Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
1
vote
1answer
82 views
nmap privilege escalation - is still a risk?
There is a known and popular technique to leverage nmap for privilege escalation if the suid bit is set for nmap.
One can execute nmap in interactive mode and from there execute bash commands in the ...
0
votes
1answer
84 views
How to brute force only username not password?
I want to find the username first, then pass the username and a password list. I could not find flags to ignore password in Ncrack and other related tools. The device I want to find a username is ...
0
votes
1answer
45 views
Risk associated with problematic linux permissions on files and libraries
I started tweaking my linux system a while ago, before I understood the security risks related to having files with problematic permissions, such as 777.
I wanted to check if I had left some ...
-1
votes
0answers
61 views
Creating a backdoor in linux [on hold]
How can i create a persistent backdoor on a linux system that i have root access to without being detected?
I have looked into two options:
To include a script that binds a shell in the /etc/init.d ...
-2
votes
0answers
28 views
Tool for checking for activity on a server [on hold]
I think my shady hoster has logged into my vps. Is there a software which can log act
0
votes
1answer
54 views
Is it possible to securely run user defined python code in AWS?
I would like to create an app that accepts users python scripts and executes them as part of its functionality. What I am wondering is if its possible to block I/O, network and other attack vectors so ...
0
votes
0answers
49 views
How do I fix: SSL/TLS: Report Weak Cipher Suites for Ubuntu Server [closed]
I ran a vulnerability scan and I got these results for ports 993, 995, and 5432. I am running Dovecot for POP3S and IMAPS and Postgres for port 5432. I got these results from the vulnerability scan:
...
1
vote
0answers
49 views
Is there a way to get a forensic image of EC2 instance
I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
-1
votes
0answers
49 views
Chain of security by booting Linux
I am curious if there is any solution that ensures that the actual OS I start is safe. I have SecureBoot on my microserver, and that way I can ensure, that GRUB is safe. But what about the drive ...
0
votes
0answers
22 views
Linux Kernel exploitation via MSFconsole
I am running a server with the service linux kernel to practice pentesting with metasploit.
I am trying to use CVE-2019-10124 to take it down, however I don't really know how to.
I am aware that ...
0
votes
2answers
43 views
How can I check what scripts are in Nmap's default category (`--script=default`)?
I know that the -sC and -A options run the "default" category of scripts (--script=default):
https://nmap.org/book/nse-usage.html
I've searched the nmap script folder for a default sub-folder, but ...
0
votes
1answer
26 views
GnuPG can see a card under root user, but not under normal user
When under an unprivileged user:
$ gpg --card-status
gpg: selecting openpgp failed: No such device
gpg: OpenPGP card not available: No such device
With sudo or under a root user:
$ sudo gpg --card-...
1
vote
1answer
89 views
Linux forensics- How can I extract sysfs procfs from a raw image?
I'm developing a software that extracts files from a Linux raw image (dd).
I use SluethKit to get the partitions & files, however i can't find any files inside /sys & /proc folders.
I know ...
1
vote
1answer
103 views
Enterprise Standard for Linux server Penetration Testing
Is there any enterprise or global standard like "OWASP" which can be followed while doing penetration testing on Linux servers?
I want to know if there are any most common/important vulnerabilities ...
3
votes
1answer
138 views
Are there any known viruses/malware that can infect Ubuntu that come from the USB?
I know that most viruses that can infect the OS from having an infected USB inserted into the PC are mostly Windows only, but is there any possibility that there is one that can affect Ubuntu as well?
2
votes
1answer
78 views
Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?
I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow:
// gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
0
votes
0answers
15 views
Analyzing Swap File [migrated]
I have the following problem:
I have a .memdump.swp~ file. I tried recovering the .memdump file by using vim -r .memdump and also tried to use vim -r .memdump.swp. Both didn't bring success.
Is there ...
6
votes
2answers
255 views
Bash function manipulation explained
I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
1
vote
1answer
734 views
ShadowHammer: Limited to Windows?
I've been reading about ShadowHammer over the last couple of days:
Kaspersky researchers estimated half a million Windows machines received the malicious backdoor via ASUS' update server. But the ...
3
votes
1answer
87 views
When accepting an SSL certificate, can I limit for which domains I accept it?
Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
1
vote
0answers
64 views
How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?
The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
1
vote
1answer
191 views
How can privilege escalation through pkexec be prevented?
I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it ...
3
votes
1answer
259 views
Could Intel SGX be dangerous under Linux?
Question Background
This morning, by accident I have found, that there is basically a backdoor in a dormant state in my Dell laptop: Computrace, which comes from Absolute Software - link to their Web,...
0
votes
0answers
37 views
How to disable .got.plt protection using GCC on Ubuntu 18.10?
I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions.
Usually, the function's .plt entry should (lazy) resolve the ...
0
votes
0answers
45 views
Arpspoof not working properly
I'm testing MITM packet manipulation on the fly between two computers on the same switch, a layer 2 switch. I'm using a Kali Linux machine as the attacker and i have written a python script to ...
1
vote
1answer
66 views
Using SUID program to avoid having entries in sudoers
Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
0
votes
1answer
155 views
What is a secure way to encrypt critical secrets for a person likely to be individually targeted [closed]
I read several guides and Stackexchange answers, but the more I know, the more I realise how much I don't know. What I learnt is that details of implementation matter and that most popular tools do ...
0
votes
0answers
51 views
Is Linux dangerous for secure environments because it's open source? [duplicate]
I work for a company that sells hardware products with Linux embedded into the product. We lost a job for a defense contractor due to our hardware running Linux. Their reason was "because it's open ...
0
votes
1answer
69 views
How to set up the Tor browser on Linux Mint in a VM with a VPN on the Host
(Forgive me, I don't know whether to post this here for in the "Tor" community)
I'm brand new to Tor, I understand the basics of how it works and the Do's & Don'ts. I have a Windows 10 computer (...
1
vote
0answers
22 views
How do I create exceptions on Wazuh (OSSEC)?
I currently have a setup with OSSEC and AIDE running on our servers.
We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log.
I want to make an exception for ...
0
votes
1answer
26 views
Can I track delete action in event viewer?
Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on ...
0
votes
1answer
28 views
Firefox switches charset encoding, brings up request to install extensin. Is this a “browser virus”?
I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...
0
votes
1answer
61 views
shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )
I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !!
Segmentation fault (core dumped)
my shellcode :
section .text
...
0
votes
0answers
42 views
Heap bugs - extinct now?
I've been practicing some computer security courses lately, and I'm bugged by one specific heap overflow that just doesn't work for me. Taken from The Shellcoder's handbook, chapter 5.
While doing my ...
0
votes
1answer
57 views
Could an infected .iso file infect a PC that is running a disc burning or drive imaging program?
I can't seem to find too much on this, but I'm worried after realizing I downloaded my Raspbian image from HTTP, and wrote it into a USB stick without verification.
I'm worried, especially since I ...
1
vote
2answers
100 views
Reverse shell refusing/difficulties to establish connection
I've been trying to reverse shell between different devices, however,
I'm never able to establish a connection or get a shell prompt
.
Let's say I have a Mac OSX as victim and use a raspberry Pi ...
1
vote
0answers
75 views
Need help in exploiting an overflow on Linux [closed]
There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string".
It's also possible to send about 10000 custom bytes to heap (it's possible to ...
0
votes
1answer
74 views
Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
Specially, can an attacker escape ...
0
votes
1answer
62 views
Command injection with brace expansion
Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces?
I am encountering most likely not a filtering engine, but an bad parsing ...
0
votes
0answers
66 views
XenForo website hacked through PHP shell script
My XenForo forum was hacked today using a PHP shell script. The website is ran on Linux (Ubuntu 18).
I'm not too experienced with backend stuff so I apologize if I use the wrong technical names.
...
1
vote
1answer
85 views
Should I treat my SSH username like a secret?
I'm trying to automate the deployment of my blog.
Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me.
...
0
votes
1answer
73 views
What are the security implications if systemd is not restarted after it has been updated?
My understanding is that systemd is the parent process for all other processes running on Linux.
If systemd has been updated on production devices such as servers and the service is not restarted, ...
0
votes
0answers
18 views
Confirming a tcp connection is encrypted not just encoded? [duplicate]
This is a follow up of this question.
The accpeted answer suggest using tcpdump -A -c 200 but leaves up the crucial part on how to distinguish whether the data is encrypted and not encoded.
What I'm ...
1
vote
2answers
98 views
Why can't iptables drop arp requests
I was trying to hide my laptop from my phone's network scan app. The app is using arp requests to find devices on the network. I tried everything on iptables. It doesn't work, even if i set all the ...
3
votes
1answer
89 views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
0
votes
2answers
123 views
Is my PC safe after DSA-4371?
I used
sudo apt-get update
sudo apt-get upgrade
before I read https://www.debian.org/security/2019/dsa-4371
There was I change that my PC got exploited/hacked/virused.
So I used
chkrootkit
and ...
0
votes
1answer
94 views
How fill up a gig interface bandwidth with hping3?
I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
0
votes
1answer
40 views
What considerations are there for using USB WiFI adapters and how to protect against them?
Often with older machines, the built-in WiFi adapters have failed. These in turn drive a demand to procure USB WiFi adapters since ethernet connectivity is not a choice.
Since the devices will be ...
2
votes
0answers
49 views
String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on
I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is:
...
1
vote
0answers
90 views
ARP spoofing doesn't work as expected?
I have seen products like CUJO (https://www.getcujo.com) and Firewalla (https://firewalla.com/) doing ARP spoofing for network filtering and device blocking.
As far as know, simplest way to ...
