The Wandering Sysadmin

Archive for the "Uncategorized" Category

Extracting Credit Card data from Ubersmith

October 27th, 2016 By Damien Gardner

So we recently purchased a number of companies who use Ubersmith as their billing system.

As I’ve mentioned before, we use WHMCS. Ubersmith weren’t overly helpful with extracting our customers’ credit card data, so I had to spend some time playing about with ubersmith. As it turned out, it wasn’t hard at all to pull credit card data out. Most of my required code was in re-encrypting it to store it back into the database with a encryption format so we can pull it out with our standard merge scripts to import into our WHMCS install.

First we want a table to store the data in.

create table whmcs_merge_carddata (
  billing_info_id INTEGER NOT NULL,
  cc_num          VARCHAR(64),
  cc_cvv2         VARCHAR(64),
  cc_issuenr      VARCHAR(64)
);

create table whmcs_merge_carddata (

billing_info_id INTEGER NOT NULL,

cc_num VARCHAR(64),

cc_cvv2 VARCHAR(64),

cc_issuenr VARCHAR(64)

);

I then placed the below script in the ubersmith web root. And popped a copy of lib_crypt.php (from https://sourceforge.net/projects/warp-cms/files/smart-framework/ library) into the parent directory – just so it wasn’t polluting the ubersmith install.

<?PHP
$_SERVER['SERVER_NAME'] = $_SERVER['argv'][1];
require_once( 'incs.php' );
require_once('../lib_crypt.php');

// This is a temporary hash to be used by our import routine later
$new_cc_encryption_hash='ApPTRYWQCF4LqMvYObfENwlaVd4VzBeZQUJyJwfb29NiM97qbcVOy6Ok9J6zbbpR';
$he_key2 = md5 (md5 ($new_cc_encryption_hash)) . md5 ($new_cc_encryption_hash);
$he_new = new hash_encryption($he_key2);

class ExtractCard extends sb_ccbackend {
 public function getRaw($id) {
 return parent::_get_raw($id);
 }
}

$backend = new ExtractCard();
$result = $_SESSION['DB']->query("select i.billing_info_id, c.class_id, i.cc_num from billing_info i JOIN CLIENT c ON c.clientid=i.clientid where c.active=1 and i.payment_type='cc'");
$results = [];
while (($row = $result->fetchRow())) {
$results[] = $row;
}

foreach ($results as $row) {
 $card = $backend->getRaw($row['billing_info_id']);
 $sql = "INSERT INTO whmcs_merge_carddata (billing_info_id, cc_num, cc_cvv2, cc_issuenr) values (?, ?, ?, ?)";
 // Encrypt the values with our temporary hash
 $qargs = array(
 $row['billing_info_id'],
 $he_new->encrypt($card[0].$row['cc_num']),
 $he_new->encrypt($card[1]),
 $he_new->encrypt($card[2])
 );
 $result2 = $_SESSION['DB']->query($sql, $qargs);
 echo "Inserting record ".$row['billing_info_id']."\n";
 
}
?>

<?PHP

$_SERVER['SERVER_NAME'] = $_SERVER['argv'][1];

require_once( 'incs.php' );

require_once('../lib_crypt.php');

// This is a temporary hash to be used by our import routine later

$new_cc_encryption_hash='ApPTRYWQCF4LqMvYObfENwlaVd4VzBeZQUJyJwfb29NiM97qbcVOy6Ok9J6zbbpR';

$he_key2 = md5 (md5 ($new_cc_encryption_hash)) . md5 ($new_cc_encryption_hash);

$he_new = new hash_encryption($he_key2);

class ExtractCard extends sb_ccbackend {

public function getRaw($id) {

return parent::_get_raw($id);

}

$backend = new ExtractCard();

$result = $_SESSION['DB']->query("select i.billing_info_id, c.class_id, i.cc_num from billing_info i JOIN CLIENT c ON c.clientid=i.clientid where c.active=1 and i.payment_type='cc'");

$results = [];

while (($row = $result->fetchRow())) {

$results[] = $row;

}

foreach ($results as $row) {

$card = $backend->getRaw($row['billing_info_id']);

$sql = "INSERT INTO whmcs_merge_carddata (billing_info_id, cc_num, cc_cvv2, cc_issuenr) values (?, ?, ?, ?)";

// Encrypt the values with our temporary hash

$qargs = array(

$row['billing_info_id'],

$he_new->encrypt($card[0].$row['cc_num']),

$he_new->encrypt($card[1]),

$he_new->encrypt($card[2])

);

$result2 = $_SESSION['DB']->query($sql, $qargs);

echo "Inserting record ".$row['billing_info_id']."\n";

}

After this, it was a simple matter of running “php extractcards.php ubsermith.panel.url.here”, and all cards were saved into the whmcs_merge_carddata table, ready for our merge scripts.

