Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

5
votes
1answer
2k views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
0
votes
1answer
36 views

Is it possible to securely run user defined python code in AWS?

I would like to create an app that accepts users python scripts and executes them as part of its functionality. What I am wondering is if its possible to block I/O, network and other attack vectors so ...
0
votes
0answers
38 views

How do I fix: SSL/TLS: Report Weak Cipher Suites for Ubuntu Server [on hold]

I ran a vulnerability scan and I got these results for ports 993, 995, and 5432. I am running Dovecot for POP3S and IMAPS and Postgres for port 5432. I got these results from the vulnerability scan: ...
1
vote
0answers
44 views

Is there a way to get a forensic image of EC2 instance

I currently have an instance on AWS which was compromised and resulted in me losing control. I have shutdown the instance since then, but require a forensic image of the volume so that I can analyze ...
0
votes
1answer
149 views

Why does Yahoo cached results button lead to blacklisted “malicious”/“phishing” IP?

I did a search for some on Yahoo, I then click on the little arrow next to one of the search results and then clicked the Cached button because I wanted to view an older version of the page. It took ...
0
votes
2answers
42 views

How can I check what scripts are in Nmap's default category (`--script=default`)?

I know that the -sC and -A options run the "default" category of scripts (--script=default): https://nmap.org/book/nse-usage.html I've searched the nmap script folder for a default sub-folder, but ...
39
votes
6answers
15k views

How secure is NOPASSWD in passwordless sudo mode?

On all our boxes we have ssh access via keys. All keys are password protected. At this moment the sudo mode is not passwordless. Because the number of VMs are growing in our setup, we investigate the ...
-1
votes
0answers
45 views

Chain of security by booting Linux

I am curious if there is any solution that ensures that the actual OS I start is safe. I have SecureBoot on my microserver, and that way I can ensure, that GRUB is safe. But what about the drive ...
0
votes
0answers
22 views

Linux Kernel exploitation via MSFconsole

I am running a server with the service linux kernel to practice pentesting with metasploit. I am trying to use CVE-2019-10124 to take it down, however I don't really know how to. I am aware that ...
1
vote
1answer
102 views

Enterprise Standard for Linux server Penetration Testing

Is there any enterprise or global standard like "OWASP" which can be followed while doing penetration testing on Linux servers? I want to know if there are any most common/important vulnerabilities ...
6
votes
1answer
1k views

How to encrypt, sign and decrypt a file with gpg?

I am using gpg to encrypt and decrypt a file. Here are the steps I am doing taking reference from this question: # Sender gpg --encrypt --recipient recipient@gmail.com --output confidential.pgp ...
1
vote
1answer
384 views

selinux : blocking sudo and su usage by placing user into user_t profile

I am trying to block privileges escalations from unprivileged accounts such as www-data. Basically, if my web server is getting compromised, crackers may find ways to escalate (vulnerabilities found ...
6
votes
2answers
254 views

Bash function manipulation explained

I was recently reading through a write up on a capture the flag Linux VulnHub machine. For privilege escalation, the author references 'bash function manipulation'. A Google search turns up very ...
-1
votes
0answers
38 views

Monitoring home control system [closed]

(Sorry in advance English is not my native language) Hi, I'm fairly new to Linux and its software in general, I am wondering if I am able to monitor what is happening on my home control system, it ...
0
votes
1answer
19 views

GnuPG can see a card under root user, but not under normal user

When under an unprivileged user: $ gpg --card-status gpg: selecting openpgp failed: No such device gpg: OpenPGP card not available: No such device With sudo or under a root user: $ sudo gpg --card-...
20
votes
7answers
6k views

How can I protect my computer from my potentially malicious colleagues?

