Alert: Bash Code Injection Vulnerability

September 25, 2014 - 8:40pm - by admin

This is really serious: Red Hat Product Security has been made aware of a vulnerability affecting all versions of the Bash package shipped with Red Hat Enterprise Linux. Since many of Red Hat's products run on a base installation of Red Hat Enteprise Linux, there is a risk of other products being impacted by this vulnerability as well.

The same issue found in Debian 6 & 7...

In order to test if your version of Bash is vulnerable to this issue, run the following command:

$ env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"

If the output of the above command looks as follows:

vulnerable<br />
this is a test

you are using a vulnerable version of Bash. The patch used to fix this issue ensures that no code is allowed after the end of a Bash function. Thus, if you run the above example with the patched version of Bash, you should get an output similar to:

$ env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"<br />
bash: warning: x: ignoring function definition attempt<br />
bash: error importing function definition for `x'<br />
this is a test

---

Find (search) and replace text from command line in multiple files (Linu

August 11, 2012 - 4:18pm - by admin

Another (and more easy) way to change text in multiple files is to use grep:

grep -lr -e 'oldtext' * | xargs sed -i 's/oldtext/newtext/g'

or to use PERL:

perl -p -i -e ’s/oldtext/newtext/g’ *

 

---

Find (search) and replace text from command line in multiple files (Linu

August 11, 2012 - 3:23pm - by admin

Just after I posted this article the second more easy solution has been found. Here it is:

Find (search) and replace text from command line in multiple files (Linux) #2

When you are working on the Linux command line and you come across a large file or a large number of files in which you need to replace a certain text with another, finding and pasting over each instance of the text can be a bit time consuming. Well, worry no more. Linux has just the solution for you. Here’s a way to find and replace a string of text in one or more files automatically.

For the purpose of this exercise we will use a Linux command line tool called “sed”.  ”sed” is a very powerful and versatile tool, and a lot can be written about its capabilities. We are using a very limited aspect of “sed” here. I would definitely recommend that you read up a little more on “sed” if you find this aspect of it interesting.

We are going to use the following syntax to find and replace a string of text in a file:

# sed -i 's/[orginal_text]/[new_text]/' filename.txt

Say you have a file called “database.txt” with numerous instances of the IP address of your database server in it. You have just switched to a new database server and need to update it with the new server’s IP address. The old IP address is 192.168.1.16 and the new one is 192.168.1.22. Here’s how you go about it:

# cat database.txt

LOCAL_DATABASE = 192.168.1.16

LOCAL_DIR = /home/calvin/

PROD_DB = 192.168.1.16

# sed -i 's/192.168.1.16/192.168.1.22/g' database.txt

# cat database.txt

LOCAL_DATABASE = 192.168.1.22

LOCAL_DIR = /home/calvin/

PROD_DB = 192.168.1.22

Now open the file “database.inc” and check to see if the new IP address has taken place of your old one. Here’s the breakup of the above command. First you call the “sed” command. Then you pass it the parameter “-s” which stands for “in place of”. Now we use a little bit of regular expressions, commonly known as “regex”  for the next bit. The “s” in the quoted string stands for “substitute”, and the “g” at the end stands for “global”. Between them they result in a “global substitution of the the string of text you place in between them.

You can optionally skip the “g” at the end. This means that the substitution will not be global, which practically translates to the substitution of only the first instance of the string in a line. So if you had a line with multiple instances of the text you are trying to replace, here’s what will happen

# cat database.txt

LOCAL_DATABASE = 192.168.1.16

LOCAL_DIR = /home/calvin/

PROD_DB = 192.168.1.16, 192.168.1.16

# sed -i 's/192.168.1.16/192.168.1.22/' database.txt

# cat database.txt

LOCAL_DATABASE = 192.168.1.22

LOCAL_DIR = /home/calvin/

PROD_DB = 192.168.1.22, 192.168.1.16

Here comes the real magic. Now, say you want to change a string of text not just in a single file, but in the entire directory you are in. There are a number of text files in which you need to find and replace the “wine” with “champagne”.

# find . -maxdepth 1 -name "*.txt" -type f -exec sed -i 's/wine/champagne/' {} \

We use the find command to get a list of all the text files in the current directory. That’s the “find . -maxdepth 1 -name “*.txt” -type f” part. “find . maxdepth 1″ tell the computer to look in the current directory and go no deeper than the current directory. The ‘-name  ”*.txt”‘ part tells find to only list files with the extension of “.txt”. Then the “-type f” section specifies that “find” should only pick exactly matching files. Finally the “-exec” part tells “find” to execute the command that follows, which, in this case, is the “sed” command to replace the text – “sed -i ‘s/wine/champagne/’ {} \”.

