239
votes
Accepted
Provide subjectAltName to openssl directly on the command line
As of OpenSSL 1.1.1, providing subjectAltName directly on command line becomes much easier, with the introduction of the -addext flag to openssl req (via this commit).
The commit adds an example to ...
- 2,514
69
votes
Provide subjectAltName to openssl directly on the command line
This is my solution to finally generate a working self signed cert, based on the answers above(The accepted answer don't work for me):
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 365 ...
- 791
47
votes
Bypassing the command/script specified in /etc/passwd
Assume there is a (probably unintentional) backdoor.
The default /etc/passwd on Sun workstations of the early 1990s included an entry something like this:
games::0:0:games:/nopath:/bin/false
In ...
- 571
47
votes
Accepted
Is using 'echo' to display attacker-controlled data on the terminal dangerous?
Is it possible for an attacker, regardless of how unlikely it would be, to exploit this somehow by modifying the content of attackerControlledFile.txt? "Somehow" refers to things like:
This code ...
- 21.6k
33
votes
How to do a privileges escalation with ping?
A SUID binary is not inherently exploitable for privilege escalation. The problem is when there is a vulnerability in the software (ex. many CTFs have a SUID binary that contains a buffer overflow ...
- 722
30
votes
Provide subjectAltName to openssl directly on the command line
As of 2023, with OpenSSL ≥ 1.1.1, the following command demonstrates how to generate a self-signed certificate with SAN for example.com and example.net:
openssl req -x509 -newkey rsa:4096 -sha256 -...
- 431
28
votes
Bypassing the command/script specified in /etc/passwd
You cannot bypass the script execution. This is your login shell, and will be started every time you login. And as a login shell, will log you off every time it ends. But you can use quirks, bugs and ...
- 55.5k
17
votes
Bypassing the command/script specified in /etc/passwd
I remember a wargame challenge where there was a similar case - the shell pointed to something that simply printed some output using the more command, then terminated the session. However, since more ...
- 413
13
votes
Provide subjectAltName to openssl directly on the command line
So I had a heck of a time getting this working right, and putting at all in Ansible. As Ansible's command module doesn't allow file-redirects (<(...)), I had to use a small .cnf file as a template, ...
- 251
12
votes
Does a Turing complete shell means equal secure?
It is not possible to determine whether Linux is more secure than Windows or vice versa. Turing completeness is not a security metric that can be used to objectively compare to what degree two systems ...
- 1,299
11
votes
Accepted
Are these bash lines (handling untrusted user input) vulnerable to command injection?
All are safe (though Esa's approach is nicer)
The result of 'parameter and variable expansion' in bash is NEVER rescanned for (further) expansions, except wordsplitting and 'filename expansion' (...
- 11.1k
10
votes
Is using 'echo' to display attacker-controlled data on the terminal dangerous?
If the output is going to a terminal, you have potentially lots of problems (regardless of how you print it, unless you strip special characters), as per other answers.
If the file can be gigantic, ...
- 908
10
votes
Accepted
/opt and sudo unzip to /opt, is it safe?
Yes, it is safer to run unzip without root permissions and then move the extracted contents to their final destination. However, if you suspect that the file which you are providing to unzip is ...
- 67.3k
9
votes
How do I track bash history cleanup?
Monitoring the Bash history is easily done with a shell script, but just checking it for unexpected changes might not be an effective security measure but rather clutter your logs with false-positives....
- 45.1k
9
votes
How to securely store credentials in a bash variables?
Storing credentials in plain text is always a tricky case, it depends on case-by-case. The main rule is: never store the password inside the script.
If the script will run only manually (someone ...
- 752
9
votes
Accepted
Bypassing the command/script specified in /etc/passwd
With the sample script you have posted, the restricted user can for example learn a whole lot about the system, like names of other users and installed programs. E.g.
What is your name?
> /home/*
...
- 10.2k
8
votes
Accepted
Do sudo and .profile/.bashrc enable trivial privilege escalation?
Anything you can do on a compromised account, an attacker can do as well.
Fundamentally, this is because Linux providers isolation between users, not between individual processes running as the same ...
- 67.3k
7
votes
Should I remove bash from my Docker web app container?
It might improve security but it's a very strange way of doing things.
What you are suggesting is to start with an image with "unnecessary" software installed and remove some of the stuff you don't ...
- 101
7
votes
Accepted
Is it possible to execute a local file or code from cURL?
Not sure if this is against the spirit of what you are asking but you can pipe the output of a shell script to bash. e.g. curl "file:///root/script.sh" | bash
Also take a look at a list of known curl ...
- 2,736
7
votes
Are these bash lines (handling untrusted user input) vulnerable to command injection?
On Bash >= 4.0 you could use shell parameter expansion to remove these special characters:
sanitized="${1//[\$\`\\]/}"
However, it does not help much if the $1 already comes from a Bash ...
- 19.4k
6
votes
What can an attacker do in this scenario? (unwritable bashrc, profile, etc.)
Path is defined in bash profile so that ~/bin comes last, so running "firefox" should run the default firefox and not a custom "firefox" installed by the user in their home directory.
Variables can ...
- 17.6k
6
votes
What do you search for in Open Source code to be sure there isn't malicious code?
If you want to be 100% sure that some git repo doesn't contain malicious code, write it yourself; anything else will be an uphill battle.
If someone's really truly trying to hide malicious code in ...
- 59.3k
5
votes
Accepted
Bash: Why would sourcing a file be less safe than bashing it (executing in another session)?
I don't know the exact statement and its context so I can only guess what was meant: if a script gets sourced instead of executed in a separate shell then any variables or functions defined in this ...
- 208k
5
votes
Bypassing the command/script specified in /etc/passwd
TLDR:
Script you're mentioned is secure!
But understanding that in production you may use different version, you should be aware of following concepts:
1.
Whether the 'read' is vulnerable to command ...
- 67
5
votes
Accepted
Find Buffer Overflows at a target you want to gain access
As schroeder has already pointed out, to identify buffer overflow vulnerabilities, you'd need to test the application locally with a debugger. It seems to me that you haven't actually gone through the ...
- 295
4
votes
Accepted
Reverse Bash Shell one liner
Can someone please explain to me the significance of the number "196"?
196 is a randomly chosen number for a file descriptor that you're opening for reading from and writing to via exec. You can ...
- 45.1k
4
votes
Is it possible to "encode" a bash sentence?
I don't know what that chain of characters is, but it's clearly not a shell command. What's happening is that bash is trying to interpret and act on various shell metacharacters in the string, but ...
- 2,621
4
votes
Accepted
Safely decrypting an unsolicited/untrusted PGP message
##Dangers of printing untrusted text
The encrypted message could contain any sort of untrusted/malformed data that could try to exploit my bash environment, my terminal emulator, etc.
When ...
- 67.3k
Only top scored, non community-wiki answers of a minimum length are eligible