Tag Info

New answers tagged

-2

W is not a risk in and of itself. However there might be times, when you'd rather there not be any local users ( lusers ) on the system. In which case, having rusers would be a better path, and the use of web based applications as opposed to shell accounts shields casual users from all this.


1

You can export the workspace from the Metasploit installed on Linux, install Metasploit on Mac OS using Carlos Parez's script or using the method outlined here. Once the installation is complete, import the workspace and you will have all the data (hosts, vulnerability information, looted data, etc) in the new setup. To export the workspace data, connect to ...


-1

No you cannot do this. The coding is specific to the operating system, Linux and OSX are different. There are two options for you. The first is to go through installing Metasploit on OSX and the other alternative would be for you to install VirtualBox, Fusion, or some other virtualization software (Parallels), and install Linux as a guest inside of OSX.


4

w, by itself, isn't what lets you do this; it doesn't have any sort of elevated privileges, and everything it can do is something you could already do yourself. The actual thing that lets you see other users' processes is that process info is stored in the /proc/ directory, and all users have access to the /proc/[pid] directories that store individual ...


2

Clamav is not the right tool, at least not by itself. It is not on par with the best commercial antiviruses. Use multiple detection engines well rated in comparative reviews. Consider an automated sandbox analysis tool like cuckoo sandbox. For public documents consider a third party service like virustotal's API (other services may come with NDAs). Use ...


0

Both LSAT and YASAT had active development in 2014. The other suggestions here have been great, you may see me upvote some of them!


4

In fact it does not matter much. The admin / normal user separation comes from the world of mainframes, back in the previous century; it was expected that a given computer was used by several (many) users, often at the same time, and these users do not trust each other. The OS enforced separation, and becoming "administrator" allowed for bypassing that ...


1

I'd say that's fine. As long as you don't preface your commands with 'sudo', you're just like any other user on the system. Just be mindful that when you use sudo, you're borrowing the power of root. Don't use sudo for untrusted programs and scripts, and keep your password extra secure. However, if there is a sudo vulnerability that allows for ...


0

Given Turla is based upon cd00r, there should not be any privilege escalation involved. cd00r runs as normal user application, starting an inetd service on some predefined ports. Thus, removing execute permissions on inted should be enough to block it. sudo chmod o=r `which inetd`


1

Yes it is possible but unnecessary in your case. People often use VMs to isolate potentially malicious applications from their main host and to have some sort of rewind button to restore the VM to a previous state in case something goes wrong in there, but looks like that's not what you want to do. To defeat forensics all you need is full disk encryption ...


0

FYI, with minor changes to tpm-luks, I got it working with our application to secure the root partition's LUK key in TPM NVRAM. The scripts work like a charm. It's easy if it's not a root partition but maybe some other partition or file. I tied the key into NVRAM based on PCRs 0 through 9 and also 12 and 13. Be aware your BIOS should comply with NIST ...


0

could you recommend what I should do to keep someone in computer forensics from finding any deleted files or files for that matter? Securely delete files, and erase over the empty space on your hard disk with a three-pass algorithm. There's a great guide for that here, on AskUbuntu. Technically you can recover stuff that has been passed with less than ...


0

Download and run Linux Exploit Suggester: $ perl ./Linux_Exploit_Suggester.pl -k 3.0.0 Kernel local: 3.0.0 Possible Exploits: [+] semtex CVE-2013-2094 Source: www.exploit-db.com/download/25444/‎ [+] memodipper CVE-2012-0056 Source: http://www.exploit-db.com/exploits/18411/


12

TURLA is the final stage of a large and sophisticated family of malware. There have been known Windows versions since at least 2010. This 40 page presentation is the most comprehensive resource I have seen, for either platform. TURLA - development & operations Some Windows Highlights Stage 0: attack stage - infection vector Stage 1: reconnaissance ...


0

(not so)Complete answer: #chmod 1770 /directory/containing/syncfile.txts/ #chmod 1750 /directory/containing/syncfile.sh/ #chgroup www-user /path/to/syncfile.sh chmod- 1:Sticky Bit (only owner may delete or modify) 7:deploy-user +rwx 7:group users (www-user) +rwx 0: Everyone else gets no read, write, or execute.Setting the sticky bit on the second ...


0

If I'm understanding your question correctly, I believe the easiest solution is: chgrp <user> /path/to/syncfile All of what you are trying to do can be accomplished with chmod, chgroup, or chown. (*not enough rep to hyperlink >2 times) This command above will keep the syncfile owned by owner, while giving group ownership to user. User group ...


21

Basically it's using the suid bit. If you check the passwd command in your machine: -rwsr-xr-x 1 root root 43K Feb 15 2011 passwd SUID (Set owner User ID up on execution) is a special type of file permissions given to a file. Normally in Linux/Unix when a program runs, it inherits access permissions from the logged in user. SUID is defined as ...


0

The MySQL SO_PEERCRED authentication is fairly recent, it was added in version 5.5.10, March 2011. The similar Postgres authentication is a lot older. (Note that Postgres also supports ident, RFC 1413, authentication; MySQL does not, that would be another plugin, perhaps someone will write it.) The relative newness of the feature in MySQL would be one reason ...


