The Wandering Sysadmin

Archive for the "PHP" Category

Extracting Credit Card data from Ubersmith

October 27th, 2016 By Damien Gardner

So we recently purchased a number of companies who use Ubersmith as their billing system.

As I’ve mentioned before, we use WHMCS. Ubersmith weren’t overly helpful with extracting our customers’ credit card data, so I had to spend some time playing about with ubersmith. As it turned out, it wasn’t hard at all to pull credit card data out. Most of my required code was in re-encrypting it to store it back into the database with a encryption format so we can pull it out with our standard merge scripts to import into our WHMCS install.

First we want a table to store the data in.

create table whmcs_merge_carddata (
  billing_info_id INTEGER NOT NULL,
  cc_num          VARCHAR(64),
  cc_cvv2         VARCHAR(64),
  cc_issuenr      VARCHAR(64)
);

create table whmcs_merge_carddata (

billing_info_id INTEGER NOT NULL,

cc_num VARCHAR(64),

cc_cvv2 VARCHAR(64),

cc_issuenr VARCHAR(64)

);

I then placed the below script in the ubersmith web root. And popped a copy of lib_crypt.php (from https://sourceforge.net/projects/warp-cms/files/smart-framework/ library) into the parent directory – just so it wasn’t polluting the ubersmith install.

<?PHP
$_SERVER['SERVER_NAME'] = $_SERVER['argv'][1];
require_once( 'incs.php' );
require_once('../lib_crypt.php');

// This is a temporary hash to be used by our import routine later
$new_cc_encryption_hash='ApPTRYWQCF4LqMvYObfENwlaVd4VzBeZQUJyJwfb29NiM97qbcVOy6Ok9J6zbbpR';
$he_key2 = md5 (md5 ($new_cc_encryption_hash)) . md5 ($new_cc_encryption_hash);
$he_new = new hash_encryption($he_key2);

class ExtractCard extends sb_ccbackend {
 public function getRaw($id) {
 return parent::_get_raw($id);
 }
}

$backend = new ExtractCard();
$result = $_SESSION['DB']->query("select i.billing_info_id, c.class_id, i.cc_num from billing_info i JOIN CLIENT c ON c.clientid=i.clientid where c.active=1 and i.payment_type='cc'");
$results = [];
while (($row = $result->fetchRow())) {
$results[] = $row;
}

foreach ($results as $row) {
 $card = $backend->getRaw($row['billing_info_id']);
 $sql = "INSERT INTO whmcs_merge_carddata (billing_info_id, cc_num, cc_cvv2, cc_issuenr) values (?, ?, ?, ?)";
 // Encrypt the values with our temporary hash
 $qargs = array(
 $row['billing_info_id'],
 $he_new->encrypt($card[0].$row['cc_num']),
 $he_new->encrypt($card[1]),
 $he_new->encrypt($card[2])
 );
 $result2 = $_SESSION['DB']->query($sql, $qargs);
 echo "Inserting record ".$row['billing_info_id']."\n";
 
}
?>

<?PHP

$_SERVER['SERVER_NAME'] = $_SERVER['argv'][1];

require_once( 'incs.php' );

require_once('../lib_crypt.php');

// This is a temporary hash to be used by our import routine later

$new_cc_encryption_hash='ApPTRYWQCF4LqMvYObfENwlaVd4VzBeZQUJyJwfb29NiM97qbcVOy6Ok9J6zbbpR';

$he_key2 = md5 (md5 ($new_cc_encryption_hash)) . md5 ($new_cc_encryption_hash);

$he_new = new hash_encryption($he_key2);

class ExtractCard extends sb_ccbackend {

public function getRaw($id) {

return parent::_get_raw($id);

}

$backend = new ExtractCard();

$result = $_SESSION['DB']->query("select i.billing_info_id, c.class_id, i.cc_num from billing_info i JOIN CLIENT c ON c.clientid=i.clientid where c.active=1 and i.payment_type='cc'");

$results = [];

while (($row = $result->fetchRow())) {

$results[] = $row;

}

foreach ($results as $row) {

$card = $backend->getRaw($row['billing_info_id']);

