Skip to main content
195 votes
Accepted

Isn't Ubuntu's system prompt for my password spoofable?

Your points are all good, and you are correct, but before we get outraged about it we need to remind ourselves how the linux security model works and what it's designed to protect. Remember that the ...
Mike Ounsworth's user avatar
183 votes
Accepted

Is `sudo` almost useless?

Sudo has no real security purpose against a malicious third-party. So yes, it is basically useless for that purpose. In the past I believed it was actually a security control to prevent escalation of ...
reed's user avatar
  • 15.8k
126 votes

Is `sudo` almost useless?

I am the co-author of sudo. It was written in the early 80's specifically to address a need to protect the integrity of a shared resource (A VAX-11/750 running BSD UNIX) from its users (the faculty ...
Bob Coggeshall's user avatar
90 votes

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

No, this is not correct. While one may argue about the relative difficulty of finding and exploiting 0day vulnerabilities on Linux when you have local access, the security architecture itself of a ...
forest's user avatar
  • 67k
67 votes
Accepted

Why is SUID disabled for shell scripts but not for binaries?

There is a race condition inherent to the way shebang (#!) is typically implemented: The kernel opens the executable, and finds that it starts with #!. The kernel closes the executable and opens the ...
Gilles 'SO- stop being evil''s user avatar
60 votes
Accepted

Is it possible to escalate privileges and escaping from a Docker container?

A user on a Docker host who has access to the docker group or privileges to sudo docker commands is effectively root (as you can do things like use docker to run a privilieged container or mount the ...
Rory McCune's user avatar
  • 62.4k
50 votes

Is `sudo` almost useless?

No, sudo is not useless. As a user (target) Usually, when you're on Linux, you're acting as a non-root user. A lot of things, like installing packages with apt, need root/sudo permission to be used. ...
ChocolateOverflow's user avatar
33 votes

Isn't Ubuntu's system prompt for my password spoofable?

Is there any safety mechanism in Linux in general or Ubuntu specifically which prevents any application from displaying a dialog which looks identical to the system's one, asking me for my ...
deviantfan's user avatar
  • 3,864
33 votes

How to do a privileges escalation with ping?

A SUID binary is not inherently exploitable for privilege escalation. The problem is when there is a vulnerability in the software (ex. many CTFs have a SUID binary that contains a buffer overflow ...
deletehead's user avatar
26 votes

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

To rephrase the quote - Privilege escalation vulnerabilities have existed and will continue to be found or created. During the last week we have this little doozy in SystemD; what are we going to ...
James Snell's user avatar
24 votes
Accepted

Privilege escalation using passwd file

Passwords are normally stored in /etc/shadow, which is not readable by users. However, historically, they were stored in the world-readable file /etc/passwd along with all account information. For ...
Gilles 'SO- stop being evil''s user avatar
22 votes

Isn't Ubuntu's system prompt for my password spoofable?

Yes. This is insecure! I personally always Cancel that dialog. Not because it could be fake, but because it could be real. I am supposed to give escalated privileges to "an application" just ...
Stig Hemmer's user avatar
  • 2,433
20 votes

Is it secure to mount Veracrypt without sudo password in this way

This is extremely insecure. I'm glad you asked elsewhere before running this setup yourself! I hope those 3000+ people on AskUbuntu were similarly cautious. So, why is this insecure? What can an ...
forest's user avatar
  • 67k
20 votes

Is `sudo` almost useless?

Sudo is far from being useless. An admin can assign privileges flexibly and granularly and have accountability options (decent logging). It's a significantly better solution to using groups. ...
Pedro's user avatar
  • 3,931
19 votes
Accepted

Escalating user privileges on Linux

There is a very useful site called GTFOBins that has details about lots of different *NIX binaries, and how they can be used to privesc or perform various other actions. Going through the list of SUID ...
Gh0stFish's user avatar
  • 13k
18 votes

Is `sudo` almost useless?

sudo is as secure, or insecure, as its popular alternatives like su. The most popular alternative to sudo is to allow some or all users to elevate their privileges with su. Most commonly, all users ...
Eliah Kagan's user avatar
  • 1,315
17 votes
Accepted

How to execute a command directly on the host system through docker.sock in a Docker container?