Posted in PHP, Uncategorized, WHMCS
No Comments

Creating RRD files in PHP

March 31st, 2014 By Damien Gardner

I was looking for a way to store (and graph) data for all of our physical servers. Now sure, we could install SNMP on every machine and just use MRTG, but as a lot of them are leased by clients, I wanted something out of band which will ‘just work’. We have a very nice IMPI based system which we use for provisioning every server on the network. That seemed like a good way to go! Pulling all the fun info via IPMI is really easy:

$ ipmitool -I lan -H 10.x.x.x -U ADMINUSER -P PASSWORD sensor
CPU1 Temp        | 29.000     | degrees C  | ok    | 0.000     | 0.000     | 0.000     | 79.000    | 82.000    | 84.000    
CPU2 Temp        | 34.000     | degrees C  | ok    | 0.000     | 0.000     | 0.000     | 79.000    | 82.000    | 84.000    
System Temp      | 27.000     | degrees C  | ok    | -9.000    | -7.000    | -5.000    | 80.000    | 85.000    | 90.000    
Peripheral Temp  | 33.000     | degrees C  | ok    | -9.000    | -7.000    | -5.000    | 80.000    | 85.000    | 90.000    
PCH Temp         | 43.000     | degrees C  | ok    | -11.000   | -8.000    | -5.000    | 90.000    | 95.000    | 100.000   
P1-DIMMA1 TEMP   | 30.000     | degrees C  | ok    | 1.000     | 2.000     | 4.000     | 80.000    | 85.000    | 90.000    
P1-DIMMB1 TEMP   | 29.000     | degrees C  | ok    | 1.000     | 2.000     | 4.000     | 80.000    | 85.000    | 90.000    
P1-DIMMC1 TEMP   | na         |            | na    | na        | na        | na        | na        | na        | na        
P1-DIMMD1 TEMP   | na         |            | na    | na        | na        | na        | na        | na        | na        
P2-DIMME1 TEMP   | 31.000     | degrees C  | ok    | 1.000     | 2.000     | 4.000     | 80.000    | 85.000    | 90.000    
P2-DIMMF1 TEMP   | 31.000     | degrees C  | ok    | 1.000     | 2.000     | 4.000     | 80.000    | 85.000    | 90.000    
P2-DIMMG1 TEMP   | na         |            | na    | na        | na        | na        | na        | na        | na        
P2-DIMMH1 TEMP   | na         |            | na    | na        | na        | na        | na        | na        | na        
FAN1             | na         |            | na    | na        | na        | na        | na        | na        | na        
FAN2             | 6375.000   | RPM        | ok    | 300.000   | 450.000   | 600.000   | 18975.000 | 19050.000 | 19125.000 
FAN3             | na         |            | na    | na        | na        | na        | na        | na        | na        
FAN4             | 6450.000   | RPM        | ok    | 300.000   | 450.000   | 600.000   | 18975.000 | 19050.000 | 19125.000 
FAN5             | 4575.000   | RPM        | ok    | 300.000   | 450.000   | 600.000   | 18975.000 | 19050.000 | 19125.000

$ ipmitool -I lan -H 10.x.x.x -U ADMINUSER -P PASSWORD sensor

CPU1 Temp | 29.000 | degrees C | ok | 0.000 | 0.000 | 0.000 | 79.000 | 82.000 | 84.000

CPU2 Temp | 34.000 | degrees C | ok | 0.000 | 0.000 | 0.000 | 79.000 | 82.000 | 84.000

System Temp | 27.000 | degrees C | ok | -9.000 | -7.000 | -5.000 | 80.000 | 85.000 | 90.000

Peripheral Temp | 33.000 | degrees C | ok | -9.000 | -7.000 | -5.000 | 80.000 | 85.000 | 90.000

PCH Temp | 43.000 | degrees C | ok | -11.000 | -8.000 | -5.000 | 90.000 | 95.000 | 100.000

P1-DIMMA1 TEMP | 30.000 | degrees C | ok | 1.000 | 2.000 | 4.000 | 80.000 | 85.000 | 90.000

