4

If you are faced with a non-root remote command execution vulnerability, and there is a foreign executable that's running on your Linux system from a user with only non-administrator privileges, what's the best way to preserve the executable and its state, and terminate the access?

The executable file itself is marked as deleted, so, it's not possible to simply make a copy of it. Additionally, since it appears that the exe file within the respective /proc/%d directory is merely a symlink, and the executable itself is not one of the files open within /proc/%d/fd, it seems like even saving the executable file itself might be a bit tricky.

How do you save all states associated with the executable for future analysis, as well as the executable itself?

5

You can freeze it with kill -STOP $pid. The process statistics will remain accessable through /proc/$pid, but it will not be executing.

You can get access to the executable file with cp /proc/$pid/exe /destination/path.

  • That's the thing -- the cp won't work, since it's a regular symlink, and the file it points to has been deleted. – cnst Sep 4 '14 at 14:12
  • 2
    @cnst try it... – Patrick Sep 4 '14 at 14:19
  • hm, interesting, it does seem to work! weird. – cnst Sep 4 '14 at 14:48
  • Is there a way to save the state, so that it can be restored later on? The kill -STOP seems like a good solution, but appears to be temporary in nature. – cnst Sep 4 '14 at 14:49
  • Depends on what you're after. Your options are basically limited to taking a gcore of the process, and/or grabbing the wanted info from /proc/$pid and storing it somewhere (you can't just recursively copy everything). – Patrick Sep 4 '14 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.