Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
1
vote
0answers
38 views
Is there a way to get a forensic image of EC2 instance
I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
-1
votes
0answers
45 views
Chain of security by booting Linux
I am curious if there is any solution that ensures that the actual OS I start is safe. I have SecureBoot on my microserver, and that way I can ensure, that GRUB is safe. But what about the drive ...
0
votes
0answers
22 views
Linux Kernel exploitation via MSFconsole
I am running a server with the service linux kernel to practice pentesting with metasploit.
I am trying to use CVE-2019-10124 to take it down, however I don't really know how to.
I am aware that ...
0
votes
2answers
42 views
How can I check what scripts are in Nmap's default category (`--script=default`)?
I know that the -sC and -A options run the "default" category of scripts (--script=default):
https://nmap.org/book/nse-usage.html
I've searched the nmap script folder for a default sub-folder, but ...
0
votes
0answers
38 views
easy_install not found when i install shodan? [closed]
I have Kali linux so i want to install shodan in terminal it's give me this message > -bash: easy_install: command not found
can you tell me what can i do ?
-1
votes
0answers
37 views
Monitoring home control system [closed]
(Sorry in advance English is not my native language) Hi, I'm fairly new to Linux and its software in general, I am wondering if I am able to monitor what is happening on my home control system, it ...
0
votes
1answer
19 views
GnuPG can see a card under root user, but not under normal user
When under an unprivileged user:
$ gpg --card-status
gpg: selecting openpgp failed: No such device
gpg: OpenPGP card not available: No such device
With sudo or under a root user:
$ sudo gpg --card-...
1
vote
1answer
89 views
Linux forensics- How can I extract sysfs procfs from a raw image?
I'm developing a software that extracts files from a Linux raw image (dd).
I use SluethKit to get the partitions & files, however i can't find any files inside /sys & /proc folders.
I know ...
1
vote
1answer
102 views
Enterprise Standard for Linux server Penetration Testing
Is there any enterprise or global standard like "OWASP" which can be followed while doing penetration testing on Linux servers?
I want to know if there are any most common/important vulnerabilities ...
3
votes
1answer
136 views
Are there any known viruses/malware that can infect Ubuntu that come from the USB?
I know that most viruses that can infect the OS from having an infected USB inserted into the PC are mostly Windows only, but is there any possibility that there is one that can affect Ubuntu as well?
2
votes
1answer
71 views
Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?
I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow:
// gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
0
votes
0answers
15 views
Analyzing Swap File [migrated]
I have the following problem:
I have a .memdump.swp~ file. I tried recovering the .memdump file by using vim -r .memdump and also tried to use vim -r .memdump.swp. Both didn't bring success.
Is there ...
6
votes
2answers
253 views
Bash function manipulation explained
I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
1
vote
1answer
726 views
ShadowHammer: Limited to Windows?
I've been reading about ShadowHammer over the last couple of days:
Kaspersky researchers estimated half a million Windows machines received the malicious backdoor via ASUS' update server. But the ...
3
votes
1answer
84 views
When accepting an SSL certificate, can I limit for which domains I accept it?
Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
1
vote
0answers
64 views
How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?
The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
1
vote
1answer
140 views
How can privilege escalation through pkexec be prevented?
I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it ...
3
votes
1answer
256 views
Could Intel SGX be dangerous under Linux?
Question Background
This morning, by accident I have found, that there is basically a backdoor in a dormant state in my Dell laptop: Computrace, which comes from Absolute Software - link to their Web,...
0
votes
0answers
34 views
How to disable .got.plt protection using GCC on Ubuntu 18.10?
I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions.
Usually, the function's .plt entry should (lazy) resolve the ...
0
votes
0answers
38 views
Arpspoof not working properly
I'm testing MITM packet manipulation on the fly between two computers on the same switch, a layer 2 switch. I'm using a Kali Linux machine as the attacker and i have written a python script to ...
0
votes
0answers
24 views
VPN Kill switch doesn't work with Tor Traffic [migrated]
Always, when I try to run kill switch for VPN my Tor Browser stops working and I am not sure why it happened. I am not good in firewalls and port forwarding but I would like to learn.
I have ...
1
vote
1answer
66 views
Using SUID program to avoid having entries in sudoers
Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
0
votes
0answers
9 views
Protecting Linux systems from symlink attacks [migrated]
Linux-based systems are vulnerable to symlink race attacks from unprivileged UID processes. For example, a PHP process can create a symlink to /etc/passwd in a directory where Apache httpd will serve ...
0
votes
1answer
155 views
What is a secure way to encrypt critical secrets for a person likely to be individually targeted [closed]
I read several guides and Stackexchange answers, but the more I know, the more I realise how much I don't know. What I learnt is that details of implementation matter and that most popular tools do ...