The best way that I've found to execute commands on the underlying host with an exposed Docker socket is Ian Miell's most pointless docker command ever The command looks like this :- docker run -ti ...
Rory McCune's user avatar
  • 62.4k
17 votes

Is `sudo` almost useless?

The point of sudo is not to make it hard to elevate privileges. It is, in fact, the exact opposite: the point is to make it easy to elevate privileges. By making it easy to elevate privileges when ...
Jörg W Mittag's user avatar
15 votes

Why is SUID disabled for shell scripts but not for binaries?

Primarily because Many kernels suffer from a race condition which can allow you to exchange the shellscript for another executable of your choice between the times that the newly exec()ed ...
gowenfawr's user avatar
  • 73k
14 votes

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

Exploiting a privilege escalation vulnerability is already hard enough, doing so while being certain that you don't leave a trace is much much harder. An Android user trying to root their phone can ...
Dmitry Grigoryev's user avatar
13 votes

Escalating user privileges on Linux

There's a fairly well-known exploit on chfn: https://github.com/advisories/GHSA-5896-67mw-rv4j A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The ...
user4867444's user avatar
12 votes

Does PT (Penetration Test) allow rooting a server?

In a Penetration test,you can root a server if you are permitted to do. The question cannot have a generic answer. It can only be specific to a each case. The Rules of Engagement specify whether or ...
Sravan's user avatar
  • 1,158
12 votes

This Program Can not Be Run in DOS Mode

Make sure you have delivered the payload correctly, I had a similar issue when transferring accesschk.exe via ftp. FTP allows transfer in ascii and binary modes, if you transfer it in binary mode it ...
John Rogers's user avatar
12 votes

Privilege escalation using passwd file

Just type: echo root::0:0:root:/root:/bin/bash > /etc/passwd su and you are root. (Removing x means root requires no password anymore, you can use sed command instead of echo yet this is enough ...
Yılmaz Değirmenci's user avatar
11 votes
Accepted

This Program Can not Be Run in DOS Mode

Background That message is from the basic header that every Windows (PE format) executable has. The message (and the code that displays it) is technically editable, but all compilers seem to just emit ...
CBHacking's user avatar
  • 49.6k
11 votes

Isn't Ubuntu's system prompt for my password spoofable?

Contrary to what you feel, the (modern) Windows and Ubuntu ways of handling privilege levels and privilege elevation are fairly similar. The reason is surely that the operating systems are both multi-...
Peter - Reinstate Monica's user avatar
10 votes

Am I affected by the Intel AMT/ISM/SBT escalation of privilege vulnerability?

Based on Matthew Garrett - Intel's remote AMT vulnerablity, which is among the most reasonable (in terms of amount of hyperbole) articles I've seen so far, you can only be affected if your system ...
user's user avatar
  • 7,805
10 votes

Escalating user privileges on Linux

Among those binaries, that date is setuid seems very suspicious, as spotted by marcelm If you look at the options supported by date, it has a -f option which displays the time described by each line ...
Ángel's user avatar
  • 19k
9 votes

Is `sudo` almost useless?

Like everything in information security, sudo is a trade-off. Let's explore the alternatives: changing the system so the commands you use sudo for don't require root-level privileges logging in as ...
Tom's user avatar
  • 10.6k
8 votes
Accepted

tty push back - priv escalation

OK, this is not a complete answer therefore I preferred to wait for the bounty to expire to not seem opportunistic. I cannot replicate the linux-vserver part of the vulnerability (mostly because it ...
grochmal's user avatar
  • 5,887

Only top scored, non community-wiki answers of a minimum length are eligible