1
vote
1answer
58 views

How can I verify my machine is not vulnerable from a specific exploit?

I'm running Ubuntu 8.04 TLS linux 2.6.24-23, I find that CVE-2009-2692 which exploits by using sock_sendpage() null pointer dereference. It describes this exploit affects linux version prior to 2.6.31 ...
-6
votes
1answer
79 views

How can mp3blaster vulnerability affect my linux OS? [closed]

Mp3blaster is a terminal mp3 player running a UNIX-like operating system, e.g. Linux, Free/Net/OpenBSD, etc. I usually use this player for playing my music, but yesterday I found a blog which claim ...
-1
votes
1answer
216 views

Exploit Compilation Problem [closed]

I am trying to compile the following exploit: http://www.exploit-db.com/exploits/10613/ But get the following error: local.c:12:22: fatal error: asm/page.h: No such file or directory compilation ...
0
votes
2answers
199 views

Disabling SMEP on x86_64

I have recently been doing some research into kernel exploitation on X86_64. A problem I have run into is that I have found Intel's SMEP to be killing my contrived example of a kernel NULL pointer ...
0
votes
1answer
347 views

Stack Guard vs Stack Shield

I would like to know why nowadays Stack Guard is used everywhere (example: ProPolice in GCC, /GS in Visual Studio), instead of Stack Shield. Both the approaches (i.e. Stack Guard & Stack Shield) ...
6
votes
2answers
368 views

buffer overflow attack scripts

I saw various different scripts for a buffer overflow attack. Many of the scripts include lines that look like this: char code[] = "\xdb\xd7\xd9\x74\x24\xf4\xb8\x79\xc4\x64\xb7\x33\xc9\xb1\x38" ...
3
votes
2answers
430 views

possible exploits through avahi daemon

It is always recommended to disable Avahi daemon, for security reasons, when not in use. So, by what ways it is possible to exploit a system which has avahi daemon service running? And how can we ...
24
votes
6answers
2k views

Most secure way to partition linux?

I recently acquired a netbook to play with, and I want to install Kali Linux so I can start learning about network security and exploit development. I want to use this to learn as much about security ...
4
votes
2answers
278 views

Vulnerability testing without the use of exploits?

I was doing some testing on a server to see if it was vulnerable to a 0-day local exploit (the exploit was for gaining root privileges using a bug in the Linux kernel). There was no real information ...
10
votes
1answer
546 views

Help in understanding an application's crash - exploitable?

Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
4
votes
1answer
293 views

Exploited by newbie3viLc063s

My debian server got exploited by some scriptiekiddie who used Newbie3viLc063 http://pastebin.com/jma8JRG1 . Scriptkiddie uploaded logo_php.png to my server (My permissions sucked :s) and he did run ...
5
votes
2answers
509 views

Using 'sudo vim' to spawn a shell

I've recently read here an answer from a user about the way he hacked a server in a CTF contest. At some point in the description, he said that he did sudo vim and then spawned a shell via VIM using ...
12
votes
2answers
497 views

Getting exploit reliability when using the off by one framepointer overwrite on linux

We have a program that is vulnerable to a one byte frame pointer overwrite. The stack is marked executable, the Linux machine has aslr disabled, stack cookies are disabled, and it's a little endian ...
1
vote
2answers
187 views

Is this Scenario Exploitable?

Here is the scenario: You get to overwrite 4 (consecutive) Bytes of a Userland Remote Process in Linux without Exploit Mitigation and without the ability to inject any Shellcode and you know the ...
1
vote
1answer
437 views

Can exploit vulnerability if program started with gdb, but segfaults if started without gdb

i'm currently trying to exploit a simple program called basic_vuln.c #include <stdio.h> int main(int argc, char** argv) { char buf[64]; strcpy(buf, argv[1]); } I'm using xubuntu ...
6
votes
2answers
301 views

How a malware executes remote payload

Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the ...
1
vote
1answer
1k views

NGINX / HTTP TRACE

I have a http server Nginx with HTTP TRACE Enabled. A single nmap --script=http-methods.nse host.name give this result : Not shown: 988 closed ports PORT STATE SERVICE VERSION [...] ...
2
votes
2answers
2k views

How to hack linux via Local File Inclusion vulnerability?

During my penetration testing, I found a local file inclusion vulnerability. In fact this vulnerability existed in mailwatch <= 1.0.4, and its exploit existed in Exploit-DB. I tried to exploit the ...
5
votes
1answer
85 views

Testing a chroot environment for privilege escalation vulnerabilities

I'm looking for holes in my current implementation of a chroot jail that I have implemented for a group of users. Is there anything I can do better here? I utilized the following packages: RHEL6 ...
7
votes
3answers
470 views

How to gain a shell?

I'm doing an exercise (exploit-exercises.com) that requires me to gain access to a shell running as another user. My question is this: I can create application that is guaranteed to be run by the ...
9
votes
2answers
1k views

Which Linux kernel vulnerabilities allow installing a kernel-level rootkit?

My question is related to vulnerabilities that allow installing a Linux kernel-level rootkit (for example, to modify the execution flow inside the kernel; for return-oriented attacks; or to modify ...
1
vote
1answer
747 views

Can you describe a real-life scenario of exploiting sticky bits?

Sticky bit are mentioned in every UNIX security book, but I couldn't find anyone that describes the exploitation of Sticky Bit set on a file. Can you?
3
votes
1answer
457 views

Two questions about learning Linux exploit development fundamentals

getting ready to delve into the technical world of vulnerability assessment, and I have two questions about where to find certain information. First, I plan on reading "Understanding the Linux ...