25/9/2016 Bonjour tout le monde,
While launching Tor 6,05 as standard user, I check the connexions and noticed these lines :
tcp 0 0 localhost:58186 localhost:ipp ESTABLISHED root 13693 -
tcp 0 0 localhost:42429 localhost:9150 TIME_WAIT root 0 -
tcp 0 0 192.168.0.15:37517 46.19.93.214:https ESTABLISHED administrateur 24447 -
tcp 0 0 localhost:37651 localhost:9151 ESTABLISHED administrateur 26433 2111/firefox
tcp 0 0 localhost:42432 localhost:9150 TIME_WAIT root 0 -
tcp 0 0 localhost:9151 localhost:37651 ESTABLISHED administrateur 26434 -
tcp 0 0 localhost:ipp localhost:58186 ESTABLISHED root 14340 -
tcp 0 0 localhost:37650 localhost:9151 ESTABLISHED administrateur 26400 2111/firefox
tcp 0 0 localhost:9151 localhost:37650 ESTABLISHED administrateur 24442 -
tcp 0 0 192.168.0.15:35375 tor.epow0.org:9001 ESTABLISHED administrateur 24509 -
tcp 0 0 localhost:37655 localhost:9151 ESTABLISHED administrateur 26682 2111/firefox
tcp 0 0 localhost:42431 localhost:9150 TIME_WAIT root 0 -
tcp 0 0 localhost:9151 localhost:37655 ESTABLISHED administrateur 26683
See those lines as root user ?
Questions :
Port 9150 is linked with Tor, right ?
I know "time wait" means no more active connexions, I know these connexions are localhost, but ...
How Tor managed to get root access ? I never used it as root and installed it as standard user.
I am worrying about privilege escalation.
Cordialement.