Showing posts with label Network Security Hacks. Show all posts
Showing posts with label Network Security Hacks. Show all posts

Jul 7, 2007

Jun 13, 2007

Hack 2 Scan for SUID and SGID Programs

Quickly check for potential root-exploitable programs and backdoors.
What is SUID? SUID stands for set user id. When a SUID file executed, the process which runs it is granted access to system resources based on the user who owns the file and not the user who created the process.
What is SGID? SGID stands for set group id. When looking at files SGID they behave much the same as SUID files, and must be executable for it to have any effect.
Scanning systems for SUID and SGID binaries
# find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -la {} \;

Hack 1 Secure Mount Points

Using mount command to mount a new partition
#mount -o ro,nodev,noexec,nosuid partition mountpoint
example
#mount -o ro,nodev,noexec,nosuid /dev/mapper/VolGroup00-LogVol02 /data
-o (option) place any option following here
Consider the minimum permision for each mountpoint.

umount command
#umount /data