Introduction

Linux capabilities provide a way for splitting permissions into small units. A binary with particular capabilities can perform certain tasks with elevated privileges. If capabilities are not properly set, or if they are excessive, this may lead to privilege escalation.

Binaries with capabilities may be found using the following command:

getcap / -r 2>/dev/null
Copy

A list of all possible capabilities can be found here.

In the above example, we can see that the python interpreter can arbitrarily set the user ID of the process. This means that we can change our user ID to 0 when running python, thus escalating our privileges: