Tagged Questions
3
votes
2answers
116 views
Vulnerability testing without the use of exploits?
I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
7
votes
0answers
142 views
Help in understanding an application's crash - exploitable?
Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
3
votes
1answer
190 views
Exploited by newbie3viLc063s
My debian server got exploited by some scriptiekiddie who used Newbie3viLc063
http://pastebin.com/jma8JRG1 .
Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
6
votes
2answers
194 views
Using 'sudo vim' to spawn a shell
I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using ...
6
votes
0answers
134 views
Getting exploit reliability when using the off by one framepointer overwrite on linux
scenario:
we have a program that is vulnerable to a one byte framepointer overwrite (note: stack is marked executable, Linux machine with aslr disabled and stack cookies disabled also standard x86 so ...
1
vote
2answers
159 views
Is this Scenario Exploitable?
Here is the scenario:
You get to overwrite 4 (consecutive) Bytes of a Userland Remote Process in Linux without Exploit Mitigation and without the ability to inject any Shellcode and you know the ...
1
vote
1answer
137 views
Can exploit vulnerability if program started with gdb, but segfaults if started without gdb
i'm currently trying to exploit a simple program called basic_vuln.c
#include <stdio.h>
int main(int argc, char** argv) {
char buf[64];
strcpy(buf, argv[1]);
}
I'm using xubuntu ...
7
votes
2answers
202 views
How a malware executes remote payload
Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
1
vote
1answer
397 views
NGINX / HTTP TRACE
I have a http server Nginx with HTTP TRACE Enabled.
A single nmap --script=http-methods.nse host.name give this result :
Not shown: 988 closed ports
PORT STATE SERVICE VERSION
[...]
...
2
votes
2answers
693 views
How to hack linux via Local File Inclusion vulnerability?
During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB.
I tried to exploit the ...
4
votes
1answer
71 views
Testing a chroot environment for privilege escalation vulnerabilities
I'm looking for holes in my current implementation of a chroot jail that I have implemented for a group of users. Is there anything I can do better here?
I utilized the following packages:
RHEL6
...
7
votes
3answers
379 views
How to gain a shell?
I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user.
My question is this: I can create application that is guaranteed to be run by the ...
8
votes
2answers
1k views
Which Linux kernel vulnerabilities allow installing a kernel-level rootkit?
My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify ...
0
votes
1answer
490 views
Can you describe a real-life scenario of exploiting sticky bits?
Sticky bit are mentioned in every UNIX security book, but I couldn't find anyone that describes the exploitation of Sticky Bit set on a file.
Can you?
3
votes
1answer
344 views
Two questions about learning Linux exploit development fundamentals
getting ready to delve into the technical world of vulnerability assessment, and I have two questions about where to find certain information.
First, I plan on reading "Understanding the Linux ...
