Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
0
votes
0answers
38 views
When a web interface requires username/password authentication, is ability to execute commands as root via www-data a big security risk?
I want to create a web interface to run some software on a small Raspberry Pi computer. This will be similar to logging in to your router from your browser.
The web interface will be have a dashboard ...
3
votes
2answers
2k views
Why can 'Others' read files by default in Ubuntu?
I am trying to figure out why when creating new files and directories in, let's say, the Documents folder, they get assigned, by default, the following permissions:
-rw-rw-r-- 1 hello world 0 Nov ...
1
vote
0answers
49 views
Command line tools exploitable on linux
I'm looking this interesting project
https://gtfobins.github.io/
But I don't understand some assumption. For example, if you consider the mv command:
https://gtfobins.github.io/gtfobins/mv/
They ...
1
vote
0answers
20 views
Identifying kernel pointer infoleaks via static analysis
Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
0
votes
1answer
38 views
Is there a list of safe/normal/expected SUID files?
Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
2
votes
1answer
86 views
Does printk() cause any security issues?
I'm asking myself if the function printk() causes security issues on Linux.
When an attacker has user level access to the system, does it make his life easier if he has access to kernel pointers? Does ...
-1
votes
0answers
28 views
Need help regarding Cyber Security project on Intrusion Analysis and File Integrity Monitoring [closed]
I want help in making a project that is
Intrusion Analysis and File Integrity Monitoring
I don't know where to begin or what to do as I am new in this cyber security field as I am a student.
At ...
0
votes
0answers
18 views
Could an intermittent or “resuming” connection be caught as a TCP port scan attempt?
I'm learning how to properly configure iptables to fend off TCP port scans on a hosted Linux-based VPS -- I'm not particularly interested in blocking this kind of attack, but rather in understanding ...
2
votes
1answer
44 views
prevent Ransomware on CIFS shares mounted on Windows 10
I am using Windows 10 with Defender. I follow all the ground rules when dealing with the internet and staying secure. I work in IS so I'm pretty familiar with the various threat-vectors and do a good ...
1
vote
0answers
38 views
Experimenting with SSLStrip+ on the same machine
I am trying to play around to understand how SSLStrip+ works by:
$ cat /proc/sys/net/ipv4/ip_forward
1
$ sudo iptables --flush
$ sudo iptables --flush -t nat
$ sudo iptables -t nat -A PREROUTING -p ...
0
votes
0answers
43 views
How to access my VM to pen test it through another VM? [closed]
I'm a total beginner in security and network in general, and I have an assignment - I was given a Linux server that has a number of security flaws that I need to find and report on.
Currently I have ...
1
vote
1answer
82 views
Understanding Microsoft list of disallowed certificates
Microsoft publishes their untrusted certificates as disallowedcerts.stl Warning: direct download.
It is ASN.1 encoded. After decoding it there is a list of sequences like so:
SEQUENCE {
...
0
votes
0answers
12 views
How can I find out clients connected to a wifi network? [duplicate]
How can I find out clients (MAC addresses) that are connected to a wifi network (that my device is not connected to)?
When I am connected to a wifi network, I can use tools like nmap or even ping to ...
0
votes
0answers
10 views
Why Isn't Netdiscover Working On My Virtual Machine? [migrated]
I am doing a vulnhub CTF walkthrough (Lampiao). I have my main VM set up using Kali Linux in VirtualBox. The victim VM is the Lampiao machine. I am supposed to run Netdiscover on Kali to search for ...
1
vote
2answers
89 views
How to copy files without copying Alternate Data Streams
I want to backup my infected Windows system's files before formatting it all and reinstalling the system. I would do it from a Linux Live USB. I've heard that one should be careful in copying only the ...
2
votes
3answers
162 views
Linux tool for monitoring network activity by application
My laptop have been hacked a few months ago and my data is being to uploaded to some remote server without my knowledge.
Is there a way I can find it out and prevent it from happening?
I have ...
