Skip to content
HackIndex logo

HackIndex

Running Processes and Service Inspection on Linux

3 min read Mar 15, 2026

Process enumeration identifies what is running, who owns it, and what it is doing. Privileged processes running as root, services with writable binaries, and internal applications expose attack surface that static file inspection alone misses. This is also where you identify what the host's actual purpose is — web server, database, CI/CD runner — which informs where to look next.

Full Process List

user@host ~ $ ps aux
user@host ~ $ ps auxww 
USER       PID  %CPU %MEM    VSZ   RSS TTY    STAT START   TIME COMMAND
root         1   0.0  0.1  16956  1084 ?      Ss   08:01   0:01 /sbin/init
root       312   0.0  0.2  28352  2048 ?      Ss   08:01   0:00 /usr/sbin/sshd -D
www-data   847   0.0  0.5 198432  5432 ?      S    08:02   0:00 /usr/sbin/apache2 -k start
root       921   0.0  0.1  14632  1024 ?      Ss   08:02   0:00 /usr/sbin/cron -f
mysql     1024   0.2  3.1 621344 31872 ?      Ssl  08:02   0:14 /usr/sbin/mysqld
jenkins   1201   1.2  8.4 2134244 85432 ?     Ssl  08:02   1:02 java -jar /opt/jenkins/jenkins.war

Focus on:

  • Processes running as root that are not standard OS services

  • Application processes — their user, binary path, and arguments

  • Processes running from non-standard paths like /opt, /tmp, or /home

  • Java processes — their -jar argument reveals the application

The COMMAND column with ps auxww shows full arguments including any credentials passed on the command line.

Process Arguments — Credential Exposure

Some applications accept passwords as command-line arguments. These are visible to all users via ps:

user@host ~ $ ps auxww | grep -E 'pass|pwd|secret|key|token' --color=auto

Database connections, backup scripts, and deployment tools are common offenders.

Process Tree

user@host ~ $ pstree -p
user@host ~ $ pstree -aup

The process tree shows parent-child relationships. Unexpected parent processes — a web server spawning a shell, or a service with an unusual child — indicate something worth investigating or confirm your own shell's ancestry.

Watching Processes Over Time

Static ps misses short-lived processes like cron jobs and scripts that execute and exit. Monitor process creation over a short window:

user@host ~ $ watch -n 1 'ps aux --sort=start_time | tail -20'

Or capture new processes with pspy if you can transfer it to the target. pspy monitors process creation without root by reading from /proc:

user@host ~ $ ./pspy64

Short-lived root processes that appear on a schedule are almost always cron jobs. Their command line reveals scripts or binaries being executed as root — feed these into Cron Job Privilege Escalation.

Systemd Services

user@host ~ $ systemctl list-units --type=service --state=running
user@host ~ $ systemctl list-units --type=service --all

Running services with their status. Look for custom or non-standard service names — anything not part of the base OS install is worth inspecting.

user@host ~ $ systemctl cat <service-name>

Shows the full unit file for a service. The ExecStart, ExecStop, User, and WorkingDirectory fields tell you what binary runs, as whom, and from where. If the binary or its directory is writable, that is a privilege escalation path. See Systemd Unit and Timer Privilege Escalation.

user@host ~ $ find /etc/systemd/system /lib/systemd/system /usr/lib/systemd/system -name "*.service" 2>/dev/null | xargs ls -la

Checks write permissions on all service unit files at once.

Systemd Timers

user@host ~ $ systemctl list-timers --all

Timers are the systemd equivalent of cron. They trigger services on a schedule. Check the ACTIVATES column to identify which service each timer calls, then inspect that service unit.

Service Binary Permissions

For each interesting service, check whether the binary it runs is writable:

user@host ~ $ ls -la $(systemctl show <service-name> --property=ExecStart | grep -oP '(?<=path=)[^ ;]+')

Or check all running service binaries at once:

user@host ~ $ ps aux | awk '{print $11}' | sort -u | xargs ls -la 2>/dev/null | grep -v root

Binaries not owned by root that run as root are direct privilege escalation paths. See Systemd Unit and Timer Privilege Escalation.

Open Files and Network Connections Per Process

user@host ~ $ lsof -p <PID>

Shows all files, sockets, and pipes a specific process has open. Useful for identifying what files an interesting process is reading or writing, and what network connections it maintains.

user@host ~ $ lsof -u <username>

All open files and connections for a specific user — useful for mapping what a service account is doing.