Ethical Hacker Tip: Linux Commands in Containers (When Common Commands Aren’t Available)

When pentesting containers/pods, you often encounter slimmed-down OS environments missing common commands like ls, netstat, or who. Here’s how to work around these limitations using built-in Bash functions and alternative methods.

Alternative Commands When Standard Tools Are Missing

1. Listing Files Without `ls`

If `ls` is unavailable, use:

echo  | tr ' ' '\n' 

This lists all files in the current directory, replacing spaces with newlines for readability.

2. Checking Network Connections Without `netstat` or `ss`

Use this script to mimic `netstat` functionality:

for proto in tcp udp; do 
for entry in /proc/net/$proto; do 
while read -r line; do 
printf "%s\n" "$line" 
done < "$entry" 
done 
done 

Or refer to the full script here: https://lnkd.in/etmdYg9m

3. Checking Active Users Without `who`

Paste this function into your shell:

function newwho() { 
for pid in $(ls /proc | grep '^[0-9]+$'); do 
if [ -d "/proc/$pid/fd" ]; then 
for fd in /proc/$pid/fd/; do 
target=$(readlink "$fd" 2>/dev/null) 
case "$target" in 
/dev/pts/|/dev/tty) 
uid=$(awk '/^Uid:/ {print $2}' /proc/$pid/status 2>/dev/null) 
username=$(awk -F: -v uid="$uid" '$3 == uid {print $1}' /etc/passwd) 
echo "User $username (UID $uid) is active via $target (PID $pid)" 
break 
;; 
esac 
done 
fi 
done 
} 

Then run:

newwho 

Example output:

User root (UID 0) is active via /dev/tty6 (PID 1544) 
User root (UID 0) is active via /dev/tty1 (PID 2300) 

You Should Know: Essential Linux Built-ins and Workarounds

File Operations

• List files (alternative to ls):

  printf "%s\n"<br />
  

• Check file contents (without cat):

  while IFS= read -r line; do echo "$line"; done < file.txt 
  

Process & System Info

• Check running processes (without ps):

  ls /proc | grep '^[0-9]+$' | xargs -I {} sh -c 'echo -n "PID {}: "; cat /proc/{}/cmdline; echo' 
  

• Check system uptime (without uptime):

  cat /proc/uptime | awk '{print int($1/86400)" days "int(($1%86400)/3600)" hours"}' 
  

Networking

• Check open ports (without `netstat` or ss):

  for port in {1..65535}; do timeout 1 bash -c "</dev/tcp/localhost/$port &>/dev/null" && echo "Port $port is open"; done 
  

• Get IP address (without `ifconfig` or ip):

  cat /proc/net/fib_trie | grep -E "32 host" | awk '{print $2}' 
  

What Undercode Say

When working in restricted container environments, relying on Bash built-ins (echo, printf, read, awk) is crucial. Always check `/proc` for system insights, as it provides process, network, and kernel data. Mastering these alternatives ensures you remain effective even in minimal Linux environments.

Expected Output:

User root (UID 0) is active via /dev/tty1 (PID 2300) 
Port 22 is open 
PID 1: /sbin/init 

References:

Reported By: Activity 7319516984835014657 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram