Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

1
vote
0answers
37 views

Is there a way to get a forensic image of EC2 instance

I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
-1
votes
0answers
45 views

Chain of security by booting Linux

I am curious if there is any solution that ensures that the actual OS I start is safe. I have SecureBoot on my microserver, and that way I can ensure, that GRUB is safe. But what about the drive ...
0
votes
0answers
22 views

Linux Kernel exploitation via MSFconsole

I am running a server with the service linux kernel to practice pentesting with metasploit. I am trying to use CVE-2019-10124 to take it down, however I don't really know how to. I am aware that ...
0
votes
2answers
42 views

How can I check what scripts are in Nmap's default category (`--script=default`)?

I know that the -sC and -A options run the "default" category of scripts (--script=default): https://nmap.org/book/nse-usage.html I've searched the nmap script folder for a default sub-folder, but ...
0
votes
0answers
38 views

easy_install not found when i install shodan? [closed]

I have Kali linux so i want to install shodan in terminal it's give me this message > -bash: easy_install: command not found can you tell me what can i do ?
-1
votes
0answers
37 views

Monitoring home control system [closed]

(Sorry in advance English is not my native language) Hi, I'm fairly new to Linux and its software in general, I am wondering if I am able to monitor what is happening on my home control system, it ...
0
votes
1answer
19 views

GnuPG can see a card under root user, but not under normal user

When under an unprivileged user: $ gpg --card-status gpg: selecting openpgp failed: No such device gpg: OpenPGP card not available: No such device With sudo or under a root user: $ sudo gpg --card-...
1
vote
1answer
89 views

Linux forensics- How can I extract sysfs procfs from a raw image?

I'm developing a software that extracts files from a Linux raw image (dd). I use SluethKit to get the partitions & files, however i can't find any files inside /sys & /proc folders. I know ...
1
vote
1answer
102 views

Enterprise Standard for Linux server Penetration Testing

Is there any enterprise or global standard like "OWASP" which can be followed while doing penetration testing on Linux servers? I want to know if there are any most common/important vulnerabilities ...
3
votes
1answer
136 views

Are there any known viruses/malware that can infect Ubuntu that come from the USB?

I know that most viruses that can infect the OS from having an infected USB inserted into the PC are mostly Windows only, but is there any possibility that there is one that can affect Ubuntu as well?
2
votes
1answer
71 views

Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?

I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow: // gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
0
votes
0answers
15 views

Analyzing Swap File [migrated]

I have the following problem: I have a .memdump.swp~ file. I tried recovering the .memdump file by using vim -r .memdump and also tried to use vim -r .memdump.swp. Both didn't bring success. Is there ...
6
votes
2answers
253 views

Bash function manipulation explained

I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
1
vote
1answer
726 views

ShadowHammer: Limited to Windows?

I've been reading about ShadowHammer over the last couple of days: Kaspersky researchers estimated half a million Windows machines received the malicious backdoor via ASUS' update server. But the ...
3
votes
1answer
84 views

When accepting an SSL certificate, can I limit for which domains I accept it?

Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
1
vote
0answers
64 views

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
1
vote
1answer
138 views

How can privilege escalation through pkexec be prevented?

I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it ...
3
votes
1answer
256 views

Could Intel SGX be dangerous under Linux?

Question Background This morning, by accident I have found, that there is basically a backdoor in a dormant state in my Dell laptop: Computrace, which comes from Absolute Software - link to their Web,...
0
votes
0answers
34 views

How to disable .got.plt protection using GCC on Ubuntu 18.10?

I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions. Usually, the function's .plt entry should (lazy) resolve the ...
0
votes
0answers
38 views

Arpspoof not working properly

I'm testing MITM packet manipulation on the fly between two computers on the same switch, a layer 2 switch. I'm using a Kali Linux machine as the attacker and i have written a python script to ...
0
votes
0answers
24 views

VPN Kill switch doesn't work with Tor Traffic [migrated]

Always, when I try to run kill switch for VPN my Tor Browser stops working and I am not sure why it happened. I am not good in firewalls and port forwarding but I would like to learn. I have ...
1
vote
1answer
66 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
0
votes
0answers
9 views

Protecting Linux systems from symlink attacks [migrated]

Linux-based systems are vulnerable to symlink race attacks from unprivileged UID processes. For example, a PHP process can create a symlink to /etc/passwd in a directory where Apache httpd will serve ...
0
votes
1answer
155 views

What is a secure way to encrypt critical secrets for a person likely to be individually targeted [closed]

I read several guides and Stackexchange answers, but the more I know, the more I realise how much I don't know. What I learnt is that details of implementation matter and that most popular tools do ...
0
votes
0answers
51 views

Is Linux dangerous for secure environments because it's open source? [duplicate]

I work for a company that sells hardware products with Linux embedded into the product. We lost a job for a defense contractor due to our hardware running Linux. Their reason was "because it's open ...
0
votes
1answer
65 views

How to set up the Tor browser on Linux Mint in a VM with a VPN on the Host

(Forgive me, I don't know whether to post this here for in the "Tor" community) I'm brand new to Tor, I understand the basics of how it works and the Do's & Don'ts. I have a Windows 10 computer (...
1
vote
0answers
20 views

How do I create exceptions on Wazuh (OSSEC)?

I currently have a setup with OSSEC and AIDE running on our servers. We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log. I want to make an exception for ...
0
votes
1answer
26 views

Can I track delete action in event viewer?

Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on ...
0
votes
1answer
28 views

Firefox switches charset encoding, brings up request to install extensin. Is this a “browser virus”?

I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...
0
votes
1answer
58 views

shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )

I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !! Segmentation fault (core dumped) my shellcode : section .text ...
0
votes
0answers
42 views

Heap bugs - extinct now?

I've been practicing some computer security courses lately, and I'm bugged by one specific heap overflow that just doesn't work for me. Taken from The Shellcoder's handbook, chapter 5. While doing my ...
0
votes
1answer
56 views

Could an infected .iso file infect a PC that is running a disc burning or drive imaging program?

I can't seem to find too much on this, but I'm worried after realizing I downloaded my Raspbian image from HTTP, and wrote it into a USB stick without verification. I'm worried, especially since I ...
1
vote
2answers
85 views

Reverse shell refusing/difficulties to establish connection

I've been trying to reverse shell between different devices, however, I'm never able to establish a connection or get a shell prompt . Let's say I have a Mac OSX as victim and use a raspberry Pi ...
1
vote
0answers
75 views

Need help in exploiting an overflow on Linux [closed]

There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string". It's also possible to send about 10000 custom bytes to heap (it's possible to ...
0
votes
1answer
68 views

Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?

I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails? Specially, can an attacker escape ...
0
votes
1answer
60 views

Command injection with brace expansion

Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces? I am encountering most likely not a filtering engine, but an bad parsing ...
0
votes
0answers
63 views

XenForo website hacked through PHP shell script

My XenForo forum was hacked today using a PHP shell script. The website is ran on Linux (Ubuntu 18). I'm not too experienced with backend stuff so I apologize if I use the wrong technical names. ...
1
vote
1answer
84 views

Should I treat my SSH username like a secret?

I'm trying to automate the deployment of my blog. Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me. ...
0
votes
1answer
73 views

What are the security implications if systemd is not restarted after it has been updated?

My understanding is that systemd is the parent process for all other processes running on Linux. If systemd has been updated on production devices such as servers and the service is not restarted, ...
0
votes
0answers
18 views

Confirming a tcp connection is encrypted not just encoded? [duplicate]

This is a follow up of this question. The accpeted answer suggest using tcpdump -A -c 200 but leaves up the crucial part on how to distinguish whether the data is encrypted and not encoded. What I'm ...
1
vote
2answers
83 views

Why can't iptables drop arp requests

I was trying to hide my laptop from my phone's network scan app. The app is using arp requests to find devices on the network. I tried everything on iptables. It doesn't work, even if i set all the ...
3
votes
1answer
88 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
0
votes
2answers
121 views

Is my PC safe after DSA-4371?

I used sudo apt-get update sudo apt-get upgrade before I read https://www.debian.org/security/2019/dsa-4371 There was I change that my PC got exploited/hacked/virused. So I used chkrootkit and ...
0
votes
1answer
93 views

How fill up a gig interface bandwidth with hping3?

I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
0
votes
1answer
40 views

What considerations are there for using USB WiFI adapters and how to protect against them?

Often with older machines, the built-in WiFi adapters have failed. These in turn drive a demand to procure USB WiFi adapters since ethernet connectivity is not a choice. Since the devices will be ...
2
votes
0answers
46 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
1
vote
0answers
83 views

ARP spoofing doesn't work as expected?

I have seen products like CUJO (https://www.getcujo.com) and Firewalla (https://firewalla.com/) doing ARP spoofing for network filtering and device blocking. As far as know, simplest way to ...
2
votes
2answers
111 views

“Don't break Debian” and bug fixes

Don't break Debian page is quite clear that always installing the latest versions of third-party software from from places other than official Debian repositories is not a good idea. Although the ...
2
votes
3answers
2k views

New Linux virus “watchbog”. What could be the cause? [duplicate]

This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause. So here's my story: There is a new virus out ...
0
votes
1answer
74 views

How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?

Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following: seal "azurekeyvault" { tenant_id = "46646709-b63e-4747-be42-516edeaf1e14" client_id = "...