Unit 6: Processes and services · Lesson 3 of 6 · 18 min
A process in costume
Unmask a process that pretends to be a kernel thread, and find the file behind it.
mission
- You are
- You are investigating the process named kthreadd.
- Situation
- Kernel threads appear in ps with names in square brackets. Attackers copy that look because admins skip over it.
- Goal
- Prove this process is not a kernel thread and find its program file.
- Hand in
- Who runs it, where the file lives and what program it really is.
Look for bracket names
ps -eo comm,args --no-headers | awk '$2 ~ /^\[/' kthreadd [kworker/0:2] infinity ps -eo user,comm,args | grep -i kworker | grep -v grep dana kthreadd [kworker/0:2] infinity
you should see Real kernel threads have no arguments, are owned by root and are children of PID 2. This one has an argument and belongs to dana.
ps- Lists running processes. Built into Linux and macOS.
awk- Splits each line into fields and prints or counts the ones you ask for. Built into Linux and macOS.
grep- Prints the lines of text that match a pattern. Built into Linux and macOS.
Check the real kernel thread parent
ps -o pid,user,comm -p 2
PID USER COMMAND
you should see No PID 2 at all here. On a normal server it is kthreadd, owned by root, and every real kworker is its child.
Find the file and identify it
The handover hinted at leftovers in /usr/local. Hidden folders there are worth a look.
ls -la /usr/local/lib/.cache total 44 drwxr-xr-x 2 root root 4096 Oct 13 22:41 . drwxr-xr-x 1 root root 4096 Oct 22 11:57 .. -rwxr-xr-x 1 root root 35336 Oct 13 22:41 kthreadd cmp /usr/local/lib/.cache/kthreadd /usr/bin/sleep && echo same same
you should see A copy of sleep, harmless here, placed on 13 October at 22:41. The point is the method: rename, hide, disguise.
defender tip Note the time. You will match it to a sudo log entry in the logs unit.
ls- Lists the files in a folder. Built into Linux and macOS.
cmp- Checks whether two files are byte-for-byte identical. Built into Linux and macOS.
echo- Prints its arguments. Built into Linux and macOS.
Real and fake
root 2 [kworker/0:2]
Owner root, parent 2, no arguments
dana 1 [kworker/0:2] infinity
Owner dana, parent 1, an argument
What a defender takes away
- 1args can say anything. comm, owner and parent are harder to fake.
- 2Kernel threads belong to root and descend from PID 2.
- 3Find the file, hash it, and record when it appeared.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.