Hot answers tagged

9

Binary exploitation does not require you understand the Linux kernel in depth, unless you are exploiting the kernel itself. You only need to know the basics such as how signal handlers are registered, how syscalls work, and how Linux manages process-specific attributes that can be relevant to exploitation. A solid understanding of Linux is very useful, but ...


5

Communicating through 127.0.0.1 can be thought of as just another IPC mechanism, but one that re-uses existing protocols. Just like shared memory or UNIX domain sockets or pipes, it's one of countless ways that two processes can communicate on a single system. If you trust that the processes on your system have not been compromised, then you can "blindly" ...


5

$(whoami) should bypass the filter and executes whoami.


4

If you know that the IP address at the other end of a TCP socket is 127.0.0.1, this guarantees that either the system administrator has configured the firewall to redirect this particular connection, or the other end of the TCP socket is a process running on the same machine. So if you trust your server machine as a whole, you can trust 127.0.0.1. However, ...


4

Is there any simpler way to exploit such vulnerability It would be more straightforward to simply integrate a PHP reverse shell into the db.php file; once it runs and connects to your listener, you'll be given shell-like access as root.


3

This simply means that dwcore application which is listening on port 8080 and 8443 are vulnerable to path traversal. Without the knowledge of what that application is, an accurate answer cannot be provided for this. Having said that, if the application running on those two ports are not used, you can kill those services or add an iptable rule to restrict ...


2

At least fish, ksh93, yash and zsh are available in Ubuntu, but not installed by default, and don't drop privileges when they start. Perl and Python are installed by default and don't drop privileges. This is not a “critical security check”. If an adversary can cause an interpreter to be setuid, they can also run code as that user. If they can inject code ...


1

But else what could they do to prevent this behaviour? Several possibilities: Disable HID drivers in kernel. Disable TTY support on kernel Disable getty on TTY. ... Is it sufficiant to disable all TTYs? Should be, yes. Can I build a Linux without a login possibility? For sure. Most embedded firmware are built with Yocto or Buildroot. Using these ...


1

You can dump the memory on your running server and do the analysis using volatility. If this server has not rebooted then you might find something interesting such as command history, strange processes, network connection ... using existing modules. I can not go into details because this is a long story and training skills to do this. Actually, people in ...


Only top voted, non community-wiki answers of a minimum length are eligible