Questions tagged [unix]

Unix is a family of multiuser, multitasking operating system that is widely used in workstations, servers and embedded devices. The best-known Unix variant is Linux.

Filter by
Sorted by
Tagged with
0 votes
1 answer
54 views

Why does this method of modifying kernel memory work?

I have no experience of kernel programming or anything low level. I just watched this video and at 21:10 the presenter started to talk about modifying kernel memory using two pointers. From my ...
1 vote
1 answer
208 views

Is TLS needed on loopback for local security?

So the scenario is that we have a server shared with a number of users, with me being the server administrator and able to determine permission assignments. The server is running a service on loopback ...
0 votes
3 answers
243 views

Would FreeBSD and OpenBSD have similar known-past-vulnerability stats if they were configured similarly?

OpenBSD has had much fewer "code execution" vulnerabilities and even fewer exploits than FreeBSD, according to https://cvedetails.com : https://www.cvedetails.com/product/163/Openbsd-...
  • 323
1 vote
1 answer
553 views

Private IPC between two processes

I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
1 vote
1 answer
676 views

Reverse PHP shell exit when netcat listening

My reverse shell is exiting when i lsten it with netcat: here is netcat output: listening on [any] 5555 ... connect to [10.9.3.117] from (UNKNOWN) [10.10.47.117] 37602 bash: cannot set terminal ...
0 votes
1 answer
182 views

Using ATA Secure Erase after buying a second-hand laptop : is this enough?

I bought a second-hand laptop from a stranger. My (totally unjustified) concern is that there might be malware on the device. According to this answer, there is no easy fix if it's malicious firmware. ...
  • 3
2 votes
2 answers
283 views

On a single user laptop does it make sense to have a separte password for root and the user?

I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is: The change of ...
1 vote
1 answer
427 views

Pass the Hash & Unix

Purpose: test if PtH (Pass the hash) is feasible against Unix box Scenario: Windows host (Windows Server 2008) vulnerable to eternalblue got Administration hash as part of the post-exploitation ...
  • 49
1 vote
3 answers
659 views

Grep Commands with User Input

I'm curious if there is a way to make user input safe for grep commands. I have a search box that should allow an end user to search a directory recursively for files containing a string. I could ...
3 votes
0 answers
833 views

GPG Agent SSH Forward Pinentry

I have GPG agent forwarding via SSH RemoteForward working up to a point. I can list my private and public keys on the remote host. If I try to decrypt a file remotely, the PIN is prompted for but the ...
1 vote
1 answer
307 views

Feeding entropy pool with my own data [duplicate]

Let's state that I have a huge bunch of truly unpredictable random data in file "random.bin". The random data has been created outside of my system and has been securely transfered into my ...
  • 111
0 votes
0 answers
102 views

Pwnable: Process has its own home directory

I recently started to do the pwnable.tw challenges. I have no problem understanding the actual buffer-overflow and shellcode injection. However, after the shell is spawned, the flag is read from /...
  • 1
3 votes
1 answer
333 views

Sanitising a file/folder path from user input

I have an external server make backups of my main server via scp and a backup-only user account. I successfully restricted it to scp only using GNU Rush. The scp command below executed on the backup ...
1 vote
1 answer
197 views

For zero-deployment via GitLab Piplines - What kind of unix User?

I want to implement a zero-deployment strategy for my websever. My first attempt was to create a specific user (deployer) for that: # Create user deployer sudo adduser deployer # Give the read-write-...
2 votes
1 answer
99 views

What are the dangers of extending my PATH?

Are there any dangers of extending my PATH, say by adding /Users/me/bin?
  • 1,680
2 votes
1 answer
413 views

Unix/Linux shells which use effective UID instead of real UID

My question is build on top of the answer of the question about SUID exploitation: SUID not used after exploit The person (official answer) is stating that: Many popular implementations of sh ...
0 votes
0 answers
445 views

set-guid exploit of a program with relative path

I'm trying to exploit a program which has the set-guid bit enabled. The program is simple it contains the following (stage.c): #include <stdio.h> #include <stdlib.h> #include <unistd....
1 vote
0 answers
116 views

How to architect a Linux application so that it can use a passphrase that is inaccessible to its users?

The Linux application under consideration is one that will be used by multiple employees of a company, and which, in order to carry out some of its functions, must be able to access a secret ...
  • 1,043
2 votes
1 answer
5k views

Advice to help crack MD5crypt hash

I've been given a homework task to crack a particularly difficult password on a Unix system. I have found users and hashes in the etc/shadow file and cracked all but this one: $1$TyPfW4pp$...
  • 31
5 votes
1 answer
419 views

Is it safe to use a unix pipe to redirect sensitive output data as input to another program?

I want to make a Node.js development server use HTTPS by giving it access to the contents of a TLS certificate and private key file. On the one hand, I don't like the idea of making the TLS private ...
  • 188
2 votes
3 answers
5k views

Why is linux filesystem considered DAC and not MAC

Citing wikipedia's MAC article: With mandatory access control, this security policy is centrally controlled by a security policy administrator; users do not have the ability to override the ...
1 vote
1 answer
277 views

Is it dangerous to keep permissions at 666 to member file on SELinux?

I just installed SELinux. I read a lot of tutorials but I am not very comfortable with SELinux. On CentOS help page , I can see that some files in /selinux/ are writable by other user : https://www....
user avatar
9 votes
1 answer
3k views

How Homebrew may impact your Mac's security [duplicate]

I read (here and here) that Homebrew (the Unix package manager) is a significant Mac security risk. An attack is allowed because Homebrew makes /usr/local/bin writable without root user privilege, ...
  • 257
9 votes
1 answer
966 views

How can utilities with setuid set to root be secure if they are debuggable?

Today I heard at Uni something that broke my mental model about separation of users' rights. Namely, I heard that: I can freely debug all programs I have the permission to run, even those that have ...
  • 5,667
4 votes
1 answer
2k views

Default value of ACLs mask

This is the question I faced in an interview as a system administrator. If we didn't set the mask value, what is the default value of mask? I was thinking that if we didn't set the mask, it ...
  • 143
5 votes
5 answers
408 views

Unix Privilege Escalation: "sudo must be owned by uid 0 and have the setuid bit set"

It seems protections are harcoded into sudo that prevent the binary from executing as a low-privileged user. Running it in Ubuntu as a normal user returns the following error: "sudo must be owned ...
2 votes
1 answer
405 views

In-memory encrypted Linux/unix kernel

Is there a variant of Linux kernel for virtualization that runs in-memory in a state that can't be read by the host operating system?
  • 121
0 votes
1 answer
108 views

Block external http calls

I want to run many snippets of untrusted and unknown code on an Ubuntu machine hosted on Digital Ocean. For safety reasons, I would like to record and block any external calls made by any of the code ...
2 votes
1 answer
1k views

Way to properly escape user input which gets run by shell_exec() in PHP?

I have the following script: $user_input = $_POST['user_input']; // If there is a way, I want to escape it here. shell_exec("php some_file.php $user_input"); Is there a way to properly escape the ...
1 vote
1 answer
514 views

SUID exploit and patch

I am working on a SUID root binary "app" that runs a system("ls -la /dir") command. I managed to exploit it by writing a malicious replacement ls that starts a shell, and changed my user's $PATH such ...
  • 25
4 votes
1 answer
264 views

Local server applications using a web frontend on multi-user desktop environments

Currently I have multi-user linux servers where developers access through remote desktop and use the session as work environment. But I'm a bit concerned about the increasing popularity of ...
  • 41
8 votes
2 answers
14k views

What is the easiest way to sandbox an application in a *NIX environment?

I have a significant number of untrusted binary applications that need to be executed on a *nix box. I'm hoping that there might be some simple command/script (e.g. sandbox ./app1953) that could ...
12 votes
1 answer
4k views

Unix command to generate cryptographically secure random string

Is the following Unix command cryptographically secure to randomly generate 20 characters (a-zA-Z0-9 only)? dd if=/dev/urandom bs=256 count=1 2> /dev/null | LC_ALL=C tr -dc 'A-Za-z0-9' | head -c20 ...
  • 1,157
2 votes
1 answer
451 views

Is the traversal permission in a Unix filesystem exploitable by itself, in the absence of any other permissions/ACLs?

