.jar file enumeration from processes in Linux involves identifying and extracting information about Java Archive (JAR) files that are currently running within a system’s processes. This process can be useful for various purposes, such as troubleshooting, security analysis, or understanding the dependencies of a running Java application.
Enumeration
1. Use tools like ps or pgrep to identify running Java processes. You can filter processes based on the Java executable or any related parameters.
- ps aux | grep -i java
2. Once you identify the Java processes, extract more detailed information using tools like jcmd or jps (Java Process Status). For instance:
- jcmd <PID> help
- jcmd <PID> VM.system_properties
Note: files associated with the Java processes. This information can be extracted from the output of the previously used tools.
3. The lsof command can be helpful in listing open files, including JAR files opened by Java processes:
- lsof -p <process-id> | grep “.jar”
4. The /proc filesystem in Linux provides a wealth of information about processes. You can navigate to /proc/<process-id>/ and examine files like cmdline, which contains the command-line arguments, and maps, which displays memory maps, potentially revealing loaded JAR files.
- ls -l /proc/<process-id>/cwd
- cat /proc/<process-id>/cmdline
5. Extract strings from the process memory to identify potential JAR file references:
- strings /proc/<process-id>/mem | grep “.jar”
6. Java applications may log information about loaded JAR files. Check the application logs for any relevant details
Exploitation
1. Once you locate the jar file you can transfer it to your computer and examine the code using jd-gui
2. Click open file, locate the .jar, open it
3. Expand the tabs analyze the code and try to find flaws or any confidential data such as usernames & passwords
Note: In this case we found POSTGRESQL database username and password