Abuse Elevation Control Mechanism
Abusing mechanisms meant to grant privileges on demand, such as Linux capabilities.
How it shows up on Hack The Box
Look for binaries with capabilities (getcap -r /): cap_setuid on python or perl is instant root, and cap_dac_read_search lets you read any file.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Guides
- Linux privilege escalation: sudo, SUID and capabilities 4 min read The three checks that give the most roots on Hack The Box: what sudo lets you run, which binaries are SUID and which capabilities they carry, with the usual abuse for each case.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Linux privilege escalation › Checks
Capabilities
getcap -r / 2>/dev/nullcap_setuid, cap_dac_read_search or cap_sys_admin on an interpreter usually mean instant root.
No command matches.