Securing JBoss AS From Remote Exploit

This morning i got a call from office telling that she can't accessing our ERP application. After some checking i found that there are something wrong with Jboss AS. There are some unrecognized .war files on deploy dir. The .war files only contain one .jsp file with similar code. The results from web search lead me to this website. The code was same, and obviously we were the victim.

It was exploiting standard and unsecured jmx console on jboss (i'm still using jboss v4.0.2), well.. that was entirely my fault wasn't to prioritize securing jmx and web console on production server. The code on .jsp was intended to open a console (cmd on windows or sh on linux) and fortunately the jboss service was executed by user 'jboss' not 'root' (you can imagine what happen if it was root).

This 'accident' forcing me to take time (mine and users) to apply jboss security. First step is i opening bookmark list on my browser (believe me or not i was bookmarking an some articles about securing jboss a couple months ago) and start to apply them. Here are the links : SecuringTheJMXConsole - Jboss Comunity and JBoss Application Server Security Vulnerability Notice.

Now some security was applied, and i need to test it right? download the exploit code and put it into linux box because it wrote using perl and i don't have perl on my windows. First i try the exploit to jboss on my development server which using standard/unsecured version and the exploit was working, this proofing that the exploit is wasn't defect. Then i try it to jboss on production server which the jmx and web concole already secured, and failed while complaining can't upload the file.


For now the jboss is secure from the exploit while i still need to explore other posibilities.

Update: April 1, 2011

Days after implementing secure jmx and web console, i'm not found any alien .war file any more. But netstat result mention some unknown irc connections.
Then i take these step:

1. Run a full scan and found 3 infected files:

ieh: Trojan.Perl.Shellbot-2
.X-un1x: Trojan.Perl.Shellbot-2
xh: Linux.Rst

and remove them.

2. I also checking /tmp and removing some suspicious files/folders which is owned by jboss and nothing to do with currently deployed legit applications (i.e: hibernate cache files).

3. Kill all process by PID shown from netstat (i use -p option to show pid).

4. Re-check all process which is owned by jboss except one which running Jboss Server.

5. Check again netstat to make sure there are no more unwanted connections.
No comments:
Labels: , ,

WAR File Auto Deployer

Ok, here its scripts for auto deploying war file, so i don't have to wait all the employees logged out before i can bring down the server ;)

1) create a file with name '/erp/scripts/war-deployer.sh'

#!/bin/bash
#
# WAR File Deployer Script
# description: Its simply stop service, backup file, replace file, and start the service again.
#

WAR_FILE="erp.war"
DIST_DIR="/erp/readyToDeploy"
DEPLOY_DIR="/usr/jboss/server/default/deploy"

# stop jboss server
/sbin/service jbossd stop

# backup
BACKUP_FILE="/erp/backup/$WAR_FILE-"`date +%F_%H-%M`".bak"
echo "Creating backup file $BACKUP_FILE ..."
/bin/cp "$DEPLOY_DIR/$WAR_FILE" "$BACKUP_FILE"

# replace
echo "Replacing $DIST_DIR/$WAR_FILE with $DEPLOY_DIR/$WAR_FILE"
/bin/cp "$DIST_DIR/$WAR_FILE" "$DEPLOY_DIR/$WAR_FILE"

# start jboss server
/sbin/service jbossd start


2) Then assign it in crontab:
run command crontab -e to insert job to be executed tonight into crontab. Then add following line:

05 22 7 3 * /erp/scripts/war-deployer.sh

It will execute script /erp/scripts/war-deployer.sh on 07 March 2011 22:05

3) Done! and let see if it will do the job :p

By given method above, all i need to do is put new erp.war file on distribution directory and change Day-of-month and Month field on crontab every time i need to update the application.
Btw, it will work great too if i have fixed schedule to update the app. consider this cycle: develop/bug fix > test > distribute it by put war file on dist directory and forget the 'deploy' part... ;)


read more about cron on : http://en.wikipedia.org/wiki/Cron.

update[March 26, 2011]
- fixed script (variable $DIST_FILE -> $DIST_DIR).
- crontab entry (year removed, and change ? with *).
No comments:

Handling Timestamp '0000-00-00 00:00:00' in jdbc

here i found quick ref to resolve SQLException when Timestamp value is '0000-00-00 00:00:00', link

Summary

In hibernate.cfg.xml:
<property name="hibernate.connection.zeroDateTimeBehavior">convertToNull</property>

In hibernate.properties:
hibernate.connection.zeroDateTimeBehavior=convertToNull

In mysql-ds.xml file for JBOSS:
<connection-property name="zeroDateTimeBehavior">convertToNull</connection-property>

In JDBC URL:
jdbc:mysql://yourserver:3306/yourdatabase?zeroDateTimeBehavior=convertToNull
No comments:
Labels: , ,

Replikasi MySQL Database

Dengan adanya kebutuhan untuk membuat pelaporan yang komplek tanpa membebani kenerja aplikasi utama maka saya merencanakan membuat modul tambahan khusus untuk sistem pelaporan. Aplikasi ini akan dibuat terpisah dengan menggunakan database replika dari database yang digunakan oleh aplikasi utama. Berdasarkan referensi mysql tentang replikasi dan howtos ini dan ini kelihatannya akan cukup mudah implementasi replika database tersebut, ok waktunya praktek.. wish me luck..
No comments:
Labels: ,

HOWTO: Download package dependencies for offline installation

Hari ini kebetulan ada waktu untuk mempelajari instalasi OpenOffice.org3 dengan menggunakan bantuan buku + cd info linux extra no.01/2009, isinya full tentang OOo3.
Skip dulu yang lainnya, langsung ke installasi! di buku itu dijelaskan step-by-step installasi pada Windows, OSX, dan Linux (Ubuntu 8.10, untuk distro lainnya hanya sekilas saja). Langsung coba install di XP, lancar, seperti biasa aja tinggal klik next terus :), berikutnya install di OSX, nah kalo ini saya ga punya jd skip aja deh.
Berikutnya adalah ubuntu, kebetulan versi-nya sama dengan ubuntu di komp yang sedang saya gunakan. Tapi maklum karena ini komp bekas pegangan orang lain dan baru bbrp hari saya pakai jadi ngga tau apakah OOo yang ada jalan atau tidak (kemungkinan besar sih tidak) karena ternyata tidak jre atau jdk yang terinstall. Itu pun baru saya ketahui pada saat install OOo3 tiba-tiba muncul message "javaldx: Could not find a Java Runtime Environment!". Setelah saya cek pada synaptic pkg manager, memang pkg jre atau jdk memang tidak terinstall... duh. Ternyata cd info linux tidak menyertakan jre. Memang ga susah sih, kita tinggal pake synaptic untuk download dan install jre/jdk nya (soalnya saya ga pegang cd ubuntu-nya :( ), tapi ada bbrp komp dengan os ubuntu yang akan di-upgrade OOo-nya. Setelah googling dikit saya nemu cara untuk mendownload package beserta dependencies-nya, sehingga saya bisa download pkg jre untuk dipajang di server files dan tidak perlu dowload jre setiap install jre.
No comments:
Labels: , , , ,

Restore MySQL Database Using Java

Restoring MySQL database from a backup file (SQL File).


import java.io.FileInputStream;
import java.io.OutputStream;

public class MySQLBackupUtil {

  private static void restore(String host, String port, String user,
      String password, String db, String sqlFile) throws Exception {
    int BUFFER = 10485760;

    String cmd = "mysql --host=" + host;
    if (port != null && port.length() > 0)
      cmd += " --port=" + port;
    cmd += " --user=" + user;
    if (password != null && password.length() > 0)
      cmd += " --password=" + password;
    cmd += " " + db;

    Process run = Runtime.getRuntime().exec(cmd);
    FileInputStream fis = new FileInputStream(sqlFile);
    OutputStream out = run.getOutputStream();
    byte[] buf = new byte[BUFFER];
    int len;
    while ((len = fis.read(buf)) >= 0)
      out.write(buf, 0, len);

    fis.close();
    out.close();
  }

  public static void main(String[] args) {
    try {
      String sqlFile = "D:\\APP\\workspace\\chunkcode\\dbtest.sql";
      restore("localhost", "3306", "root", "", "dbtest", sqlFile);
    } catch (Exception e) {
      e.printStackTrace();
    }