$sql = "INSERT INTO whmcs_merge_carddata (billing_info_id, cc_num, cc_cvv2, cc_issuenr) values (?, ?, ?, ?)";

// Encrypt the values with our temporary hash

$qargs = array(

$row['billing_info_id'],

$he_new->encrypt($card[0].$row['cc_num']),

$he_new->encrypt($card[1]),

$he_new->encrypt($card[2])

);

$result2 = $_SESSION['DB']->query($sql, $qargs);

echo "Inserting record ".$row['billing_info_id']."\n";

}

After this, it was a simple matter of running “php extractcards.php ubsermith.panel.url.here”, and all cards were saved into the whmcs_merge_carddata table, ready for our merge scripts.

Posted in PHP, Uncategorized, WHMCS
No Comments

Extending the WHMCS API and Fetching Invoice PDF’s

September 17th, 2014 By Damien Gardner

At work, we’re currently doing a FULL rebuild of our customer portal. Part of the requirements of the system are that our staff must only be logging into one place. At present they have to be logged into the portal AND WHMCS. So in v2, we have to basically rebuild 90% of the WHMCS admin interface into our portal, and use the WHMCS API for manipulating data stored in WHMCS. (We’re also adding a MongoDB caching layer for read access, and then using hooks in WHMCS to update the cache whenever data is modified).

We found a few ‘holes’ (read: missing functionality) in the WHMCS API, so had to see about adding an API to sit alongside WHMCS. We did ask WHMCS how to go about writing custom API functions to use within the WHMCS API framework, but they came back saying this was not possible. A fair bit of Googling around, and I managed to find a blog post detailing how to write custom API functions for WHMCS. With a bit of work, we now have a nice basis for writing WHMCS API modules. The first one I built for testing was for pulling Invoice PDF’s, which is not currently available in the WHMCS API.

<?PHP

// We don't want someone getting crafy and calling this manually without using the WHMCS API authentications
if (!defined("WHMCS")) {
  die("This file cannot be accessed directly");
}

// Borrowed from http://bobcares.com/blog/extend-whmcs-create-your-own-whmcs-api-functions/
function buildParams($vars)
{
  $param = array(
    'action' => array(),
    'params' => array()
  );
  
  // Is cmd set? If so we're being used as Local API
  if (isset($vars['cmd'])) {
    $param['action']    = $vars['cmd'];
    $param['params']    = (object) $vars['apivalues1'];
    $param['adminuser'] = $vars['adminuser'];
  } else {
    // Nope, then we're in remote API mode..

    // Fix for WHMCS > 7.x
    if (!isset($vars['_POST']) && isset($vars['_POSTbackup'])) {
       $vars['_POST'] = $vars['_POSTbackup'];
    }
    $param['action'] = $vars['_POST']['action'];
    // Just cleaning up a bit, so these don't go into the params sub array..
    unset($vars['_POST']['username']);
    unset($vars['_POST']['password']);
    unset($vars['_POST']['action']);
    $param['params'] = (object) $vars['_POST'];
  }
  return (object) $param;
}

try {
  
  // Get the arguments
  $vars       = get_defined_vars();
  $postFields = buildParams($vars);
  
  // Include the WHMCS invoicefunctions
  if (!function_exists('pdfInvoice')) {
    require_once('invoicefunctions.php');
  }
  // And build an invoice PDF for the given invoiceID  - Note, if this invoice ID is invalid, it will return a blank PDF..
  $pdfdata = pdfInvoice($postFields->params->invoiceid);
  
  // Base64 encode it so it doesn't break the xml or json return
  $doc = base64_encode($pdfdata);
  
  // And return.  WHMCS takes care of the json/xml encoding
  $apiresults = array(
    "result" => "success",
    "pdf" => $doc,
    "message" => "Success Message"
  );
  
}
catch (Exception $e) {
  // Return with an error!
  $apiresults = array(
    "result" => "error",
    "message" => $e->getMessage()
  );
}

<?PHP

// We don't want someone getting crafy and calling this manually without using the WHMCS API authentications

if (!defined("WHMCS")) {

die("This file cannot be accessed directly");

}

// Borrowed from http://bobcares.com/blog/extend-whmcs-create-your-own-whmcs-api-functions/

function buildParams($vars)

{

$param = array(

'action' => array(),

'params' => array()

);

// Is cmd set? If so we're being used as Local API

if (isset($vars['cmd'])) {

$param['action'] = $vars['cmd'];

$param['params'] = (object) $vars['apivalues1'];

$param['adminuser'] = $vars['adminuser'];

} else {

// Nope, then we're in remote API mode..

