Process list with /proc -r

You may already have encountered this small issue, you are on a system and want to list processes but /proc has no read permission so you cannot list entries. Does it stop us? No, obviously we can iterate all possible pids and check for /proc/<pid>/ directory.

In shell we can get a simple process list with:

$ for P in $(seq 1 32168); do
  [ -d "/proc/$P" ] || continue
  echo "$P: $(cat /proc/$P/cmdline 2>/dev/null |sed 's/\x00/ /g')"
done
1: init [2]
1423: -bash
[...]

But what if we want more information, just like ps from procps gives us?

From file tampering to local root

Ubuntu Security Notice USN-959-1 (CVE-2010-0832) reports that Denis Excoffier discovered a serious flaw in PAM MOTD module in Ubuntu: it does not correctly handle path permissions when creating user file stamps. For more details, just have a look at the diff.

The exploit made by Kristian Erik Hermansen allows tampering any file. From that, we can get root for example by adding a user with uid 0. We don't want an empty password because the SSH server sshd has default PermitEmptyPasswords to no. Also, we don't want to prompt the user for his password at SSH connection, so we could create a temporary SSH key and add it to authorized_keys. Also, we want to be sure we backup any file we modify. Finally, we want to remove the rogue user and restore files we modified.