Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [linux]

Securing Linux systems and applications; understanding Linux security features.

152 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
15
votes
2answers
849 views

Fully transparent proxy

By default mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections. The following ...
5
votes
1answer
3k views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
5
votes
1answer
157 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should only be ...
5
votes
1answer
160 views

How to distinguish malware from system crash?

Recently, I browsed to a website, which appeared to consume all the computer's resources. Although the mouse cursor continued to move, the browser (and other applications) slowed down fast and soon ...
4
votes
0answers
127 views

How to securely delete a file after it was insecurely deleted (in linux)

How can I securely delete/shred a file after I accidentally deleted the file insecurely? Let's say I have Debian Linux installed on a laptop with a 1000T spinning hard disk (so putting aside wear ...
4
votes
0answers
1k views

What is the general approach to create FIPS compliant SSH?

Please bear in mind that I have no cyber-security background at all, but have been tasked by my company with making certain applications on our platform FIPS-compliant. From what I've discussed with ...
4
votes
0answers
586 views

Practicing with return-2-libc exploits

I am trying to reproduce a return-to-libc for a simple vulnerable program. The tutorial is taken from https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-chained-return-to-libc/ I made ...
4
votes
0answers
127 views

Address of environment variable different for each directory

I'm writing a return-to-libc attack for a school project. My script retrieves the system(), exit() and shell addresses as follows (it's a sh script that calls some c programs): Create the environment ...
4
votes
1answer
923 views

Linux antivirus and files bigger then 4GB

I wish to scan files that are bigger then 4GB. For example video files. I noticed many antivirus software are limited to a maximum of 4GB (ClamAV for example). So: Is there a antivirus software ...
3
votes
0answers
160 views

What are the security implications of capabilities in Kubernetes pods?

We have a Kubernetes deployment with an application that need to be on a VPN. We implement this requirement by running openvpn-client in a sidecar container within the pod with elevated capabilities: ...
3
votes
0answers
74 views

Identifying kernel pointer infoleaks via static analysis

Leaking pointers from the kernel can be useful to an attacker. Normally, pointers are printed using a special identifier, %pK, which will sanitize them. However, there are times when a kernel pointer ...
3
votes
0answers
153 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
3
votes
0answers
115 views

EIP Overwrite Exploit not working

I am writing an exploit for an x86 binary on Linux and I'm learning exploitation. The binary has no protections and the stack is also executable. It has a buffer overflow when it uses memcpy() ...
3
votes
1answer
124 views

Allow only single aplication to access files on USB stick with Linux namespaces

It looks like i found a way to allow only single application to access files in USB storage. This script must be run with sudo. #!/bin/bash # create namespace unshare -m<<EOF # mount device ...
3
votes
0answers
133 views

Is the difference between a loaded elf and libc a constant value?

While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of ...
3
votes
0answers
58 views

How do I obtain linux user authentication information securely?

For security purposes the application needs to know, securely who is logged in and what groups they are authorised for. This must be done securely so that a user application cannot perform a man in ...
3
votes
0answers
331 views

Why isn't rng-tools installed by default on all OS?

Many Linux distributions use the package rng-tools, but why isn't it always installed by default? It would increase entropy (/proc/sys/kernel/random/entropy_avail) greatly! Is there any security ...
3
votes
0answers
80 views

Can I detect unique identifiers from random radio chatter?

I am trying to find out if I can uniquely identify smartphones (I would like to find constant identifiers such as IMEI) by passively sniffing the cellular data frequencies. I know that sensitive data ...
2
votes
0answers
34 views

How to securely run Puppeteer / Chromium in a Docker container?

Attempting to run Puppeteer, a Node library to control a headless Chromium (in order to do things like create a PDF of a website), in Docker is a surprisingly fiddly thing. The problem is that, from ...
2
votes
0answers
53 views

Patch management for production servers

I'm trying to implement an automated patching program at a small SaaS provider. When a customer signs up for our software, we provision them a Linux VM in our primary datacenter. Each customer also ...
2
votes
0answers
47 views

How to store a key for a Java app server?

Assume I have a Java app running on a Linux server. The app needs a secret key to do a task, such as decrypting or encrypting a file, after it starts up. This is a question about best practice for ...
2
votes
0answers
91 views

How to detect file or file system tampering

I would like to know if the following is possible: Is it possible to detect a file that has been put into my file system using back dating? Are there any trace artifacts left behind which can help to ...
2
votes
0answers
117 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
2
votes
0answers
76 views

String Format Exploit x64 compiled with -Wformat-security -D_FORTIFY_SOURCE=2 on

I found a daemon running as uid 0 that has a string format vulnerability. It is compiled with -Wformat-security and -D_FORTIFY_SOURCE=2 on. I'm trying to write an exploit for it, but what I get is: ...
2
votes
0answers
38 views

How is CVE-2016-6787 a UAF bug in Linux kernel?

