phpsploit icon indicating copy to clipboard operation
phpsploit copied to clipboard

plugins/proclist: Implement a full-php way to get process list in Linux

Open nil0x42 opened this issue 5 years ago • 2 comments

Current implementation of proclist plugin uses win32_ps_list_procs() php function on Windows host.

Therefore, linux implementation is a simple system("ps -a"), which is OPSEC unsafe, an would probably trigger EDR alerts.

A better implementation should avoid relying on system command execution.

nil0x42 avatar Oct 03 '20 14:10 nil0x42

would groveling through /proc on linux work, you think?

paralax avatar Dec 08 '20 15:12 paralax

i think it's a lot better indeed @paralax ! anyway ps does that internally, directly reading on /proc is probably the best way

nil0x42 avatar Dec 09 '20 19:12 nil0x42