AI
Process Arguments as a Credentials Vector
The ps auxw command leaks process arguments to any unprivileged user. Linux inherited this behavior from its university roots, where multi-user transparency was a feature. Changing it now would break debugging and monitoring tools, so hosting providers, dev servers, education labs, and VPS infrastructure all run with it enabled by default. An attacker with a basic SSH or web shell account can loop this command every 100 milliseconds and harvest credentials as they briefly appear.
What ps Reveals at Hosting Providers
On one hosting provider, a user installing WordPress had their username and password exposed in ps output. A second provider ran account provisioning as root, passing Linux passwords as command-line arguments. A third ran database restores as root with the MySQL root password in plain sight. Cernica found this pattern across multiple providers. Each automated their setup differently but all passed secrets through process arguments where any tenant could read them.
Breaking CageFS, Chroot, and LiteSpeed
Most hosting panels deploy CageFS or chroot. Cernica bypassed CageFS in a major panel by finding a binary that ran outside the jail. The chroot escape exploited an undocumented command in File Browser, a Go-based file management UI used across panels. LiteSpeed, a caching layer deployed by providers with thousands of users, exposed /proc/self/fd/2, which returned the stderr log shared across all users. That log held full HTTP requests: passwords, session cookies, and OAuth tokens. LiteSpeed patched it within four days.
Temporary File Leaks and Database Backup Exposure
When a hosting panel creates a database backup, it stages a SQL file in /tmp under a world-readable path before moving it. Any tenant watching that directory can grab the file before deletion. One hardened target blocked ps entirely but still placed WordPress install scripts in /tmp with credentials inside. In the demo, Cernica triggered a database restore on a live panel, ran ps auxww in a 100-millisecond loop from a second account, and captured the MySQL root password in the output.
Notable Quotes
as you can see. So it’s easily to wait Cernica Ionut Cosmin · ▶ 5:16
So here is the root password of my SQL Cernica Ionut Cosmin · ▶ 16:59
So you can easily take this kind of data Cernica Ionut Cosmin · ▶ 18:42
Key Takeaways
- Running
ps auxwin a loop exposes passwords, database credentials, and usernames across all tenant accounts. - CageFS and chroot jails at major hosting panels are bypassable through binaries running outside the jail.
- World-readable
/tmpdirectories let any tenant steal database backups and install scripts within milliseconds.
About the Speaker(s)
Ionut Cernica started in security through Facebook’s bug bounty program, then responsibly disclosed vulnerabilities to Google, Microsoft, Yahoo, AT&T, eBay, and VMware. He brings nine years of web application and penetration testing experience alongside more than 100 CTF competitions worldwide, including finals appearances at Codegate, Trend Micro, and DEF CON with the PwnThyBytes team. He won the mini CTF at the first AppSec Village at DEF CON. He works as an Application Security Engineer at UiPath, focused on product security and AI security research.