Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
1,921
questions
0
votes
2answers
75 views
Is there a way to change your current UID to equal your EUID?
Here is the scenario:
running id gives this :
uid=1001(test1) gid=1001(test1) euid=1000(bl4ckc4t) groups=1001(test1) -
This means that I am user test1, but my euid is set to another user.
My goal is ...
0
votes
0answers
39 views
How to interpret received packets, although not being destination host
Set up:
Victim: 192.168.0.2
Attacker (also having SSH server installed): 192.168.0.3
SSH server: 192.168.0.4
I perform a successful ARP Spoofing attack (being obviously the attacker's MAC address):
...
0
votes
0answers
64 views
I clicked on a phishing site [duplicate]
I accidentally clicked on a phishing link when I was going to a manga website that I usually go to but accidentally clicked on a website that was pretending to be the actual site, and I immediately ...
1
vote
2answers
73 views
Parrot OS live vs Tails [closed]
Is Parrot OS as secure as Tails?
Tails is running from USB, loading to RAM so it means that it doesn't use local computer storage. After each start, Tails starts a new session and doesn't store files ...
0
votes
0answers
32 views
Mod Security: Multipart XML fails with Message: “XML parser error: XML: Failed parsing document.”
The CRS Rule 200000 seems to hit and I didn't found the exact problem yet.
Versions:
owasp-modsecurity-crs-3.2.0
Apache/2.4.38
The Log looks like this:
[30/Mar/2021:14:28:57 +0200] YGMZiY3fnzEmfTyS-...
0
votes
0answers
67 views
Are Linux distributions that use musl as the standard C library more secure?
It seems that musl based Distros are more minimal and lightweight. Examples are Void Linux and Alpine Linux. Lots of packages only available for glibc-based systems.
But, are Linux distributions (for ...
0
votes
0answers
7 views
D-Link DWA-192 won't go on monitoring mode using airmon-ng [migrated]
I have Kali linux running on Oracle Virtual Machine and it has problem with D-Link DWA-192 at first. It doesn't recognize it all.
So I decided to investigate for installing a driver of it.
github ...
0
votes
0answers
42 views
What are the security implications of different permissions of /etc/shadow in different Linux distributions?
The file in which user password hashes are stored, /etc/shadow, is not readable to normal users on all OSes, but the details differ from distribution to distribution:
-rw-r----- 1 root shadow 1811 Feb ...
3
votes
1answer
99 views
Instruction Overwrites with Garbage?
I am practicing a function return address overwriting exploit. However, the program instruction pointer instead gets overwritten by gibberish. I have tried compiling with -fno-builtin and -fno-...
1
vote
1answer
130 views
Sudo “/usr/sbin/halt”, “/usr/sbin/reboot”, “/usr/sbin/poweroff” - how to leverage it to privilege escalation?
A normal user can execute these commands as root without providing any password (sudo includes the full path of the command so path hijack isn't the case here), could "halt", "reboot&...
0
votes
0answers
15 views
Are there any kernel's which can upgrade without reboot? [migrated]
(excluding toy, academic-only, and unmaintained)
My use-case is getting nontechnical people to have servers deployed for them, and for neither me nor them to worry about [attended] maintenance and ...
1
vote
1answer
72 views
How to make access to a remote program without that the user has the possibility to run any Linux command?
I have an interactive program. Actually, the program can be reachable over SSH. In the .profile file, the program is launched immediately and with the interactive interface it is not possible to ...
0
votes
0answers
21 views
ntfsdecrypt - Key does not have an EFS purpose OID [migrated]
I'm trying to copy EFS-encrypted files from an NTFS partition using:
ntfsdecrypt -k mycert.pfx /dev/sda2 -i 32768
and I get:
Key does not have an EFS purpose OID
Failed to extract the private RSA key....
0
votes
2answers
78 views
Path traversal in POST request?
Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request?
For example
POST
[...]
----boundary
Content-...
2
votes
1answer
110 views
How do I compare the safety of a compiled program with optimization flag?
I would like to know how I can know which is the safest compilation line, that is:
Having several compilation lines in, for example, GCC, how do I know which one is more secure? Hardening would be a ...
0
votes
1answer
25 views
What is the practical approach for CIS Benchmark (Ensure permissions on all logfiles are configured)?
I am trying to harden RHEL with CIS benchmark. One of the items states the following:
Ensure permissions on all logfiles are configured
Description: Log files stored in /var/log/ contain logged ...
