darnellkeith/PEASS-ng
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

swap ppid and pid user in "PPID belongs to a different user (not root)" test

Browse Source 
Seems like it is reporting processes with ppid user root instead of not root. e.g. I see it reports "proc xyz with ppid 1 is run by user messagebus but the ppid user is root" when run in a linux box
This commit is contained in:
KatsuragiCSL 2025-01-13 18:17:51 +08:00 committed by GitHub
parent 3e8078f1cb
commit 7abe31c107
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
linPEAS/builder/linpeas_parts/4_procs_crons_timers_srvcs_sockets/4_Processes_PPID_different_user.sh
View File

@ -28,7 +28,7 @@ if ! [ "$SEARCH_IN_FOLDER" ] && ! [ "$NOUSEPS" ]; then
continue
fi
ppid_user=$(get_user_by_pid "$ppid")
if echo "$user" | grep -Eqv "$ppid_user|root$"; then
if echo "$ppid_user" | grep -Eqv "$user|root$"; then
echo "Proc $pid with ppid $ppid is run by user $user but the ppid user is $ppid_user" | sed -${E} "s,$sh_usrs,${SED_LIGHT_CYAN}," | sed "s,$USER,${SED_LIGHT_MAGENTA}," | sed -${E} "s,$nosh_usrs,${SED_BLUE}," | sed "s,root,${SED_RED},"
fi
done