Questions tagged [bash]

The Bourne-again shell (Bash) is a unix shell. It lets the user run commands on the host machine in as a text based program. Questions using this tag should either be related to vulnerabilities of bash or proper use of specific commands.

Filter by
Sorted by
Tagged with
2
votes
0answers
64 views

Unable to start reverse shell over HTTP

I am able to get a reverse shell working locally over TCP, but failing to trigger it remotely over HTTP. Locally over TCP: Attacker terminal runs netcat to listen for a connection over port 8000: nc -...
1
vote
0answers
58 views

Prevent Android Meterpreter being killed when apps are closed

This is the bash script for my android payload #!/bin/bash while : do am start --user 0 -a android.intent.action.MAIN -n com.metasploit.stage/.MainActivity sleep 60 done The issue is when I do Clear ...
3
votes
1answer
66 views

Randomly generating invoice IDs

I'm in the process of setting up a local (i.e. offline and very limited) business, and I'm thinking of generating invoice IDs randomly to avoid the clients knowing that they're customer number #...
1
vote
3answers
81 views

Is running bash script that is taking arguments from site dialog box a good idea?

I'm building a site that will use youtubeAPI to keep track of playlist changes. In order for 3rd party to use it I would supply a dialog box in which user would type his/hers playlistID - this would ...
0
votes
0answers
57 views

How secure is /dev/stdin in UNIX systems?

Is decrypting secrets with ccrypt and piping the result via stdin to openvpn secure? I've written the following alias to start an openvpn client more easily than before: sudo bash -c 'cd ...
0
votes
1answer
242 views

What is bindshell backdoor?

I just found out a bindshell backdoor, but I don't know how to access/connect to it using Metasploit. I'm a beginner with exploiting; is there a way to access the backdoor? I tried to search for "...
0
votes
2answers
245 views

Exectuting sudo command in one line within a non-tty shell

I have access to a server via RCE over http. I can send post requests to the server which results in command execution. I am attempting to escalate privileges via sudo (su is not installed). The ...
0
votes
1answer
47 views

msfconsole and using bash variables

When trying to set RHOSTS for an auxiliary module, I tried using $server, which is a bash variable I've set before entering msfconsole. It is not readable from within msfconsole. How do I access bash ...
0
votes
1answer
54 views

Looking for a way to overwrite a symbolic link

I'm peparing for OSCP and I found an interesting situation (Alpine Linux). There is a daemon super_service executed by root that is reading configuration file from /var/super_service/configs/ which ...
2
votes
1answer
132 views

Is this bash command vulnerable to code injection?

I'm wondering if the following code is vulnerable to command injection in bash: sumo /bin/netflash -Uk $CONTROLED_OPTION 2>&1 I'm thinking since it's not included in " " it should be ...
0
votes
2answers
253 views

Find Buffer Overflows at a target you want to gain access

I want to pass my OSCP exam and I am learning with the material I got. I watched the videos and read the pdf but I have a question about buffer overflows. In the example in the videos, the guy has ...
0
votes
1answer
300 views

How .bashrc can be used to attack a system?

I read about this malicious Sudo function on Nullbyte where by inserting this bash function into a victims .bashrc/.bash_profile an attacker could exfiltrate sudo passwords fairly easily. This got ...
5
votes
0answers
132 views

Why am I getting seemingly random fingerprints back when connecting via SSH/SCP?

I manage an application that connects to various servers using a client-specific keypair. We have around 70 customers; all but one can connect to our FTP server (for SCP) after first accepting the RSA ...
16
votes
1answer
7k views

How to do a privileges escalation with ping?

I am trying to achieve a privilege escalation. I have a virtual machine on Linux and I escaped from an rbash terminal. I have now a "normal" user terminal. My user is not in the sudoers file. Is it ...
3
votes
2answers
104 views

Are alphanumeric strings safe to pass to a bash script?

I'm currently developing a web service that takes user input and passes it to a bash script as an argument. I know that without sanitizing this allows for remote command execution. So I want to know ...
1
vote
0answers
35 views

name file as command [closed]

name file as command Is it possible to put command as filename in Linux For example touch anything.jpg or touch anything Can i change name of file with mv to be anything;nc -e /bin/sh
2
votes
2answers
859 views

Is this Bash code vulnerable to code injection?

I'm writing a libre program named "silently" for enhancing error handling in Bash, emulating the behavior of a jidoka. My question is if that eval would be vulnerable to code injection if the ...
2
votes
0answers
64 views

Safe Bash Emulation - using chroot and qemu

I am trying to run a bash script in a sandbox to gain information about what it launches. There don't appear to be good emulators or static analysis tools for it, so I was going to run it in a chroot, ...
1
vote
1answer
379 views

Protect server in CTF challenge when exploting input() vulnerability in python

There was this challenge in one of the CTF's I played in which you had to exploit the input vulnerability of Python 2.x . I was just wondering that since the input function in Python 2.x is same as ...
0
votes
2answers
117 views

The most secure way to allow downloading and installing an app on Mac, Windows, or Linux

I have been introduced to the anti-bash-script-piping stuff such as these: Curl Bash Piping Wall of Shame (link broken) Piping curl to s(hell) Don't Pipe to your Shell The hidden dangers of piping ...
47
votes
5answers
7k views

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Imagine the following code: ATTACKERDATA="$(cat attackerControlledFile.txt)" echo "${ATTACKERDATA}" An attacker can, through whatever arbitrary process, modify the contents of attackerControlledFile....
0
votes
2answers
185 views

In some situation can be dangerous to echo command (e.g. rm -rf *) using a script?

