Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

12
votes
0answers
2k views

DMA attacks despite IOMMU isolation

If you're already familiar with PCI behavior and Linux's handling of DMA buffers, skip to the third section for my actual question. Otherwise read on for a small summary of how PCI devices perform ...
4
votes
0answers
528 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
4
votes
0answers
124 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
3
votes
0answers
59 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
3
votes
0answers
141 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
3
votes
0answers
89 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
3
votes
0answers
127 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
3
votes
0answers
866 views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
3
votes
0answers
98 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should only be ...
3
votes
0answers
58 views

How do I obtain linux user authentication information securely?

For security purposes the application needs to know, securely who is logged in and what groups they are authorised for. This must be done securely so that a user application cannot perform a man in ...
3
votes
0answers
304 views

Why isn't rng-tools installed by default on all OS?

Many Linux distributions use the package rng-tools, but why isn't it always installed by default? It would increase entropy (/proc/sys/kernel/random/entropy_avail) greatly! Is there any security ...
2
votes
0answers
81 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
2
votes
0answers
52 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
33 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
2
votes
0answers
211 views

Exploit Development - Find system address in a given libc

If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it? I have both the vulnerable binary and the libc file with ...
2
votes
0answers
165 views

Help with Format String Exploit

I am working on a 32-bit binary which reads an input from the user and uses that input as a format string for printf. I need to overwrite a specific address with a single byte. The issue is that I ...
2
votes
0answers
87 views

Can maliciously modified ACPI AML be executed without a reboot?

ACPI tables contain ACPI Machine Language, or AML, which is executed by an interpreter in the kernel at boot. Certain ACPI tables, such as the DSDT, are necessary to support hardware ACPI events such ...
2
votes
0answers
268 views

Linux memory acquisition issues

I am reaching out for possible assistance regarding memory acquisition of a linux system. As of yet I have been unable to either acquire or inspect the memory dump with known tools. The following ...
2
votes
0answers
302 views

Detect kASLR/ASLR within a Linux firmware image without running it

I'm currently looking into exploit mitigation techniques and I've come across a question I can't find an answer to just now. To detect the presence of let's says PIE or Canaries within a binary there ...
2
votes
0answers
251 views

Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate

I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized: $ lsusb ... Bus 001 Device 005: ID 1050:0407 Yubico.com ... However, ...
2
votes
0answers
91 views

Get IP/network info with Local File Inclusion

I've been thinking about expanding what I could do with a LFI attack to somehow extract information that we usually get by invoking commands. And since a lot of things in linux behaves like a file or ...
2
votes
0answers
310 views

Blocking Multiple Failed Postfix AUTH Attempts with CSF

I am using CSF/LFD on my CentOS 7 server, and would like to use it to temporarily block IP addresses that have multiple failed Postfix AUTH attempts. You know the one, I get line after line of: lost ...
2
votes
0answers
67 views

Can I detect unique identifiers from random radio chatter?

I am trying to find out if I can uniquely identify smartphones (I would like to find constant identifiers such as IMEI) by passively sniffing the cellular data frequencies. I know that sensitive data ...
2
votes
0answers
180 views

Git Server with several repos

I'm not sure if I'm allowed to post and have one of my newly asked question on both security.stackexchange and unix.stackexchange or not, but I think it is appropriate to ask the question here too ...
2
votes
0answers
126 views

Wayland Partial Encryption for Mouse / Keyboard? (Also X and RDP)

Question What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using X,...
2
votes
0answers
69 views

Is an unprivileged LXC where the host user itself is mapped to 0 less secure of one where one of its subids is mapped to 0, and why?

Instead of creating "common" LXC unprivileged containers where all the users are mapped to (unprivileged) subuid/gid of my host user, I'm considering a mapping where my host user itself will be mapped ...
2
votes
0answers
479 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
0answers
398 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
2
votes
0answers
227 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
1
vote
0answers
26 views

Basic buffer overflow able to overwrite EIP but doesn't correctly overwrite when using memory address

I wrote a basic vulnerable app in C. #include void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I ...
1
vote
0answers
99 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
1
vote
0answers
40 views

Software mitigation for variant 3a (rogue system register read) and variant 4 (speculative store bypass)

AFAIK, all mitigable meltdown / spectre variants have software mitigation except for variant 3a and 4. Why is this the case? For variant 4, a straightforward software mitigation is to place lfence ...
1
vote
0answers
69 views

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
1
vote
0answers
29 views

How do I create exceptions on Wazuh (OSSEC)?