0
votes
1answer
35 views
Change ettercap default port
Guys does anyone know how I can change the port that ettercap runs? I need it to run on port 8080.
When I try to run sudo ettercap -G it presents me with this error:
ERROR : 13, Permission denied
[/...
3
votes
1answer
54 views
Why does file traversal not working in this PHP file upload code?
I am using this script to upload file to the system with apache2 as server and php7.
If I provide filename as ../../../../tmp/data.png of uploaded file, then also the file gets uploaded to /var/up/...
1
vote
0answers
29 views
AuditD and SysCall alerts
Given an alert rule like -a always,exit -F arch=b32 -S open -S openat -F exit=-EACCES -k access how does adding multiple SysCalls (-S) options work?
When an application gets executed do all the ...
1
vote
1answer
41 views
What config files and logs files of a Linux system (CentOS 7) deserve to be monitored by a SIEM?
I am not a security expert (I am more a software developer) and I am working on a project related to a SIEM installation (Wazuh). This installation is only a demo for a customer, in a second time a ...
1
vote
0answers
48 views
Cmd line tool to scan an eml file against spam/phishing rules [closed]
For a purpose of a security class I want to demonstrate a threat delivered via email. As a demo message I want to use an eml file that contains a banking-themed pdf attachment, requiring further ...
1
vote
0answers
41 views
How to install Java 8 on Kali Nethunter [closed]
Guys I need to install jdk 8 for my programs to work better, many programs do not support the version higher than Java 8 so I want to install Java 8 to run better, I tried to install via apt-get, but ...
0
votes
1answer
71 views
dm-crypt 2.0.3 + luks: salt auto-generated? what affects decryption speed?
I am trying to encrypt one of my primary Linux partition (5GB) by following this example to encrypt.
I want to confirm some of my understandings:
Salt is automatically generated by cyrptsetup with ...
1
vote
1answer
66 views
CGI-BIN - suspicious activity (unknown IP made request)
I have a python-script being run regularly on my Linux system by means of a cron daemon process - every weekday 18:00 scraping stockmarket data.
This scraping script is placed in cgi-bin folder so ...
0
votes
1answer
103 views
How to use msfvenom elf approach for metasploitable 2?
How to use msfvenom elf approach for metasploitable 2?
I am reading a book that teaches how to make a msfvenom executable for Windows. But I am learning on metasploitable 2. I really did not want to ...
0
votes
2answers
92 views
is there a way to close 22 ssh port from public, ubuntu?
I am using putty and private key to access my development server. I used Nmap online port scanner, to see which ports are visible to the public, and in fact, the 22 is open.
My question is, is it ...
0
votes
0answers
49 views
Is it possible to verify that a USB adapter is not malicious? [duplicate]
I have some generic USB C-to-A and A-to-C adapters that were bought cheaply.
I thought that if any of them had any advanced capabilities (other than being "dumb" adapters) such as mimicking ...
2
votes
1answer
144 views
How to do string buffter overflow with scanf function?
I'm new to buffer overflow exploitation. I've written a simple C program which will ask user to input a string (as a password) and match that string with "1235". If matched then it will ...
0
votes
1answer
50 views
Vulnerability in which part of the Android architecture would allow an attacker to take control of the hardware [closed]
This question is intended for better understanding of security features of Android architecture.
In particular, I want to know what part of the architecture needs to be secure to prevent an attacker ...
0
votes
1answer
55 views
How to distribute bash scripts to multiple IOT devices securely
Here is the dilemma we're having: we developed proprietary bash scripts that do something, which is meant to be secure and closed source.
Our customers however will have to buy separate IOT devices ...
1
vote
0answers
42 views
Linuxcontainers » LXC : Security Vulnerabilities
I have a question regarding Linuxcontainers. How do you classify the security vulnerability mentioned here, more specifically the ones that ends with 6441,1331,1134,1335 and 10124.
I mean are they a ...
1
vote
1answer
71 views
Vulnerabilities for multiple kernel versions that are installed on a given server
As per Exclude or display vulnerabilities for non-running Linux kernels :
It is possible to have multiple kernels detected on a single Linux
host and Qualys will report all vulnerabilities found on ...
0
votes
0answers
28 views
Set ipv6 Docker — unfamiliar process running
While trying to debug an exceptionally high load on the server, I came across this process.
set-ipv6 /var/run/docker/netns/xxxxxxxxx all false
I have two docker processes running, but neither have the ...
