I will say that looking and viewing at the processes running on the actual POSIX-based
system is a whole lot easier than it is inside of Windows. This can be done simply by typing
NPS to start off with, and you can see there as I zoom in for you that we have four process IDs
that are running under the actual user that we're chilled into, in this case learner.
And with the PIDs, we get some more information, but I'll come back on that here in just a minute.
If you want a little bit more detail of what's actually running for real reels, you can actually
type in PS space all and you get not only the actual process ID, but more information about
it as well too. And you can see that how it interacts with the system, how long it's been
running, if the TTY is enabled, meaning like remote desktop or remote sessions or anything
like that. The command that was actually used to do it, which is good information to know, because
that way later on if you want to be able to put something else on this system, you know kind of
where that user is going to be floating around at and how to hide stuff. And basically the user
that was responsible for doing it with the UID associated with the actual PID. Now why is all
this really important? Well, as we know on POSIX based systems that anytime a process is running
that there is a folder associated with that process as well too. So for take for instance
process ID 1779, which is our first one. I'll zoom in and show you here right there, that first line
and that is the TTY2 user library exec. This is GDM Wayland session environment
and a whole lot of information with that. But we can actually go in and do it ls
dash la forward slash proc 1779. I got to put my forward slash in there because that's the PID
and there will be a process ID folder associated to that PID inside of proc. And when we do this
we can see all the files that are associated along with symbolic links that are associated
because you have exe referenced over to the library exec. But these are all the files that
are associated with that actual process ID and this gives us a whole fun bag full of stuff to
play with because now we have plenty of places to be able to put these files at and potentially
make changes. How do I know this? Well, you can also go through and start taking a look
at some of the user permissions and I'm going to highlight one right here
and then zoom in for you real quick because this one in particular has 777 on it meaning
anybody can rewrite and execute. You might be able to make changes to that file.
And that is the cwd that is pointed to home learner. Now does that mean that's a file?
Not necessarily. You would have to go into the prop do it ls dash la on that particular file
itself. I'm just showing you that there are different things on here inside of the proc
folder and with the dash la command you can see specified properties of that file and get an idea
of what you can and cannot link on to as you're starting to do or get ready for your post
exploitation. And you will see and I'm going to show you real quick that inside that proc folder
I'm going to do ls slash proc it's got a lot of stuff in there and as I scroll up you'll see a
lot of numbers for PID representation. Now you may be wondering we don't have that many PIDs
running under our users like four or five or something like that. What's up with all these
folders here? I'm glad you asked. Well a lot of these folders are either running under the actual
process or system itself or these are previous processes that were ran in previous sessions or
by previous users etc etc. Regardless these are different areas that you could also tap into as
well too to not only get places to put files or exploits in the future but also get more information
about the system overall. You can get start getting histories you could start getting
file links and locations and potentially again looking for more of those files that contain
passwords and unencrypted text documents that you know exist in every organization out there.