// Fix for WHMCS > 7.x

if (!isset($vars['_POST']) && isset($vars['_POSTbackup'])) {

$vars['_POST'] = $vars['_POSTbackup'];

}

$param['action'] = $vars['_POST']['action'];

// Just cleaning up a bit, so these don't go into the params sub array..

unset($vars['_POST']['username']);

unset($vars['_POST']['password']);

unset($vars['_POST']['action']);

$param['params'] = (object) $vars['_POST'];

}

return (object) $param;

}

try {

// Get the arguments

$vars = get_defined_vars();

$postFields = buildParams($vars);

// Include the WHMCS invoicefunctions

if (!function_exists('pdfInvoice')) {

require_once('invoicefunctions.php');

}

// And build an invoice PDF for the given invoiceID - Note, if this invoice ID is invalid, it will return a blank PDF..

$pdfdata = pdfInvoice($postFields->params->invoiceid);

// Base64 encode it so it doesn't break the xml or json return

$doc = base64_encode($pdfdata);

// And return. WHMCS takes care of the json/xml encoding

$apiresults = array(

"result" => "success",

"pdf" => $doc,

"message" => "Success Message"

);

}

catch (Exception $e) {

// Return with an error!

$apiresults = array(

"result" => "error",

"message" => $e->getMessage()

);

}

And Voila, a simple WHMCS call such as:

$postfields["action"] = "saugetinvoicepdf";
$postfields["invoiceid"] = "16";

1 2	$postfields["action"] = "saugetinvoicepdf"; $postfields["invoiceid"] = "16";

Returned Variables

 <whmcsapi>
   <action>saugetinvoicepdf</action>
   <result>success</result>
   <pdf>......BASE64DATA......</pdf>
   <message>Success Message</message>
 </whmcsapi>

<action>saugetinvoicepdf</action>

<result>success</result>

<message>Success Message</message>

</whmcsapi>

Then it’s a simple matter to go base64_decode($jsondata->pdf) (assuming you used json format and had done a json_decode() on the returned data…), and you have the binary data for the PDF, ready to save to disk, or pass back out to the user via HTTP.

Posted in PHP, WHMCS
12 Comments

Creating RRD files in PHP

March 31st, 2014 By Damien Gardner

I was looking for a way to store (and graph) data for all of our physical servers. Now sure, we could install SNMP on every machine and just use MRTG, but as a lot of them are leased by clients, I wanted something out of band which will ‘just work’. We have a very nice IMPI based system which we use for provisioning every server on the network. That seemed like a good way to go! Pulling all the fun info via IPMI is really easy:

$ ipmitool -I lan -H 10.x.x.x -U ADMINUSER -P PASSWORD sensor
CPU1 Temp        | 29.000     | degrees C  | ok    | 0.000     | 0.000     | 0.000     | 79.000    | 82.000    | 84.000    
CPU2 Temp        | 34.000     | degrees C  | ok    | 0.000     | 0.000     | 0.000     | 79.000    | 82.000    | 84.000    
System Temp      | 27.000     | degrees C  | ok    | -9.000    | -7.000    | -5.000    | 80.000    | 85.000    | 90.000    
Peripheral Temp  | 33.000     | degrees C  | ok    | -9.000    | -7.000    | -5.000    | 80.000    | 85.000    | 90.000    
PCH Temp         | 43.000     | degrees C  | ok    | -11.000   | -8.000    | -5.000    | 90.000    | 95.000    | 100.000   
P1-DIMMA1 TEMP   | 30.000     | degrees C  | ok    | 1.000     | 2.000     | 4.000     | 80.000    | 85.000    | 90.000    
P1-DIMMB1 TEMP   | 29.000     | degrees C  | ok    | 1.000     | 2.000     | 4.000     | 80.000    | 85.000    | 90.000    
P1-DIMMC1 TEMP   | na         |            | na    | na        | na        | na        | na        | na        | na        
P1-DIMMD1 TEMP   | na         |            | na    | na        | na        | na        | na        | na        | na        
P2-DIMME1 TEMP   | 31.000     | degrees C  | ok    | 1.000     | 2.000     | 4.000     | 80.000    | 85.000    | 90.000    
P2-DIMMF1 TEMP   | 31.000     | degrees C  | ok    | 1.000     | 2.000     | 4.000     | 80.000    | 85.000    | 90.000    
P2-DIMMG1 TEMP   | na         |            | na    | na        | na        | na        | na        | na        | na        
P2-DIMMH1 TEMP   | na         |            | na    | na        | na        | na        | na        | na        | na        
FAN1             | na         |            | na    | na        | na        | na        | na        | na        | na        
FAN2             | 6375.000   | RPM        | ok    | 300.000   | 450.000   | 600.000   | 18975.000 | 19050.000 | 19125.000 
FAN3             | na         |            | na    | na        | na        | na        | na        | na        | na        
FAN4             | 6450.000   | RPM        | ok    | 300.000   | 450.000   | 600.000   | 18975.000 | 19050.000 | 19125.000 
FAN5             | 4575.000   | RPM        | ok    | 300.000   | 450.000   | 600.000   | 18975.000 | 19050.000 | 19125.000

$ ipmitool -I lan -H 10.x.x.x -U ADMINUSER -P PASSWORD sensor

CPU1 Temp | 29.000 | degrees C | ok | 0.000 | 0.000 | 0.000 | 79.000 | 82.000 | 84.000

CPU2 Temp | 34.000 | degrees C | ok | 0.000 | 0.000 | 0.000 | 79.000 | 82.000 | 84.000

System Temp | 27.000 | degrees C | ok | -9.000 | -7.000 | -5.000 | 80.000 | 85.000 | 90.000

Peripheral Temp | 33.000 | degrees C | ok | -9.000 | -7.000 | -5.000 | 80.000 | 85.000 | 90.000

PCH Temp | 43.000 | degrees C | ok | -11.000 | -8.000 | -5.000 | 90.000 | 95.000 | 100.000

P1-DIMMA1 TEMP | 30.000 | degrees C | ok | 1.000 | 2.000 | 4.000 | 80.000 | 85.000 | 90.000

P1-DIMMB1 TEMP | 29.000 | degrees C | ok | 1.000 | 2.000 | 4.000 | 80.000 | 85.000 | 90.000

P1-DIMMC1 TEMP | na | | na | na | na | na | na | na | na

P1-DIMMD1 TEMP | na | | na | na | na | na | na | na | na

P2-DIMME1 TEMP | 31.000 | degrees C | ok | 1.000 | 2.000 | 4.000 | 80.000 | 85.000 | 90.000

P2-DIMMF1 TEMP | 31.000 | degrees C | ok | 1.000 | 2.000 | 4.000 | 80.000 | 85.000 | 90.000

P2-DIMMG1 TEMP | na | | na | na | na | na | na | na | na

P2-DIMMH1 TEMP | na | | na | na | na | na | na | na | na

FAN1 | na | | na | na | na | na | na | na | na

FAN2 | 6375.000 | RPM | ok | 300.000 | 450.000 | 600.000 | 18975.000 | 19050.000 | 19125.000

FAN3 | na | | na | na | na | na | na | na | na

FAN4 | 6450.000 | RPM | ok | 300.000 | 450.000 | 600.000 | 18975.000 | 19050.000 | 19125.000

FAN5 | 4575.000 | RPM | ok | 300.000 | 450.000 | 600.000 | 18975.000 | 19050.000 | 19125.000

That gives us quite a useful amount of info! Though for our purposes, we’ll ignore everything except the first three columns.