0
votes
0answers
51 views
Is Linux dangerous for secure environments because it's open source? [duplicate]
I work for a company that sells hardware products with Linux embedded into the product. We lost a job for a defense contractor due to our hardware running Linux. Their reason was "because it's open ...
0
votes
1answer
65 views
How to set up the Tor browser on Linux Mint in a VM with a VPN on the Host
(Forgive me, I don't know whether to post this here for in the "Tor" community)
I'm brand new to Tor, I understand the basics of how it works and the Do's & Don'ts. I have a Windows 10 computer (...
1
vote
0answers
20 views
How do I create exceptions on Wazuh (OSSEC)?
I currently have a setup with OSSEC and AIDE running on our servers.
We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log.
I want to make an exception for ...
0
votes
1answer
26 views
Can I track delete action in event viewer?
Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on ...
0
votes
1answer
28 views
Firefox switches charset encoding, brings up request to install extensin. Is this a “browser virus”?
I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...
0
votes
1answer
58 views
shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )
I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !!
Segmentation fault (core dumped)
my shellcode :
section .text
...
0
votes
0answers
42 views
Heap bugs - extinct now?
I've been practicing some computer security courses lately, and I'm bugged by one specific heap overflow that just doesn't work for me. Taken from The Shellcoder's handbook, chapter 5.
While doing my ...
0
votes
1answer
56 views
Could an infected .iso file infect a PC that is running a disc burning or drive imaging program?
I can't seem to find too much on this, but I'm worried after realizing I downloaded my Raspbian image from HTTP, and wrote it into a USB stick without verification.
I'm worried, especially since I ...
1
vote
2answers
85 views
Reverse shell refusing/difficulties to establish connection
I've been trying to reverse shell between different devices, however,
I'm never able to establish a connection or get a shell prompt
.
Let's say I have a Mac OSX as victim and use a raspberry Pi ...
1
vote
0answers
75 views
Need help in exploiting an overflow on Linux [closed]
There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string".
It's also possible to send about 10000 custom bytes to heap (it's possible to ...
0
votes
1answer
68 views
Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
Specially, can an attacker escape ...
0
votes
1answer
60 views
Command injection with brace expansion
Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces?
I am encountering most likely not a filtering engine, but an bad parsing ...
0
votes
0answers
63 views
XenForo website hacked through PHP shell script
My XenForo forum was hacked today using a PHP shell script. The website is ran on Linux (Ubuntu 18).
I'm not too experienced with backend stuff so I apologize if I use the wrong technical names.
...
1
vote
1answer
84 views
Should I treat my SSH username like a secret?
I'm trying to automate the deployment of my blog.
Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me.
...
0
votes
1answer
73 views
What are the security implications if systemd is not restarted after it has been updated?
My understanding is that systemd is the parent process for all other processes running on Linux.
If systemd has been updated on production devices such as servers and the service is not restarted, ...
0
votes
0answers
18 views
Confirming a tcp connection is encrypted not just encoded? [duplicate]
This is a follow up of this question.
The accpeted answer suggest using tcpdump -A -c 200 but leaves up the crucial part on how to distinguish whether the data is encrypted and not encoded.
What I'm ...
1
vote
2answers
83 views
Why can't iptables drop arp requests
I was trying to hide my laptop from my phone's network scan app. The app is using arp requests to find devices on the network. I tried everything on iptables. It doesn't work, even if i set all the ...
3
votes
1answer
88 views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
0
votes
2answers
122 views
Is my PC safe after DSA-4371?
I used
sudo apt-get update
sudo apt-get upgrade
before I read https://www.debian.org/security/2019/dsa-4371
There was I change that my PC got exploited/hacked/virused.
So I used
chkrootkit
and ...
0
votes
1answer
93 views
How fill up a gig interface bandwidth with hping3?
I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
0
votes
1answer
40 views
What considerations are there for using USB WiFI adapters and how to protect against them?
Often with older machines, the built-in WiFi adapters have failed. These in turn drive a demand to procure USB WiFi adapters since ethernet connectivity is not a choice.
Since the devices will be ...
2
votes
0answers
46 views
String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on
I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is:
...
1
vote
0answers
84 views
ARP spoofing doesn't work as expected?
I have seen products like CUJO (https://www.getcujo.com) and Firewalla (https://firewalla.com/) doing ARP spoofing for network filtering and device blocking.
As far as know, simplest way to ...
2
votes
2answers
111 views
“Don't break Debian” and bug fixes
Don't break Debian page is quite clear that always installing the latest versions of third-party software from from places other than official Debian repositories is not a good idea. Although the ...
2
votes
3answers
2k views
New Linux virus “watchbog”. What could be the cause? [duplicate]
This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause.
So here's my story:
There is a new virus out ...
0
votes
1answer
74 views
How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?
Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following:
seal "azurekeyvault" {
tenant_id = "46646709-b63e-4747-be42-516edeaf1e14"
client_id = "...
