Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
0
votes
1answer
43 views
How fill up a gig interface bandwidth with hping3?
I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
0
votes
1answer
33 views
What considerations are there for using USB WiFI adapters and how to protect against them?
Often with older machines, the built-in WiFi adapters have failed. These in turn drive a demand to procure USB WiFi adapters since ethernet connectivity is not a choice.
Since the devices will be ...
2
votes
0answers
37 views
String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on
I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is:
...
1
vote
0answers
46 views
ARP spoofing doesn't work as expected?
I have seen products like CUJO (https://www.getcujo.com) and Firewalla (https://firewalla.com/) doing ARP spoofing for network filtering and device blocking.
As far as know, simplest way to ...
2
votes
2answers
99 views
“Don't break Debian” and bug fixes
Don't break Debian page is quite clear that always installing the latest versions of third-party software from from places other than official Debian repositories is not a good idea. Although the ...
1
vote
3answers
305 views
New Linux virus “watchbog”. What could be the cause? [duplicate]
This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause.
So here's my story:
There is a new virus out ...
0
votes
1answer
35 views
How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?
Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following:
seal "azurekeyvault" {
tenant_id = "46646709-b63e-4747-be42-516edeaf1e14"
client_id = "...
-2
votes
0answers
32 views
Kali Linux Install VB macbook [migrated]
I downloaded the kali-linux-2018.4-amd64.iso and ran the graphical install on virtualbox on my mac.
After the install I was able to login and I saw all the tools available, but when I poweroff from ...
0
votes
0answers
20 views
PHP socks proxy with no port opening
let's say i have file apache file access on a webserver, but due to firewall rules etc, i can't connect to ssh and can't open a port.
Is there a way to do this exactly this :
create a socks proxy on ...
0
votes
0answers
21 views
Access HOST RDP Behind NAT - SSL Tunnel
I have a lab scenario, and I would like to get some help:
Linux SSH accessed from public || Firewall (NAT) || Windows PC with RDP
I tried to establish Reverse SSH from Windows with the command:
...
0
votes
1answer
37 views
Is my mongodb data safe given that by mistake I left the default port 127017 open on firewall?
A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup
ufw allow 127017
ufw allow 127017/tcp
No user authentication ...
0
votes
0answers
55 views
Exploit TinyCore Linux 4.2.9 with DirtyCow remote from Kali Linux
Do you know if is possible execute an exploit from Kali Linux for obtain root privileges in a remote machine (that I have exploited before with a local user) with tiny-core Linux version 4.2.9, I've ...
1
vote
2answers
101 views
dirtycow exploit without gcc [closed]
I found many vulnerabilities but almost all of them require gcc which is not available on most of my target machines.
I was wondering if it's possible to run dirtycow without gcc installed or what is ...
0
votes
1answer
52 views
apparmor: How to enable dbus feature of apparmor ('dbus mediation'), in the linux kernel?
Would very much like to use apparmor to restrict specific dbus communications within my system. However the following line appears in my syslog:
Dec 28 09:36:21 apex snapd[1127]: AppArmor status: ...
1
vote
1answer
39 views
Apparmor - how to 'allow everything' rule, then tighten up?
Being very new to apparmor, would just like to start by placing some simple 1 line restriction on a program. And leave everything else as-is. Also, for other reasons it's not possible for me to easily ...
2
votes
0answers
27 views
How is CVE-2016-6787 a UAF bug in Linux kernel?
From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
0
votes
1answer
31 views
What are the security trade offs between the different methods for encrypting a guest VM image?
The scenario is a lightly secured home or work PC used primarily for low-sensitive operations. For more secure activities a pre-built and restrictive virtual machine will be used.
I'm mostly ...
1
vote
1answer
168 views
Privilege escalation in Linux 2.6.32
I am in an audit and I need to show the client that privileges can be scaled but I have tried in various ways and I could not. The Kernel version is 2.6.32-754.3.5.el6.x86_64.
I have already tried ...
3
votes
1answer
134 views
Where in a binary can '/bin/sh' be written to get a shell?
I've come across some behaviour in a CTF challenge that seems very strange and I was wondering if someone could help me understand it.
The CTF challenge was the can-you-gets-me challenge in ...
1
vote
1answer
49 views
How does the public key get authenticated during an ssh session
When using SSH, my private key is stored on my computer safely and my public key is given to the other party I wish to communicate with.
I understand that the two keys are mathematically related, and ...
0
votes
1answer
47 views
dhclient cloud-init /var/tmp process
There's a process that's running that I'm trying to investigate why its running and what its doing. The server is a Linux Ubuntu server running on AWS. Running 16.04.
The process in question is:
...
5
votes
1answer
785 views
I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is [duplicate]
This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing:
What is this process? How can I get ...
5
votes
0answers
103 views
Forensic investigation of a vehicle infotainment system [closed]
As far as I know most vehicle infotainment systems are run on a customized Linux system built with Yocto.
Forensic toolkits such as Berla iVe allows to extract information such as GPS data, call log, ...
2
votes
0answers
47 views
Exploit Development - Find system address in a given libc
If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it?
I have both the vulnerable binary and the libc file with ...
2
votes
0answers
39 views
Explanation of linux shell access via backpipes? [closed]
I have been looking at different ways to gain shell access to a Linux machine and came across this article.
Under point #2, there is an slightly different way of using netcat to gain shell. here it ...
2
votes
1answer
76 views
How to verify file Integrity?
I have downloaded a software(zipped), from a website: example-linux.gtk.x86_64.zip
There is another file given for verification, example-linux.gtk.x86_64.zip.asc, whose content are
-----BEGIN PGP ...
3
votes
2answers
75 views
Malware spreading via installation media
Imagine user downloads and burns installation USB stick on their compromised Linux system. Are there any known malware that is capable of spreading via Linux distributions installation media so that ...
1
vote
1answer
45 views
Is it dangerous to keep permissions at 666 to member file on SELinux?
I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux.
On CentOS help page , I can see that some files in
/selinux/ are writable by other user : https://www....
2
votes
1answer
36 views
is there a low-overhead way to log every new file created on a Linux host?
I know about inotify but am concerned it would use too many resources.
Is there a better way to monitor a fairly static system (like a web host) for new and unexpected files being created?
2
votes
0answers
61 views
Help with Format String Exploit
I am working on a 32-bit binary which reads an input from the user and uses that input as a format string for printf.
I need to overwrite a specific address with a single byte.
The issue is that I ...
45
votes
5answers
13k views
Should I close port 80 forever and ever since the 2018 Google-indicated web-security initiatives?
I often establish Ubuntu-LAMP environments on which I host a few Drupal web applications that I myself own (I don't provide any hosting services and never done so in the past).
Whenever I establish ...
1
vote
1answer
56 views
How can I block access to module for Firefox? (gmail accessing camera)
I run the following command in the background constantly to check for camera access on Ubuntu Linux:
lsmod | grep ^uvcvideo
I noticed that every time I load into gmail my check is triggering my ...
6
votes
2answers
2k views
Why can 'Others' read files by default in Ubuntu?
I am trying to figure out why when creating new files and directories in, let's say, the Documents folder, they get assigned, by default, the following permissions:
-rw-rw-r-- 1 hello world 0 Nov ...
1
vote
0answers
67 views
Command line tools exploitable on linux
I'm looking this interesting project
https://gtfobins.github.io/
But I don't understand some assumption. For example, if you consider the mv command:
https://gtfobins.github.io/gtfobins/mv/
They ...
2
votes
0answers
35 views
Identifying kernel pointer infoleaks via static analysis
Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
0
votes
1answer
46 views
Is there a list of safe/normal/expected SUID files?
Exploitable SUID executables are a basic privilege escalation vector. But just doing a search for all such files turns up a bunch of results on any linux system, most or all of which are presumed to ...
2
votes
1answer
92 views
Does printk() cause any security issues?
I'm asking myself if the function printk() causes security issues on Linux.
When an attacker has user level access to the system, does it make his life easier if he has access to kernel pointers? Does ...
2
votes
1answer
77 views
prevent Ransomware on CIFS shares mounted on Windows 10
I am using Windows 10 with Defender. I follow all the ground rules when dealing with the internet and staying secure. I work in IS so I'm pretty familiar with the various threat-vectors and do a good ...
2
votes
0answers
121 views
Experimenting with SSLStrip+ on the same machine
I am trying to play around to understand how SSLStrip+ works by:
$ cat /proc/sys/net/ipv4/ip_forward
1
$ sudo iptables --flush
$ sudo iptables --flush -t nat
$ sudo iptables -t nat -A PREROUTING -p ...
1
vote
1answer
175 views
Understanding Microsoft list of disallowed certificates
Microsoft publishes their untrusted certificates as disallowedcerts.stl Warning: direct download.
It is ASN.1 encoded. After decoding it there is a list of sequences like so:
SEQUENCE {
...
1
vote
2answers
211 views
How to copy files without copying Alternate Data Streams
I want to backup my infected Windows system's files before formatting it all and reinstalling the system. I would do it from a Linux Live USB. I've heard that one should be careful in copying only the ...
2
votes
3answers
245 views
Linux tool for monitoring network activity by application
My laptop have been hacked a few months ago and my data is being to uploaded to some remote server without my knowledge.
Is there a way I can find it out and prevent it from happening?
I have ...
3
votes
1answer
331 views
Docker: when to use apparmor vs seccomp vs --cap-drop
Docker seems to support both apparmor and seccomp. Docker also allows to drop capabilities when running a container.
However I couldn't find any documentation or guideline on when to use which ...
2
votes
2answers
443 views
Is it possible to execute a local file or code from cURL?
I wonder if it is possible to execute bash code or a local file from cURL, that is, using the following syntax:
curl "local file"
I was looking for possible solutions and found that to read the ...
2
votes
2answers
235 views
Should a windows IT shop have concerns about enabling WSL for users?
I work in a place that only supports windows, and the folks in charge of IT are (1) very conservative, and (2) not at the bleeding edge of their profession.
I want the Windows Subsystem for Linux (...
0
votes
1answer
129 views
watch DNS queries while using OpenVPN.-
I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client.
My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
63
votes
4answers
12k views
Are most Linux systems that allow non-root users to execute code straightforwardly rootable?
long story short if you can execute code on a box it is usually straightforward to get root
(quote source)
The immediate implication of this quote (if it's accurate) is that if you're running a ...
7
votes
1answer
562 views
How can utilities with setuid set to root be secure if they are debuggable?
Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that:
I can freely debug all programs I have the permission to run, even those that have ...
0
votes
1answer
46 views
Security Incident File Change Timestamp
How can I obtain all timestamps of all files ( starting"/") on a Linux system in order to verify if a file was changed within a breach?
0
votes
2answers
109 views
Privilege Escalation: C functions setuid(0) with system() not working in Linux
Quick disclaimer: I fully understand that the code I am attempting to write is insecure, and allows for arbitrary users to escalate to root. I am writing a simple C program like this to demonstrate ...