If I have a script which on some conditions just do echo "rm -rf *" Can it be exploited in some way? EDIT: the goal is to write an enumeration script which will eventually suggests a command to ...
1
vote
0answers
62 views

.bash_history, where else commands might be stored in a Linux system? [closed]

How can I find all places where commands are stored in plain text in the system? I would disable the logging or restrict access to. Is it a security risk for a system if an attacker get access to all ...
1
vote
0answers
112 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
2
votes
1answer
58 views

Confusion Matrix for Generated Signatures in Snort

How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
6
votes
2answers
382 views

Bash function manipulation explained

I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
7
votes
3answers
147 views

SH Write a file with contents without any special chars

So, I've got a challenge and it's as follows. You can access a normal shell(sh) on clean RHEL 6 installation. Write arbitrary content to file.txt, but without the following characters. # & \ +...
0
votes
1answer
145 views

Command injection with brace expansion

Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces? I am encountering most likely not a filtering engine, but an bad parsing ...
0
votes
3answers
5k views

Leveraging curl to spawn a shell

So I'm doing a HTB challenge where I have leveraged the targets box use of reading a file that sets a url for curl in order to transverse down the directory and display the root flag in a report that ...
1
vote
2answers
97 views

Capture Response Attempting to Connect to Open SSH

I want to be able to attempt to connect to a host using password authentication and store the server's response in a variable. This is to see what hosts in my list accept passwords for their ssh ...
3
votes
2answers
7k views

Is it possible to execute a local file or code from cURL?

I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax: curl "local file" I was looking for possible solutions and found that to read the ...
3
votes
2answers
697 views

The way to determine IV for AES encryption, possible security problems with this approach

I am trying to make a folder encryption with maximum automation (except password input). Inside a bash script I do the following: echo $RANDOM | md5sum | cut -d' ' -f1 > iv and then using it: ...
3
votes
1answer
577 views

What do you search for in Open Source code to be sure there isn't malicious code?

I realize the answers will be language specific, but I am curious what terms you would look for when checking something out on Github? I was looking for a remote administration tool that I could use ...
34
votes
5answers
7k views

Bypassing the command/script specified in /etc/passwd

Consider the following line from /etc/passwd: sadeq:x:1000:1000:Mohammad Sadeq Dousti,,,:/home/sadeq:/bin/custom-script.sh The last part, /bin/custom-script.sh, shows the command/script to be run ...
1
vote
1answer
820 views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
6
votes
2answers
1k views

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
1
vote
1answer
60 views

Bash wildcards - Manipulate globbing to delete arbitrary files

I am currently auditing a plugin and have the following situation (simplified for example purposes): <?php $post_id = false; $absolute_path = "/var/www/html/wordpress/cache"; $extension = ".min....
1
vote
0answers
48 views

Input on a somewhat controversial backup solution using shell based SFTP

I've been tinkering with a backup solution in my spare time, made to simplify doing backups as much as possible. It's written in bash. The solution consists of 2 files, one placed on a backup server, ...
5
votes
2answers
2k views

WireGuard: what's wrong with this automatic IP assignment

WireGuard is extremely simple and fast kernel-space VPN based on modern cryptography. I want to use it in production and need automatic IP assignment for new peers. The project provides two short ...
-2
votes
2answers
339 views

Creating portable bash terminal & cmd to USB [closed]

Developing my toolkit and I want to have a safe edition of cmd.exe and bash on a usb. Why? These can be tampered with by attackers and I want a version I know is safe from manipulation. Any ...
4
votes
1answer
2k views

Run bash command when spaces and '`/\<>?&| are filtered?

I have some PHP code that run bash commands, and it has a bug that may make it vulnerable to remote code execution. The executed command would be $(id), but if I execute any other command like ls -la ...
5
votes
5answers
2k views

Should I remove bash from my Docker web app container?

Suppose I am a dev and want to harden my web application environment. If my application does not make use of binaries like sh, ls, find, echo etc. should I just remove them from my image?
3
votes
2answers
298 views

Safely decrypting an unsolicited/untrusted PGP message

I am accepting public security vulnerability reports for my website, and I publish my personal PGP (GPG) key to encourage people to encrypt their communications. Upon receiving an encrypted message, ...
1
vote
1answer
409 views

Is it possible to “encode” a bash sentence?

I was recently solving a CTF challenge that I found quite strange, first of all I have been given a chain of characters that no matter how hard I try to find an answer I can not find it, I am going to ...
2
votes
2answers
77 views

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)?

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)? Is it the case, or I completely misunderstood? I've heard in the the context of sourcing a sub-script ...
6
votes
2answers
4k views

Turned on cgi.fix_pathinfo still “dangerous” in Nginx?

In this article in digitalocean.com Justin Ellingwood recommends to turn off cgi.fix_pathinfo: Inside, we need to find a section that configures the cgi.fix_pathinfo behavior. It will be ...
2
votes
3answers
262 views

Why linux is used for security? [duplicate]

As a course of my School, I am starting to study Information Security. And I have to use GNU Linux OS using VMWare. My questions are: Why I need to use a linux distro other than Windows OS? On linux, ...
2
votes
1answer
290 views

Security implications of using Bash script as a SSH login shell

I have a fairly simple monitoring implementation, let's say that the monitoring server connects to a target through SSH via key authentication, and fetches information according to a script set up as ...
0
votes
1answer
60 views

Implications of running script as argument to shell

Context for the question is the following comment on one of my answers: @SergiyKolodyazhnyy Prefacing a script name with /bin/bash or even just bash is also a common way to solve the lack of ...
1
vote
1answer
1k views

Metasploit automate actions when reverse shell connects

I have used metasploit's netgear_wnr2000_rce to gain root shell access on a linux embedded device (no option for payloads). I am currently automating the process, and want to run a bash script when ...