From the explanation video of the Linux kernel vulnerability CVE-2016-6787, I don't understand is though put_ctx isn't inside a mutex, there's an atomic_dec_and_test inside put_ctx at the very ...
2
votes
0answers
305 views

Exploit Development - Find system address in a given libc

If I have a libc file which is used on another server where the vulnerable binary is running, then how can I find the address of system in it? I have both the vulnerable binary and the libc file with ...
2
votes
0answers
192 views

Help with Format String Exploit

I am working on a 32-bit binary which reads an input from the user and uses that input as a format string for printf. I need to overwrite a specific address with a single byte. The issue is that I ...
2
votes
0answers
100 views

Can maliciously modified ACPI AML be executed without a reboot?

ACPI tables contain ACPI Machine Language, or AML, which is executed by an interpreter in the kernel at boot. Certain ACPI tables, such as the DSDT, are necessary to support hardware ACPI events such ...
2
votes
0answers
304 views

Linux memory acquisition issues

I am reaching out for possible assistance regarding memory acquisition of a linux system. As of yet I have been unable to either acquire or inspect the memory dump with known tools. The following ...
2
votes
2answers
805 views

Privilege Escalation Wordpress

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to ...
2
votes
0answers
341 views

Detect kASLR/ASLR within a Linux firmware image without running it

I'm currently looking into exploit mitigation techniques and I've come across a question I can't find an answer to just now. To detect the presence of let's says PIE or Canaries within a binary there ...
2
votes
0answers
263 views

Setting up Yubikey for GnuPG on Linux Mint: Unsupported certificate

I am trying to set up my Yubikey 4 for GnuPGP following the Yubico documentation. I plugged in my Yubikey and it is recognized: $ lsusb ... Bus 001 Device 005: ID 1050:0407 Yubico.com ... However, ...
2
votes
0answers
94 views

Get IP/network info with Local File Inclusion

I've been thinking about expanding what I could do with a LFI attack to somehow extract information that we usually get by invoking commands. And since a lot of things in linux behaves like a file or ...
2
votes
0answers
182 views

Git Server with several repos

I'm not sure if I'm allowed to post and have one of my newly asked question on both security.stackexchange and unix.stackexchange or not, but I think it is appropriate to ask the question here too ...
2
votes
0answers
127 views

Wayland Partial Encryption for Mouse / Keyboard? (Also X and RDP)

Question What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using X,...
2
votes
0answers
70 views

Is an unprivileged LXC where the host user itself is mapped to 0 less secure of one where one of its subids is mapped to 0, and why?

Instead of creating "common" LXC unprivileged containers where all the users are mapped to (unprivileged) subuid/gid of my host user, I'm considering a mapping where my host user itself will be mapped ...
2
votes
0answers
483 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
2
votes
0answers
417 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
2
votes
0answers
229 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
2
votes
2answers
219 views

Is a netcat server without -e exploitable?

This is related to a college assignment. I have an Ubuntu server I am trying to do a penetration test on. The server is running a netcat server which when I contact it sends me a nice info message ...
1
vote
0answers
34 views

How safe is md5sum in regards to verifying executable files?

is it possible to trick someone into running a malicious executable file instead of a real one provided by a website; assuming they will md5sum the file
1
vote
1answer
51 views

sudo white list just program perl

In visudo Ubuntu I white list this program myuser ALL=(root) NOPASSWD:/myuser/program.pl when I run sudo /myuser/program.pl I get prompt to set password solution add to visudo /usr/bin/perl ...
1
vote
0answers
111 views

Bizarre request being made from Chrome

I've been seeing a very weird request being made from my Chrome browser (haven't noticed it on Brave). It does not run on all websites, and not all the time (it can appear on a website, then after a ...
1
vote
0answers
52 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...
1
vote
0answers
50 views

Why is keybase/gui_config.json owned by root?

I have keybase running on my Linux Desktop (Ubuntu 19.04). Since a recent update, the file ~/.config/keybase/gui_config.json is owned by root which is quite irritating. One negative effect of this is ...
1
vote
0answers
56 views

x.509 certificate chain verification in Linux kernel prior to 4.12

I am trying to use certificate chain verification in Linux kernel. The purpose is to use IMA/EVM with public keys that are included in x.509 certificates signed by an own root CA. For this purpose I ...
1
vote
0answers
114 views

Basic buffer overflow able to overwrite EIP but doesn't correctly overwrite when using memory address

I wrote a basic vulnerable app in C. #include void vuln(char *arg) { char buffer[10]; strcpy(buffer, arg); } int main( int argc, char** argv ) { vuln(argv[1]); return 0; } I ...
1
vote
0answers
101 views

How to stop logging for a specific user?

I'm a root user on my server. There are a bunch of users on my system. As you know, when you type w you can see who is and who isn't online. With the last command you can check last users who were ...
1
vote
0answers
52 views

Software mitigation for variant 3a (rogue system register read) and variant 4 (speculative store bypass)

AFAIK, all mitigable meltdown / spectre variants have software mitigation except for variant 3a and 4. Why is this the case? For variant 4, a straightforward software mitigation is to place lfence ...
1
vote
0answers
72 views

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...