D-Bus Misconfiguration Privilege Escalation
D-Bus is the inter-process communication system used by most Linux desktop and server services. System services expose methods over D-Bus that perform privileged operations. If a service's D-Bus policy permits unprivileged callers to invoke methods that execute commands, write files, or manage system state, you can escalate privileges without any exploit — just call the method.
Prerequisites Check
Check if D-Bus is running:
List system bus services — these are the privileged ones worth targeting:
Check D-Bus policy files for permissive rules:
Finding Exploitable Policies
A permissive policy grants unprivileged users access to call methods on a service. Look for policies that allow sending to a destination without requiring a specific user or group:
Dangerous patterns:
<!-- Dangerous: allows any user to call any method -->
<allow send_destination="com.example.Service"/>
<!-- Dangerous: allows any user to call specific method -->
<allow send_destination="com.example.Service" send_interface="com.example.Interface" send_member="RunCommand"/>
Introspecting a Target Service
Once you identify a service worth targeting, introspect its interface to see available methods:
Look for methods with names suggesting command execution: Exec, Run, Execute, Start, Install, Update.
Technique 1 — systemd via D-Bus (Misconfigured Policy)
Some systems allow unprivileged users to start/stop services via D-Bus without Polkit. If org.freedesktop.systemd1 allows your user to manage units:
The standard path for systemd/Polkit escalation is covered at https://hackindex.io/platforms/linux/privilege-escalation/polkit-local-auth-escalation.
Technique 2 — Custom Service Method Injection
Third-party applications frequently expose D-Bus methods with insufficient access controls. Find and call them:
For each interesting object path, introspect the interface:
Call a method that accepts a command argument:
Technique 3 — NetworkManager D-Bus Abuse
NetworkManager exposes D-Bus methods that on some versions allow unprivileged script execution via connection profiles:
If the dispatcher directory is writable:
Trigger a network event (connect/disconnect) to fire the dispatcher.
Using d-feet for Enumeration (GUI)
If you have GUI access, d-feet provides a graphical D-Bus browser:
Browse system bus services, inspect interfaces, and call methods interactively. Useful for understanding a service's attack surface before writing a command-line exploit.
References
-
D-Bus Documentation Architecture,www.freedesktop.org/wiki/Software/dbus (opens in new tab)
policy file format, and security model documentation.
-
busctl(1) Manualman7.org/linux/man-pages/man1/busctl.1.html (opens in new tab)
D-Bus introspection and method calling from the command line.
-
D-Bus Specificationdbus.freedesktop.org/doc/dbus-specification.html (opens in new tab)
Full message format, interface conventions, and policy rules reference.
Was this helpful?
Your feedback helps improve this page.