Unit 7: The network from the host · Lesson 2 of 7 · 15 min

Who owns that port

Tie each listening port to the process and account behind it.

mission

You are
You are attributing each listener.
Situation
ss can name the process behind a port only when it belongs to you, or when root asks.
Goal
Name the program and account behind 4444 and 8081 without root.
Hand in
Port, program, account for each listener.

From port to person

  1. Portss -tln
  2. Processss -p or ps
  3. Program/proc/PID/exe or the command line
  4. AccountThe user that owns the process
01

Ask ss for processes

learner@root-lab
ss -tlnp
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess                       
LISTEN 0      4096       127.0.0.1:7681      0.0.0.0:*    users:(("ttyd",pid=20,fd=12))
LISTEN 0      5          127.0.0.1:8081      0.0.0.0:*                                 
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*                                 
LISTEN 0      1            0.0.0.0:4444      0.0.0.0:*                                 
LISTEN 0      4096         0.0.0.0:8080      0.0.0.0:*

you should see Only your own ttyd gets a name. The others belong to other accounts.

02

Correlate with ps

Listeners usually carry their port in the command line. Search for it.

learner@root-lab
ps -eo user,args | grep -E 'sync-agent|status.py|sshd' | grep -v grep
root     sshd: /usr/sbin/sshd [listener] 0 of 10-100 startups
www-data /usr/bin/python3 /usr/local/lib/shop-status/status.py
dana     /usr/local/lib/sync/sync-agent -lk 4444
file /usr/local/lib/sync/sync-agent | cut -d, -f1
/usr/local/lib/sync/sync-agent: ELF 64-bit LSB pie executable
cmp /usr/local/lib/sync/sync-agent /usr/bin/nc.openbsd && echo same
same

you should see sync-agent is netcat, a raw network tool, renamed and listening for anyone on 4444 as dana.

defender tip As root, ss -tlnp names every listener directly. Without root, correlation is the skill.

03

Match the command line

-l makes netcat listen and -k keeps it listening after each connection.

learner@root-lab
ps -o user,args -C sync-agent
USER     COMMAND
dana     /usr/local/lib/sync/sync-agent -lk 4444

you should see dana runs it with -lk 4444: a listener that never stops.

What a defender takes away

  1. 1ss -p shows owners only for your processes unless you are root.
  2. 2Command lines often reveal ports and paths.
  3. 3A renamed network tool on an open port is a top finding.

Questions

0 of 2 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    ps -eo user,args | grep 4444

  2. Show hint

    cmp it against /usr/bin/nc.openbsd.