Tag Info

New answers tagged

0

(This is just a complement to the correct answer from Wim Lewis.) Once you have the pid of your suspect process, here are a few commands to help you analyse what this process might be doing. Let's say you stored this pid in the variable _pid. lsof -p ${_pid} will provide you all the files opened now opensnoop ${_pid} will show you all the files during ...


1

ps l [pid] will list, among other things, the "parent process ID" (PPID) of the process. (If the parent process has exited, though, that information is lost and PPID will be 1.) ps eww [pid] will list its environment variables, which may give a hint where it came from. Are you sure this is malware and not an unexpected behavior of something you're doing on ...


1

You can upgrade your shell to a Meterpreter with sessions -u <#> and then run post modules (e.g., post/multi/recon/local_exploit_suggestor) or you can also take an existing session (Meterpreter or not) and run a local privilege escalation exploit, e.g., udev_netlink, sock_sendpage, et al, by setting the SESSION variable. Some modules vary by OS or ...


4

At this point you've achieved the basics of a compromise on the system and you're on to the common phase two of exploitation which is privilege escalation. Exactly how you can achieve that depends very much on the system in question, what code is installed on it and how it's configured. Some options for things to look for to get privilege escalation on a ...


0

According to metasploit documentation, user priv is a module alvailable to the native Windows meterpreter only (not other meterpreters). You probably want to look into unix privilege escalation, which i do not know about. I do not believe there's an automated module for metasploit that would do that... Good luck ;)


5

It has to do with the potential for early entires masking later ones: Note that earlier entries in /etc/passwd take precedence over, or mask, later entries with the same user name or same user ID. Therefore, please note the order of the entries in the example for the daemon and sync user names (which have the same user ID). Make sure you do not alter ...


5

Well any program can have security flaws and one's that interact with the Internet are exposed to potentially malicious content. That said the major browsers have pretty good track records (all things considered) at reacting to security issues and issuing appropriate patches. If you do decide to try to protect yourself from this, it might make sense to ...


0

"Let's suppose a host machine in the client environment has been infected and its performing port scanning on other machine within the LAN or same Network without passing through Firewall:" Typically, if a host within your environment gets infected, it's not going to be port scanning other devices on your LAN. At least in my experience. It's typically going ...



Top 50 recent answers are included