A library loaded into every program
A host’s ps and ls look normal, but /etc/ld.so.preload names a library that every dynamically linked program loads first. Read it, read its strings, and see what it hides.
Briefing
app-12 is sending traffic nobody can match to a process. ps, ls, and ss all look clean.
Every path in /etc/ld.so.preload is loaded into every dynamically linked program before its own libraries. A library there can replace readdir() and fopen() and hide files, processes, and sockets from every tool that uses them.
app-12 · Persistence hunting
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.