Scenario/question: A unix directory tree has NTFv4 ACLs configured to allow an unprivileged account traversal on all dirs (but no other ACL granting further rights on any file/dir anywhere In such a ...
  • 1,674
2 votes
2 answers
2k views

Permissions for configuration file for program run as root that must be modifiable by SFTP

A shell script (myscript) will be run as root, by cron. It reads IP addresses from a configuration file, and updates iptables to whitelist those IPs for inbound connections. myscript uses a regexp (...
1 vote
2 answers
394 views

Unix - Automated MD5 Checksum Verification

I am currently looking into ways of securing a number of E-Commerce websites which serve a large amount of traffic every day. So far we have implemented WAF's (Web Application Firewall), SSL ...
5 votes
3 answers
577 views

Can a self-build router minimize the potential risk of intels management engine (ME)?

I read some stuff about intels ME and got interested because of its huge potential security threat to basically (more or less) every intel system since 2008. And I came across the great work of @igor-...
0 votes
1 answer
304 views

Security of Linux/Unix user information

Linux (and Unix) users can store in /etc/passwd not only the usual parameters (username, home directory, default shell, ...) but also: their names and surnames, addresses, phone numbers, etc.. In some ...
  • 109
1 vote
1 answer
182 views

Unix - Is it safe by default to give a new user ssh access and be certain they can not alter the system?

When creating a new user on a fresh NetBSD system (assuming all scripts/programs/directories have the correct permissions) can I be certain that the user can not in any way alter the system? Is it ...
2 votes
2 answers
344 views

Sniff plaintext password written in /tmp directory

I was recently reading about Ansible and the way it manages the sudo passwords. More specifically: When using become_user to a user other than root, the module arguments are briefly written into a ...
6 votes
2 answers
792 views

`rsync -K`-based exploit

In the description of the -K (--keep-dirlinks) flag, the rsync man page gives this warning (my emphasis): One note of caution: if you use --keep-dirlinks, you must trust all the symlinks in the ...
  • 1,043
5 votes
2 answers
6k views

Best practices for securing a public facing web server? [closed]

I'm looking to make a "bare minimum" checklist for securing a public facing Unix web server. Assume it's a LAMP stack (or similar). This list should be what minimums you would implement. Obviously ...
  • 153
1 vote
1 answer
301 views

Open SFTP on the main server - the safe way?

We need to open an SFTP to allow some of our clients to upload files to our server. As I see it right now, there are two options: Open SFTP on our main server with restrictions (directory, user, size,...
52 votes
6 answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public-key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
  • 819
1 vote
1 answer
569 views

Gaining shell access on a Unix Webserver [closed]

I was pen testing an Unix web server for a challenge. I need to get root/shell access to the server & have got stuck at a point for quite a while now. I have access to the web admin console but ...
  • 143
0 votes
1 answer
271 views

it is possible to make a copy of an iPhone?

Is it possible to make a copy (an image like iso or img) of an iPhone supposing that we can only connect it to a computer? Can I use the dd command to do this? Are any alternative ways to a clone an ...
  • 23
0 votes
2 answers
98 views

Can environment variables created for a unix account be viewable by another account?

If I run a program that accepts configs from environment variables under non-privileged user userA; can a user with root access read those environment varibles ?
  • 133
2 votes
2 answers
334 views

Paste-once or paste-and-clear [closed]

I use a password manager (to be specific: pass) to store my passwords. The interface I use most often is passmenu to put the password on my clipboard, which I can then paste in my terminal/browser/...
  • 121
3 votes
3 answers
203 views

Are environment variables entered *directly* before a command visible to other users?

UPDATE: I know that environment variables are generally secure, and am familiar with this question. My question is can other users see them if they are entered as part of a command (same line, no semi-...
2 votes
1 answer
197 views

Audio Streaming Server associated vulnerabilities

What vulnerabilities will I be facing with during using a server as a audio streaming server? Please explain all possibilities and all need-to-know stuff. The first thing made me think of ...