P1-DIMMB1 TEMP | 29.000 | degrees C | ok | 1.000 | 2.000 | 4.000 | 80.000 | 85.000 | 90.000

P1-DIMMC1 TEMP | na | | na | na | na | na | na | na | na

P1-DIMMD1 TEMP | na | | na | na | na | na | na | na | na

P2-DIMME1 TEMP | 31.000 | degrees C | ok | 1.000 | 2.000 | 4.000 | 80.000 | 85.000 | 90.000

P2-DIMMF1 TEMP | 31.000 | degrees C | ok | 1.000 | 2.000 | 4.000 | 80.000 | 85.000 | 90.000

P2-DIMMG1 TEMP | na | | na | na | na | na | na | na | na

P2-DIMMH1 TEMP | na | | na | na | na | na | na | na | na

FAN1 | na | | na | na | na | na | na | na | na

FAN2 | 6375.000 | RPM | ok | 300.000 | 450.000 | 600.000 | 18975.000 | 19050.000 | 19125.000

FAN3 | na | | na | na | na | na | na | na | na

FAN4 | 6450.000 | RPM | ok | 300.000 | 450.000 | 600.000 | 18975.000 | 19050.000 | 19125.000

FAN5 | 4575.000 | RPM | ok | 300.000 | 450.000 | 600.000 | 18975.000 | 19050.000 | 19125.000

That gives us quite a useful amount of info! Though for our purposes, we’ll ignore everything except the first three columns.

Handling that in PHP, we do something like the following:

<?PHP
$output = shell_exec('ipmitool -H ' . $server->internalIp . ' -U ' . $user . ' -P ' . $pw . ' sensor 2>&1');
// Split into lines
$lines = explode("\n", $output);
foreach ($lines as $line) {
  // Remove whitespace
  $line = implode('', explode(' ', $line));
  // Explode by |
  $data = explode('|', $line);
  var_dump($data);
  // data is:
  //  $data[0] = Name
  //  $data[1] = Value
  //  $data[2] = Units
}

<?PHP

$output = shell_exec('ipmitool -H ' . $server->internalIp . ' -U ' . $user . ' -P ' . $pw . ' sensor 2>&1');

// Split into lines

$lines = explode("\n", $output);

foreach ($lines as $line) {

// Remove whitespace

$line = implode('', explode(' ', $line));

// Explode by |

$data = explode('|', $line);

var_dump($data);

// data is:

// $data[0] = Name

// $data[1] = Value

// $data[2] = Units

}

Then we need to think about the RRD’s. We need to check if we HAVE one, if so we put the data in. Or we generate a new RRD and put the data in.

if (!file_exists($rrdfile)) {
    // Create the RRD
    $options = array(
        "--step", "300", // Use a step-size of 5 minutes
        "DS:" . $data[0] . ":GAUGE:600:U:U",
        "RRA:AVERAGE:0.5:1:288",
        "RRA:MIN:0.5:1:288",
        "RRA:MAX:0.5:1:288",
        "RRA:AVERAGE:0.5:12:168",
        "RRA:MIN:0.5:12:168",
        "RRA:MAX:0.5:12:168",
        "RRA:AVERAGE:0.5:228:365",
        "RRA:MIN:0.5:228:365",
        "RRA:MAX:0.5:228:365",
    );

    $ret = rrd_create($rrdfile, $options);
    if (!$ret) {
        echo "<b>Creation error: </b>" . rrd_error() . "\n";
    }
}

if (!file_exists($rrdfile)) {

// Create the RRD

$options = array(

"--step", "300", // Use a step-size of 5 minutes

"DS:" . $data[0] . ":GAUGE:600:U:U",

"RRA:AVERAGE:0.5:1:288",

"RRA:MIN:0.5:1:288",

"RRA:MAX:0.5:1:288",

"RRA:AVERAGE:0.5:12:168",

"RRA:MIN:0.5:12:168",

"RRA:MAX:0.5:12:168",

"RRA:AVERAGE:0.5:228:365",

"RRA:MIN:0.5:228:365",

"RRA:MAX:0.5:228:365",

);

$ret = rrd_create($rrdfile, $options);

if (!$ret) {

echo "<b>Creation error: </b>" . rrd_error() . "\n";

}

What we’re doing above is creating the datastore, and creating Round Robin Archives for Min, Max, and Average. Storing a sample every 5 minutes for 24 hours (288 samples), a sample every hour for 7 days, and a sample every day for a year.