Handling that in PHP, we do something like the following:

<?PHP
$output = shell_exec('ipmitool -H ' . $server->internalIp . ' -U ' . $user . ' -P ' . $pw . ' sensor 2>&1');
// Split into lines
$lines = explode("\n", $output);
foreach ($lines as $line) {
  // Remove whitespace
  $line = implode('', explode(' ', $line));
  // Explode by |
  $data = explode('|', $line);
  var_dump($data);
  // data is:
  //  $data[0] = Name
  //  $data[1] = Value
  //  $data[2] = Units
}

<?PHP

$output = shell_exec('ipmitool -H ' . $server->internalIp . ' -U ' . $user . ' -P ' . $pw . ' sensor 2>&1');

// Split into lines

$lines = explode("\n", $output);

foreach ($lines as $line) {

// Remove whitespace

$line = implode('', explode(' ', $line));

// Explode by |

$data = explode('|', $line);

var_dump($data);

// data is:

// $data[0] = Name

// $data[1] = Value

// $data[2] = Units

}

Then we need to think about the RRD’s. We need to check if we HAVE one, if so we put the data in. Or we generate a new RRD and put the data in.

if (!file_exists($rrdfile)) {
    // Create the RRD
    $options = array(
        "--step", "300", // Use a step-size of 5 minutes
        "DS:" . $data[0] . ":GAUGE:600:U:U",
        "RRA:AVERAGE:0.5:1:288",
        "RRA:MIN:0.5:1:288",
        "RRA:MAX:0.5:1:288",
        "RRA:AVERAGE:0.5:12:168",
        "RRA:MIN:0.5:12:168",
        "RRA:MAX:0.5:12:168",
        "RRA:AVERAGE:0.5:228:365",
        "RRA:MIN:0.5:228:365",
        "RRA:MAX:0.5:228:365",
    );

    $ret = rrd_create($rrdfile, $options);
    if (!$ret) {
        echo "<b>Creation error: </b>" . rrd_error() . "\n";
    }
}

if (!file_exists($rrdfile)) {

// Create the RRD

$options = array(

"--step", "300", // Use a step-size of 5 minutes

"DS:" . $data[0] . ":GAUGE:600:U:U",

"RRA:AVERAGE:0.5:1:288",

"RRA:MIN:0.5:1:288",

"RRA:MAX:0.5:1:288",

"RRA:AVERAGE:0.5:12:168",

"RRA:MIN:0.5:12:168",

"RRA:MAX:0.5:12:168",

"RRA:AVERAGE:0.5:228:365",

"RRA:MIN:0.5:228:365",

"RRA:MAX:0.5:228:365",

);

$ret = rrd_create($rrdfile, $options);

if (!$ret) {

echo "<b>Creation error: </b>" . rrd_error() . "\n";

}

What we’re doing above is creating the datastore, and creating Round Robin Archives for Min, Max, and Average. Storing a sample every 5 minutes for 24 hours (288 samples), a sample every hour for 7 days, and a sample every day for a year.

Now we need to store our data. That’s the easy part!

// rewrite 'na' to 'U' for undefined
if ($data[1]=='na') {
  $data[1] = 'U';
}
//  insert the data
$ret = shell_exec("/usr/bin/rrdtool update ".$rrdfile." N:".$data[1])

// rewrite 'na' to 'U' for undefined

if ($data[1]=='na') {

$data[1] = 'U';

}

// insert the data

$ret = shell_exec("/usr/bin/rrdtool update ".$rrdfile." N:".$data[1])

And we’re now storing data. Note the use of the shell_exec. At least in PHP5.4 on Ubuntu, rrd_update and rrd_graph do not work.

But that’s not much fun if we can’t display the graphs when we need them!

I could write them out to file and then include them from static HTML etc. But I’d rather have it all dynamically generated. I have a php file which generates the HTML table referencing the graphs:

    echo '<table>';
     $rrds = ServerRRDS::model()->findAllByAttributes(array('serverId'=>$id));
     $i = 0;
     foreach ($rrds as $rrd) {

       // Table handling
       if ($i%2==0)
         echo '<tr>';

       echo '<td>';
       echo '<img src="/index.php?r=graph/drawGraph&orderId='.urlencode($rrd->orderId).'&dataName='.urlencode($rrd->dataName).'">';
       echo '</td>';

       if ($i++%2==1)
         echo '</tr>';
     }
     echo '</table>';

echo '<table>';

$rrds = ServerRRDS::model()->findAllByAttributes(array('serverId'=>$id));

