Skip to main content
Share Your Experience: Take the 2024 Developer Survey
232 votes
Accepted

Provide subjectAltName to openssl directly on the command line

As of OpenSSL 1.1.1, providing subjectAltName directly on command line becomes much easier, with the introduction of the -addext flag to openssl req (via this commit). The commit adds an example to ...
Peter W's user avatar
  • 2,444
68 votes

Provide subjectAltName to openssl directly on the command line

This is my solution to finally generate a working self signed cert, based on the answers above(The accepted answer don't work for me): openssl genrsa -out ca.key 2048 openssl req -new -x509 -days 365 ...
tsl0922's user avatar
  • 781
47 votes

Bypassing the command/script specified in /etc/passwd

Assume there is a (probably unintentional) backdoor. The default /etc/passwd on Sun workstations of the early 1990s included an entry something like this: games::0:0:games:/nopath:/bin/false In ...
DrSheldon's user avatar
  • 571
47 votes
Accepted

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Is it possible for an attacker, regardless of how unlikely it would be, to exploit this somehow by modifying the content of attackerControlledFile.txt? "Somehow" refers to things like: This code ...
Steve Sether's user avatar
  • 21.6k
33 votes

How to do a privileges escalation with ping?

A SUID binary is not inherently exploitable for privilege escalation. The problem is when there is a vulnerability in the software (ex. many CTFs have a SUID binary that contains a buffer overflow ...
deletehead's user avatar
30 votes

Provide subjectAltName to openssl directly on the command line

As of 2023, with OpenSSL ≥ 1.1.1, the following command demonstrates how to generate a self-signed certificate with SAN for example.com and example.net: openssl req -x509 -newkey rsa:4096 -sha256 -...
vog's user avatar
  • 431
28 votes

Bypassing the command/script specified in /etc/passwd

You cannot bypass the script execution. This is your login shell, and will be started every time you login. And as a login shell, will log you off every time it ends. But you can use quirks, bugs and ...
ThoriumBR's user avatar
  • 54.4k
17 votes

Bypassing the command/script specified in /etc/passwd

I remember a wargame challenge where there was a similar case - the shell pointed to something that simply printed some output using the more command, then terminated the session. However, since more ...
Elhitch's user avatar
  • 413
13 votes

Provide subjectAltName to openssl directly on the command line

So I had a heck of a time getting this working right, and putting at all in Ansible. As Ansible's command module doesn't allow file-redirects (<(...)), I had to use a small .cnf file as a template, ...
Excalibur's user avatar
  • 241
12 votes

Does a Turing complete shell means equal secure?

It is not possible to determine whether Linux is more secure than Windows or vice versa. Turing completeness is not a security metric that can be used to objectively compare to what degree two systems ...
julian's user avatar
  • 1,299
11 votes
Accepted

Security of only allowing a few vetted commands using $SSH_ORIGINAL_COMMAND

Your forced command is unsafe. Consider: ssh -l user your-server /var/lib/authorized-scripts/../../../bin/rm -rf / The command name starts with /var/lib/authorized-scripts/ so it's safe, right? Nope!...
Celada's user avatar
  • 686
10 votes

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

If the output is going to a terminal, you have potentially lots of problems (regardless of how you print it, unless you strip special characters), as per other answers. If the file can be gigantic, ...
Peter Cordes's user avatar
10 votes
Accepted

/opt and sudo unzip to /opt, is it safe?

Yes, it is safer to run unzip without root permissions and then move the extracted contents to their final destination. However, if you suspect that the file which you are providing to unzip is ...
forest's user avatar
  • 66.8k
9 votes

How to securely store credentials in a bash variables?

Storing credentials in plain text is always a tricky case, it depends on case-by-case. The main rule is: never store the password inside the script. If the script will run only manually (someone ...
Ricardo Reimao's user avatar
9 votes

How do I track bash history cleanup?

Monitoring the Bash history is easily done with a shell script, but just checking it for unexpected changes might not be an effective security measure but rather clutter your logs with false-positives....
Arminius's user avatar
  • 44.8k
9 votes
Accepted

Bypassing the command/script specified in /etc/passwd

With the sample script you have posted, the restricted user can for example learn a whole lot about the system, like names of other users and installed programs. E.g. What is your name? > /home/* ...
Dmitry Grigoryev's user avatar
8 votes
Accepted

Do sudo and .profile/.bashrc enable trivial privilege escalation?

Anything you can do on a compromised account, an attacker can do as well. Fundamentally, this is because Linux providers isolation between users, not between individual processes running as the same ...
forest's user avatar
  • 66.8k
7 votes

Should I remove bash from my Docker web app container?

It might improve security but it's a very strange way of doing things. What you are suggesting is to start with an image with "unnecessary" software installed and remove some of the stuff you don't ...
Tobias Guggenmos's user avatar
7 votes
Accepted

Is it possible to execute a local file or code from cURL?

Not sure if this is against the spirit of what you are asking but you can pipe the output of a shell script to bash. e.g. curl "file:///root/script.sh" | bash Also take a look at a list of known curl ...
DarkMatter's user avatar
  • 2,691
6 votes
Accepted

Why is `cd` restricted in rbash/restricted bash?

By itself, this measure most probably doesn't make a lot of sense, however you have to put it aside the other limitation to understand its role, in particular (quoting the page you linked): ...
WhiteWinterWolf's user avatar
6 votes

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.)

Path is defined in bash profile so that ~/bin comes last, so running "firefox" should run the default firefox and not a custom "firefox" installed by the user in their home directory. Variables can ...
vidarlo's user avatar
  • 16.5k
6 votes

What do you search for in Open Source code to be sure there isn't malicious code?

If you want to be 100% sure that some git repo doesn't contain malicious code, write it yourself; anything else will be an uphill battle. If someone's really truly trying to hide malicious code in ...
Mike Ounsworth's user avatar
5 votes
Accepted

Bash: Why would sourcing a file be less safe than bashing it (executing in another session)?

I don't know the exact statement and its context so I can only guess what was meant: if a script gets sourced instead of executed in a separate shell then any variables or functions defined in this ...
Steffen Ullrich's user avatar
5 votes

Bypassing the command/script specified in /etc/passwd

TLDR: Script you're mentioned is secure! But understanding that in production you may use different version, you should be aware of following concepts: 1. Whether the 'read' is vulnerable to command ...
dtrizna's user avatar
  • 67
5 votes
Accepted

Find Buffer Overflows at a target you want to gain access

As schroeder has already pointed out, to identify buffer overflow vulnerabilities, you'd need to test the application locally with a debugger. It seems to me that you haven't actually gone through the ...
Soutzikevich's user avatar
4 votes
Accepted

List wireless stations around me

The solution for grepping airodump for specific mac: airodump-ng mon0 2>&1 | grep "de:ad:be:ef:de:ad" Thanks Kolanich. airodump prints to stderr, which had to be redirected to stdout to be ...
unknown6708's user avatar
4 votes
Accepted

What does this malicious bash script do?

I'm having a hard time actually finding what it does. ... brands=(flashmall webshoppers webshoppy smartshoppy shoptool shoppytool coolshopper easyshopper liveshoppers smart-shoppy easy-shopper ...
Steffen Ullrich's user avatar
4 votes
Accepted

Reverse Bash Shell one liner

Can someone please explain to me the significance of the number "196"? 196 is a randomly chosen number for a file descriptor that you're opening for reading from and writing to via exec. You can ...
Arminius's user avatar
  • 44.8k

Only top scored, non community-wiki answers of a minimum length are eligible