1
vote
0answers
9 views
Fluxion disconnecting both of my external and internal wifi cards [migrated]
I installed fluxion in raspberry pi so i can use it on the go. I mainly connect to my pi using ssh and vnc. I plugged an external wifi adapter to my PI to support monitor mode, but when I select my ...
3
votes
1answer
72 views
Docker: when to use apparmor vs seccomp vs --cap-drop
Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container.
However I couldn't find any documentation or guideline on when to use which ...
2
votes
2answers
136 views
Is it possible to execute a local file or code from cURL?
I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax:
curl "local file"
I was looking for possible solutions and found that to read the ...
2
votes
2answers
105 views
Should a windows IT shop have concerns about enabling WSL for users?
I work in a place that only supports windows, and the folks in charge of IT are (1) very conservative, and (2) not at the bleeding edge of their profession.
I want the Windows Subsystem for Linux (...
0
votes
1answer
44 views
watch DNS queries while using OpenVPN.-
I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client.
My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
63
votes
4answers
11k views
Are most Linux systems that allow non-root users to execute code straightforwardly rootable?
long story short if you can execute code on a box it is usually straightforward to get root
(quote source)
The immediate implication of this quote (if it's accurate) is that if you're running a ...
7
votes
1answer
543 views
How can utilities with setuid set to root be secure if they are debuggable?
Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:
I can freely debug all programs I have the permission to run, even those that have ...
0
votes
1answer
45 views
Security Incident File Change Timestamp
How can I obtain all timestamps of all files ( starting"/") on a Linux system in order to verify if a file was changed within a breach?
0
votes
2answers
55 views
Privilege Escalation: C functions setuid(0) with system() not working in Linux
Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
2
votes
2answers
45 views
What exactly does a default port scan look like? I am trying to run a default port scan without setting off the ids on my test network
What is the best option to use for a default port scan of a server on my test network without setting off the ids using nmap. -f is not a switch i am wanting to use.
0
votes
2answers
62 views
How to hide device files on linux?
I want to hide /dev files on Linux because some files can be dumped and used for reverse engineering/attack purposes.
My primary goal is to avoid users able to see those files from a shell: lurking ...
3
votes
0answers
24 views
EIP Overwrite Exploit not working
I am writing an exploit for an x86 binary on Linux and I'm learning exploitation.
The binary has no protections and the stack is also executable.
It has a buffer overflow when it uses memcpy() ...
2
votes
1answer
135 views
Does an Egghunter attack still make sense in a 64 bit system?
Background
An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage,...
0
votes
1answer
36 views
SSH host key: Is the public one necessary and should the key be password protected
I was playing around with my SSH server side config sshd_config. I replaced my default SSH host keys with only one RSA key while I'm using Protocol 2 and key auth only.
ssh-keygen -f /etc/ssh/...
2
votes
0answers
41 views
Can maliciously modified ACPI AML be executed without a reboot?
ACPI tables contain ACPI Machine Language, or AML, which is executed by an interpreter in the kernel at boot. Certain ACPI tables, such as the DSDT, are necessary to support hardware ACPI events such ...
0
votes
1answer
183 views
Keepass2 vs KeepassXC - KeePass-Http connector - Mono in Linux
please forgive beginner question.
I have been using Xubuntu for several years now; this question is regarding password managers under Linux/Ubuntu.
I have been using Keepass2 which is just such an ...
0
votes
0answers
38 views
Doubt about portfw on pivoting
I was recently reading about pivoting but I have doubts
If i route the traffic of the first subnet (using portfw)
to another subnet it will go out with the ip of the second subnet (?)
Having said ...
3
votes
1answer
79 views
Default value of ACLs mask
This is the question I faced in an interview as a system administrator.
If we didn't set the mask value, what is the default value of mask?
I was thinking that if we didn't set the mask, it ...
-1
votes
0answers
62 views
On Ubuntu, if Secure Boot is enabled, then can Trusted Boot even run?
