Root access in Tor 6,0.5?

Question

25/9/2016 Bonjour tout le monde,

While launching Tor 6,05 as standard user, I check the connexions and noticed these lines :

tcp 0 0 localhost:58186 localhost:ipp ESTABLISHED root 13693 -
tcp 0 0 localhost:42429 localhost:9150 TIME_WAIT root 0 -
tcp 0 0 192.168.0.15:37517 46.19.93.214:https ESTABLISHED administrateur 24447 -
tcp 0 0 localhost:37651 localhost:9151 ESTABLISHED administrateur 26433 2111/firefox
tcp 0 0 localhost:42432 localhost:9150 TIME_WAIT root 0 -
tcp 0 0 localhost:9151 localhost:37651 ESTABLISHED administrateur 26434 -
tcp 0 0 localhost:ipp localhost:58186 ESTABLISHED root 14340 -
tcp 0 0 localhost:37650 localhost:9151 ESTABLISHED administrateur 26400 2111/firefox
tcp 0 0 localhost:9151 localhost:37650 ESTABLISHED administrateur 24442 -
tcp 0 0 192.168.0.15:35375 tor.epow0.org:9001 ESTABLISHED administrateur 24509 -
tcp 0 0 localhost:37655 localhost:9151 ESTABLISHED administrateur 26682 2111/firefox
tcp 0 0 localhost:42431 localhost:9150 TIME_WAIT root 0 -
tcp 0 0 localhost:9151 localhost:37655 ESTABLISHED administrateur 26683

See those lines as root user ?

Questions :

Port 9150 is linked with Tor, right ?

I know "time wait" means no more active connexions, I know these connexions are localhost, but ...

How Tor managed to get root access ? I never used it as root and installed it as standard user.

I am worrying about privilege escalation.

Cordialement.

Answer 1

Port 9150 is a Tor SOCKS port by default, so something was using your local SOCKS[port 9150] and your local ControlPort to control Tor via telnet protocol, default port is 9151. The Tor itself seems to behave fine, no rooting/jailbreaking so far. Please post your torrc config if you need to take a deeper look, but your log looks OK and very common for TorButton or something similar like Tor Browser Bundle.