New answers tagged linux
2
If you know that the IP address at the other end of a TCP socket is 127.0.0.1, this guarantees that either the system administrator has configured the firewall to redirect this particular connection, or the other end of the TCP socket is a process running on the same machine. So if you trust your server machine as a whole, you can trust 127.0.0.1. However, ...
4
Communicating through 127.0.0.1 can be thought of as just another IPC mechanism, but one that re-uses existing protocols. Just like shared memory or UNIX domain sockets or pipes, it's one of countless ways that two processes can communicate on a single system. If you trust that the processes on your system have not been compromised, then you can "blindly" ...
0
But else what could they do to prevent this behaviour?
Several possibilities:
Disable HID drivers in kernel.
Disable TTY support on kernel
Disable getty on TTY.
...
Is it sufficiant to disable all TTYs?
Should be, yes.
Can I build a Linux without a login possibility?
For sure. Most embedded firmware are built with Yocto or Buildroot. Using these ...
4
Is there any simpler way to exploit such vulnerability
It would be more straightforward to simply integrate a PHP reverse shell into the db.php file; once it runs and connects to your listener, you'll be given shell-like access as root.
0
It is possible to analyze windows malware on linux - but you'll be limited when it comes to analyzing runtime behaviour. wine is good, but to observe the behaviour of the malware, you'll need a debugging vm with windows.
2
At least fish, ksh93, yash and zsh are available in Ubuntu, but not installed by default, and don't drop privileges when they start. Perl and Python are installed by default and don't drop privileges.
This is not a “critical security check”. If an adversary can cause an interpreter to be setuid, they can also run code as that user. If they can inject code ...
0
What about monitoring the system calls on the side of the kernel using an external gdb instance.
This could be done by setting up a virtual machine that is configured to run the code of interest. Then QEMU and KVM (by my knowledge) have to be configured to open a port for gdb debugging of the kernel. (See guides blow.)
If this VM is started gdb could be ...
5
$(whoami) should bypass the filter and executes whoami.
9
Binary exploitation does not require you understand the Linux kernel in depth, unless you are exploiting the kernel itself. You only need to know the basics such as how signal handlers are registered, how syscalls work, and how Linux manages process-specific attributes that can be relevant to exploitation. A solid understanding of Linux is very useful, but ...
-2
I like the idea of an added layer of security, though I would say this borders on the whole security through obscurity thing, mainly because you can do sysrq requests from userspace/software (remotely) as I understand it, via /proc/sys/kernel/sysrq and/or /proc/sysrq-trigger. However its not at all a large task to disable these via a sysctl, boot time flag, ...
1
You can dump the memory on your running server and do the analysis using volatility. If this server has not rebooted then you might find something interesting such as command history, strange processes, network connection ... using existing modules. I can not go into details because this is a long story and training skills to do this.
Actually, people in ...
2
The "l" strip part is just to check whether the system is infected yet. The exploit came from server misconfiguration by exposing redis public with no-auth. Find more information here: https://blog.cystack.net/pwn-a-bunch-of-servers-via-a-redis-misconfiguration-and-the-shodan-search-engine/
Top 50 recent answers are included