0
votes
1answer
84 views
How to start pentesting/reverse engineering/cracking a software on Linux? (Docker based) [closed]
TL:DR; What are good learning resources for security testing a software which runs with Docker on Ubuntu.
I am in junior position at this company, and they figured it would be good if I just test ...
1
vote
1answer
53 views
auditd rules for both 64-bit (b64) and 32-bit (b32) architectures
I'm looking at the OpenSCAP Security Guide for CentOS 7:
https://static.open-scap.org/ssg-guides/ssg-centos7-guide-index.html
Under "Record File Deletion Events by User" (as an example), it ...
1
vote
2answers
72 views
How do attackers determine ROP gadgets remotely?
Being gadgets change per each system and architecture (do they?), how would an attacker be able to determine the offsets of various Return Oriented Programming gadgets, would an attacker first need to ...
1
vote
1answer
49 views
Java application run as root
I'm testing Linux server where Java web application is run as root, I typed:
>ps aux
in the result I see:
root 18265 (...) Sl+ 19:52 0:37 java -Xmx2g -jar test_app.jar
what is the best ...
4
votes
1answer
142 views
Privilege escalation writing /etc/passwd but without SUID permission on su
This is not an exercise, there might be no solution.
We are producing a Docker image (based on CentOS) which is designed to be executed by a non-root user.
However, this user has write access to /etc/...
2
votes
1answer
111 views
Bots are using my own static IP to brute force DNS/Email server [closed]
My email server has been under constant brute force attack for a while now, without success.
Recently, however, these bots or automated scripts have found a way to "use my own static IP" in ...
0
votes
1answer
98 views
How to find the IP address of a CCTV camera connected to laptop via ethernet [closed]
I'm trying to get the IP address of a CCTV camera and so far had no luck.
The device it's a Hikvision DS-2CD2042WD-I
I have connected it to a PoE switch, which is then connected to my laptop(Ubuntu 18....
-1
votes
1answer
42 views
is it possible to call libc function with rop
let say hacker want to come over the aslr or he want to call function that doesn't exists in user program ,can he insert to the return address address to the share library function or this functions ...
0
votes
1answer
57 views
How to get information about segments of physical memory not described in System.map on linux
When I do in linux root shell cat /boot/System.map-$(uname -r) it returns me segments of memory but there is a big gap around phys_startup_64:
00000000000228c0 D softnet_data
0000000000022a80 d ...
2
votes
2answers
131 views
On a single user laptop does it make sense to have a separte password for root and the user?
I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is:
The change of ...
0
votes
0answers
39 views
Recovery files fails Raspberry Pi 3b
i am trying to learn something about computer security, I decided to start from the linux world, through raspberry p3 with raspbian jessie OS
I would like to start with forensics file management, and ...
17
votes
5answers
5k views
Can I check the content of a suspicious file directly on the server using an editor, e.g. vim?
in the Wordpress directory I found some suspicious-looking files with random strings in their name e.g. uxs5sxp59f_index.php. Can I safely check their content ? I have a suspicion that the site has ...
1
vote
2answers
133 views
Can gnupg sign multiple files in parallel?
I want to sign every file in a directory. I can do so with the following shell command, but it's slow.
Serial Execution:
find . -type f -printf "Signing %p...\n" -exec gpg --quiet --batch --...
0
votes
0answers
92 views
Exploit apache2 service as member of www-data group
I am attempting to solve a CTF challenge where I am logged in as a member of the www-data group and the apache2 service is misconfigured and can be run as sudo without a password. What I am attempting ...
0
votes
1answer
78 views
How to prevent a web application from accessing local URLs (SSRF) [duplicate]
In our web app the users can specify a URL that the server will access later (POP3 access and browser push notifications).
This means the web app does a network request to a user-chosen server. The ...
0
votes
1answer
60 views
Backup on a distant dedicated server, such that even if someone gets root / hacks my distant server, they cannot read the data
Let's say we have:
a local computer (Windows or Linux)
a distant dedicated server with 2TB storage, running Linux
I'd like to do a backup my local computer's data folder (1 TB) to the distant server ...
0
votes
0answers
58 views
security implications of libvirt socket access
In most Linux distributions it is possible to manage virtual machines as a regular user if that user has access to /run/libvirt/libvirt-sock and is a member of the libvirt group.
I understand that we ...
