Processes & Persistence

Knowing what’s running — and why — is half of security work: enumeration when you play the attacker, detection when you play the defender.

Looking at processes

ps aux                # everything, with user and command
top                   # live view (htop if you have it)
ss -tulpn             # listening sockets: who holds port 80?
lsof -i -P -n         # network connections mapped to processes

ss -tulpn output is worth reading slowly: every listening port is a door, and unexpected doors are the first thing both attackers and auditors look for.

/proc: the X-ray of a process

Every process exposes its internals under /proc/<pid>/:

tr '\0' ' ' < /proc/1/cmdline     # the real command line (null-separated)
tr '\0' '\n' < /proc/2412/environ # environment variables of the process
ls -l /proc/2412/fd               # open files and sockets
cat /proc/2412/maps               # loaded libraries and memory regions

Handy truths it reveals: a “renamed” binary shows its real path in exe, deleted malware still visible in fd, and secrets passed as env vars are readable here (see the LD_PRELOAD section below).

Persistence: how intruders survive reboots

After getting in, an attacker plants a way back. The classic spots, and how to check them:

crontab -l                      # user crontab
ls /etc/cron.d /etc/cron.*      # system-wide cron
systemctl list-timers           # systemd timers (the modern cron)
systemctl list-units --type=service --state=running
ls -la ~/.bashrc ~/.profile     # executed at every login
cat ~/.ssh/authorized_keys      # a new key = a new permanent user

A single line in any of these can spawn a reverse shell at every boot. When auditing, ask of each entry: do I know why this is here?

Indirect execution: PATH hijacking & LD_PRELOAD

PATH hijacking — a script calls service nginx restart without an absolute path. The shell searches $PATH in order, so a malicious service placed in an earlier writable directory wins:

echo $PATH
# /home/carlo/bin:/usr/local/bin:/usr/bin:...
# if ~/bin is first and writable, a fake 'service' there shadows the real one

Defenses: absolute paths in scripts and cron entries, and never let . or user-writable directories sit in a root-owned script’s PATH.

LD_PRELOAD — an environment variable that forces an extra shared library into every program started with it:

LD_PRELOAD=./evil.so ls    # 'ls' now runs attacker code first

Defenses: sudo resets the environment by default for a reason (env_reset) — don’t disable it; treat environment variables from untrusted sources as code.

Post-compromise checklist

• cron / timers / services reviewed (this note)
• authorized_keys and users checked (grep bash /etc/passwd)
• new SUID binaries hunted (SUID, SGID & File Capabilities)
• logs shipped and searched for the intrusion window (Logs & Auditing)
• filesystem timestamps read to reconstruct the story (Linux Forensics Fundamentals)