So, I work in this small company (10 people) where we do stuff in programming, for various platforms. I started recently working there (2 months) right after I graduated. My work is not exactly ...
10
votes
1answer
14k views

Pros and cons of disabling TCP timestamps

So, lynis informs me that I should unset net.ipv4.tcp_timestamps. I know that's a bad thing because an attacker could figure out which updates that require restarting the machine I haven't applied, or ...
10
votes
3answers
2k views

Linux Plausibly Deniable File System

Is there any way to encrypt a Linux filesystem in such a way to maintain plausible deniability? E.g. "Hidden OS support," the way TrueCrypt and Veracrypt work, they only support Windows OS due to low ...
1
vote
1answer
89 views

Linux forensics- How can I extract sysfs procfs from a raw image?

I'm developing a software that extracts files from a Linux raw image (dd). I use SluethKit to get the partitions & files, however i can't find any files inside /sys & /proc folders. I know ...
5
votes
2answers
262 views

Luks+Sleep: Login screen security?

Situation: A Desktop Linux (eg. Debian, Xfce desktop, Lightdm login) with LUKS-encrypted partitions (as far as possible, eg. Efi files are not encrypted of course). The computer is in sleep mode (not ...
0
votes
1answer
278 views

Per-host authentication and configuration of ssh files

I'm only starting to learn SSH. Is it possible to have per-host authorized_keys file (eg /etc/ssh/authorized_keys) to allow passwordless login for every user of the given host? To test I've tried to ...
3
votes
1answer
136 views

Are there any known viruses/malware that can infect Ubuntu that come from the USB?

I know that most viruses that can infect the OS from having an infected USB inserted into the PC are mostly Windows only, but is there any possibility that there is one that can affect Ubuntu as well?
2
votes
1answer
71 views

Cannot exploit stack-based buffer overflow with ASLR-disabled, since RSP differs heavily between executions?

I have made a little toy program, compiled with ALSR disabled, that I want to exploit using stack-based buffer overflow: // gcc stackexec0x1.c -Wl,-z,execstack -no-pie -fno-stack-protector -o ...
0
votes
1answer
65 views

How to set up the Tor browser on Linux Mint in a VM with a VPN on the Host

(Forgive me, I don't know whether to post this here for in the "Tor" community) I'm brand new to Tor, I understand the basics of how it works and the Do's & Don'ts. I have a Windows 10 computer (...
0
votes
0answers
15 views

Analyzing Swap File [migrated]

I have the following problem: I have a .memdump.swp~ file. I tried recovering the .memdump file by using vim -r .memdump and also tried to use vim -r .memdump.swp. Both didn't bring success. Is there ...
3
votes
1answer
84 views

When accepting an SSL certificate, can I limit for which domains I accept it?

Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating ...
1
vote
1answer
728 views

ShadowHammer: Limited to Windows?

I've been reading about ShadowHammer over the last couple of days: Kaspersky researchers estimated half a million Windows machines received the malicious backdoor via ASUS' update server. But the ...
1
vote
0answers
64 views

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
1
vote
1answer
145 views

How can privilege escalation through pkexec be prevented?

I've managed to elevate privileges on a Linux machine (3.19) using pkexec, but I don't understand the mechanics. /usr/bin/pkexec has the SUID bit set (which is normal, I gather), and simply using it ...
3
votes
1answer
256 views

Could Intel SGX be dangerous under Linux?

Question Background This morning, by accident I have found, that there is basically a backdoor in a dormant state in my Dell laptop: Computrace, which comes from Absolute Software - link to their Web,...
2
votes
0answers
81 views

Can maliciously modified ACPI AML be executed without a reboot?

ACPI tables contain ACPI Machine Language, or AML, which is executed by an interpreter in the kernel at boot. Certain ACPI tables, such as the DSDT, are necessary to support hardware ACPI events such ...
0
votes
1answer
2k views

How to continue where I left off on reaver?

I was attempting to brute-force the WPS PIN on my home router to check the security of my network. Strangely, after three days it still had not finished, I believe this is because my computer was far ...
0
votes
0answers
34 views

How to disable .got.plt protection using GCC on Ubuntu 18.10?

