Running Processes

Running processes reveal what the system is doing in real time. They show which users are active, which services are running, which binaries are executed, and how privileges flow across the system. For pentesters, process enumeration is a direct path to discovering misconfigurations, credential leaks, exploitable services, and privilege-escalation vectors. Every Linux compromise involves examining processes to find escalation paths or stealthy persistence.

Listing All Running Processes

The most common command for process enumeration is:

ps aux

Example output excerpt:

root       1  0.0  0.2 169276  8500 ?     Ss   10:12   0:01 /sbin/init
root     727  0.0  0.5 290432 21000 ?     Ss   10:12   0:02 /usr/sbin/sshd -D
www-data 1143 0.1  1.0 310200 40900 ?     S    10:13   0:10 /usr/sbin/apache2 -k start
mayur    2247 0.2  0.5 108300 17800 pts/0 Ss   10:20   0:03 bash

Interpretation:

• Processes owned by root control critical services.

• Processes owned by www-data or other service accounts may be exploited.

• Shells owned by user accounts show interactive sessions.

Viewing Processes Tree for Escalation Paths

Process tree view shows parent-child relationships, which is essential for spotting injection points.

ps auxf

Or:

pstree -p

Output example:

systemd(1)
 ├─sshd(727)
 │   └─sshd(1200)
 │       └─bash(1240)
 └─apache2(1143)
     ├─apache2(1144)
     └─apache2(1145)

Practical insights:

• If Apache is running as root initially and later switches to www-data, look for writable configs or scripts executed by Apache.

• Parent-child shells reveal unexpected interactive access.

Checking Running Services

List all systemd services:

systemctl --type=service --state=running

Shows all active services with real-time state information.

Practical example:

systemctl status ssh
systemctl status apache2

This helps identify insecure or unnecessary services.

Identifying Processes Running as Root

Root-owned processes represent the highest-value targets.

ps -U root -u root u

Key insights:

• Any root process executing scripts from writable directories is a critical privilege-escalation vector.

• Root-owned Python, Perl, or Bash scripts indicate editable code paths.

Identifying Processes Running as Other Users

ps -u www-data
ps -u mysql
ps -u <username>

Used to detect misconfigured service accounts with unusual privileges.

Checking Environment Variables of Processes

Environment variables frequently contain secrets such as database passwords or API tokens.

List environment of a process:

tr '\0' '\n' < /proc/<PID>/environ

Look for:

• DB passwords

• API tokens

• AWS keys

• Internal URLs

This is one of the most overlooked privilege escalation techniques.

Checking Executable Paths of Processes

Determine which binary is executed:

ls -l /proc/<PID>/exe

Check for writable or replaced binaries:

stat /proc/<PID>/exe

If a binary used by a privileged process is writable by the current user, it can be overwritten with a malicious binary.

Finding Processes Using Network Ports

Network-connected processes assist in remote exploitation.

ss -tulpn

Example:

tcp   LISTEN  0  80   0.0.0.0:22     0.0.0.0:*    users:(("sshd",pid=727,fd=3))
tcp   LISTEN  0 128   0.0.0.0:80     0.0.0.0:*    users:(("apache2",pid=1143,fd=4))

Practical uses:

• Identify vulnerable services.

• Check if SSH or web servers are running unexpectedly.

• Determine which user owns the process.

Finding Processes Running Exploitable Binaries

Look for sensitive interpreters:

ps aux | grep -E "python|perl|bash|sh|php"

Why?

• Scripts executed by privileged users are often writable.

• Python or PHP processes may expose environment variables or sockets.

Detecting Crontab-Triggered Processes

Cron-based scripts are major privilege-escalation targets.

View cron processes:

ps aux | grep cron

Check cron directories:

ls -la /etc/cron.d
ls -la /etc/cron.daily

Any script executed as root but writable by a user equals immediate root access.

Detecting Malicious or Suspicious Processes

Unusual patterns:

• Random alphanumeric process names

• Processes without binaries ((deleted) flag)

• Processes running from /tmp, /dev/shm

• Processes running on high ports without reason

• Background shells spawned under www-data

Detect deleted binaries:

ls -l /proc/*/exe 2>/dev/null | grep deleted

If found, this is often malware or a stealthy intrusion.

Inspecting Command-Line Arguments of Processes

Command-line arguments often contain credentials.

cat /proc/<PID>/cmdline | tr '\0' ' '

Look for:

• DB connection strings

• Tokens

• Passwords

• Internal IPs

Enumerating Open File Descriptors

Check open resources:

ls -l /proc/<PID>/fd

This reveals:

• Open logs

• Secrets in files

• Network sockets

• Pipes and inter-process communication

Practical use:

• If a privileged process has an open writable file descriptor pointing to a script or config file, exploitation becomes possible.

Detecting Privileged Child Processes

Attackers often escalate using child processes spawned by high-privilege parents.

Check parent-child chains:

ps -eo pid,ppid,user,cmd --forest

Look for:

• Unexpected shells as children of root services

• PHP spawning bash

• Python scripts spawning system commands

These behaviors often indicate misconfigured or vulnerable services.

Detecting Containers via Processes

Containers expose unique process patterns.

Check cgroup:

cat /proc/1/cgroup

Check for Docker or LXC:

ps aux | grep -E "docker|lxc"

If inside a container, inspect host mounts for escape possibilities:

mount | grep docker

Practical Exploitation Scenarios from Process Enumeration

Scenario 1: Writable Script Executed by Root

If you find:

root  990  python3 /opt/backup.py

Check permissions:

ls -la /opt/backup.py

If writable:

• Insert reverse shell code

• Wait for execution

• Gain root

Scenario 2: Apache Running Custom Scripts

www-data python /var/www/html/app/worker.py

If the file is writable, modify code to escalate or steal credentials.

Scenario 3: Process Using Sensitive Tokens

If command-line reveals:

--db-password=admin123

Use it for lateral movement.

Intel Dump

• Processes reveal user activity, services, vulnerabilities, and escalation paths

• ps aux shows full system process list and owners

• ps auxf and pstree expose parent-child chains

• Root-owned processes using writable scripts allow escalation

• Environment variables can leak credentials

• /proc/<PID>/cmdline reveals sensitive arguments

• /proc/<PID>/fd shows open file descriptors and sockets

• ss -tulpn maps processes to network ports

• Deleted binaries and processes from /tmp indicate compromise

• Cron-based processes and writable cron scripts enable root-level exploitation

• Interpreters (Python, PHP, Bash) running as privileged users expose injection opportunities

• Container processes and cgroups help detect container escape vectors

Give the next chapter title when you're ready.