Questions tagged [linux]
Securing Linux systems and applications; understanding Linux security features.
0
votes
0answers
22 views
why does my simple 0x86 shellcode execve not do anything?
I'm just starting to learn execve command, so I'm sure this is a very easy mistake, but I've stuck on this for hours, so any help or hints would really be appreciated, my code is as follows:
section ...
0
votes
0answers
28 views
Finding images with high white content [on hold]
I have a large amount of mixed-content images that also contain some scanned documents. I want to filter out potential documents automatically by defining some lower bound of "whiteness" that ...
0
votes
0answers
26 views
Arpspoof not working properly
I'm testing MITM packet manipulation on the fly between two computers on the same switch, a layer 2 switch. I'm using a Kali Linux machine as the attacker and i have written a python script to ...
0
votes
0answers
24 views
VPN Kill switch doesn't work with Tor Traffic [migrated]
Always, when I try to run kill switch for VPN my Tor Browser stops working and I am not sure why it happened. I am not good in firewalls and port forwarding but I would like to learn.
I have ...
0
votes
0answers
31 views
Gain access to files with higher privileges [on hold]
I have this vulnerable linux distribution. There are some files that only users within a specific group can access, which is not my group. And I want to access these files. I tried to use symlinks, ...
1
vote
1answer
56 views
Using SUID program to avoid having entries in sudoers
Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
0
votes
0answers
9 views
Protecting Linux systems from symlink attacks [migrated]
Linux-based systems are vulnerable to symlink race attacks from unprivileged UID processes. For example, a PHP process can create a symlink to /etc/passwd in a directory where Apache httpd will serve ...
0
votes
1answer
150 views
What is a secure way to encrypt critical secrets for a person likely to be individually targeted
I read several guides and Stackexchange answers, but the more I know, the more I realise how much I don't know. What I learnt is that details of implementation matter and that most popular tools do ...
0
votes
0answers
7 views
kali can't connect to metasploitable [migrated]
I need your help guys.
I have my kali virtual box image and its network is my created NAT network(NAT1)
I have my metasmploitable image and its network is my same created NAT Network(NAT1)
on ...
0
votes
0answers
8 views
MAC reverting back to original [migrated]
I'm trying to change MAC address on wlan0 USB device, so I write:
ifconfig wlan0 down
ifconfig wlan0 hw ether 00:11:22:33:44:55
ifconfig wlan0 up
And MAC doesn't change, I even modified the "...
0
votes
0answers
51 views
Is Linux dangerous for secure environments because it's open source? [duplicate]
I work for a company that sells hardware products with Linux embedded into the product. We lost a job for a defense contractor due to our hardware running Linux. Their reason was "because it's open ...
0
votes
0answers
5 views
How to log failure to start/stop a service? [migrated]
I want to track whether a normal user attempted to run a service.
The command for starting/stopping service is given as below:
service filebeat start
I wrote an auditd rule like below:
-w /usr/sbin/...
0
votes
1answer
44 views
How to set up the Tor browser on Linux Mint in a VM with a VPN on the Host
(Forgive me, I don't know whether to post this here for in the "Tor" community)
I'm brand new to Tor, I understand the basics of how it works and the Do's & Don'ts. I have a Windows 10 computer (...
1
vote
0answers
19 views
How do I create exceptions on Wazuh (OSSEC)?
I currently have a setup with OSSEC and AIDE running on our servers.
We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log.
I want to make an exception for ...
0
votes
0answers
16 views
`tls-crypt unwrap error: packet authentication failed` connection error for OpenVPN Server [migrated]
• I am unable to set up the VPN server on my host, using OpenVPN, specifically, when connecting to the server, the connection is failing with an error tls-crypt unwrap error: packet authentication ...
0
votes
0answers
5 views
How to set up a new linux user that has no access to any file or command (for reverse-ssh-tunnel) [migrated]
I created a Raspbian-Image which is used by a bunch of friends, colleagues and other nerds. They run it at home on their own Raspberry Pi's. However, I need SSH-Access to that Raspberry Pis to be able ...
0
votes
0answers
28 views
Hard drive - not seen by fdisk, not mounted but detected [migrated]
I had hard drive which was target location for CCTV, connected to linux mini pc running rsync in background to collect footage from few locations.
Well, I noticed that sometimes rsync failed due ...
0
votes
1answer
25 views
Can I track delete action in event viewer?
Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on ...
0
votes
1answer
27 views
Firefox switches charset encoding, brings up request to install extensin. Is this a “browser virus”?
I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...
0
votes
1answer
49 views
shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )
I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !!
Segmentation fault (core dumped)
my shellcode :
section .text
...
0
votes
0answers
40 views
Heap bugs - extinct now?
I've been practicing some computer security courses lately, and I'm bugged by one specific heap overflow that just doesn't work for me. Taken from The Shellcoder's handbook, chapter 5.
While doing my ...
0
votes
1answer
55 views
Could an infected .iso file infect a PC that is running a disc burning or drive imaging program?
I can't seem to find too much on this, but I'm worried after realizing I downloaded my Raspbian image from HTTP, and wrote it into a USB stick without verification.
I'm worried, especially since I ...
1
vote
2answers
40 views
Reverse shell refusing/difficulties to establish connection
I've been trying to reverse shell between different devices, however,
I'm never able to establish a connection or get a shell prompt
.
Let's say I have a Mac OSX as victim and use a raspberry Pi ...
1
vote
0answers
74 views
Need help in exploiting an overflow on Linux [closed]
There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string".
It's also possible to send about 10000 custom bytes to heap (it's possible to ...
0
votes
1answer
46 views
Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails?
Specially, can an attacker escape ...
0
votes
1answer
60 views
Command injection with brace expansion
Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces?
I am encountering most likely not a filtering engine, but an bad parsing ...
0
votes
0answers
51 views
XenForo website hacked through PHP shell script
My XenForo forum was hacked today using a PHP shell script. The website is ran on Linux (Ubuntu 18).
I'm not too experienced with backend stuff so I apologize if I use the wrong technical names.
...
1
vote
1answer
76 views
Should I treat my SSH username like a secret?
I'm trying to automate the deployment of my blog.
Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me.
...
0
votes
1answer
72 views
What are the security implications if systemd is not restarted after it has been updated?
My understanding is that systemd is the parent process for all other processes running on Linux.
If systemd has been updated on production devices such as servers and the service is not restarted, ...
0
votes
0answers
18 views
Confirming a tcp connection is encrypted not just encoded? [duplicate]
This is a follow up of this question.
The accpeted answer suggest using tcpdump -A -c 200 but leaves up the crucial part on how to distinguish whether the data is encrypted and not encoded.
What I'm ...
1
vote
2answers
65 views
Why can't iptables drop arp requests
I was trying to hide my laptop from my phone's network scan app. The app is using arp requests to find devices on the network. I tried everything on iptables. It doesn't work, even if i set all the ...
3
votes
1answer
87 views
Is it safe to use a unix pipe to redirect sensitive output data as input to another program?
I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file.
On the one hand, I don't like the idea of making the TLS private ...
0
votes
2answers
119 views
Is my PC safe after DSA-4371?
I used
sudo apt-get update
sudo apt-get upgrade
before I read https://www.debian.org/security/2019/dsa-4371
There was I change that my PC got exploited/hacked/virused.
So I used
chkrootkit
and ...
0
votes
1answer
69 views
How fill up a gig interface bandwidth with hping3?
I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
0
votes
1answer
39 views
What considerations are there for using USB WiFI adapters and how to protect against them?
Often with older machines, the built-in WiFi adapters have failed. These in turn drive a demand to procure USB WiFi adapters since ethernet connectivity is not a choice.
Since the devices will be ...
2
votes
0answers
44 views
String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on
I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is:
...
1
vote
0answers
68 views
ARP spoofing doesn't work as expected?
I have seen products like CUJO (https://www.getcujo.com) and Firewalla (https://firewalla.com/) doing ARP spoofing for network filtering and device blocking.
As far as know, simplest way to ...
2
votes
2answers
109 views
“Don't break Debian” and bug fixes
Don't break Debian page is quite clear that always installing the latest versions of third-party software from from places other than official Debian repositories is not a good idea. Although the ...
1
vote
3answers
1k views
New Linux virus “watchbog”. What could be the cause? [duplicate]
This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause.
So here's my story:
There is a new virus out ...
0
votes
1answer
63 views
How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?
Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following:
seal "azurekeyvault" {
tenant_id = "46646709-b63e-4747-be42-516edeaf1e14"
client_id = "...
0
votes
0answers
72 views
PHP socks proxy with no port opening
let's say i have file apache file access on a webserver, but due to firewall rules etc, i can't connect to ssh and can't open a port.
Is there a way to do this exactly this :
create a socks proxy on ...
0
votes
0answers
24 views
Access HOST RDP Behind NAT - SSL Tunnel
I have a lab scenario, and I would like to get some help:
Linux SSH accessed from public || Firewall (NAT) || Windows PC with RDP
I tried to establish Reverse SSH from Windows with the command:
...
0
votes
1answer
39 views
Is my mongodb data safe given that by mistake I left the default port 127017 open on firewall?
A few months ago I started production mongodb server on ubuntu 18.04 secured with SSL (https access) with following UFW rules setup
ufw allow 127017
ufw allow 127017/tcp
No user authentication ...
0
votes
0answers
89 views
Exploit TinyCore Linux 4.2.9 with DirtyCow remote from Kali Linux
Do you know if is possible execute an exploit from Kali Linux for obtain root privileges in a remote machine (that I have exploited before with a local user) with tiny-core Linux version 4.2.9, I've ...
1
vote
2answers
155 views
dirtycow exploit without gcc [closed]
I found many vulnerabilities but almost all of them require gcc which is not available on most of my target machines.
I was wondering if it's possible to run dirtycow without gcc installed or what is ...
0
votes
1answer
172 views
apparmor: How to enable dbus feature of apparmor ('dbus mediation'), in the linux kernel?
Would very much like to use apparmor to restrict specific dbus communications within my system. However the following line appears in my syslog:
Dec 28 09:36:21 apex snapd[1127]: AppArmor status: ...
1
vote
1answer
96 views
Apparmor - how to 'allow everything' rule, then tighten up?
Being very new to apparmor, would just like to start by placing some simple 1 line restriction on a program. And leave everything else as-is. Also, for other reasons it's not possible for me to easily ...
2
votes
0answers
32 views
How is CVE-2016-6787 a UAF bug in Linux kernel?
From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
0
votes
1answer
39 views
What are the security trade offs between the different methods for encrypting a guest VM image?
The scenario is a lightly secured home or work PC used primarily for low-sensitive operations. For more secure activities a pre-built and restrictive virtual machine will be used.
I'm mostly ...
1
vote
1answer
218 views
Privilege escalation in Linux 2.6.32
I am in an audit and I need to show the client that privileges can be scaled but I have tried in various ways and I could not. The Kernel version is 2.6.32-754.3.5.el6.x86_64.
I have already tried ...