I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions. Usually, the function's .plt entry should (lazy) resolve the ...
5
votes
1answer
567 views

Use TPM2.0 to securely decrypt the hard drive in Linux — unattended

I already spent several days trying to figure out how to securely decrypt a hard drive on remote location using TPM2.0 in Linux. I'm no security expert and this is my first battle with TPM2.0. I ...
0
votes
0answers
40 views

Arpspoof not working properly

I'm testing MITM packet manipulation on the fly between two computers on the same switch, a layer 2 switch. I'm using a Kali Linux machine as the attacker and i have written a python script to ...
0
votes
1answer
60 views

Command injection with brace expansion

Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces? I am encountering most likely not a filtering engine, but an bad parsing ...
1
vote
1answer
66 views

Using SUID program to avoid having entries in sudoers

Well, I've done a lot of reading and documentation around possible exploitation of sudoers files and SUID programs, but don't have a deep enough knowledge to pick up the wisest possible solution for ...
0
votes
1answer
69 views

Do systemd-nspawn containers provide the same security guarantees as FreeBSD jails?

I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails? Specially, can an attacker escape ...
11
votes
1answer
507 views

Fully transparent proxy

By default mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections. The following ...
0
votes
1answer
155 views

What is a secure way to encrypt critical secrets for a person likely to be individually targeted [closed]

I read several guides and Stackexchange answers, but the more I know, the more I realise how much I don't know. What I learnt is that details of implementation matter and that most popular tools do ...
0
votes
0answers
51 views

Is Linux dangerous for secure environments because it's open source? [duplicate]

I work for a company that sells hardware products with Linux embedded into the product. We lost a job for a defense contractor due to our hardware running Linux. Their reason was "because it's open ...
18
votes
2answers
4k views

RdRand from /dev/random

"Linus Torvalds, in response to a petition on Change.org to remove RdRand from /dev/random, has lambasted the petitioner by called him ignorant for not understanding the code in Linux Kernel. Kyle ...
1
vote
0answers
20 views

How do I create exceptions on Wazuh (OSSEC)?

I currently have a setup with OSSEC and AIDE running on our servers. We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log. I want to make an exception for ...
0
votes
2answers
122 views

Is my PC safe after DSA-4371?

I used sudo apt-get update sudo apt-get upgrade before I read https://www.debian.org/security/2019/dsa-4371 There was I change that my PC got exploited/hacked/virused. So I used chkrootkit and ...
0
votes
1answer
58 views

shellcode JMP-CALL-POP technique ( Segmentation fault (core dumped) )

I write this shellcode for spawn a shell on the box using JMP-CALL-POP technique but i keep got this error i don't now why !! Segmentation fault (core dumped) my shellcode : section .text ...
1
vote
0answers
75 views

Need help in exploiting an overflow on Linux [closed]

There is a 32-bit linux application. It's possible to overwrite EIP easily. I will call this process: "send a string". It's also possible to send about 10000 custom bytes to heap (it's possible to ...
3
votes
1answer
129 views

Does printk() cause any security issues?

I'm asking myself if the function printk() causes security issues on Linux. When an attacker has user level access to the system, does it make his life easier if he has access to kernel pointers? Does ...
0
votes
1answer
26 views

Can I track delete action in event viewer?

Ihave a centos file server mapped in a windows pc. Unfortunately, someone deleted a file inside the file server and UNFORTUNATELY we have just deleted the backup of the file server and it's logs on ...
20
votes
3answers
21k views

For LUKS: The most preferable and safest cipher?

I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
0
votes
1answer
28 views

Firefox switches charset encoding, brings up request to install extensin. Is this a “browser virus”?

I use Devuan ASCII (~= Debian Stretch) on my desktop, with Firefox and Chromium as my browsers. As I came back to my computer today after a few hours of non-use, and loaded a new browser frame, ...