Use a file capability that enables a specific privileged operation

Needs: The exact capability is effective in the execution context; mount/namespace/bounding-set restrictions permit its use

Capability interpretation and example

# Capability interpretation and example
capsh --print 2>/dev/null
grep '^Cap' /proc/self/status

Only when the exact interpreter has effective cap_setuid

# Only when the exact interpreter has effective cap_setuid
/PATH/TO/python3 -c 'import os; os.setuid(0); os.execl("/bin/sh","sh","-p")'

Verify → Match the granted capability to the observed effect and effective IDs; do not infer unrelated root powers.

If it fails → nosuid, capability bounding sets, namespaces or a missing effective bit can change behavior. Choose another supported primitive. More detail ↓

If → then

A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate
Needs: A working command channel and accurate effective identity, group, mount and process context
Readable configuration, shell history, environment, process arguments or session sockets → Recover credentials from Linux user, service and process trails
Needs: Read access to the artifact; exact account/service context; session/agent access must include a usable live identity
A nonstandard or dangerous privileged executable → Use a SUID or SGID program's exposed privileged primitive
Needs: Effective SUID/SGID on the relevant mount; a program operation preserves and exposes useful privilege

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use a file capability that enables a specific privileged operation

USE WHEN: An interpreter/helper has an effective high-value capability
STARTING ACCESS: A verified Linux foothold with a known effective UID, groups and filesystem context
RESULT: The specific privileged operation or identity transition enabled by that capability

Recognize the clue

Search file capabilities and inspect the exact program plus current namespace/bounding context.

getcap -r / 2>/dev/null
capsh --print 2>/dev/null

SYNTHETIC EXAMPLE OUTPUT

/opt/TOOLS/python3 cap_setuid=ep

Means: The specific interpreter has effective set-UID authority, unlike an ordinary copy of python3 elsewhere.

Confirm: Read getcap for the exact executable, inspect its mount and match the named capability to the program operation. A version or capability name alone does not prove that the program retains a useful effective capability.

After validation: The exact capability-backed operation changes the effective identity as expected: select that method.
Ruled out in this context: Only cap_net_raw exists for the candidate: reject the assumed general UID-changing route.
Still inconclusive: A capability name without effective-context/consumer evidence is insufficient.

Troubleshooting: nosuid, capability bounding sets, namespaces or a missing effective bit can change behavior. Choose another supported primitive.

Additional prerequisite checks

getcap -r / 2>/dev/null
capsh --print 2>/dev/null
grep '^Cap' /proc/self/status

Capability interpretation and example

High-value capability candidates include cap_setuid, cap_setgid, cap_dac_override, cap_dac_read_search, cap_sys_ptrace, cap_sys_admin, cap_setfcap and cap_sys_module. cap_net_raw is usually not a direct root transition.

Only when the exact interpreter has effective cap_setuid:

+ep indicates permitted plus the file effective bit. Bounding sets, namespaces, nosuid mounts and program behavior can still change the result.

Why it works

Capabilities divide root authority into individual powers. cap_setuid and file-read capabilities enable different chains; cap_net_raw is not a general root capability.

Worked example · hypothetical

Observation: a Python interpreter has effective cap_setuid. Test: confirm its exact executable and context, then use the capability-backed identity operation. Illustrative output: UID 0 is obtained. Interpretation: verify host/namespace and re-enumerate.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