Home / Labs / Processes in Odd Places

Processes in Odd Places

You saved a process snapshot from the host. Legitimate services live in /usr/sbin, /sbin and /usr/bin. Anything running out of /tmp or /dev/shm has no business existing.

Open this lab

Commands practised here

• ps auxEvery process with user, PID, CPU and full command path.
• ps -eo pid,ppid,user,cmdCleaner column layout when you are reading a saved snapshot.
• ls -l /proc/901/exeThe real binary behind a PID, even if argv lies.

Nearby labs

• All labsBrowse the full list.
• Exam prepWhich exams these objectives map to.
• Weak Permissions
• Reading Files