Since Ubuntu supports Secure Boot, i don't see any reason to not enable Secure Boot before installing Ubuntu. Secure Boot verifies the 1st-stage bootloader all the way up to the launch of the Linux ...
0
votes
2answers
94 views
How does default Debian boot drive encryption works?
When installing Debian, I chose an option to create Encrypted LVM (Logical Volume Management). So now, when I turn on my PC, it asks me for an encryption password.
It looks ok, but how does it work? ...
0
votes
0answers
48 views
suidperl Privilege Escalation
I have machine vulnerable to suidperl Privilege Escalation that was released by Equation group. I am using the exploit released by them and shared at this page
https://github.com/x0rz/EQGRP/blob/...
1
vote
0answers
32 views
UFW (Uncomplicated Firewall) Question
I was wondering if there's any benefit of adding following rules to a Raspberry-Pi directly exposed to the internet:
sudo ufw deny to 0.0.0.0/8 &&
sudo ufw deny to 169.254.0.0/16 &&
...
16
votes
2answers
1k views
Dealing with spam scripts as a shared hosting operator, with users who host mail externally
Assume the following setup;
A shared hosting server, sharing a single IP with many small websites.
A subset of the set of websites is sending e-mails. Some of those e-mails may be to their own ...
1
vote
1answer
40 views
OpenVPN one account multiple servers & Load Balancing
I have recently been experimenting with OpenVPN. My aim is to create a group of servers in different locations with a single username and password for each user stored in a central database. For ...
2
votes
1answer
62 views
Secure erase partition only on SSD, not the whole thing
I have a 512 SSD which is partitioned into essentially two 256 areas. One for Windows, the other for Linux (Ubuntu). Neither is encrypted. I want to clean my system up, but am only concerned about the ...
0
votes
0answers
52 views
Buffer Overflow on Ubuntu x64
I'm trying to understand how works in detail a buffer overflow. Basically I compiled the following program:
#include <stdio.h>
#include <string.h>
int main(int argc, char **argv) {
char ...
0
votes
0answers
45 views
Using buffer overflow to execute a command in execlp()
I am trying to improve my skills on buffer overflows and, this is my scenario:
There are 2 C string variables defined subsequently.
Both are taking user input; first one is a filename and the other ...
2
votes
1answer
62 views
In-memory encrypted Linux/unix kernel
Is there a variant of Linux kernel for virtualization that runs in-memory in a state that can't be read by the host operating system?
0
votes
0answers
34 views
Track logs in Ubuntu Linux
I am using Ubuntu linux. I want to track my data which is going to the internet or coming from internet.
As per my knowledge, few softwares are uploading logs on their sites which contains basic ...
0
votes
0answers
44 views
“Hacking The Art of Exploitation” - format string exploit size inconsistency
fmt_vuln.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main(int argc, char *argv[]) {
char text[1024];
static char buffer[1000] = {"yellow"};
static int ...
1
vote
1answer
191 views
Is Debian 9.5 stretch vulnerable to CVE-2018-17182?
I have a Debian system running the following kernel version:
Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9.110-3+deb9u2 (2018-08-13) x86_64 GNU/Linux Linux REDACTED 4.9.0-7-amd64 #1 SMP Debian 4.9....
1
vote
1answer
84 views
Files on external drives executable by default with exFAT or NTFS under Ubuntu
On Ubuntu, if you use (external) drives formatted as exFAT or NTFS, i.e. not ext4 or something made for the UNIX world, you may end up with a situation where all files are executable.
This is because ...
0
votes
0answers
18 views
Gateway firewall basics & managing multiple elastic IPs to non-http services
I've been trying to make sense of this for months now. If this is too broad, or more appropriate for another forum please say so. I would appreciate at least a lead to documentation, as I simply ...
0
votes
1answer
117 views
Empty password field in /etc/passwd
I am reversing a firmware update and found a empty password field in /etc/passwd
root::0:0:root:/:/bin/sh
otheruser:x:0:0:otheruser:/bin/false
Do I need a password to login as root?
I found out, ...
