Skip to main content

Bash

Processes​

List processes​

List all processes
ps aux
List all processes running as root
ps aux | grep ^root
List the processes tree
ps auxf
Command explanation
  • a lists processes from all users
  • u displays the process's user/owner
  • x lists processes without a controlling terminal
  • f displays a tree of processes

Trace processes system calls​

Run and trace a process
strace <command>
Trace a process
strace -p <pid>
Trace a process and its children
strace -p <pid> -f
strace

You'll need to install strace on the target machine to use it. Also, you'll need to be root to trace processes you don't own.

Containers

If you're tracing a process inside a container, you'll need SYS_PTRACE capabilities.

File System​

Find files by name​

Simple find
# Find flag.txt recursively from root
find / -name flag.txt 2>/dev/null
tip

You can change -name to -iname to make the search case-insensitive.

Find every executable file with SUID permissions
find / -perm -u=s -type f 2>/dev/null
Find every executable file with SUID permissions owned by root
find / -uid 0 -perm -u=s -type f 2>/dev/null
Command explanation
  • -uid 0 specifies the user ID to search for (in this case, root)
  • -perm -u=s specifies the permissions to search for (in this case, SUID)
  • -type f specifies the file type to search for (in this case, a file)
  • 2> /dev/null redirects errors to /dev/null

Find files by content​

Find every file which contains the word 'password'
grep -irn / -e password 2>/dev/null
Command explanation
  • -i makes the search case-insensitive
  • -r makes the search recursive
  • -n prints the line number of the match
  • -e specifies the regex pattern to search for
  • 2> /dev/null redirects errors to /dev/null

Create a .tar archive​

Create a .tar archive
tar -czvf archive.tar <file>
Command explanation
  • -c creates a new archive
  • -z compresses the archive with gzip
  • -v prints the files being archived
  • -f specifies the archive file

Extract a .tar archive​

Extract a .tar archive
tar -xzvf archive.tar
Extract to another directory

You can use the command tar -xf archite.tar -C target/ to extract all files to the target/ directory.

Command explanation
  • -x extracts the archive
  • -z specifies the archive is compressed with gzip
  • -v prints the files being extracted
  • -f specifies the archive file