Scrutiny_Privilege_Escalation

sudo systemctl

---

It has been identified that the braind user has sudo privileges to execute the /usr/bin/systemctl status teamcity-server.service command as the root account without getting prompted for password.

By default, systemctl uses less as a pager

From within the less pager, I can spawn a shell; !/bin/bash

System level compromise