I realize that the above command seems complicated. However, once you use it a little bit you will realize that it is probably worth noting it down and using it. Now try changing a string of text in multiple levels of directories.

---

VIM Editor Commands

November 9, 2011 - 9:56pm - by admin

Vim is an editor to create or edit a text file.

There are two modes in vim. One is the command mode and another is the insert mode.
In the command mode, user can move around the file, delete text, etc.
In the insert mode, user can insert text.

Changing mode from one to another

From command mode to insert mode type a/A/i/I/o/O ( see details below)
From insert mode to command mode type Esc (escape key)

Some useful commands for VIM

Text Entry Commands (Used to start text entry)

a Append text following current cursor position
A Append text to the end of current line
i Insert text before the current cursor position
I Insert text at the beginning of the cursor line
o Open up a new line following the current line and add text there
O Open up a new line in front of the current line and add text there
The following commands are used only in the commands mode.

Cursor Movement Commands

h Moves the cursor one character to the left
l Moves the cursor one character to the right
k Moves the cursor up one line
j Moves the cursor down one line
nG or :n Cursor goes to the specified (n) line
(ex. 10G goes to line 10)
^F (CTRl F) Forward screenful
^B Backward screenful
^f One page forward
^b One page backward
^U Up half screenful
^D Down half screenful
$ Move cursor to the end of current line
0 (zero) Move cursor to the beginning of current line
w Forward one word
b Backward one word
Exit Commands
:wq Write file to disk and quit the editor
:q! Quit (no warning)
:q Quit (a warning is printed if a modified file has not been saved)
ZZ Save workspace and quit the editor (same as :wq)
: 10,25 w temp
write lines 10 through 25 into file named temp. Of course, other line
numbers can be used. (Use :f to find out the line numbers you want.

Text Deletion Commands

x Delete character
dw Delete word from cursor on
db Delete word backward
dd Delete line
d$ Delete to end of line
d^ (d caret, not CTRL d) Delete to beginning of line
Yank (has most of the options of delete)-- VI's copy commmand
yy yank current line
y$ yank to end of current line from cursor
yw yank from cursor to end of current word
5yy yank, for example, 5 lines
Paste (used after delete or yank to recover lines.)
p paste below cursor
P paste above cursor
"2p paste from buffer 2 (there are 9)
u Undo last change
U Restore line
J Join next line down to the end of the current line

File Manipulation Commands

:w Write workspace to original file
:w file Write workspace to named file
:e file Start editing a new file
:r file Read contents of a file to the workspace
To create a page break, while in the insert mode, press the CTRL key
And l. ^L will appear in your text and will cause the printer to start
A new page.

Other Useful Commands

Most commands can be repeated n times by typing a number, n, before
the command. For example 10dd means delete 10 lines.
. Repeat last command
cw Change current word to a new word
r Replace one character at the cursor position
R Begin overstrike or replace mode – use ESC key to exit
:/ pattern Search forward for the pattern
:? pattern Search backward for the pattern
n (used after either of the 2 search commands above to
continue to find next occurrence of the pattern.
:g/pat1/s//pat2/g replace every occurrence of pattern1 (pat1) with pat2
Example :g/tIO/s//Ada.Text_IO/g
This will find and replace tIO by Ada.text_IO everywhere in the file.
:g/a/s// /g replace the letter a, by blank
:g/a/s///g replace a by nothing
note: Even this command be undone by u

Examples

Opening a New File

Step 1 type vim filename (create a file named filename)
Step 2 type i ( switch to insert mode)
Step 3 enter text (enter your Ada program)
Step 4 hit Esc key (switch back to command mode)
Step 5 type :wq (write file and exit vim)

Editing the Existing File

Step 1 type vim filename (edit the existing file named filename)
Step 2 move around the file using h/j/k/l key or any appropriate command
h Moves the cursor one character to the left
l Moves the cursor one character to the right
k Moves the cursor up one line
j Moves the cursor down one line
nG or :n Cursor goes to the specified (n) line
(ex. 10G goes to line 10)
Step 3 edit required text (replace or delete or insert)
Step 4 hit Esc key (exit from insert mode if you insert or replace text)
Step 5 type :wq

---