I currently have a setup with OSSEC and AIDE running on our servers. We are currently receiving a daily alert for each agent when AIDE runs and changes audit.log. I want to make an exception for ...
1
vote
0answers
117 views

ARP spoofing doesn't work as expected?

I have seen products like CUJO (https://www.getcujo.com) and Firewalla (https://firewalla.com/) doing ARP spoofing for network filtering and device blocking. As far as know, simplest way to ...
1
vote
0answers
102 views

Command line tools exploitable on linux

I'm looking this interesting project https://gtfobins.github.io/ But I don't understand some assumption. For example, if you consider the mv command: https://gtfobins.github.io/gtfobins/mv/ They ...
1
vote
0answers
76 views

UFW (Uncomplicated Firewall) Question

I was wondering if there's any benefit of adding following rules to a Raspberry-Pi directly exposed to the internet: sudo ufw deny to 0.0.0.0/8 && sudo ufw deny to 169.254.0.0/16 && ...
1
vote
0answers
64 views

Use BlueBorne to get arbitrary code execution on locked-down Android system from 2016

So here's the story. I have this smart watch, the Olio Model One. I would like to install Asteroid OS onto this watch, and in order to do that I have to get root code execution (the objective of this ...
1
vote
0answers
38 views

Are parts of my system susceptible to IP based malicious attack even with effective IPtables rules?

Yesterday I installed Cent OS 6 and had to flush the default IPtables rules (IPtables -F) in order to access a web app via my browser. Having very little experience with Linux/Network security this ...
1
vote
0answers
37 views

Is it possible to circumvent (ignore) routing table without root permissions?

The local host is configured to send all non-local traffic to a restrictive firewall VM configured in the routing table (route). Preliminary scanning shows that other routers are available on the ...
1
vote
0answers
167 views

ARP poisoning command slows down victim internet and victim has no access

im currently enrolled in a CPEH course my 3rd lab was arp poison. command i used is echo -1 > /proc/sys/met/ipv4/ip_forward iptables -t nat -A PREROUTING -p tcp --detination-port 80 -j REDIRECT -...
1
vote
0answers
68 views

network ports are filtered strangely?

I have some Ubuntu servers deployed in VULTR Global Cloud and I have about 300 network ports each server. However, every server will be filtered in China suddenly (I can ping from China). I use nmap ...
1
vote
0answers
176 views

What Spectre V2 patches fixes which vulnerabilties on Linux?

Let's assume I have a computer with a pre-Skylake Intel processor that doesn't have microcode mitigating the Spectre V2 attack. Then to my understanding, if the kernel and all user-space applications ...
1
vote
0answers
114 views

xhost si:localuser:foo security

With my current setup, I have two user accounts: internet and secure. For the user "secure", all networking is disabled with the iptables rule: -A OUTPUT -m owner --gid-owner 1000 -j DROP The user "...
1
vote
0answers
74 views

Combining passwords and PAM

I'm researching the ways to implement an authentication server capable of 2FA - I want to be able to validate a short password along with a TOTP (probably Google authenticate). But I want to support ...
1
vote
0answers
48 views

Protecting the password in a PBE scheme for an application

I am currently formulating security best practices and requirements for ongoing Java software development in my department and have settled with a recommendation of using the Jasypt framework for ...
1
vote
0answers
176 views

Idle Scan with Windows 10 machine as a Zombie

I'm learning how to do an Idle scan and I'm practicing on my personal computers: I have a machine with port 21 open. I sent a SYN/ACK ping on the Windows 10 machine (the zombie) and I get x as the IP-...
1
vote
0answers
458 views

Dirty-COW CVE-2016-5195 not working

I'm working on an Android 4.4.4 device (armeabi-v7a architecture) and I'm testing the SELinux behavior using the Dirty-COW CVE-2016-5195 exploit for escalation priviledge and see what happens. I've ...
1
vote
0answers
47 views

Locking Down a Port-Forwarding User

I have the need to tunnel/forward a port over SSH. While I'm familiar with the ins and outs of doing this, I'd like to lock down the user so they effectively have no shell, rather just a process that ...
1
vote
0answers
100 views

Loki/Linux Personal Realtime IDS and/or IPS

In the old days i used to use firewall apps on windows that would have intrusion detection that would alert me while on my system and/or email. For instance, i would see a popup that says: "Warning: ...