Patching Bash "shellshock" on Apple Mac OS X 10.9.5

Given the recent bash vulnerability disclosure[1] most linux distributions have released patches. Unfortunately Apple still expected users to compile their patches into bash. If you were using Homebrew or Macport you were in better standing and simply had to create symlinks to the patched executables. I've documented the steps I had to take on my Mac desktop.

Compile

1. mkdir bash
2. cd bash/
3. wget http://opensource.apple.com/tarballs/bash/bash-92.tar.gz
4. tar zxvf bash-92.tar.gz
5. cd bash-92
6. cd bash-3.2/
7. curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 | patch -p0
8. curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-053 | patch -p0
9. curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-054 | patch -p0
10. cd ..
11. xcodebuild

Verify

1. /bin/bash --version
2. ~/bash/bash-92/build/Release/bash --version

Install

1. sudo mv /bin/bash /bin/bash.vulnerable sudo cp /bin/bash /bin/bash.vulnerable
2. sudo mv /bin/sh /bin/sh.vulnerable sudo cp /bin/sh /bin/sh.vulnerable
3. sudo chmod 0000 /bin/bash.vulnerable
4. sudo chmod 0000 /bin/sh.vulnerable
5. sudo cp ~/bash/bash-92/build/Release/bash /bin/
6. sudo cp ~/bash/bash-92/build/Release/sh /bin/
7. /bin/bash --version

References:

1. https://www.us-cert.gov/ncas/current-activity/2014/09/24/Bourne-Again-Shell-Bash-Remote-Code-Execution-Vulnerability
2. http://www.theregister.co.uk/2014/09/24/bash_shell_vuln/
3. https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
4. https://access.redhat.com/articles/1200223
5. http://alblue.bandlem.com/2014/09/bash-remote-vulnerability.html
6. http://support.apple.com/kb/HT1222
7. http://lists.gnu.org/archive/html/bug-bash/2014-09/msg00085.html
8. http://lists.gnu.org/archive/html/bug-bash/2014-09/msg00228.html
9. http://lists.gnu.org/archive/html/bug-bash/2014-09/msg00282.html

! LaTeX Error: File `algorithm2e.sty' not found.

During yet another LaTeX project on my MacBook, I added some algorithms to my paper. After checking a couple of examples online, and discussing with a colleage I decided to go with algorithm2e over others such as algorithm, algorithmic, algorithmicx, program and pseudocode[1].

However I got the following error "! LaTeX Error: File `algorithm2e.sty' not found." Since I am using macport, to resolve this I needed to install the texlive-science package by executing sudo port install texlive-science, and all was good again.

References:

1. http://en.wikibooks.org/wiki/LaTeX/Algorithms_and_Pseudocode

Connecting to OpenVPN from a Mac using Tunnelblink

To connect to an OpenVPN server you need an appropriate OpenVPN client installed to establish the SSL link. For Apple Mac OS X systems, TunnelBlick (http://code.google.com/p/tunnelblick/) is a good graphical user interface. At the time of this blog the current latest stable version of TunnelBlick available was 3.2.7. These instructions were executed on an Apple iMac running Mac OS X 10.7.4. As with all other posts on this blog, the purpose of this post is not to provide a tutorial, but instead to documents the steps taken, for my own benefit.

Download and install Tunnelblink

1. Download the latest stable version of TunnelBlick (3.2.7).
2. Click on the downloaded dmg package file to mount it.
3. Once the Tunnelblink window is open double-click the Tunnelblink.app icon
4. A warning may be displayed to indicate that the package may be unsafe as it was downloaded, continue by clicking the "Open" button
5. Enter the system administrator credentials to start the install
6. Once installation is completed, the installation succeeded window will be displayed, click the "Quit" button
7. Close the Tunnelblink window, and eject the dmg package
8. Start the Tunnelblink GUI by going to Applications and clicking Tunnelblink.app
9. You should see a Tunnelblink icon up the top

The first time you start the Tunnelblink application

1. A warning may be displayed to indicate that the package may be unsafe as it was downloaded, continue by clicking "Open" button
2. When prompted, click on the "I have configuration files" button

Setting up the OpenVPN connection

1. Then click on "OpenVPN Configuration(s)" button
2. Select the "Create Tunnelblick VPN Configuration" button to generate a configuration based on your OpenVPN configuration files
3. Take a note of the instructions in the dialog box and Click the "Done" button
4. You may be prompted for automatic updates
1. To prevent your system details (although it is anonymous) from being transmitted, uncheck the "Include anonymous system profile" 
2. Then click on "Check Automatically" button to enable automatic checking of updates
5. You should have a directory called "Empty Tunnelblick VPN Configuration" on your desktop
6. Get the CA certificate (ca.crt), your private key (I used MACHINE.key as an example) and certificate (e.g. MACHINE.crt) and your client configuration file (this may be something like client.ovpn or client.conf). These should be provided by your network administrator.
1. ca.crt
2. MACHINE.crt
3. MACHINE.key
4. client-config.ovpn
7. Copy or move the files above into the directory on your desktop
8. Rename the directory into something meaningful with a .tblk extension, e.g. Office-VPN.tblk
9. When prompted to add the .tblk extension click on the "Add" button, you should see the directory icon change to a Tunnelblink icon
10. Double-click the renamed directory to install the configuration
11. When prompted to continue the installation click the "Only Me" button
12. Enter the system administrator credentials to complete the install
13. Once installed, click the "OK button"

