How to Retrieve Running Process Credentials in an IaaS Instance?
Short answer
B file=../../../proc/self/environ
Question
Key Takeaways
The question tests knowledge of Linux /proc filesystem enumeration through Local File Inclusion (LFI), pitting it against cloud metadata endpoints. The common trap is confusing instance metadata (169.254.169.254) with process-level environment variables.
The correct payload for retrieving running process credentials on an IaaS compute instance is a directory traversal to /proc/self/environ. This environment file exposes variables that often contain credentials; community consensus overwhelmingly supports answer B.
Common mistake: Answer D (file=http://169.254.169.254/latest/meta-data/) is the most common alternative because it retrieves cloud instance metadata and can include IAM role credentials. However, those are instance-level credentials, not the credentials of the current running process, which are found in /proc/self/environ.
Expert Analysis
Why the Answer Is Correct
B, file=../../../proc/self/environ, is a classic LFI payload that exploits directory traversal to read /proc/self/environ on a Linux system. This file contains environment variables of the current process (e.g., the web server), often including database passwords, API keys, or other secrets. As comment [1] explains, /proc gives access to process information, /self refers to the process currently reading the file, and /environ exposes the process environment variables — correctly called the "keys to the castle."
Why the Other Options Are Wrong
A (document.cookie) attempts to read a JavaScript cookie and send it externally, but that is unrelated to process credentials. C is an SQL injection payload, not an LFI/file-read attempt. D accesses the AWS EC2 metadata service at 169.254.169.254, which can provide IAM role temporary credentials, but those are instance-level or role-based credentials, not the credentials of the web server process itself. The question specifically asks for "running process credentials," making B the only choice that directly enumerates the process environment.
Community Comment Notes
Comments [1], [3], [4], and [5] all correctly identify B and explain /proc/self/environ as accessing process environment variables. Comment [2] argues for D, citing the metadata service, but it misinterprets the question's wording: while metadata can contain IAM role credentials, those are not the running process's credentials. The distinction is critical for the exam: understand what each payload targets before selecting the answer.
Official Reference
- https://man7.org/linux/man-pages/man5/proc_pid_environ.5.html
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html
These links open the official vendor documentation in a new tab.
Exam Strategy
When a question asks for "running process credentials" on a Linux host, immediately think of /proc/self/environ as the direct source. Avoid picking cloud metadata endpoints (169.254.169.254) unless the question refers to instance IAM roles or instance metadata — these are two different types of credential exposure on the exam.
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
Tytuss 👍 2The answer is actually D. Look at question 292 about the curl http://169.254.169.254/latest as it reads from EC2 metadata and can retrieve IAM roles and credentials. The correct answer is D. file=http://169.254.169.254/latest/meta-data/. This is a well-known method for retrieving metadata including credentials from an IaaS compute instance, specifically in AWS EC2 instances. The URL http://169.254.169.254/latest/meta-data/ is a link-local address where AWS EC2 instances store metadata about the instance, including security credentials.
-
Myfeedins479 👍 2 Answered BFound on a web hacking blog /proc = processs /self = process currently reading the file system /environ = keys to the castle pair these elements with a local file inclusion and you will have the credentials you are looking for.
-
opem 👍 2 Answered BB. file=../../../proc/self/environ
-
Etc_Shadow28000 👍 1 Answered BB. file=../../../proc/self/environ: This payload attempts to traverse directories and access the /proc/self/environ file, which contains environment variables of the current process. These variables can include sensitive information such as credentials. Explanation: A. file=http://192.168.1.78?+document.cookie: This payload attempts to send the contents of the document’s cookies to an external server. It is generally used for stealing session cookies via cross-site scripting (XSS) and does not target local file access. C. file=’%20or%2054365=54365;––: This payload appears to be attempting an SQL injection attack. It is unrelated to accessing local files for process credentials. D. file=http://169.254.169.254/latest/meta-data/: This payload targets the metadata service of a cloud instance (such as AWS). While it can retrieve metadata and credentials, it is specific to cloud environments and does not directly access local process credentials.
-
041ba31 👍 1 Answered BThis payload is designed to exploit directory traversal vulnerabilities in web applications. By accessing /proc/self/environ, the attacker aims to read the environment variables of the process running the web server, which may contain sensitive information such as credentials.
Show 1 more comment
-
Big_Dre 👍 1 Answered Dis the correct answer
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.