Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

140 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
15
votes
2answers
765 views

Fully transparent proxy

By default mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections. The following ...
5
votes
1answer
2k views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
5
votes
1answer
155 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should only be ...
5
votes
1answer
159 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
4
votes
0answers
119 views

How to securely delete a file after it was insecurely deleted (in linux)

How can I securely delete/shred a file after I accidentally deleted the file insecurely? Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear ...
4
votes
0answers
575 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
4
votes
0answers
127 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
4
votes
1answer
892 views

Linux antivirus and files bigger then 4GB

I wish to scan files that are bigger then 4GB. For example video files. I noticed many antivirus software are limited to a maximum of 4GB (ClamAV for example). So: Is there a antivirus software ...
3
votes
0answers
156 views

What are the security implications of capabilities in Kubernetes pods?

We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities: ...
3
votes
0answers
70 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
3
votes
0answers
146 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
3
votes
0answers
106 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
3
votes
0answers
130 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
3
votes
0answers
1k views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
3
votes
0answers
58 views

How do I obtain linux user authentication information securely?

For security purposes the application needs to know, securely who is logged in and what groups they are authorised for. This must be done securely so that a user application cannot perform a man in ...
3
votes
0answers
325 views

Why isn't rng-tools installed by default on all OS?

Many Linux distributions use the package rng-tools, but why isn't it always installed by default? It would increase entropy (/proc/sys/kernel/random/entropy_avail) greatly! Is there any security ...
2
votes
0answers
71 views

How to detect file or file system tampering

I would like to know if the following is possible: Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
2
votes
0answers
106 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
2
votes
0answers
71 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
35 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
2
votes
0answers
261 views

Exploit Development - Find system address in a given libc

If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it? I have both the vulnerable binary and the libc file with ...
2
votes
0answers
181 views

Help with Format String Exploit

I am working on a 32-bit binary which reads an input from the user and uses that input as a format string for printf. I need to overwrite a specific address with a single byte. The issue is that I ...
2
votes
0answers
96 views

Can maliciously modified ACPI AML be executed without a reboot?

ACPI tables contain ACPI Machine Language, or AML, which is executed by an interpreter in the kernel at boot. Certain ACPI tables, such as the DSDT, are necessary to support hardware ACPI events such ...
2
votes
1answer
104 views

Allow only single aplication to access files on USB stick with Linux namespaces

It looks like i found a way to allow only single application to access files in USB storage. This script must be run with sudo. #!/bin/bash # create namespace unshare -m<<EOF # mount device ...
2
votes
0answers
295 views

Linux memory acquisition issues

I am reaching out for possible assistance regarding memory acquisition of a linux system. As of yet I have been unable to either acquire or inspect the memory dump with known tools. The following ...
2
votes
2answers
778 views

Privilege Escalation Wordpress

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to ...
2
votes
0answers
332 views

Detect kASLR/ASLR within a Linux firmware image without running it

I'm currently looking into exploit mitigation techniques and I've come across a question I can't find an answer to just now. To detect the presence of let's says PIE or Canaries within a binary there ...
2
votes
0answers
260 views

Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate

I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized: $ lsusb ... Bus 001 Device 005: ID 1050:0407 Yubico.com ... However, ...
2
votes
0answers
93 views

Get IP/network info with Local File Inclusion

I've been thinking about expanding what I could do with a LFI attack to somehow extract information that we usually get by invoking commands. And since a lot of things in linux behaves like a file or ...
2
votes
0answers
341 views

Blocking Multiple Failed Postfix AUTH Attempts with CSF

I am using CSF/LFD on my CentOS 7 server, and would like to use it to temporarily block IP addresses that have multiple failed Postfix AUTH attempts. You know the one, I get line after line of: lost ...
2
votes
0answers
68 views

Can I detect unique identifiers from random radio chatter?

I am trying to find out if I can uniquely identify smartphones (I would like to find constant identifiers such as IMEI) by passively sniffing the cellular data frequencies. I know that sensitive data ...
2
votes
0answers
182 views

Git Server with several repos

I'm not sure if I'm allowed to post and have one of my newly asked question on both security.stackexchange and unix.stackexchange or not, but I think it is appropriate to ask the question here too ...
2
votes
0answers
127 views

Wayland Partial Encryption for Mouse / Keyboard? (Also X and RDP)

Question What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using X,...
2
votes
0answers
70 views

Is an unprivileged LXC where the host user itself is mapped to 0 less secure of one where one of its subids is mapped to 0, and why?

Instead of creating "common" LXC unprivileged containers where all the users are mapped to (unprivileged) subuid/gid of my host user, I'm considering a mapping where my host user itself will be mapped ...
2
votes
0answers
481 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
0answers
411 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
2
votes
0answers
227 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
2
votes
2answers
213 views

Is a netcat server without -e exploitable?

This is related to a college assignment. I have an Ubuntu server I am trying to do a penetration test on. The server is running a netcat server which when I contact it sends me a nice info message ...
1
vote
0answers
47 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...
1
vote
0answers
47 views

Why is keybase/gui_config.json owned by root?

I have keybase running on my Linux Desktop (Ubuntu 19.04). Since a recent update, the file ~/.config/keybase/gui_config.json is owned by root which is quite irritating. One negative effect of this is ...
1
vote
0answers
46 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
1
vote
0answers
73 views

Basic buffer overflow able to overwrite EIP but doesn't correctly overwrite when using memory address

I wrote a basic vulnerable app in C. #include void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I ...
1
vote
0answers
101 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
1
vote
0answers
51 views

Software mitigation for variant 3a (rogue system register read) and variant 4 (speculative store bypass)

AFAIK, all mitigable meltdown / spectre variants have software mitigation except for variant 3a and 4. Why is this the case? For variant 4, a straightforward software mitigation is to place lfence ...
1
vote
0answers
71 views

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
1
vote
0answers
50 views

How do I create exceptions on Wazuh (OSSEC)?

I currently have a setup with OSSEC and AIDE running on our servers. We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log. I want to make an exception for ...
1
vote
0answers
138 views

ARP spoofing doesn't work as expected?

I have seen products like CUJO (https://www.getcujo.com) and Firewalla (https://firewalla.com/) doing ARP spoofing for network filtering and device blocking. As far as know, simplest way to ...
1
vote
1answer
117 views

What are the security trade offs between the different methods for encrypting a guest VM image?

The scenario is a lightly secured home or work PC used primarily for low-sensitive operations. For more secure activities a pre-built and restrictive virtual machine will be used. I'm mostly ...
1
vote
0answers
212 views

Command line tools exploitable on linux

I'm looking this interesting project https://gtfobins.github.io/ But I don't understand some assumption. For example, if you consider the mv command: https://gtfobins.github.io/gtfobins/mv/ They ...
1
vote
0answers
96 views

UFW (Uncomplicated Firewall) Question

I was wondering if there's any benefit of adding following rules to a Raspberry-Pi directly exposed to the internet: sudo ufw deny to 0.0.0.0/8 && sudo ufw deny to 169.254.0.0/16 && ...