Now we need to store our data. That’s the easy part!

// rewrite 'na' to 'U' for undefined
if ($data[1]=='na') {
  $data[1] = 'U';
}
//  insert the data
$ret = shell_exec("/usr/bin/rrdtool update ".$rrdfile." N:".$data[1])

// rewrite 'na' to 'U' for undefined

if ($data[1]=='na') {

$data[1] = 'U';

}

// insert the data

$ret = shell_exec("/usr/bin/rrdtool update ".$rrdfile." N:".$data[1])

And we’re now storing data. Note the use of the shell_exec. At least in PHP5.4 on Ubuntu, rrd_update and rrd_graph do not work.

But that’s not much fun if we can’t display the graphs when we need them!

I could write them out to file and then include them from static HTML etc. But I’d rather have it all dynamically generated. I have a php file which generates the HTML table referencing the graphs:

    echo '<table>';
     $rrds = ServerRRDS::model()->findAllByAttributes(array('serverId'=>$id));
     $i = 0;
     foreach ($rrds as $rrd) {

       // Table handling
       if ($i%2==0)
         echo '<tr>';

       echo '<td>';
       echo '<img src="/index.php?r=graph/drawGraph&orderId='.urlencode($rrd->orderId).'&dataName='.urlencode($rrd->dataName).'">';
       echo '</td>';

       if ($i++%2==1)
         echo '</tr>';
     }
     echo '</table>';

echo '<table>';

$rrds = ServerRRDS::model()->findAllByAttributes(array('serverId'=>$id));

$i = 0;

foreach ($rrds as $rrd) {

// Table handling

if ($i%2==0)

echo '<tr>';

echo '<td>';

echo '<img src="/index.php?r=graph/drawGraph&orderId='.urlencode($rrd->orderId).'&dataName='.urlencode($rrd->dataName).'">';

echo '</td>';

if ($i++%2==1)

echo '</tr>';

}

echo '</table>';

And then the actual graphing script:

       // Load the Server as well
         $server = Servers::model()->findByPk($rrd->orderId);
         // Clean up the data name to get what we use in the rrd file
         $dataname = str_replace(array('+','-','.'), array('PLUS', 'NEG',  'DOT'), $dataName);

         $options = array(
           "--slope-mode",
           "--start ". $start,
           "--title=\"".$server->orderId.' - '.$rrd->dataName."\"",
           "--vertical-label=".$rrd->dataUnit,
           "--lower=0",
           "DEF:vname=/path/to/rrds/".$rrd->fileName.":".$dataname.":AVERAGE",
           "VDEF:vnamemin=vname,MINIMUM",
           "VDEF:vnamemax=vname,MAXIMUM",
           "VDEF:vnameavg=vname,AVERAGE",
           "COMMENT:\"          \"",
           "COMMENT:\"Maximum    \"",
           "COMMENT:\"Average    \"",
           "COMMENT:\"Minimum    \l\"",
           "AREA:vname#0000BB:".$rrd->dataName,
           "GPRINT:vnamemin:\"%6.2lf     \"",
           "GPRINT:vnamemax:\"%6.2lf     \"",
           "GPRINT:vnameavg:\"%6.2lf     \l\"",
        );

         $tmpfile = "/path/to/temp/moo".rand(11111111, 9999999).".png";

         $ret = shell_exec('/usr/bin/rrdtool graph '.$tmpfile.' '.implode(" ", $options)." 2>&1");

   header('Content-Type: image/png');
         header('Content-Length: '. filesize($tmpfile));
         passthru($tmpfile);
         $fp = fopen($tmpfile,'rb');
         fpassthru($fp);
         fclose($fp);
         unlink($tmpfile);

       }

// Load the Server as well

$server = Servers::model()->findByPk($rrd->orderId);

// Clean up the data name to get what we use in the rrd file

$dataname = str_replace(array('+','-','.'), array('PLUS', 'NEG', 'DOT'), $dataName);

$options = array(

"--slope-mode",

"--start ". $start,

"--title=\"".$server->orderId.' - '.$rrd->dataName."\"",

"--vertical-label=".$rrd->dataUnit,

"--lower=0",

"DEF:vname=/path/to/rrds/".$rrd->fileName.":".$dataname.":AVERAGE",

"VDEF:vnamemin=vname,MINIMUM",

"VDEF:vnamemax=vname,MAXIMUM",

"VDEF:vnameavg=vname,AVERAGE",

"COMMENT:\" \"",

"COMMENT:\"Maximum \"",

"COMMENT:\"Average \"",

"COMMENT:\"Minimum \l\"",

"AREA:vname#0000BB:".$rrd->dataName,

"GPRINT:vnamemin:\"%6.2lf \"",

"GPRINT:vnamemax:\"%6.2lf \"",

"GPRINT:vnameavg:\"%6.2lf \l\"",

);

