pspy
Spies on processes and cron jobs without root.
Spies on the processes that spawn and the cron jobs of a Linux system without being root, by reading /proc. It is the way to discover scheduled tasks running as root that open an escalation vector (writable scripts, wildcards, path-less binaries).
Family Privilege escalation
Flags -pf -i 1000
Concepts pspy: spy on processes without root, Cron running a script in a writable path, Cron abuse with symlink (chmod -R), RCE via a cron-deployed Git repo, RCE via git hooks, Logrotate abuse (logrotten)
Cheatsheet Enumeration
Installation
# upload the binary to the victimUseful commands
Appears in
Some machines where its use is documented; not an exhaustive list.
- BitforgeProving Grounds Practice
- BookHackTheBox
- CelestialHackTheBox
- Cereal 1VulnHub
- FluProving Grounds Practice
- LaVitaProving Grounds Practice
- MantisProving Grounds Practice
- NorCDockerLabs
- SickOs 1.2VulnHub
- Symfonos 3VulnHub
- Vulnerable Lab (1 · 4 · 5)VulnHub