Using Lsof To Determine Which Processes Are Listening On TCP Or ...

TL;DR

Use lsof to find all processes listening on TCP or UPD ports:

sudo lsof -n | egrep 'TCP.*LISTEN|UDP' Details

After a routine security audit using nmap, a production server is found to be running a rogue server listening on port 8000:

jemurray@mbp-2019:~ $ nmap shell.jasonmurray.org Starting Nmap 7.91 ( https://nmap.org ) at 2020-12-27 19:23 CST Nmap scan report for shell.jasonmurray.org (104.131.191.87) Host is up (0.067s latency). Other addresses for shell.jasonmurray.org (not scanned): 2604:a880:800:10::19d5:4001 Not shown: 991 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https 8000/tcp open http-alt

Connecting to port 8000 confirms the host is leaking files:

jemurray@mbp-2019:~ $ elinks shell.jasonmurray.org:8000 -dump Directory listing for / -------------------------------------------------------------------------- * [1]dontleakthisfile.txt -------------------------------------------------------------------------- References Visible links 1. http://shell.jasonmurray.org:8000/dontleakthisfile.txt

Use lsof to find the process listening on port 8000. In this example, we dump all process listening on tcp or udp ports:

jemurray@shell:~$ sudo lsof -n | egrep 'TCP.*LISTEN|UDP' exim4 3533 Debian-exim 3u IPv4 21882742 0t0 TCP 127.0.0.1:smtp (LISTEN) exim4 3533 Debian-exim 4u IPv6 21882743 0t0 TCP [::1]:smtp (LISTEN) ntpd 3744 ntp 18u IPv4 55660414 0t0 UDP 127.0.0.1:ntp ntpd 3744 ntp 19u IPv4 55660416 0t0 UDP 104.131.191.87:ntp ntpd 3744 ntp 20u IPv4 55660418 0t0 UDP 10.17.0.5:ntp ntpd 3744 ntp 21u IPv6 55660420 0t0 UDP [::1]:ntp ntpd 3744 3747 ntpd ntp 16u IPv6 55660407 0t0 UDP *:ntp ntpd 3744 3747 ntpd ntp 17u IPv4 55660410 0t0 UDP *:ntp ntpd 3744 3747 ntpd ntp 18u IPv4 55660414 0t0 UDP 127.0.0.1:ntp ntpd 3744 3747 ntpd ntp 19u IPv4 55660416 0t0 UDP 104.131.191.87:ntp ntpd 3744 3747 ntpd ntp 20u IPv4 55660418 0t0 UDP 10.17.0.5:ntp sshd 15426 root 3u IPv4 12655697 0t0 TCP *:ssh (LISTEN) sshd 15426 root 4u IPv6 12655708 0t0 TCP *:ssh (LISTEN) python3 16760 jemurray 3u IPv4 57858801 0t0 TCP *:8000 (LISTEN) nginx 30170 root 6u IPv4 12851776 0t0 TCP *:http (LISTEN) nginx 30170 root 7u IPv6 12851777 0t0 TCP *:http (LISTEN) nginx 30170 root 8u IPv4 12851778 0t0 TCP *:https (LISTEN) nginx 30170 root 9u IPv6 12851779 0t0 TCP *:https (LISTEN) nginx 30174 www-data 6u IPv4 12851776 0t0 TCP *:http (LISTEN) nginx 30174 www-data 7u IPv6 12851777 0t0 TCP *:http (LISTEN) nginx 30174 www-data 8u IPv4 12851778 0t0 TCP *:https (LISTEN) nginx 30174 www-data 9u IPv6 12851779 0t0 TCP *:https (LISTEN)

Looking at the python3 processes, we see:

jemurray@shell:~$ ps -ef | grep python3 jemurray 16760 13824 0 01:19 pts/8 00:00:00 python3 -m http.server 8000

lsof will also display which directory the python3 program is sharing:

jemurray@shell:~$ sudo lsof | grep 16760 | grep cwd python3 16760 jemurray cwd DIR 254,1 4096 264931 /home/jemurray/example-hacked-directory