$tmpfile = "/path/to/temp/moo".rand(11111111, 9999999).".png";

$ret = shell_exec('/usr/bin/rrdtool graph '.$tmpfile.' '.implode(" ", $options)." 2>&1");

header('Content-Type: image/png');

header('Content-Length: '. filesize($tmpfile));

passthru($tmpfile);

$fp = fopen($tmpfile,'rb');

fpassthru($fp);

fclose($fp);

unlink($tmpfile);

}

And now it’s working very nicely indeed!

Posted in IPMI, Linux, PHP, Uncategorized
No Comments

WHMCS Password Encryption and Decryption

March 1st, 2014 By Damien Gardner

So at my work, we just bought out a couple of other hosting companies, and needed to bring all their customer data from WHMCS into our WHMCS install.

We figured ‘no problems, WHMCS has a merge tool’. Yeah, that didn’t work at all!

So. We sat down and wrote one!

Where things almost came unstuck, was transferring passwords. WHMCS stores all manner of passwords – customer passwords, hosting account passwords, even server passwords. For that matter, they also store credit card details. And they’re all stored Encrypted!

After discovering this helpful class, and mucking about for a few hours working out how they use the hash, I was ready to go! Using it is a breeze. You just need your cc_encryption_hash from your WHMCS configuration.php, and off you go.

<?PHP
include('hash_crypt.php');
// Encryption hash from WHMCS
$cc_encryption_hash='SOmECRAZYLONGHASHROFLCOPTERBBQKTHX';
$key = md5 (md5 ($cc_encryption_hash)) . md5 ($cc_encryption_hash);
$he = new hash_encryption($key);

echo $plaintext $he->decrypt('JATa2iUqVdzCkBP5RiyitlQlUiACl8UrpJOeGUJO');
?>

<?PHP

include('hash_crypt.php');

// Encryption hash from WHMCS

$cc_encryption_hash='SOmECRAZYLONGHASHROFLCOPTERBBQKTHX';

$key = md5 (md5 ($cc_encryption_hash)) . md5 ($cc_encryption_hash);

$he = new hash_encryption($key);

echo $plaintext $he->decrypt('JATa2iUqVdzCkBP5RiyitlQlUiACl8UrpJOeGUJO');

If you were to run this code, it would display ‘MyPassword’.

So in my case, transferring between two WHMCS installations, I use a code block like the following:

<?PHP
include('hash_crypt.php');
$old_cc_encryption_hash='SOmECRAZYLONGHASHROFLCOPTERBBQKTHX';
$new_cc_encryption_hash='SOMeOtHERLongEnCryptionHashSTRING';

$oldkey = md5 (md5 ($old_cc_encryption_hash)) . md5 ($old_cc_encryption_hash);
$newkey = md5 (md5 ($new_cc_encryption_hash)) . md5 ($new_cc_encryption_hash);
$he_old = new hash_encryption($oldkey);
$he_new = new hash_encryption($newkey);

$newpass = $he_new->encrypt($he_old->decrypt($oldpass));

<?PHP

include('hash_crypt.php');

$old_cc_encryption_hash='SOmECRAZYLONGHASHROFLCOPTERBBQKTHX';

$new_cc_encryption_hash='SOMeOtHERLongEnCryptionHashSTRING';

$oldkey = md5 (md5 ($old_cc_encryption_hash)) . md5 ($old_cc_encryption_hash);

$newkey = md5 (md5 ($new_cc_encryption_hash)) . md5 ($new_cc_encryption_hash);

$he_old = new hash_encryption($oldkey);

$he_new = new hash_encryption($newkey);

$newpass = $he_new->encrypt($he_old->decrypt($oldpass));

Assuming you had the encrypted password from the old system in $oldpass, you will now have the password for the new system in $newpass.

Hopefully this helps someone! Google was no help at all for re-encrypting the password!

Posted in Hosting, Uncategorized
4 Comments

Recent Posts

Recent Comments

Archives

Categories

Meta

Extracting Credit Card data from Ubersmith

Creating RRD files in PHP

WHMCS Password Encryption and Decryption