i’ve been using 0x0.st pretty happily.
X0.at: upload files from cURL
31–40 of 93 posts
Re: X0.at: upload files from cURL
#32Uploading files without auth layer - is asking for trouble IMHO. Change without audit trail will encourage wrong doers. But I get the idea, this is an example for a file upload in a simple way using Curl or other tools.
> Uploading files without auth layer - is asking for trouble IMHO. If you make it super user-friendly and advertise it as the next Megaupload, sure. But if you keep a small audience of good-faith users it's not asking for problems. If you can teach me to make my file upload as hacker-friendly as this service while implementing auth, i'd be glad. Here the entire point is you don't need further configuration/credential…
This is incompatible with using curl as your client, but one “hacker-friendly way to do auth” is to use Github’s public SSH keys API.
You can stand up an (SCP/SFTP-subprotocol-only) SSH server, and tell the user to log in with their GitHub username + GitHub SSH key. Then configure your SSH server to call[1] a check on GitHub’s API to map the provided username to the GitHub user’s set of public SSH keys. From there, the server treats that list exactly as if it were the user’s ~/.ssh/authorized_keys file.
[1] As it happens, I wrote an OpenSSHD plugin for exactly this: https://github.com/tsutsu/github-auth3
Following that, you can configure PAM to continue the auth process however you like, policy-wise: let any GitHub user in; only let GitHub users in from a specific GitHub org; keep an LDAP directory of GitHub usernames such that you can attach metadata to them like “is banned” or “has used up their upload credits for the day” or “is on plan tier X”; etc.
Then, to actually handle the uploads, you can 1. set up automatic local user instantiation per remote user; 2. populate /etc/skel with just the right set of limited files to allow the user to upload into one “spool” directory; 3. have an inotify-like daemon that watches for files to be closed in that directory and handles them from there (e.g. uploading them to an S3 bucket, etc.)
—————
Or, alternately, you can avoid building this on top of OpenSSH, since you’re really fighting against the current by trying to virtualize everything, when OpenSSH expects to be relying on, and providing access to, a traditional POSIX environment.
Instead, you can have your own SSH server daemon that provides access to a pretend environment inside the SSH-server process, and handles SCP/SFTP upload streams through a custom in-process handler, the same way a web framework handles PUT requests.
I don’t know how common this is in other runtimes, but Erlang has an SSH server framework that you can use to implement exactly this. (As it happens, I’ve also written a high-level service that uses this SSH server framework to implement an alternative carrier for Erlang remote shell, where you can just SSH into the Erlang node to get a shell on it: https://github.com/tsutsu/exuvia. This app is also, AFAIK, the only public/FOSS demonstration of how to use Erlang’s SSH server library—which is kind of sad. People should play with things like this more! Make MUDs and such!)
Re: X0.at: upload files from cURL
#33Re: X0.at: upload files from cURL
#34Sia https://siasky.net/ has also upload from curl.
Re: X0.at: upload files from cURL
#35These are always nice little sites to have around, but they can't really grow much in popularity before users start abusing them to distribute illegal things at which point the site has to start doing more and more content moderation or be shut down.
Can confirm. I had a public demo of my open source image hosting solution [1] (where you can resize images and videos by just entering a different URL) up for years without problems, until idiots started uploading CSAM (Children sexual abuse material). Luckily I found out before law enforcement did [2] so I proactively talked to my federal bureau for months generating Excel sheets of IPs and access times and devices…
The process of properly reporting and working with authorities seems daunting. (Anecdotally,) It sounds too easy to implicate yourself for a technical violation of the law by (even unknowingly) hosting this content, or accidentally transferring it to one of your personal devices. Much worse following the advice of your local police to print out images which would be completely illegal! On the other hand, if the process was too lenient on reporters, hosting a file sharing service that "gets abused" with illegal content might turn into the ultimate scapegoat for illegal content users/creators/brokers
Nice job going through the reporting process and I'm glad you blogged about it to share with others
Re: X0.at: upload files from cURL
#36I like the simplicity of it. One PHP file, throw it on a server with Apache and rock and roll.
Other comments are right to point out that this site is setting itself up to be abused. My feeling is that this is intended to be a demo. I doubt the creator is trying to provide a real service here. And they might be in for a rude awakening if it gains traction.
But, it looks like they intend this to be open source. Anyone can clone the repo and run this on their own server! Unfortunately, the repo does not have a license file, which makes me a little uneasy.
Edit: I didn’t say that very well. With no license file, technically we cannot actually use this code since it defaults to ‘All rights reserved’. I think the author might not realize that though. It seems they intend it to be ‘open’ based on line 334.
Also, it is not particularly good PHP code, a little rough around the edges. But hey, it's a cool demonstration on a very straight forward way to upload & share files! Could be a good starting point to develop further.
Re: X0.at: upload files from cURL
#37Earlier quoted context omitted.
Came to say this. OP: If this is your site it will be used for piracy, underage porn and phishing within hours.
which makes the p2p file transfer websites so special https://file.pizza/ and https://webwormhole.io/ (*based on https://github.com/magic-wormhole/magic-wormhole )
[deleted]
Re: X0.at: upload files from cURL
#38Earlier quoted context omitted.
Link is dead for me.
Which one? https://downforeveryoneorjustme.com/transfer.sh says it's up and fine for me. If you're curling don't include the last character that the URL has in response. That's effectively a carriage return/end of data
This is what my dig shows
`transfer.sh. 2 IN A 0.0.0.0`
Re: X0.at: upload files from cURL
#39Earlier quoted context omitted.
Which one? https://downforeveryoneorjustme.com/transfer.sh says it's up and fine for me. If you're curling don't include the last character that the URL has in response. That's effectively a carriage return/end of data
This is what my dig shows `transfer.sh. 2 IN A 0.0.0.0`
Probably your DNS blocking it then
Re: X0.at: upload files from cURL
#40Yeah this is asking for trouble. We only had a small demo on our homepage where users could upload media files and they were deleted after 24 hours and still some people managed to abuse it and nearly got our site killed, domain blacklisted in Google with a big red screen of death.
I don't want to spam any links here but if you are interested please do look at my last post about the dangers of doing this and lessons I learned from my mistake.
Please do not keep the files for 10 days. Even 24 hours is a deal-breaker. From what I've learned, anything more than 30 minutes can get you into trouble.