194
votes
Accepted
Isn't Ubuntu's system prompt for my password spoofable?
Your points are all good, and you are correct, but before we get outraged about it we need to remind ourselves how the linux security model works and what it's designed to protect.
Remember that the ...
- 58.8k
181
votes
Accepted
Is `sudo` almost useless?
Sudo has no real security purpose against a malicious third-party. So yes, it is basically useless for that purpose. In the past I believed it was actually a security control to prevent escalation of ...
- 15.7k
126
votes
Is `sudo` almost useless?
I am the co-author of sudo. It was written in the early 80's specifically to address a need to protect the integrity of a shared resource (A VAX-11/750 running BSD UNIX) from its users (the faculty ...
- 1,231
90
votes
Are most Linux systems that allow non-root users to execute code straightforwardly rootable?
No, this is not correct. While one may argue about the relative difficulty of finding and exploiting 0day vulnerabilities on Linux when you have local access, the security architecture itself of a ...
- 66.5k
66
votes
Accepted
Why is SUID disabled for shell scripts but not for binaries?
There is a race condition inherent to the way shebang (#!) is typically implemented:
The kernel opens the executable, and finds that it starts with #!.
The kernel closes the executable and opens the ...
59
votes
Accepted
Is it possible to escalate privileges and escaping from a Docker container?
A user on a Docker host who has access to the docker group or privileges to sudo docker commands is effectively root (as you can do things like use docker to run a privilieged container or mount the ...
- 62.1k
58
votes
Accepted
Can the root user be removed from a *nix system to prevent privilege-escalation?
Even if you wanted to, I don't think you can remove the root user. From Wikipedia:
On Unix-like systems, for example, the user with a user identifier (UID) of zero is the superuser, regardless of ...
- 58.8k
50
votes
Is `sudo` almost useless?
No, sudo is not useless.
As a user (target)
Usually, when you're on Linux, you're acting as a non-root user. A lot of things, like installing packages with apt, need root/sudo permission to be used. ...
- 3,482
33
votes
Isn't Ubuntu's system prompt for my password spoofable?
Is there any safety mechanism in Linux in general or Ubuntu
specifically which prevents any application from displaying a dialog
which looks identical to the system's one, asking me for my ...
- 3,844
33
votes
How to do a privileges escalation with ping?
A SUID binary is not inherently exploitable for privilege escalation. The problem is when there is a vulnerability in the software (ex. many CTFs have a SUID binary that contains a buffer overflow ...
- 702
27
votes
Can the root user be removed from a *nix system to prevent privilege-escalation?
As argued by others, it makes no sense to "remove" the root UID (which is represented on UNIX as the UID 0). I would go even further and state that it makes no sense to freeze a system into not having ...
- 6,848
26
votes
Are most Linux systems that allow non-root users to execute code straightforwardly rootable?
To rephrase the quote - Privilege escalation vulnerabilities have existed and will continue to be found or created.
During the last week we have this little doozy in SystemD; what are we going to ...
- 888
23
votes
Accepted
Privilege escalation using passwd file
Passwords are normally stored in /etc/shadow, which is not readable by users. However, historically, they were stored in the world-readable file /etc/passwd along with all account information. For ...
22
votes
Accepted
Bank complains about rooted Android. Is it really any worse than a Windows desktop?
It's All About the Security Model
We see reference to "Checking for jailbroken/rooted device" in nearly all Mobile Application Security Checklists (e.g OWASP). When comparing it to desktops or web ...
- 3,397
22
votes
Isn't Ubuntu's system prompt for my password spoofable?
Yes. This is insecure!
I personally always Cancel that dialog. Not because it could be fake, but because it could be real.
I am supposed to give escalated privileges to "an application" just ...
- 2,433
20
votes
Is it secure to mount Veracrypt without sudo password in this way
This is extremely insecure. I'm glad you asked elsewhere before running this setup yourself! I hope those 3000+ people on AskUbuntu were similarly cautious. So, why is this insecure? What can an ...
- 66.5k
20
votes
Is `sudo` almost useless?
Sudo is far from being useless.
An admin can assign privileges flexibly and granularly and have accountability options (decent logging). It's a significantly better solution to using groups.
...
- 3,931
19
votes
Accepted
Escalating user privileges on Linux
There is a very useful site called GTFOBins that has details about lots of different *NIX binaries, and how they can be used to privesc or perform various other actions. Going through the list of SUID ...
- 9,267
18
votes
Is `sudo` almost useless?
sudo is as secure, or insecure, as its popular alternatives like su.
The most popular alternative to sudo is to allow some or all users to elevate their privileges with su. Most commonly, all users ...
- 1,315
17
votes
Accepted
How to execute a command directly on the host system through docker.sock in a Docker container?
The best way that I've found to execute commands on the underlying host with an exposed Docker socket is Ian Miell's most pointless docker command ever
The command looks like this :-
docker run -ti
...
- 62.1k
17
votes
Is `sudo` almost useless?
The point of sudo is not to make it hard to elevate privileges. It is, in fact, the exact opposite: the point is to make it easy to elevate privileges.
By making it easy to elevate privileges when ...
- 1,210
15
votes
Why is SUID disabled for shell scripts but not for binaries?
Primarily because
Many kernels suffer from a race condition which can allow you to
exchange the shellscript for another executable of your choice between
the times that the newly exec()ed ...
- 72.7k
14
votes
Are most Linux systems that allow non-root users to execute code straightforwardly rootable?
Exploiting a privilege escalation vulnerability is already hard enough, doing so while being certain that you don't leave a trace is much much harder. An Android user trying to root their phone can ...
- 10.2k
13
votes
Escalating user privileges on Linux
There's a fairly well-known exploit on chfn: https://github.com/advisories/GHSA-5896-67mw-rv4j
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The ...
- 237
12
votes
Does PT (Penetration Test) allow rooting a server?
In a Penetration test,you can root a server if you are permitted to do. The question cannot have a generic answer. It can only be specific to a each case.
The Rules of Engagement specify whether or ...
- 1,158
12
votes
This Program Can not Be Run in DOS Mode
Make sure you have delivered the payload correctly, I had a similar issue when transferring accesschk.exe via ftp. FTP allows transfer in ascii and binary modes, if you transfer it in binary mode it ...
- 123
12
votes
Privilege escalation using passwd file
Just type:
echo root::0:0:root:/root:/bin/bash > /etc/passwd
su
and you are root.
(Removing x means root requires no password anymore, you can use sed command instead of echo yet this is enough ...
11
votes
Accepted
This Program Can not Be Run in DOS Mode
Background
That message is from the basic header that every Windows (PE format) executable has. The message (and the code that displays it) is technically editable, but all compilers seem to just emit ...
- 46.3k
11
votes
Isn't Ubuntu's system prompt for my password spoofable?
Contrary to what you feel, the (modern) Windows and Ubuntu ways of handling privilege levels and privilege elevation are fairly similar. The reason is surely that the operating systems are both multi-...
- 1,043
10
votes
Am I affected by the Intel AMT/ISM/SBT escalation of privilege vulnerability?
Based on Matthew Garrett - Intel's remote AMT vulnerablity, which is among the most reasonable (in terms of amount of hyperbole) articles I've seen so far, you can only be affected if your system ...
- 7,755
Only top scored, non community-wiki answers of a minimum length are eligible