Changing DNS settings

1. Right click on the Tunnelblink icon up the top
2. Select VPN Details, then select the VPN connection you wish to edit, e.g. "Office-VPN"
3. Select the "Settings" option on the middle of the window
4. Change the "Set DNS/WINS" option to suit, e.g. You may want to disable DNS changes to be pushed through from the VPN tunnel, thus to use your existing nameserver configuration select "Do not set nameserver"

Connecting to the VPN

1. Once Tunnelblink has been installed and the configuration completed
2. Right click the Tunnelblink icon up the top
3. You should see the VPN connection, e.g. "Connect Office-VPN", select it to connect

Disconnecting from the VPN

1. Once the VPN connection has been established and you wish to disconnect
2. Right click the Tunnelblink icon up the top
3. You should see the VPN connection, e.g. "Disconnect Office-VPN", select it to disconnect

Here is a sample client configuration file for reference, substitute the SERVER, PORT and MACHINE as appropriate

client

dev tun

proto udp

remote SERVER PORT

resolv-retry infinite

nobind

persist-key

persist-tun

ca ca.crt

cert MACHINE.crt

key MACHINE.key

comp-lzo

verb 3

; the following lines are needed for Windows Vista, 7 and 8 machines, not needed for Windows XP

route-method exe

route-delay 2

References:

1. http://code.google.com/p/tunnelblick/

Change Apple Mac OS X Software Update Service (SUS) address

Apple IU Software Update service allows uses to keep their Mac OS X machines updated with the latest software updates and security patched. In some controlled environments, the update servers are specified in the user profile. Sometimes there may be delays in the server updates, or problems with the local update server and users may desire to connect to Apple's services directly. Here's are some instructions that users may find useful. Please note that to make configuration changes you will need Administrative privileges on your Mac.

Users should also note that where a URL for the update catalog is not specified, network administrators may have implemented transparent update redirection by manipulating DNS entries on a local server for URLs such as; http://swscan.apple.com, http://swquery.apple.com, http://swdownload.apple.com, http://swcdn.apple.com

Check the SUS server settings
To check you current SUS settings, issue the following command from a terminal;

1. /usr/libexec/PlistBuddy -c Print /Library/Preferences/com.apple.SoftwareUpdate.plist
2. /usr/libexec/PlistBuddy -c Print ~/Library/Preferences/com.apple.SoftwareUpdate.plist

The above commands would produce an output similar to the following;

Dict {

    LastAttemptSystemVersion = 10.7.2 (11C74)

    LastRecommendedUpdatesAvailable = 0

    RecommendedUpdates = Array {

    }

    CatalogURL = http://XXX.XXX.XXX.XX:8088/index.sucatalog

    LastResultCode = 2

    ScheduleFrequency = 1

    LastUpdatesAvailable = 0

    LastAttemptDate = Thu Jul 26 10:37:51 EST 2012

    LastSuccessfulDate = Thu Jul 26 10:37:51 EST 2012

}

Change the SUS server settings back to Apple's default
Delete the CatalogURL entry by issuing the following command to force the IU software update to connect to Apple's URL

1. defaults delete /Library/Preferences/com.apple.SoftwareUpdate CatalogURL

To change the SUS server
To change the SUS server to any other value issue the following command from a terminal;

1. defaults write com.apple.SoftwareUpdate CatalogURL 'http://SERVER:PORT/index.sucatalog'

References

1. http://support.apple.com/kb/HT3923

IEEETrans on Mac OS X with texlive

While compiling a journal paper, I got the following error message "I couldn't open style file IEEEtran.bst"

The IEEETrans TeX distribution can be manullay installed by using the packages from CTAN [1] or  IEEE [2]. However since I use macports, I just had to;

1. sudo port install texlive-publishers

References:

1. http://www.ctan.org/tex-archive/macros/latex/contrib/IEEEtran/
2. http://www.ieee.org/portal/cms_docs/pubs/transactions

Installing Metasploit 4.0.0 on Apple Mac OS X 10.6.8

The installation instructions are quite well documented on the Rapid7 documentation site[1]; But in my usual style of duplicating data on the Internet, I have documented my efforts below. The key requirements of Xcode and macports was already addressed on this particular machine :)

Note: It's important to ensure that any anti-virus (AV) software is temporarily disabled and appropriate scanning exceptions added, this is to prevent the AV from quarenteening the exploits and payloads that some with metasploit.

1. sudo bash
2. port selfupdate
3. port install ruby19 +nosuffix
4. echo $PATH # Ensure that /opt/local/bin appears before /usr/bin, else edit ~/.bash_profile file and source it; ". ~/.bash_profile" or "source ~/.bash_profile"
5. port install mysql5-server
6. gem install mysql
7. cd /opt
8. wget http://updates.metasploit.com/data/releases/framework-4.0.0.tar.bz2
9. bunzip2 framework-4.0.0.tar.bz2
10. tar xvf framework-4.0.0.tar
11. cd msf3
12. svn update
13. ln -s /opt/msf3/msf* /opt/local/bin/

References:

1. https://community.rapid7.com/docs/DOC-1037
2. http://www.metasploit.com/download/