Tag Info

Hot answers tagged

3

In short, you have NO idea what he downloaded, so change ALL PASSWORDS. I would also be interested to know if it was possible to upload.


3

Your problem is ASLR randomly choosing where your program is loaded. You can turn off ASLR in Linux using sudo sysctl -w kernel.randomiz_va_space=0. Here's my program. I'm using RAX instead of EAX, and an unsigned long * rather than an int *. #include <stdio.h> #include <stdlib.h> unsigned long *get_stack_ptr(void) { __asm__( "mov ...


3

From the nmap documentation: Another cause of duplicate fingerprints is embedded devices which share a common OS. For example, a printer from one vendor and an ethernet switch from another may actually share an embedded OS from a third vendor. In many cases, subtle differences between the devices still allow them to be distinguished. But ...


2

This is normal. It's how EFS works. Although it is common to refer to file folders with the encryption attribute set as “encrypted,” the folder itself is not encrypted. When encryption is set for a folder, EFS automatically encrypts all new files created in the folder and all files copied or moved into the folder by using My Computer. (Source: ...


2

What you're looking at is a PLT, which is a way of doing late-bound library imports. The "calling convention" of PLTs isn't standard, but the toolchain usually uses register-based parameter passing for performance, which is why you're seeing edi as the address of the string. The call will go to a stub in the Global Offset Table (GOT) which then calls into ...


2

I don't believe any improvements were made to the Linux development cycle in response to ShellShock. As "the vulnerabilities had existed since version 1.03 of Bash released in September 1989" (Wikipedia), it's not considered a current development cycle issue. (And insofar as it is, it's a universal lesson: "don't write buggy code, and find it if you do", ...


1

There was some very carful algebra done on this site on the variables that manage a doubly linked list of addresses. Have you investigated the source code in for malloc.c and unlink to see that the code has not changed in some way? I believe you will find your problem in there.


1

Access can be controlled for local processes accessing local network assets like for example network ports. By associating labels with port objects and userids, groupids associated with processes (even individual processes, allowing you to specify whether and how an entities associated with particular labels can operate on or interact with entities ...


1

The seminal work on detection of promiscuous interfaces on the network is Detection of Promiscuous Modes using ARP Packets: ...promiscuous mode detection is performed by checking the responses of ARP packets, when ARP request packets are sent to all nodes on the network I don't know of implementations offhand, but the paper is detailed enough for ...


1

So this should answer the question of "is symlink common?" A search on the MITRE database shows there are 4 CVEs for a Linux Symlink Race condition vulnerability. For comparison, there are 2749 Linux CVEs known to MITRE. Linux at the kernel level has protections against this. Kees Cook created a patch for Linux to prevent this problem: The solution is ...


1

I think it is fine to have a web facing panel as long as: Its not guessable, for example, www.example.com/admin. U don't want notorious users to attempt brute-forcing for two reasons: Incase the brute-force succeeds. If u have an account lockout policy in place, which you should, u don't want to be locked out by notorious users. Use strong passwords ...


1

There is no isolation between GUI apps on X11, so that allows your user to spy on your clipboard's content, create windows that may look like spoofs of your own windows (e.g. spoofs of your polkit1 dialog or screen locker), record your entire monitor, implement a keylogger... Just create a guest session, seriously. Or use a VM. I would not trust other ...


1

You may find a forensic tool called unhide to be of interest! http://www.unhide-forensics.info unhide uses a variety of techniques to find (or unhide) hidden processes and TCP/UDP ports utilized by rootkits/LKMs (Loadable Kernel Modules). It supports both Linux/Unix & Windows... More details on the techniques used can be found on the website: ...



Only top voted, non community-wiki answers of a minimum length are eligible