Skip to main content

Questions tagged [unix]

Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.

Filter by
Sorted by
Tagged with
0 votes
1 answer
152 views

What are the security related challenges in implementing something like Unix sudo?

There exist several sudo alternatives (systemd's run0, OpenBSD and doas, etc.), all created after sudo has been an established tool, allegedly for security reasons. If someone were to implement Unix ...
Oliver Gondža's user avatar
0 votes
1 answer
91 views

I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover

I have access to companies internal files through SSRF and Path traversal both but want to leverage it further to website takeover. Thus I can increase the impact and get more bounty then what they ...
oo7hacker's user avatar
0 votes
1 answer
104 views

Why does this method of modifying kernel memory work?

I have no experience of kernel programming or anything low level. I just watched this video and at 21:10 the presenter started to talk about modifying kernel memory using two pointers. From my ...
Nicholas Humphrey's user avatar
1 vote
1 answer
785 views

Is TLS needed on loopback for local security?

So the scenario is that we have a server shared with a number of users, with me being the server administrator and able to determine permission assignments. The server is running a service on loopback ...
Chaser hkj's user avatar
0 votes
3 answers
372 views

Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?

OpenBSD has had much fewer "code execution" vulnerabilities and even fewer exploits than FreeBSD, according to https://cvedetails.com : https://www.cvedetails.com/product/163/Openbsd-...
MWB's user avatar
  • 343
2 votes
1 answer
1k views

Private IPC between two processes

I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
Andrea Rubi's user avatar
1 vote
1 answer
1k views

Reverse PHP shell exit when netcat listening

My reverse shell is exiting when i lsten it with netcat: here is netcat output: listening on [any] 5555 ... connect to [10.9.3.117] from (UNKNOWN) [10.10.47.117] 37602 bash: cannot set terminal ...
Grainbox's user avatar
0 votes
1 answer
277 views

Using ATA Secure Erase after buying a second-hand laptop : is this enough?

I bought a second-hand laptop from a stranger. My (totally unjustified) concern is that there might be malware on the device. According to this answer, there is no easy fix if it's malicious firmware. ...
Banjo's user avatar
  • 33
3 votes
3 answers
1k views

On a single user laptop does it make sense to have a separte password for root and the user?

I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is: The change of ...
Martijn de Munnik's user avatar
1 vote
1 answer
550 views

Pass the Hash & Unix

Purpose: test if PtH (Pass the hash) is feasible against Unix box Scenario: Windows host (Windows Server 2008) vulnerable to eternalblue got Administration hash as part of the post-exploitation ...
t5j's user avatar
  • 49
1 vote
3 answers
1k views

Grep Commands with User Input

I'm curious if there is a way to make user input safe for grep commands. I have a search box that should allow an end user to search a directory recursively for files containing a string. I could ...
FamousAv8er's user avatar
5 votes
1 answer
1k views

GPG Agent SSH Forward Pinentry

I have GPG agent forwarding via SSH RemoteForward working, up to a point: I can list my private and public keys on the remote host. If I try to decrypt a file remotely, the PIN is prompted for but ...
ephemeric's user avatar
1 vote
1 answer
457 views

Feeding entropy pool with my own data [duplicate]

Let's state that I have a huge bunch of truly unpredictable random data in file "random.bin". The random data has been created outside of my system and has been securely transfered into my ...
Algiz's user avatar
  • 111
0 votes
0 answers
148 views

Pwnable: Process has its own home directory

I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection. However, after the shell is spawned, the flag is read from /...
Sam's user avatar
  • 1
3 votes
1 answer
790 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
ᴍᴇʜᴏᴠ's user avatar
1 vote
1 answer
225 views

For zero-deployment via GitLab Piplines - What kind of unix User?

I want to implement a zero-deployment strategy for my websever. My first attempt was to create a specific user (deployer) for that: # Create user deployer sudo adduser deployer # Give the read-write-...
Philipp Mochine's user avatar
2 votes
1 answer
137 views

What are the dangers of extending my PATH?

Are there any dangers of extending my PATH, say by adding /Users/me/bin?
gen's user avatar
  • 1,680
2 votes
1 answer
581 views

Unix/Linux shells which use effective UID instead of real UID

My question is build on top of the answer of the question about SUID exploitation: SUID not used after exploit The person (official answer) is stating that: Many popular implementations of sh ...
Awaaaaarghhh's user avatar
0 votes
0 answers
559 views

set-guid exploit of a program with relative path

I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c): #include <stdio.h> #include <stdlib.h> #include <unistd....
Ervin Cosic's user avatar
1 vote
0 answers
143 views

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
kjo's user avatar
  • 1,063
2 votes
1 answer
7k views

Advice to help crack MD5crypt hash

I've been given a homework task to crack a particularly difficult password on a Unix system. I have found users and hashes in the etc/shadow file and cracked all but this one: $1$TyPfW4pp$...
Ali97's user avatar
  • 31
5 votes
1 answer
661 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
Will's user avatar
  • 187
3 votes
3 answers
6k views

Why is linux filesystem considered DAC and not MAC

Citing wikipedia's MAC article: With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the ...
user134167's user avatar
1 vote
1 answer
376 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
user avatar
9 votes
1 answer
4k views

How Homebrew may impact your Mac's security [duplicate]

I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
Nick's user avatar
  • 279
9 votes
1 answer
1k views

How can utilities with setuid set to root be secure if they are debuggable?

Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that: I can freely debug all programs I have the permission to run, even those that have ...
gaazkam's user avatar
  • 6,147
4 votes
3 answers
3k views

Default value of ACLs mask

This is the question I faced in an interview as a system administrator. If we didn't set the mask value, what is the default value of mask? I was thinking that if we didn't set the mask, it ...
rj487's user avatar
  • 143
5 votes
5 answers
496 views

Unix Privilege Escalation: "sudo must be owned by uid 0 and have the setuid bit set"

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
user188691's user avatar
2 votes
1 answer
517 views

In-memory encrypted Linux/unix kernel

Is there a variant of Linux kernel for virtualization that runs in-memory in a state that can't be read by the host operating system?
jimmy's user avatar
  • 121
0 votes
1 answer
157 views

Block external http calls

I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
Jesse Aldridge's user avatar
2 votes
1 answer
2k views

Way to properly escape user input which gets run by shell_exec() in PHP?

I have the following script: $user_input = $_POST['user_input']; // If there is a way, I want to escape it here. shell_exec("php some_file.php $user_input"); Is there a way to properly escape the ...
Tim von Känel's user avatar
1 vote
1 answer
666 views

SUID exploit and patch

I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
Gian's user avatar
  • 25
4 votes
1 answer
363 views

Local server applications using a web frontend on multi-user desktop environments

Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment. But I'm a bit concerned about the increasing popularity of ...
sligor's user avatar
  • 41
8 votes
2 answers
15k views

What is the easiest way to sandbox an application in a *NIX environment?

I have a significant number of untrusted binary applications that need to be executed on a *nix box. I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
Stack Tracer's user avatar
13 votes
1 answer
6k views

Unix command to generate cryptographically secure random string

Is the following Unix command cryptographically secure to randomly generate 20 characters (a-zA-Z0-9 only)? dd if=/dev/urandom bs=256 count=1 2> /dev/null | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c20 ...
Justin's user avatar
  • 1,247
2 votes
1 answer
624 views

Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?

Scenario/question: A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere In such a ...
Stilez's user avatar
  • 1,694
2 votes
2 answers
2k views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...
sampablokuper's user avatar
1 vote
2 answers
434 views

Unix - Automated MD5 Checksum Verification

I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day. So far we have implemented WAF's (Web Application Firewall), SSL ...
Lewis Browne's user avatar
5 votes
3 answers
818 views

Can a self-build router minimize the potential risk of intels management engine (ME)?

I read some stuff about intels ME and got interested because of its huge potential security threat to basically (more or less) every intel system since 2008. And I came across the great work of @igor-...
user6775658's user avatar
0 votes
1 answer
352 views

Security of Linux/Unix user information

Linux (and Unix) users can store in /etc/passwd not only the usual parameters (username, home directory, default shell, ...) but also: their names and surnames, addresses, phone numbers, etc.. In some ...
BowPark's user avatar
  • 109
1 vote
1 answer
211 views

Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?

When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system? Is it ...
BugHunterUK's user avatar
2 votes
2 answers
522 views

Sniff plaintext password written in /tmp directory

I was recently reading about Ansible and the way it manages the sudo passwords. More specifically: When using become_user to a user other than root, the module arguments are briefly written into a ...
bergercookie's user avatar
6 votes
2 answers
851 views

`rsync -K`-based exploit

In the description of the -K (--keep-dirlinks) flag, the rsync man page gives this warning (my emphasis): One note of caution: if you use --keep-dirlinks, you must trust all the symlinks in the ...
kjo's user avatar
  • 1,063
5 votes
2 answers
7k views

Best practices for securing a public facing web server? [closed]

I'm looking to make a "bare minimum" checklist for securing a public facing Unix web server. Assume it's a LAMP stack (or similar). This list should be what minimums you would implement. Obviously ...
wubs's user avatar
  • 153
1 vote
1 answer
428 views

Open SFTP on the main server - the safe way?

We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options: Open SFTP on our main server with restrictions (directory, user, size,...
Ronen Ness's user avatar
52 votes
6 answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public-key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
Alex's user avatar
  • 819
1 vote
1 answer
637 views

Gaining shell access on a Unix Webserver [closed]

I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now. I have access to the web admin console but ...
Neel's user avatar
  • 143
0 votes
1 answer
342 views

it is possible to make a copy of an iPhone?

Is it possible to make a copy (an image like iso or img) of an iPhone supposing that we can only connect it to a computer? Can I use the dd command to do this? Are any alternative ways to a clone an ...
duca's user avatar
  • 23
0 votes
2 answers
127 views

Can environment variables created for a unix account be viewable by another account?

If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?
Bon Ami's user avatar
  • 133
2 votes
2 answers
417 views

Paste-once or paste-and-clear [closed]

I use a password manager (to be specific: pass) to store my passwords. The interface I use most often is passmenu to put the password on my clipboard, which I can then paste in my terminal/browser/...
Sebastian's user avatar
  • 121