1

25/9/2016 Bonjour tout le monde,

While launching Tor 6,05 as standard user, I check the connexions and noticed these lines :

tcp 0 0 localhost:58186 localhost:ipp ESTABLISHED root 13693 -
tcp 0 0 localhost:42429 localhost:9150 TIME_WAIT root 0 -
tcp 0 0 192.168.0.15:37517 46.19.93.214:https ESTABLISHED administrateur 24447 -
tcp 0 0 localhost:37651 localhost:9151 ESTABLISHED administrateur 26433 2111/firefox
tcp 0 0 localhost:42432 localhost:9150 TIME_WAIT root 0 -
tcp 0 0 localhost:9151 localhost:37651 ESTABLISHED administrateur 26434 -
tcp 0 0 localhost:ipp localhost:58186 ESTABLISHED root 14340 -
tcp 0 0 localhost:37650 localhost:9151 ESTABLISHED administrateur 26400 2111/firefox
tcp 0 0 localhost:9151 localhost:37650 ESTABLISHED administrateur 24442 -
tcp 0 0 192.168.0.15:35375 tor.epow0.org:9001 ESTABLISHED administrateur 24509 -
tcp 0 0 localhost:37655 localhost:9151 ESTABLISHED administrateur 26682 2111/firefox
tcp 0 0 localhost:42431 localhost:9150 TIME_WAIT root 0 -
tcp 0 0 localhost:9151 localhost:37655 ESTABLISHED administrateur 26683

See those lines as root user ?

Questions :

Port 9150 is linked with Tor, right ?

I know "time wait" means no more active connexions, I know these connexions are localhost, but ...

How Tor managed to get root access ? I never used it as root and installed it as standard user.

I am worrying about privilege escalation.

Cordialement.

  • This doesn't appear to show tor with root access, this appears to show the root user using tor. The left hand side shows the source, the right the destination. The destination is tor, not the source. – cacahuatl Nov 28 '16 at 1:26
1

Port 9150 is a Tor SOCKS port by default, so something was using your local SOCKS[port 9150] and your local ControlPort to control Tor via telnet protocol, default port is 9151. The Tor itself seems to behave fine, no rooting/jailbreaking so far. Please post your torrc config if you need to take a deeper look, but your log looks OK and very common for TorButton or something similar like Tor Browser Bundle.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.