Lion Cipher Lab
Escalate to root on your own Linux VM by abusing file capabilities
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Most people learn Linux privilege escalation as SUID binaries and sudo rules and stop there — which means the day they meet a box where the privesc path is a single capability on a copied binary, they walk right past it, because there is no `s` in the permissions and a SUID sweep comes up empty. Capabilities were designed to be SAFER than SUID: instead of 'run this whole program as root,' you grant one narrow power, like 'bind to a low port' or 'send raw packets,' and drop the rest. But a few of those narrow powers — the ability to set your own user ID, to bypass file-read checks, to load…
What you'll learn
- what Linux capabilities are: root's power split into ~40 independent privileges a binary can hold one of, instead of the all-or-nothing SUID bit
- reading a capability string like `cap_setuid=ep` — the effective (e) and permitted (p) flags — and why `+ep` on a shell-capable binary is game over
- finding capability-bearing binaries with `getcap -r / 2>/dev/null`, the vector an `ls -l` and a SUID-only sweep both miss
- exploiting cap_setuid+ep on an interpreter (python3) with os.setuid(0) to drop to a real root shell, straight from GTFOBins
- exploiting cap_dac_read_search+ep to bypass file-read permission checks and read /etc/shadow without being root
- telling a legitimate capability (cap_net_raw on ping, cap_net_bind_service on a web server) apart from a dangerous one (cap_setuid, cap_dac_*, cap_sys_admin, cap_sys_ptrace)
- the defense: removing capabilities with `setcap -r`, auditing with `getcap -r /`, and preferring no capability at all over a needless one
Steps in this lab
- The one rule: your own throwaway VM, and nothing else
- What a capability is — root, sliced into pieces
- Read a capability string: the =ep that matters
- Plant vector #1: cap_setuid on a copy of python3 (deliberate, on your VM)
- Find it the way an attacker does — getcap -r /
- Exploit vector #1: cap_setuid to a root shell
- Plant and exploit vector #2: cap_dac_read_search reads /etc/shadow
- Fix it and revert — leave the box clean
- When to reach for this, and how a pro reads it