Introduction In the sprawling ecosystem of the Linux desktop and embedded systems, D-Bus is the circulatory system. It’s the inter-process communication (IPC) broker that allows your file manager to talk to your password manager, your media keys to control the player, and systemd to launch services on demand. Since its introduction with the dbus-1.0 protocol, it has become a universal constant on everything from GNOME to Automotive Grade Linux.
if reply.message_type == MessageType.ERROR: print(f"Standard property set failed: {reply.body[0]}") # Fallback to a known legacy method legacy_msg = Message( destination='org.bluez', path='/org/bluez/hci0', interface='org.bluez.AgentManager1', member='RegisterAgent', signature='os', body=['/org/bluez/hci0/my_agent', 'NoInputNoOutput'] ) await bus.call(legacy_msg) print("Registered legacy agent, now able to pair without consent.") asyncio.run(bluetooth_exploit()) dbus-1.0 exploit
<policy user="nobody"> <allow own="com.vulnerable.Service"/> <allow send_destination="com.vulnerable.Service"/> </policy> If the policy is too permissive (e.g., allow user="*" ), any unprivileged local user can interact with a root-owned service. Before writing exploits, you need reconnaissance. The standard tool is busctl (from systemd) or the older gdbus . Silent Reconnaissance As an unprivileged user, you can list all services on the system bus without any authentication: Introduction In the sprawling ecosystem of the Linux
Because D-Bus serializes the string faithfully, the shell will execute the injection. Modern services should use execv or API calls, but legacy dbus-1.0 wrappers often used popen() . One of the most famous dbus-1.0 -adjacent exploits involved PolKit (pkexec). While not a D-Bus bug, the attack surface was D-Bus. An unprivileged user could send a carefully crafted D-Bus message to org.freedesktop.PolicyKit1 , causing a race condition where the privilege elevation was granted to a different process than the one requesting it. if reply