$i = 0;

foreach ($rrds as $rrd) {

// Table handling

if ($i%2==0)

echo '<tr>';

echo '<td>';

echo '<img src="/index.php?r=graph/drawGraph&orderId='.urlencode($rrd->orderId).'&dataName='.urlencode($rrd->dataName).'">';

echo '</td>';

if ($i++%2==1)

echo '</tr>';

}

echo '</table>';

And then the actual graphing script:

       // Load the Server as well
         $server = Servers::model()->findByPk($rrd->orderId);
         // Clean up the data name to get what we use in the rrd file
         $dataname = str_replace(array('+','-','.'), array('PLUS', 'NEG',  'DOT'), $dataName);

         $options = array(
           "--slope-mode",
           "--start ". $start,
           "--title=\"".$server->orderId.' - '.$rrd->dataName."\"",
           "--vertical-label=".$rrd->dataUnit,
           "--lower=0",
           "DEF:vname=/path/to/rrds/".$rrd->fileName.":".$dataname.":AVERAGE",
           "VDEF:vnamemin=vname,MINIMUM",
           "VDEF:vnamemax=vname,MAXIMUM",
           "VDEF:vnameavg=vname,AVERAGE",
           "COMMENT:\"          \"",
           "COMMENT:\"Maximum    \"",
           "COMMENT:\"Average    \"",
           "COMMENT:\"Minimum    \l\"",
           "AREA:vname#0000BB:".$rrd->dataName,
           "GPRINT:vnamemin:\"%6.2lf     \"",
           "GPRINT:vnamemax:\"%6.2lf     \"",
           "GPRINT:vnameavg:\"%6.2lf     \l\"",
        );

         $tmpfile = "/path/to/temp/moo".rand(11111111, 9999999).".png";

         $ret = shell_exec('/usr/bin/rrdtool graph '.$tmpfile.' '.implode(" ", $options)." 2>&1");

   header('Content-Type: image/png');
         header('Content-Length: '. filesize($tmpfile));
         passthru($tmpfile);
         $fp = fopen($tmpfile,'rb');
         fpassthru($fp);
         fclose($fp);
         unlink($tmpfile);

       }

// Load the Server as well

$server = Servers::model()->findByPk($rrd->orderId);

// Clean up the data name to get what we use in the rrd file

$dataname = str_replace(array('+','-','.'), array('PLUS', 'NEG', 'DOT'), $dataName);

$options = array(

"--slope-mode",

"--start ". $start,

"--title=\"".$server->orderId.' - '.$rrd->dataName."\"",

"--vertical-label=".$rrd->dataUnit,

"--lower=0",

"DEF:vname=/path/to/rrds/".$rrd->fileName.":".$dataname.":AVERAGE",

"VDEF:vnamemin=vname,MINIMUM",

"VDEF:vnamemax=vname,MAXIMUM",

"VDEF:vnameavg=vname,AVERAGE",

"COMMENT:\" \"",

"COMMENT:\"Maximum \"",

"COMMENT:\"Average \"",

"COMMENT:\"Minimum \l\"",

"AREA:vname#0000BB:".$rrd->dataName,

"GPRINT:vnamemin:\"%6.2lf \"",

"GPRINT:vnamemax:\"%6.2lf \"",

"GPRINT:vnameavg:\"%6.2lf \l\"",

);

$tmpfile = "/path/to/temp/moo".rand(11111111, 9999999).".png";

$ret = shell_exec('/usr/bin/rrdtool graph '.$tmpfile.' '.implode(" ", $options)." 2>&1");

header('Content-Type: image/png');

header('Content-Length: '. filesize($tmpfile));

passthru($tmpfile);

$fp = fopen($tmpfile,'rb');

fpassthru($fp);

fclose($fp);

unlink($tmpfile);

}

And now it’s working very nicely indeed!

Posted in IPMI, Linux, PHP, Uncategorized
No Comments

The Wandering Sysadmin

Recent Posts

Recent Comments

Archives

Categories

Meta

Extracting Credit Card data from Ubersmith

Extending the WHMCS API and Fetching Invoice PDF’s

Returned Variables

Creating RRD files in PHP