# Process secret hunting

> Enumerate running process memory and cmdline args to extract plaintext secrets, credentials, and sensitive data from live Linux processes.

- **URL:** https://hackindex.io/platforms/linux/post-exploitation/credentials/pprocess-secret-hunting
- **Path:** Linux > Post-Exploitation > Credentials
- **Up:** [Credentials](https://hackindex.io/platforms/linux/post-exploitation/credentials.md)
- **Published:** 2026-02-17
- **Updated:** 2026-08-11

> [!WARNING]
> Run these techniques only on systems you are explicitly authorized to test. Process arguments and environment variables may expose live secrets. Capture only what you need, avoid writing sensitive output to disk, and handle results per scope and retention rules.

Secrets show up most often in command-line arguments, environment variables, and unit ExecStart lines.

## Wide process view

```bash
ps auxwwf
```

What you should see:

- Full command lines including flags. Look for `--password`, `--token`, `-p`, `Authorization`, JDBC URLs, and inline creds.
- Custom app paths under `/opt`, `/srv`, `/var/www`, or user home directories.

Next move:

- Pick a suspicious PID and pull args and environment from procfs.

## Pull a single process args and environment

Set `$PID` to a target PID you saw in `ps`.

```bash
PID=<pid>
tr '\0' ' ' < /proc/$PID/cmdline; echo
tr '\0' '\n' < /proc/$PID/environ 2>/dev/null | sed -n '1,200p'
```

Interpretation:

- If creds are in `cmdline`, you can usually reuse them immediately.
- If creds are in `environ`, they often match `.env` files or systemd Environment entries. Hunt the source file next.

## Identify files and sockets the process uses

```bash
PID=<pid>
ls -la /proc/$PID/fd 2>/dev/null | head
lsof -p $PID 2>/dev/null | head -n 80
```

What to do with results:

- Config file paths and log paths are the fastest pivot. Open the config file and look for static secrets.
- Established connections reveal internal targets and ports. That becomes lateral movement planning later, but you can capture hostnames now.

## Hunt for likely secret flags across all processes

```bash
ps auxww | grep -Ei "pass(word)?=|token=|secret=|api[_-]?key=|authorization:|bearer" | grep -v grep
```

If the box is noisy, focus on common runtimes:

```bash
ps auxww | grep -E "java|node|python3|python|gunicorn|uwsgi|dotnet|php-fpm" | grep -v grep
```

## systemd ExecStart and environment (when readable)

If you have access to service definitions, you can often read the full command line and referenced config.

```bash
systemctl list-units --type=service --state=running 2>/dev/null
systemctl cat <service> 2>/dev/null | sed -n '1,200p'
systemctl show <service> -p Environment 2>/dev/null
```

Interpretation:

- `ExecStart` points at the real binary and flags. If flags include secrets, capture them.
- If it references a config path, open it and confirm whether the secret is static.

## References

- [proc(5) manual](https://man7.org/linux/man-pages/man5/proc.5.html) - cmdline/environ behavior
- [ps(1) manual](https://man7.org/linux/man-pages/man1/ps.1.html) - wide output flags
- [lsof(8) manual](https://man7.org/linux/man-pages/man8/lsof.8.html) - open files and sockets by PID