Lion Cipher Lab
Escalate to root via a writable systemd service, then fix it
- Penetration Testing / Red Team
- Advanced
- ~50 min
- Free · no account required
Why it matters
systemd is the init system — the first process, PID 1 — on essentially every mainstream Linux distribution, and it is what starts, stops and supervises the background services (daemons) a server runs. Each service is described by a small text file called a UNIT, and a unit's ExecStart line names the program or script that systemd launches, very often as root because services need privilege to do their jobs. That arrangement is completely safe when the thing being launched is owned by root and cannot be modified by ordinary users. It becomes a straight road to root the moment an ordinary user…
What you'll learn
- explaining what systemd is, what a service unit and a timer are, and why a root-run service that executes a writable script is a local privilege-escalation hole
- planting the misconfiguration on your own VM (a root service on a timer whose ExecStart script is world-writable) so the whole exercise stays on a box you control
- enumerating like an attacker from a low-privileged shell: reading the unit with systemctl cat, spotting the writable ExecStart target with ls -l and find, and confirming the service runs as root on a timer
- exploiting it by rewriting the script the root service runs, then collecting a root shell from a setuid copy of bash it drops for you
- applying the fix: making the script root-owned and not world-writable, keeping service scripts out of world-writable directories, and auditing units for the same mistake
- measuring before and after: before the fix you can write the script and become root; after it you get Permission denied and stay unprivileged
- judgment: why a packaged service is never in this state, so a writable-service finding is always a human permissions mistake and a fixable one
Steps in this lab
- The one idea: whatever a root service runs, you can become
- Plant the misconfiguration (as admin, on your own VM)
- Enumerate like an attacker (as the low-privileged user)
- Exploit it: rewrite the script, collect a root shell (the 'before')
- Fix it (as admin): correct ownership and permissions
- Re-test and confirm the fix (the 'after')
- What you just did — and how to carry it