Systemctl privilege escalation

Thu, 28 Apr 2022 00:00:00 +0000

Systemctl (suid enabled) privilege escalation Link to heading

Link to heading

Sceanrio: We have initial shell and during the checks we have found a systemctl file is enabled with SUID bit. refer below:

find / -perm -u=s -type f 2>/dev/null
/bin/fusermount
/bin/mount
/bin/ping
/bin/systemctl
/bin/umount
/bin/su
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/chsh
/usr/bin/sudo
/usr/bin/chfn
/usr/lib/eject/dmcrypt-get-device

As per checking GTFO site, its says as below

Suid on rchitect

Systemctl privilege escalation

Systemctl (suid enabled) privilege escalation Link to heading

Link to heading