  }
}
No comments:
Labels: , , ,

Extracting Zip File Using Java

Extract a zip file to a directory:

import java.io.*;
import java.util.zip.*;

public class Unzip {
public static void unzipTo(String zipName, String dirName) throws Exception {
  final int BUFFER = 2048;
  File dir = new File(dirName);
  if (!dir.exists())
    dir.mkdir();

  if (!dirName.endsWith("\\") && !dirName.endsWith("/")) {
    dirName += "/";
  }
  BufferedOutputStream dest = null;
  FileInputStream fis = new FileInputStream(zipName);
  CheckedInputStream checksum = new CheckedInputStream(fis, new Adler32());
  ZipInputStream zis = new ZipInputStream(new BufferedInputStream(
      checksum));

  ZipEntry entry;
  while ((entry = zis.getNextEntry()) != null) {
    System.out.println("Extracting: " + entry + " to " + dirName
        + entry.getName());
    int count;
    byte data[] = new byte[BUFFER];
    // write the files to the disk
    FileOutputStream fos = new FileOutputStream(dirName
        + entry.getName());
    dest = new BufferedOutputStream(fos, BUFFER);
    while ((count = zis.read(data, 0, BUFFER)) != -1) {
      dest.write(data, 0, count);
    }
    dest.flush();
    dest.close();
  }
  zis.close();
  System.out.println("Checksum: " + checksum.getChecksum().getValue());
}

public static final void main(String[] args) {
  try {
    String targetDir = "D:\\APP\\workspace\\chunkcode\\tmp";
    String zipFile = "D:/APP/workspace/chunkcode/test.zip";
    unzipTo(zipFile, targetDir);
  } catch (Exception e) {
    e.printStackTrace();
  }
}
}

The code is based from this article.
No comments:
Labels: ,

MIME Type Quick Reference

MIME TypeFile Extension
application/SLAstl
application/STEPstep
application/STEPstp
application/acaddwg
application/andrew-insetez
application/clariscadccad
application/draftingdrw
application/dsptypetsp
application/dxfdxf
application/excelxls
application/i-deasunv
application/java-archivejar
application/mac-binhex40hqx
application/mac-compactprocpt
application/vnd.ms-powerpointpot
application/vnd.ms-powerpointpps
application/vnd.ms-powerpointppt
application/vnd.ms-powerpointppz
application/msworddoc
application/octet-streambin
application/octet-streamstyle
application/octet-streamdms
application/octet-streamexe
application/octet-streamlha
application/octet-streamlzh
application/odaoda
application/oggogg
application/oggogm
application/pdfpdf
application/pgppgp
application/postscriptai
application/postscripteps
application/postscriptps
application/pro_engprt
application/rtfrtf
application/setset
application/smilsmi
application/smilsmil
application/solidssol
application/vdavda
application/vnd.mifmif
application/vnd.ms-excelxlc
application/vnd.ms-excelxll
application/vnd.ms-excelxlm
application/vnd.ms-excelxls
application/vnd.ms-excelxlw
application/vnd.rim.codcod
application/x-arj-compressedarj
application/x-bcpiobcpio
application/x-cdlinkvcd
application/x-chess-pgnpgn
application/x-cpiocpio
application/x-cshcsh
application/x-debian-packagedeb
application/x-directordcr
application/x-directordir
application/x-directordxr
application/x-dvidvi
application/x-freelancepre
application/x-futuresplashspl
application/x-gtargtar
application/x-gunzipgz
application/x-gzipgz
application/x-hdfhdf
application/x-ipixipx
application/x-ipscriptips
application/x-javascriptjs
application/x-koanskd
application/x-koanskm
application/x-koanskp
application/x-koanskt
application/x-latexlatex
application/x-lisplsp
application/x-lotusscreencamscm
application/x-mifmif
application/x-msdos-programbat
application/x-msdos-programcom
application/x-msdos-programexe
application/x-netcdfcdf
application/x-netcdfnc
application/x-perlpl
application/x-perlpm
application/x-rar-compressedrar
application/x-shsh
application/x-sharshar
application/x-shockwave-flashswf
application/x-stuffitsit
application/x-sv4cpiosv4cpio
application/x-sv4crcsv4crc
application/x-tar-gztar.gz
application/x-tar-gztgz
application/x-tartar
application/x-tcltcl
application/x-textex
application/x-texinfotexi
application/x-texinfotexinfo
application/x-troff-manman
application/x-troff-meme
application/x-troff-msms
application/x-troffroff
application/x-trofft
application/x-trofftr
application/x-ustarustar
application/x-wais-sourcesrc
application/x-zip-compressedzip
application/zipzip
audio/TSP-audiotsi
audio/basicau
audio/basicsnd
audio/midikar
audio/midimid
audio/midimidi
audio/mpegmp2
audio/mpegmp3
audio/mpegmpga
audio/ulawau
audio/x-aiffaif
audio/x-aiffaifc
audio/x-aiffaiff
audio/x-mpegurlm3u
audio/x-ms-waxwax
audio/x-ms-wmawma
audio/x-pn-realaudio-pluginrpm
audio/x-pn-realaudioram
audio/x-pn-realaudiorm
audio/x-realaudiora
audio/x-wavwav
chemical/x-pdbpdb
chemical/x-pdbxyz
image/cmu-rasterras
image/gifgif
image/iefief
image/jpegjpe
image/jpegjpeg
image/jpegjpg
image/pngpng
image/tifftif tiff
image/tifftif
image/tifftiff
image/x-cmu-rasterras
image/x-portable-anymappnm
image/x-portable-bitmappbm
image/x-portable-graymappgm
image/x-portable-pixmapppm
image/x-rgbrgb
image/x-xbitmapxbm
image/x-xpixmapxpm
image/x-xwindowdumpxwd
model/igesiges
model/igesigs
model/meshmesh
model/meshmsh
model/meshsilo
model/vrmlvrml
model/vrmlwrl
text/csscss
text/htmlhtm
text/htmlhtml htm
text/htmlhtml
text/plainasc txt
text/plainasc
text/plainc
text/plaincc
text/plainf90
text/plainf
text/plainh
text/plainhh
text/plainm
text/plaintxt
text/richtextrtx
text/rtfrtf
text/sgmlsgm
text/sgmlsgml
text/tab-separated-valuestsv
text/vnd.sun.j2me.app-descriptorjad
text/x-setextetx
text/xmlxml
video/dldl
video/flifli
video/flvflv
video/glgl
video/mpegmp2
video/mp4mp4
video/mpegmpe
video/mpegmpeg
video/mpegmpg
video/quicktimemov
video/quicktimeqt
video/vnd.vivoviv
video/vnd.vivovivo
video/x-flifli
video/x-ms-asfasf
video/x-ms-asxasx
video/x-ms-wmvwmv
video/x-ms-wmxwmx
video/x-ms-wvxwvx
video/x-msvideoavi
video/x-sgi-moviemovie
www/mimemime
x-conference/x-cooltalkice
x-world/x-vrmlvrm
x-world/x-vrmlvrml
vnd.openxmlformats-officedocument.spreadsheetml.sheetxlsx
application/vnd.openxmlformats-officedocument.wordprocessingml.documentdocx
[Update 2019-05-13]
-add: docx, & xlsx.
No comments:
Labels: ,

