All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
0answers
100 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
6
votes
2answers
285 views

Bash function manipulation explained

I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
0
votes
1answer
95 views

Command injection with brace expansion

Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces? I am encountering most likely not a filtering engine, but an bad parsing ...
2
votes
2answers
3k views

Is it possible to execute a local file or code from cURL?

I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax: curl "local file" I was looking for possible solutions and found that to read the ...
34
votes
5answers
6k views

Bypassing the command/script specified in /etc/passwd

Consider the following line from /etc/passwd: sadeq:x:1000:1000:Mohammad Sadeq Dousti,,,:/home/sadeq:/bin/custom-script.sh The last part, /bin/custom-script.sh, shows the command/script to be run ...
1
vote
1answer
117 views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
6
votes
2answers
581 views

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
1
vote
1answer
349 views

Is it possible to “encode” a bash sentence?

I was recently solving a CTF challenge that I found quite strange, first of all I have been given a chain of characters that no matter how hard I try to find an answer I can not find it, I am going to ...
3
votes
2answers
3k views

Turned on cgi.fix_pathinfo still “dangerous” in Nginx?

In this article in digitalocean.com Justin Ellingwood recommends to turn off cgi.fix_pathinfo: Inside, we need to find a section that configures the cgi.fix_pathinfo behavior. It will be ...
2
votes
3answers
231 views

Why linux is used for security? [duplicate]

As a course of my School, I am starting to study Information Security. And I have to use GNU Linux OS using VMWare. My questions are: Why I need to use a linux distro other than Windows OS? On linux, ...
2
votes
1answer
281 views

Security implications of using Bash script as a SSH login shell

I have a fairly simple monitoring implementation, let's say that the monitoring server connects to a target through SSH via key authentication, and fetches information according to a script set up as ...
0
votes
1answer
54 views

Implications of running script as argument to shell

Context for the question is the following comment on one of my answers: @SergiyKolodyazhnyy Prefacing a script name with /bin/bash or even just bash is also a common way to solve the lack of ...
1
vote
0answers
118 views

/bin/sh orphaned link - have I been hacked?

Just today I found that when I log in to my linux server, I receive an error message: -bash: /usr/bin/lesspipe: /bin/sh: bad interpreter: No such file or directory This seems to be because my /bin/...
-2
votes
1answer
97 views

Shell Script to display network info [closed]

I need help with a shell script to display my current IP Address and MAC Address with a "|" in between them like this: IP Address: | MAC Address: So can this be done easily in a shell script?
7
votes
2answers
1k views

How do I track bash history cleanup?

I'd like to catch events when bash history is cleaned or some lines are deleted. Are there any best practices or auditing tools with this capability?
-1
votes
4answers
717 views

Does a Turing complete shell means equal secure?

I have heard that Linux is more secure than Windows. Is that true? I think they are equally secure because both has a Turing complete shell so if you management to do harm on one system, there is a ...
2
votes
0answers
1k views

system(“/bin/sh”) exits without waiting for user input [OverTheWire narnia0 challenge] [closed]

Problem : Why does system("/bin/sh") process exits immediately instead of waiting for user input? Code : int main(){ long val=0x41414141; char buf[20]; printf("Correct val's value from ...
2
votes
0answers
57 views

Vulnerabilities in Linux Memory Segments [closed]

I am somewhat new to mining memory and looking for plaintext/ciphertext so I thought I would reach out and ask you all some questions. First of all, I wrote a script that automatically dumps the ...
1
vote
0answers
47 views

How does text that is displayed with cat end up trying to execute in the Linux terminal? [duplicate]

Sometimes you accidentally "cat" a binary... only for your terminal to become utterly corrupted, ending up in another code page where all characters are unrecognizable, while your shell spits back at ...
4
votes
0answers
126 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
6
votes
4answers
18k views

How can I use netcat like ping?

How can we use the netcat (nc) to determine whether a particular machine is running web, mail or SSH services?
2
votes
2answers
426 views

Prevent Plain-Text Passwords Output by a Script From Being Accessible in the Future

Let's say I have a Bash script that generates a password, creates a new user with that password, and then tells me what the password is: # Generate a password and set it to $PASSWORD PASSWORD=$(tr -...
7
votes
2answers
5k views

Hacked Ubuntu server, probably hacked commands (netstat, ps, …), how to replace them? [duplicate]

An Ubuntu server of my company has been hacked to carry out a DoS attack. I found the shellshock bug had not been fixed by my colleagues, and I think it's the problem. Then, I found an ELF file that ...
1
vote
1answer
157 views

Can shellshock be used on a system with public webpages but restricted server access?

I want to know if my servers are still vulnerable under the following conditions... My servers are private - only myself and trusted developers have access to them We have enabled executables within ...
2
votes
2answers
207 views

what makes envirnments vulnerable/protected vs shellshock bug

I just tested whether or not my university's environment was vulnerable to the shellshock bug using env X="() { :;} ; echo busted" /bin/sh -c "echo stuff" (code from http://www.troyhunt.com/2014/09/...
2
votes
1answer
341 views

Has CVE-2014-6271 Shell Shock been mitigated completely what is the latest? [closed]

I have patched my system however CVE-2014-7169 claims that the fix for 6271 was incomplete. Sure enough if I run the command below: env X='() { (a)=>\' sh -c "echo date"; cat echo It appears that ...
212
votes
5answers
149k views

What is a specific example of how the Shellshock Bash bug could be exploited?

I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...
15
votes
5answers
4k views

Can a .sh file be malware?

Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes, can someone read this script and tell me if it safe and is it effect any how on GnuPG security? It gives me an ...