Hetemit
Privilege Escalation by injecting a reverse shell into a writable systemd service and rebooting via sudo
Last updated
Was this helpful?
Privilege Escalation by injecting a reverse shell into a writable systemd service and rebooting via sudo
Last updated
Was this helpful?
Werkzeug development server exposed on port 50000 allowed Python code execution via POST request.
Reverse shell established by abusing Flask’s endpoint.
Privilege escalation achieved by modifying a systemd service file (pythonapp.service) and rebooting the machine using sudo.
50000/tcp → Werkzeug httpd 1.0.1 (Python 3.6.8)
Identified as vulnerable Flask debug interface
Other high-range ports filtered or unrelated
From here I took Help from this writeup ->
Listener on:
✅ Reverse shell landed as user cmeeks
Clues from linpeas
Service files writable
sudo -l shows cmeeks can reboot the machine as root:
Exploitation Steps
Inject reverse shell in pythonapp.service:
Start listener:
Trigger reboot:
✅ Root shell obtained upon reboot!