ANSI Characters

update: [2013-01-20] just posted about how to use it on HTML
ANSICharacter
33!
34"
35#
36$
37%
38&
39'
40(
41)
42*
43+
44,
45-
46.
47/
480
491
502
513
524
535
546
557
568
579
58:
59;
60<
61=
62>
63?
64@
65A
66B
67C
68D
69E
70F
71G
72H
73I
74J
75K
76L
77M
78N
79O
80P
81Q
82R
83S
84T
85U
86V
87W
88X
89Y
90Z
91[
92\
93]
94^
95_
96`
97a
98b
99c
100d
101e
102f
103g
104h
105i
106j
107k
108l
109m
110n
111o
112p
113q
114r
115s
116t
117u
118v
119w
120x
121y
122z
123{
124|
125}
126~
128€
138Š
145‘
146’
161¡
162¢
163£
164¤
165¥
166¦
167§
168¨
169©
170ª
171«
172¬
173­
174®
175¯
176°
177±
178²
179³
180´
181µ
182
183·
184¸
185¹
186º
187»
188¼
189½
190¾
191¿
192À
193Á
194Â
195Ã
196Ä
197Å
198Æ
199Ç
200È
201É
202Ê
203Ë
204Ì
205Í
206Î
207Ï
208Ð
209Ñ
210Ò
211Ó
212Ô
213Õ
214Ö
215×
216Ø
217Ù
218Ú
219Û
220Ü
221Ý
222Þ
223ß
224à
225á
226â
227ã
228ä
229å
230æ
231ç
232è
233é
234ê
235ë
236ì
237í
238î
239ï
240ð
241ñ
242ò
243ó
244ô
245õ
246ö
247÷
248ø
249ù
250ú
251û
252ü
253ý
254þ
255ÿ
No comments:
Labels: ,

HTML Characters

CharacterCode
space&nbsp;
"&quot;
&&amp;
<&lt;
>&gt;
©&copy;
®<SUP>&reg;</SUP>
TM<FONT ><SUP>TM</SUP></FONT>
´&acute;
«&laquo;
»&raquo;
¡&iexcl;
¿&iquest;
À&Agrave;
à&agrave;
Á&Aacute;
á&aacute;
Â&Acirc;
â&acirc;
Ã&Atilde;
ã&atilde;
Ä&Auml;
ä&auml;
Å&Aring;
å&aring;
Æ&AElig;
æ&aelig;
Ç&Ccedil;
ç&ccedil;
Ð&ETH;
ð&eth;
È&Egrave;
è&egrave;
É&Eacute;
é&eacute;
Ê&Ecirc;
ê&ecirc;
Ë&Euml;
ë&euml;
Ì&Igrave;
ì&igrave;
Í&Iacute;
í&iacute;
Î&Icirc;
î&icirc;
Ï&Iuml;
ï&iuml;
Ñ&Ntilde;
ñ&ntilde;
Ò&Ograve;
ò&ograve;
Ó&Oacute;
ó&oacute;
Ô&Ocirc;
ô&ocirc;
Õ&Otilde;
õ&otilde;
Ö&Ouml;
ö&ouml;
Ø&Oslash;
ø&oslash;
Ù&Ugrave;
ù&ugrave;
Ú&Uacute;
ú&uacute;
Û&Ucirc;
û&ucirc;
Ü&Uuml;
ü&uuml;
Ý&Yacute;
ý&yacute;
ÿ&yuml;
Þ&THORN;
þ&thorn;
ß&szlig;
§&sect;
&para;
µ&micro;
¦&brvbar;
±&plusmn;
·&middot;
¨&uml;
¸&cedil;
ª&ordf;
º&ordm;
¬&not;
­&shy;
¯&macr;
°&deg;
¹&sup1;
²&sup2;
³&sup3;
¼&frac14;
½&frac12;
¾&frac34;
×&times;
÷&divide;
¢&cent;
£&pound;
¤&curren;
¥&yen;
update 2013-03-25
CharacterCodeDescription
‘&lsquo;left single quote
’&rsquo;right single quote
‚&sbquo;single low-9 quote
“&ldquo;left double quote
”&rdquo;right double quote
„&bdquo;double low-9 quote
†&dagger;dagger
‡&Dagger;double dagger
‰&permil;per mill sign
‹&lsaquo;single left-pointing angle quote
›&rsaquo;single right-pointing angle quote
♠&spades;black spade suit
♣&clubs;black club suit
♥&hearts;black heart suit
♦&diams;black diamond suit
‾&oline;overline, = spacing overscore
←&larr;leftward arrow
↑&uarr;upward arrow
→&rarr;rightward arrow
↓&darr;downward arrow
™&trade;trademark sign
No comments:
Labels: ,
Subscribe to: Posts (Atom)