# Running Processes and Service Inspection on Linux

- **URL:** https://hackindex.io/platforms/linux/enumeration/running-processes-and-services
- **Path:** Linux > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/linux/enumeration.md)
- **Published:** 2026-03-15
- **Updated:** 2026-03-15

Process enumeration identifies what is running, who owns it, and what it is doing. Privileged processes running as root, services with writable binaries, and internal applications expose attack surface that static file inspection alone misses. This is also where you identify what the host's actual purpose is (web server, database, CI/CD runner), which informs where to look next.

## Full Linux Process Enumeration

```bash
ps aux
ps auxww
# USER       PID  %CPU %MEM    VSZ   RSS TTY    STAT START   TIME COMMAND
# root         1   0.0  0.1  16956  1084 ?      Ss   08:01   0:01 /sbin/init
# root       312   0.0  0.2  28352  2048 ?      Ss   08:01   0:00 /usr/sbin/sshd -D
# www-data   847   0.0  0.5 198432  5432 ?      S    08:02   0:00 /usr/sbin/apache2 -k start
# root       921   0.0  0.1  14632  1024 ?      Ss   08:02   0:00 /usr/sbin/cron -f
# mysql     1024   0.2  3.1 621344 31872 ?      Ssl  08:02   0:14 /usr/sbin/mysqld
# jenkins   1201   1.2  8.4 2134244 85432 ?     Ssl  08:02   1:02 java -jar /opt/jenkins/jenkins.war
```

Focus on:

- Processes running as root that are not standard OS services
- Application processes: their user, binary path, and arguments
- Processes running from non-standard paths like `/opt`, `/tmp`, or `/home`
- Java processes: their `-jar` argument reveals the application

The `COMMAND` column with `ps auxww` shows full arguments including any credentials passed on the command line.

## Process Arguments: Credential Exposure

Some applications accept passwords as command-line arguments. These are visible to all users via `ps`:

```bash
ps auxww | grep -E 'pass|pwd|secret|key|token' --color=auto
```

Database connections, backup scripts, and deployment tools are common offenders.

## Process Tree

```bash
pstree -p
pstree -aup
```

The process tree shows parent-child relationships. Unexpected parent processes (a web server spawning a shell, or a service with an unusual child) indicate something worth investigating or confirm your own shell's ancestry.

## Watching Processes Over Time

Static `ps` misses short-lived processes like cron jobs and scripts that execute and exit. Monitor process creation over a short window:

```bash
watch -n 1 'ps aux --sort=start_time | tail -20'
```

Or capture new processes with `pspy` if you can transfer it to the target. `pspy` monitors process creation without root by reading from `/proc`:

```bash
./pspy64
```

Short-lived root processes that appear on a schedule are almost always cron jobs. Their command line reveals scripts or binaries being executed as root: feed these into [Cron Job Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/cron-job-privilege-escalation).

## Systemd Services

```bash
systemctl list-units --type=service --state=running
systemctl list-units --type=service --all
```

Running services with their status. Look for custom or non-standard service names: anything not part of the base OS install is worth inspecting.

```bash
systemctl cat <service-name>
```

Shows the full unit file for a service. The `ExecStart`, `ExecStop`, `User`, and `WorkingDirectory` fields tell you what binary runs, as whom, and from where. If the binary or its directory is writable, that is a privilege escalation path. See [Systemd Unit and Timer Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/systemd-unit-and-timer-privilege-escalation).

```bash
find /etc/systemd/system /lib/systemd/system /usr/lib/systemd/system -name "*.service" 2>/dev/null | xargs ls -la
```

Checks write permissions on all service unit files at once.

## Systemd Timers

```bash
systemctl list-timers --all
```

Timers are the systemd equivalent of cron. They trigger services on a schedule. Check the `ACTIVATES` column to identify which service each timer calls, then inspect that service unit.

## Service Binary Permissions

For each interesting service, check whether the binary it runs is writable:

```bash
ls -la $(systemctl show <service-name> --property=ExecStart | grep -oP '(?<=path=)[^ ;]+')
```

Or check all running service binaries at once:

```bash
ps aux | awk '{print $11}' | sort -u | xargs ls -la 2>/dev/null | grep -v root
```

Binaries not owned by root that run as root are direct privilege escalation paths. See [Systemd Unit and Timer Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/systemd-unit-and-timer-privilege-escalation).

## Open Files and Network Connections Per Process

```bash
lsof -p <PID>
```

Shows all files, sockets, and pipes a specific process has open. Useful for identifying what files an interesting process is reading or writing, and what network connections it maintains.

```bash
lsof -u <username>
```

All open files and connections for a specific user: useful for mapping what a service account is doing.