Unit 6: Processes and services · Lesson 3 of 6 · 18 min
A process in costume
Unmask a process that pretends to be a kernel thread, and find the file behind it.
mission
- You are
- You are investigating the process named kthreadd.
- Situation
- Kernel threads appear in ps with names in square brackets. Attackers copy that look because admins skip over it.
- Goal
- Prove this process is not a kernel thread and find its program file.
- Hand in
- Who runs it, where the file lives and what program it really is.
Look for bracket names
ps -eo comm,args --no-headers | awk '$2 ~ /^\[/' kthreadd [kworker/0:2] infinity ps -eo user,comm,args | grep -i kworker | grep -v grep dana kthreadd [kworker/0:2] infinity
you should see Real kernel threads have no arguments, are owned by root and are children of PID 2. This one has an argument and belongs to dana.
Check the real kernel thread parent
ps -o pid,user,comm -p 2
PID USER COMMAND
you should see No PID 2 at all here. On a normal server it is kthreadd, owned by root, and every real kworker is its child.
Find the file and identify it
The handover hinted at leftovers in /usr/local. Hidden folders there are worth a look.
ls -la /usr/local/lib/.cache total 44 drwxr-xr-x 2 root root 4096 Oct 13 22:41 . drwxr-xr-x 1 root root 4096 Oct 22 11:57 .. -rwxr-xr-x 1 root root 35336 Oct 13 22:41 kthreadd cmp /usr/local/lib/.cache/kthreadd /usr/bin/sleep && echo same same
you should see A copy of sleep, harmless here, placed on 13 October at 22:41. The point is the method: rename, hide, disguise.
defender tip Note the time. You will match it to a sudo log entry in the logs unit.
Real and fake
root 2 [kworker/0:2]
Owner root, parent 2, no arguments
dana 1 [kworker/0:2] infinity
Owner dana, parent 1, an argument
What a defender takes away
- 1args can say anything. comm, owner and parent are harder to fake.
- 2Kernel threads belong to root and descend from PID 2.
- 3Find the file, hash it, and record when it appeared.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.