-2

Do xor 0 and exit() linux syscall instead of nop since the argv ends with a null byte opcode, thats the cause for segfault


3

In the proposed example, the program is executing a nop sled consisting of \x90. After this nop sled executes, it does not return to main, and therefore crashes with a Segmentation fault. Consider learning more assembler, and most importantly, use GDB to debug segmentation faults.


1

The easiest way is probably to use a secure kernel, I mean the grsecurity patched kernel: http://grsecurity.net/ Grsec is providing 2 options to disable usb after boot : the soft one : https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options#Deny_new_USB_connections_after_toggle User can still unlock usb using a sysctl ...


0

You could make use of the secure boot feature present in many computers, if the netbook does support it and the manufacturer hasn't locked it to Microsoft Boot Keys. What you could do then, is clearing the Secure Boot key database, and then making your own signing key and installing in the BIOS as PK (Platform Key) and KEK (Key Exchange Key). After this, ...


0

Not a direct answer to your question...but the following would be cumbersome as a comment/without formatting. Based on the link you provided, the exploit you want to prevent is essentially 'malicious alteration of initrd.img by someone with physical access to the hard drive'. Since you plan to move /boot to a USB stick, initrd.img will no longer be on the ...


8

It's always a question of effort vs result. If an attacker has gained complete control over the system, there are thousands of things that can be replaced or trojanized. Hunting them down one by one is a very time consuming task. If the attackers aren't very sophisticated, you can start by searching for files that have been modified recently. One starting ...


56

You should "nuke it from orbit": wipe and reinstall the OS and applications from clean source media, and then carefully restore the data from backup.


3

I doubt this is possible to set up in the BIOS. However, even if it was, you have a bigger issue: The only way to identify a USB device is by its vendor and device ID. However, all devices by a specific vendor share the same device ID. So even if you could whitelist your own USB, any USB of that same make would also be accepted. Also, I'm pretty sure it's ...


0

Just take a look at OpenVZ kernel changelogs -- there are regular (up to a few times per month) kernel releases, often with CVE fixes. Also, it's not 2.6.32 -- it's RHEL6 (which was based on 2.6.32 but moved forward a lot).


0

most probably a firewall. a good firewall will block outgoing connections, just like most firewalls block incoming connections if the local firewall does not allow outgoing connections to port 4444 that wont work perhaps try using a basic port like 80 or 443


0

You asked this question and it was downvoted before. There could be a lot of reasons for this happening, your question is too broad, and lacks a lot of relevant information. For example, can you ping that host, is it running a firewall, it is vulnerable to that exploit. What you are experiencing is the host not responding back after it is exploited. This ...


2

There's a myriad of ways, depending on the system configuration and installed software. Learn what you can about the system, and then look for publicly-known "privilege escalation" vulnerabilities in the OS and installed software. Make sure to check for the specific versions that are installed, as most known vulnerabilities will likely have been patched in ...


0

Remove your browsers profile data from your account, and clean out any extension synchronization you might have. As others have said if other accounts are unaffected it is likely a rouge plugin of some kind. I also wouldn't trust that profile for much, if it was me, I would get whatever static files I needed out of that account, delete it and make a new ...


0

Since other user accounts seem fine, the system itself is probably not compromised. In that case, I'd back up the user's home directory, then nuke their preferences (every file and directory in $HOME that begins with a .). If that fixes it, I'd selectively restore files from backup until things break again, then take a careful look at the ...


1

Here are some of the steps I would take: 1) Run Burpsuite as a proxy server, intercept the calls, and analyze whether or not there is a specific page you are visiting that is causing this. 2) Uninstall any browser plugins you may be using 3) Remove and reinstall the browser(s) The extreme measure would be to dig into your files and find where the ...


0

According to my reading of the source code (docs/file-format.txt), the iteration count is stored in the keyring file, specifically in the 25th through 28th bytes after the end of the keyring name.


0

Drivers for hardware devices in your system typically operate with a high degree of privilege. They need to, in order to interface with your hardware. So the question is - how much do you trust the code you're running at a high privilege level? For that, you'd probably have to consider source of driver, whether it's signed by the issuer, can you inspect ...


0

I found some related news that hopefully confirms that openvz does in fact apply patches to their kernel as they come out: The OpenVZ kernel is based on the Linux kernel. The OpenVZ team tracks and analyzes all the security updates to the Linux kernel and applies them accordingly. To achieve the maximum possible security and stability, stable OpenVZ ...


1

When you say that 128 bits are not enough for you, and you really want 256 bits, then you are basically saying one of the two following things: Laws of physics do not apply to you. You do not understand what key size is, and you just want the biggest number, the cryptographic equivalent of painting your car in red to make it go faster. Your choice. See ...


1

If I understand correctly, your computer serves as a Wifi Access Point, so it should have a dhcp server running on wlan0, is that so ? Assuming this is the case, First you need to have /proc/sys/net/ipv4/ip_forward set to 1 instead of 0 (if you are using IPv4, I don't know the equivalent for IPv6, if there is any) The iptables command you are looking for ...



Top 50 recent answers are included