PoC to demonstrate root permission hijacking by exploiting “systemd-run”

This isn't the only bug of course, it's not possible on Linux to read the environment of a root owned process but as systemd creates a service in the system slice, you can query D-BUS and learn sensitive information passed to the process env, such as API keys or other secrets.

{
  "by": "mariuz",
  "descendants": 19,
  "id": 40247399,
  "kids": [
    40247802,
    40247788,
    40248293,
    40248244,
    40254216,
    40258100,
    40258711,
    40247771
  ],
  "score": 31,
  "time": 1714742639,
  "title": "PoC to demonstrate root permission hijacking by exploiting “systemd-run”",
  "type": "story",
  "url": "https://twitter.com/hackerfantastic/status/1785495587514638559"
}

{
  "author": null,
  "date": "2024-05-01T02:24:55.000Z",
  "description": "Lennart Poettering intends to replace “sudo” with systemd’s run0. Here’s a quick PoC to demonstrate root permission hijacking by exploiting the fact “systemd-run” (the basis of uid0/run0, the sudo replacer) creates a user owned pty for communication with the new “root” process.",
  "image": "https://pbs.twimg.com/media/GMdanXOWkAAwG4K?format=webp&name=large",
  "logo": null,
  "publisher": "Twitter",
  "title": "hacker.house (@hackerfantastic) on X",
  "url": "https://x.com/hackerfantastic/status/1785495587514638559"
}

{
  "url": "https://twitter.com/hackerfantastic/status/1785495587514638559",
  "title": "hacker.house (@hackerfantastic) on X",
  "description": "Lennart Poettering intends to replace \"sudo\" with systemd's run0. Here's a quick PoC to demonstrate root permission hijacking by exploiting the fact \"systemd-run\" (the basis of uid0/run0, the sudo…",
  "links": [
    "https://x.com/hackerfantastic/status/1785495587514638559",
    "https://twitter.com/hackerfantastic/status/1785495587514638559"
  ],
  "image": "https://pbs.twimg.com/media/GMdanXOWkAAwG4K?format=webp&name=large",
  "content": "<div><div><p><span><div><div><p><a target=\"_blank\" href=\"https://x.com/hackerfantastic\">hacker.house</a></p></div><div><p><a target=\"_blank\" href=\"https://x.com/hackerfantastic\">@hackerfantastic</a></p></div></div></span><span><a target=\"_blank\" href=\"https://twitter.com/hackerfantastic/status/1785495590400626990\">May 1, 2024</a></span></p></div><p><span>This isn't the only bug of course, it's not possible on Linux to read the environment of a root owned process but as systemd creates a service in the system slice, you can query D-BUS and learn sensitive information passed to the process env, such as API keys or other secrets.</span></p></div>",
  "author": "@hackerfantastic",
  "favicon": "https://twitter.com/favicon.ico",
  "source": "twitter.com",
  "published": "2024-05-01T02:24:55.000Z",
  "ttr": 11,
  "type": "article"
}