Hetemit_Privilege_Escalation

Service Exec via sudo reboot

---

As previously identified, the cmeeks user is able to modify the pythonapp.service service due to the file’s group ownership. Additionally, the service is enabled to start on bootup

Given that the cmeeks user has write access to the pythonapp.service file (due to group ownership and permissions) and has the sudo privileges to reboot the system, I can modify the service to run as root and trigger a reboot to execute it in the root security context

Exploitation

---

Writing Kali’s public SSH key into the /root/.ssh/authorized_keys file

Rebooting with the sudo privileges

System Level Compromise systemd successfully executed the service file and it wrote the Kali’s public SSH key into the /root/.ssh/authorized_keys file