OpenShift – git push your webpage to the cloud

OpenShift provides you with up to three free gadgets. Sufficient cloud space to maintain your PoCs at no cost. The blog shall guide you through the first steps to get your PHP server and pages up and running.

Setup toolchain (git, ruby gems, rhc)

bla@blu:~$ sudo apt-get install git-core
bla@blu:~$ sudo gem install rhc
bla@blu:~$ rhc setup
OpenShift Client Tools (RHC) Setup Wizard

This wizard will help you upload your SSH keys, set your application namespace,
and check that other programs like Git are properly installed.

If you have your own OpenShift server, you can specify it now. Just hit enter to
use the server for OpenShift Online:
Enter the server hostname: ||

You can add more servers later using 'rhc server'.

Login to
Password: ******************************

OpenShift can create and store a token on disk which allows to you to access the
server without using your password. The key is stored in your home directory and
should be kept secret.  You can delete the key at any time by running 'rhc
Generate a token now? (yes|no) yes
Generating an authorization token for this client ... done
Saving configuration to /home/user/.openshift/express.conf ... done

Your public SSH key must be uploaded to the OpenShift server to access code.
Upload now? (yes|no)

Since you do not have any keys associated with your OpenShift account, your new
key will be uploaded as the 'default' key.

Uploading key 'default' ... done

Checking for git ... found git version 1.9.1

Checking common problems .. done

Checking for a domain ... none

Applications are grouped into domains - each domain has a unique name (called a
namespace) that becomes part of your public application URL. You may create your
first domain here or leave it blank and use 'rhc create-domain' later. You will
not be able to create an application without completing this step.

Please enter a namespace (letters and numbers only) |<none>|: xmpldomain
Your domain 'xmpldomain' has been successfully created

Checking for applications ... none

Run 'rhc create-app' to create your first application.

Do-It-Yourself 0.1                         rhc create-app <app name> diy-0.1
JBoss Application Server 7                 rhc create-app <app name> jbossas-7
JBoss Data Virtualization 6                rhc create-app <app name> jboss-dv-6.1.0
JBoss Enterprise Application Platform 6    rhc create-app <app name> jbosseap-6
JBoss Unified Push Server 1.0.0.Beta1      rhc create-app <app name> jboss-unified-push-1
JBoss Unified Push Server 1.0.0.Beta2      rhc create-app <app name> jboss-unified-push-2
Jenkins Server                             rhc create-app <app name> jenkins-1
Node.js 0.10                               rhc create-app <app name> nodejs-0.10
PHP 5.3                                    rhc create-app <app name> php-5.3
PHP 5.4                                    rhc create-app <app name> php-5.4
PHP 5.4 with Zend Server 6.1               rhc create-app <app name> zend-6.1
Perl 5.10                                  rhc create-app <app name> perl-5.10
Python 2.6                                 rhc create-app <app name> python-2.6
Python 2.7                                 rhc create-app <app name> python-2.7
Python 3.3                                 rhc create-app <app name> python-3.3
Ruby 1.8                                   rhc create-app <app name> ruby-1.8
Ruby 1.9                                   rhc create-app <app name> ruby-1.9
Ruby 2.0                                   rhc create-app <app name> ruby-2.0
Tomcat 6 (JBoss EWS 1.0)                   rhc create-app <app name> jbossews-1.0
Tomcat 7 (JBoss EWS 2.0)                   rhc create-app <app name> jbossews-2.0
Vert.x 2.1                                 rhc create-app <app name> jboss-vertx-2.1
WildFly Application Server 10              rhc create-app <app name> jboss-wildfly-10
WildFly Application Server 8.2.1.Final     rhc create-app <app name> jboss-wildfly-8
WildFly Application Server 9               rhc create-app <app name> jboss-wildfly-9

You are using 0 of 3 total gears
The following gear sizes are available to you: small

Your client tools are now configured.

By now, you have a working environment and setup all necessary credentials and your own cloud space.

Create your first PHP application (gear, cartridge)

bla@blu:~$ rhc create-app xmplapp php-5.4
Domain:     xmpldomain
Cartridges: php-5.4
Gear Size:  default
Scaling:    no

Creating application 'xmplapp' ... done

Waiting for your DNS name to be available ... done

Cloning into 'xmplapp'... done

Your application 'xmplapp' is now available.

SSH to:
Git remote: ssh://
Cloned to:  /home/user/xmplapp

Run 'rhc show-app xmplapp' for more details about your app.

