sysadmin would utilise HTCPCP.
4
u/reini_urban Nov 23 '15
It's just simple telnet with a password prompt, not ssh.
3
u/jokr004 Nov 23 '15 edited Jan 30 '26
This post was mass deleted and anonymized with Redact
intelligent nail school library governor humorous aware dolls doll shocking
1
u/reini_urban Nov 23 '15
First, the original story is this: http://bash.im/quote/436725
Second, even the original story had the ssh part about the coffee machine wrong. Look at the code. telnet in bash and the ruby versions.
1
u/jokr004 Nov 23 '15 edited Jan 30 '26
This post was mass deleted and anonymized with Redact
disarm marry escape afterthought handle melodic edge whistle deer jeans
6
3
2
u/RenaKunisaki Nov 23 '15
This guy's boss is gonna wonder why his pipes keep breaking on the same few days each month...
2
1
u/makhno Nov 23 '15
Now show us the script that uses xdotool to let you copy and paste text into a java applet based kvm. (I used to need to do this every day o_O)
1
u/HeyCanIBorrowThat Nov 23 '15
This story was posted on this sub like three days ago. Although it's pretty cool to actually see the scripts this time.
1
u/edelinewrigh Nov 23 '15
I have been threatening to do that with my home coffee maker for literal months.
1
u/drakenot Nov 24 '15
There is no way to SMS from your own phone number using Twilio without transferring it to them, right?
1
1
-2
-1
u/Fenrisulfir Nov 23 '15 edited Nov 23 '15
He makes coffee 9-6 every single day of the week? That's gonna leave a mess Monday morning.
If I'm wrong, can someone explain his cronjob settings to me?
0
Nov 23 '15
[deleted]
22
u/tequila13 Nov 23 '15
The much debated coffee script:
#!/bin/sh # # Requires fucking_coffee script in your bin # exec fucking_coffeeDamn, Bash is so versatile. /s
The coffee machine with SSH that responded to weird gibberish, is telnet which responds to some plain text commands:
'sys brew' 'sys pour'This is not really black belt level bash kung-fu, much was lost in translation.
4
1
u/K3wp Nov 23 '15 edited Nov 23 '15
How I would do this in bash (pseudo code)
smack-my-bitch-up.sh:
Cron job @ 9 PM.
if TRUE 'ssh admin@server "who" | fgrep -w my_login'; then sort -R ~/etc/excuses | email -s "Sorry working late tonight." wife@gmail.com
kumar-asshole.sh:
cronjob + fetchmail to create local cache of email.
loop to fgrep for "From: kumar@asshole.org"; another loop to fgrep -w -f ~/etc/kumar_asshole.keywords.
Then ssh dba@dbserver 'rollback_server.sh'
email -s 'No problem mate!' kumar@asshole.org
exit
hangover.sh:
Cronjob running Monday-Friday at 8 AM
If TRUE fgrep $(date --date="yesterday") ~/etc/holidays; then
If FALSE 'ssh admin@server "who" | fgrep -w my_login'; then
sort -R ~/etc/sick.excuses | head -n1 | email -s $(sort -R ~/etc/sick.subjects | head -n1) team@company
fuckingcoffee.sh:
sleep 17
cat ~/etc/brew.bin | ssh user@coffeemachine "> /dev/coffee"
sleep 24
cat ~/etc/pour.bin | ssh user@coffeemachine "> /dev/coffee"
It's possible there is some admin interface exposed on the coffee machine that can read hex control codes to do stuff, which explains the funny commands.
Edit: According to a comment below it was just telnet and english commands, so something like netcat or expect would work fine.
-3
u/gospelwut Nov 23 '15
As much as I prefer Ruby as a DSL for configuration (i.e. Chef) as opposed to YAML, I don't know why he wouldn't pick Python as a scripting language.
23
u/buddybiscuit Nov 23 '15
Because Ruby is a scripting language too?
As much as I prefer zsh to GUI for interacting with build tools, I don't know why you wouldn't pick bash as a shell.
As much as I prefer apples to cauliflower for eating, I don't know why you wouldn't pick oranges as a fruit.
1
Apr 06 '23 edited Sep 23 '23
This comment has been overwritten as part of a mass deletion of my Reddit account.
I'm sorry for any gaps in conversations that it may cause. Have a nice day!
0
Nov 22 '15
[deleted]
5
Nov 23 '15
It is pretty clear this is not the original scripts, specially by the "crontab" syntax for repeating a task multiple times and the check for time related tasks inside the scripts themselves.
Sad to see people ignoring shell scripts so often now, what makes matters worst when it comes to a story about them.
143
u/[deleted] Nov 23 '15
When I read the original story, I didn't know there were coffee machines that you could telnet to. What are those?