You just successfully deployed your web server under your custom domain. You are ready to push your files to your webserver.

Publish your files using git (git push)

OpenShift relies on git repositories to synchronize files between the cloud server and your machine. Files in your repo will be pushed to the web servers document root.

bla@blu:~/Dev/rhc-git/xmplapp$ cp ~/Documents/mirror/* . -r

bla@blu:~/Dev/rhc-git/xmplapp$ ls
myfolder  robots.txt

bla@blu:~/Dev/rhc-git/xmplapp$ git add -A

bla@blu:~/Dev/rhc-git/xmplapp$ git commit -a -m 'initial content load'
[master ef9624f] initial content load
1037 files changed, 159387 insertions(+)
create mode 100644 robots.txt

bla@blu:~/Dev/rhc-git/xmplapp$ git push
Counting objects: 1058, done.
Delta compression using up to 4 threads.
Compressing objects: 100% (1046/1046), done.
Writing objects: 100% (1057/1057), 9.25 MiB | 1.22 MiB/s, done.
Total 1057 (delta 531), reused 0 (delta 0)
remote: Stopping PHP 5.4 cartridge (Apache+modphp)
remote: Waiting for stop to finish
remote: Waiting for stop to finish
remote: Building git ref 'master', commit a23b241
remote: Checking .openshift/pear.txt for PEAR dependency...
remote: Preparing build for deployment
remote: Deployment id is ab46361a
remote: Activating deployment
remote: Starting PHP 5.4 cartridge (Apache+modphp)
remote: Application directory "/" selected as DocumentRoot
remote: -------------------------
remote: Git Post-Receive Result: success
remote: Activation status: success
remote: Deployment completed with status: success
To ssh://
1aa6203..a23b241  master -> master

Finally, it’s all there. Go, have a look at

Custom Domain Name (add an alias and CNAME record)

Add an alias to your PHP application (gear) if your prefer to run it under your custom domain. Run the following command assumed your domain name is Note, you need to add a CNAME record to your DNS configuration to let point to

bla@blu:~/Dev/rhc-git/xmplapp$ rhc alias add xmplapp
Alias '' has been added.

Your web page will be reachable by Note, that TLS (formerly SSL) for custom domains is not available within the free plan.

Create your first backup (save snapshots)

Well, it’s nice to have stuff online but a local backup might come in handy some time. So, let’s keep a snapshot of the site.

bla@blu:~/Dev/rhc-git$ rhc snapshot save xmplapp
Pulling down a snapshot of application 'xmplapp' to xmplapp.tar.gz ... done

rhc will store the snapshot as gzipped tarball (.tar.gz) in the working directory. It’s named after the application xmplapp.tar.gz.

bla@blu:~/Dev/rhc-git$ ls
xmplapp  xmplapp.tar.gz

BeanShell puts Java Application Servers at Risk

Developers increasingly integrate BeanShell support into web applications to provide end users and administrators with a simple extension framework. But be warned! BeanShell support without appropriate access control will put the hosting web server at severe risk. An attacker could easily execute operating system calls and without appropriate system hardening such an attack will immediately result in full system compromise.

The BeanShell[1] is an environment that provides execution of Java code snippets in the web application context. The shell supports full Java language syntax and some loose structures for convenience. Be aware, to run code within an Java Virtual Machine (JVM) means to run code on the server. The following screenshot shows BeanShell enabled web application that just run a hello world command.

However, to be able to do some meaningful attacks one must first overcome and understand some limitations of the Java Runtime.getRuntime().exec() method. Simply putting a whole command into the exec method will not run properly since Java will internally tokenize the String and redirect IO streams. The first argument will be taken as executable. All remaining tokens will be passed as parameters to the executable. Thus, the below statement will not work as intended because the “-c” parameter awaits a single argument.

Runtime.getRuntime().exec("/bin/sh -c /bin/echo pwned > /tmp/poc"};

Following that, command injection in Java is a difficult thing to do since the attacker mostly just gains control over the parameters. However, in BeanShell we are pretty free to choose from the whole arsenal of Java API classes and methods. Finally, a correct call would look like:

String[] cmd = {"/bin/sh", "-c", "/bin/echo pwned > /tmp/poc"};

That way, Java will pass “/bin/echo pwned > /tmp/poc” correctly. Unfortunately, there is another limitation on the IO streams. Thus, to read and process the output of a command the InputStream classes will be needed. The following snippet is a working example with the Unix list directory (ls) command.


try {
    Process ls_proc = Runtime.getRuntime().exec(“/bin/ls -lah”);
    DataInputStream lsin = new DataInputStream(lsproc.getInputStream());
    String ls_str;

    while ((lsstr = lsin.readLine()) != null)
        print(ls_str + ” “);

} catch (IOException e) {

So, you might be asking yourself how this ex-course on the Runtime class’s exec method is related to BeanShell support in web applications?

I have published an advisory[3] on insufficient access control of an integrated BeanShell in an Enterprise Java (J2EE) based document management system software (OpenKM). An attacker could prepare en evil e-mail or website that runs a malicious command on the server if the OpenKM administrator clicks on the link or visits the prepared website.

For example, an attacker would simply embed the below JavaScript exploit code into a web page to cause writing a proof of concept file into the /tmp folder.

img = new Image();

Related vulnerabilities are often seen in administrative interfaces of web apps. The attack scheme is also known as Cross-site Request Forgery or XSRF[4]. There are several ways to approach the issue. Either ensure proper access controls[5] or lock down the JVM using Java security policies and the Security Manager[6]. In the end, system hardening may help limiting collateral damage in case of successful attacks.


ImageMagick C++ Template

This entry is intended to give anyone interested in using the C++ ImageMagick API a kickstart.

Base C++ code

#include <iostream>
#include <Magick++.h>

using namespace Magick;
using namespace std;


int main(void) {
cout << "hello ImageMagick.";
return 0;

Base Makefile

CFLAGS=-c -Wall -m32 -Wall -ansi -pedantic -O3 -Wno-long-long -I /usr/include/ImageMagick
LDFLAGS=-m32 -pthread -L /usr/lib/ImageMagick-6.6.2 -lMagick++ -ljpeg -lpng -ltiff -lbz2 -lxml2 -lz -lm -lgomp -lMagickWand -lMagickCore



$(CC) $(LDFLAGS) $(OBJECTS) -o $@
$(CC) $(CFLAGS) $< -o $@


rm $(EXECUTABLE) *.o

Google +1 Button for Pebble Blog

You basically need to change 2 files to add the Google +1 button to the Pebble Blog.

First, add the Google +1 button javascript code at the end of your favorite template. This should be located somewhere around themes/your-theme/template.jsp

<script type="text/javascript" src="">
<script type="text/javascript">
   (function() {
      var po = document.createElement('script');
      po.type = 'text/javascript'; po.async = true;
      po.src = '';
      var s = document.getElementsByTagName('script')[0];
      s.parentNode.insertBefore(po, s);

Second, set the button tag within the entry Java server page. So it does appears right behind the title of each blog entry. You will find the file in WEB-INF/jsp/blogEntry.jsp

<a href="${blogEntry.permalink}">${blogEntry.title}</a>&nbsp;
<g:plusone size="small" href="${blogEntry.localPermalink}"></g:plusone>


Resize multiple images using Imagemagick

Ever tried to resize a whole folder of images in a single line? Make sure you have  the imagemagick convert utility installed. Paste to following line into your bash

bash# ls -1 *.jpg > images; while read line; do SRC=$line; cp $line temp.jpg; convert -resize 400x400 temp.jpg $SRC; done < images; rm images temp.jpg

The command will resize alle images to 400 pixels height or width depending on the orientation of the image. Thus, the propotions of the image will not change.

Extract Content of Multi-part Uuencoded Binaries

I’ve been looking for a simple way to extract parts of a uuencoded file and stumbled over an old sed paper covering sed one-liners.

However, Use sed to extract multi-part uuencoded binaries and to remove extraneous header info, so that only the uuencoded portion remains. Files passed to sed must be passed in the proper order.
sed '/^end/,/^begin/d' file1 file2 ... fileX | uudecode

Amavisd Passed CLEAN Mails

Ever wanted to know what mails cleanly passed your postfix/amavis installation? Use the following statement to generate an overview for the current day.

prompt# TODAY=`date | perl -pe 's/....(......).*/$1/'` egrep "$TODAY.*Passed CLEAN" /var/log/maillog | perl -pe 's/.*(..:..).* (<.*>) ->.*Hits: (.*), size.*/$1 Hits: $3 $2/' | grep -v "Hits: -"

16:23 Hits: 2.957