{"id":2680,"date":"2022-03-11T23:34:42","date_gmt":"2022-03-11T23:34:42","guid":{"rendered":"https:\/\/hardsoftsecurity.es\/?p=2680"},"modified":"2022-03-11T23:41:59","modified_gmt":"2022-03-11T23:41:59","slug":"privilege-escalation-linux-capability","status":"publish","type":"post","link":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/","title":{"rendered":"Privilege Escalation – Linux Capability"},"content":{"rendered":"\n

Hola a tod@s, hoy os traigo un nuevo caso pr\u00e1ctico el cual se requiere la demostraci\u00f3n de un escalado de privilegios en Linux, en mi caso he decidido seleccionar una t\u00e9cnica sugerida, la t\u00e9cnica a utilizar es la que aprovecha los \u201cLinux Capability\u201d.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n\n\n\n\n

\u00bfQu\u00e9 es Linux Capability?<\/h2>\n\n\n\n

\u201cLinux Capability\u201d forma un rol importante en la seguridad de los usuarios, espec\u00edficamente en los casos en los que un usuario tiene la necesidad de tener privilegios elevados para realizar cualquier acci\u00f3n. Normalmente este tipo de elevaciones de privilegios en los usuarios se suele otorgar dando permisos con sudo o con permisos setuid, pero en este caso se puede realizar la misma acci\u00f3n de manera m\u00e1s segura con \u201cLinux Capability\u201d.<\/p>\n\n\n\n

Por as\u00ed decir, las capacidades de Linux son atributos especiales en el n\u00facleo Linux que otorgan privilegios espec\u00edficos a los procesos y ejecutables binarios que normalmente est\u00e1n reservados para procesos cuyo ID de usuario es 0, es decir el usuario ra\u00edz del sistema (root).<\/p>\n\n\n\n

A modo de ejemplo, se expone el siguiente caso, supongamos que tenemos un usuario y este est\u00e1 ejecutando un proceso como usuario normal, esto quiere decir que nuestro proceso no es privilegiado. Solo podr\u00edamos acceder a los datos que son propiedad de dicho usuario o a los datos que han sido marcados para ser tratados por todos. Supongamos que dicho proceso tiene la necesidad de abrir un socket de red, el cual se necesitan permisos del usuario ra\u00edz, dicho proceso al estar ejecutado con un usuario normal, no tendr\u00eda la capacidad de ejecutar el socket. Ahora es cuando entran las capacidades de Linux, gracias a esta caracter\u00edstica podemos otorgar permisos especiales a ciertos procesos o binarios para que puedan ejecutar tareas con los permisos que les sean necesarios.<\/p>\n\n\n\n

En resumidas cuentas, el objetivo de las capacidades de Linux, es dividir el poder del usuario root en privilegios espec\u00edficos, de modo que, si un proceso o binario fuese explotado, los permisos de este se ver\u00edan limitados a los necesarios.<\/p>\n\n\n\n

Preparando entorno para escalado de privilegios.<\/h2>\n\n\n\n

Para preparar una m\u00e1quina se tiene que dar una casu\u00edstica la cual un binario tenga otorgados ciertos permisos de \u201cLinux Capability\u201d, para esto, lo primero que necesitamos saber, es como funciona y como podemos realizar una gesti\u00f3n de \u201cLinux Capability\u201d, para empezar, vamos a ver como a\u00f1adir permisos, pero antes tenemos que tener instalado en el sistema los siguientes paquetes:<\/p>\n\n\n\n

libcap2-bin: Paquete que contiene las principales herramientas de gesti\u00f3n (getcap y setcap).<\/p><\/blockquote>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Tras realizar la instalaci\u00f3n del paquete, en mi caso ya se encontraba instalado en el sistema operativo, podemos realizar una comprobaci\u00f3n de todos los archivos que contienen permisos de las capacidades de Linux. Esto lo podemos realizar con el siguiente comando:<\/p>\n\n\n\n

getcap -r \/ 2>\/dev\/null<\/p><\/blockquote>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Es habitual encontrarse al comando \u201cping\u201d como \u00fanico binario en el sistema con permisos de capacidades de Linux.<\/p>\n\n\n\n

En caso de tener la necesidad de querer consultar los permisos que tiene un binario en particular, se har\u00eda de la siguiente manera:<\/p>\n\n\n\n

getcap \/ruta\/del\/binario<\/p><\/blockquote>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Para nuestro caso, no vamos a utilizar el binario de ping para la escalada de privilegios, si no que vamos a crear o copiar nuestro propio binario, o simplemente copia uno existente simulando la acci\u00f3n de un administrador del sistema que necesita otorgarle la ejecuci\u00f3n con permisos del usuario ra\u00edz a un usuario normal, esto lo haremos copiando el binario de Python para que el usuario normal \u201csoporte\u201d lo pueda ejecutar con permisos de root, lo que provocar\u00e1 que el usuario normal, tenga la posibilidad de realizar un escalado de privilegios como veremos a lo largo del documento.<\/p>\n\n\n\n

Primero procedemos a la copia del binario de Python:<\/p>\n\n\n\n

cp \/usr\/bin\/python3 \/home\/soporte<\/p><\/blockquote>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Una vez hemos copiado el binario para el usuario normal, procedemos a darle permisos completos al binario de Python para que el usuario normal \u201csoporte\u201d pueda ejecutarlo con todos los permisos de root:<\/p>\n\n\n\n

setcap cap_setuid+ep \/home\/soporte\/python3<\/p><\/blockquote>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Si comprobamos los permisos que tiene el binario, nos tendr\u00e1 que mostrar los permisos que acabamos de asignar:<\/p>\n\n\n\n

\/sbin\/getcap \/home\/soporte\/python3<\/p><\/blockquote>\n\n\n\n

\"\"<\/figure>\n\n\n\n

<\/p>\n\n\n\n

Listo, ya tenemos un binario con permisos de ejecuci\u00f3n root, en este caso Python.<\/p>\n\n\n\n

Escalado de privilegios con Linux Capability.<\/h2>\n\n\n\n

Si analizamos un posible escenario, es completamente posible que un administrador por no darle permisos sudo o SUID al usuario en espec\u00edfico, haya preferido permitir la ejecuci\u00f3n del binario a trav\u00e9s de las capacidades de Linux, en este caso ese binario ha sido Python y el usuario \u201csoporte\u201d.<\/p>\n\n\n\n

Supongamos tambi\u00e9n que el atacante ya ha conseguido acceso a la m\u00e1quina y tiene sesi\u00f3n con el usuario \u201csoporte\u201d y ha localizado el fichero con los permisos de ejecuci\u00f3n del usuario ra\u00edz, en este caso \u201c\/home\/soporte\/python3\u201d:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Tras localizar el binario que vamos atacar, comprobamos el usuario y grupo del binario de Python:<\/p>\n\n\n\n

ls -al \/home\/soporte\/python3<\/p><\/blockquote>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Como se puede observar en la captura el binario es del usuario y grupo \u201croot\u201d, es decir que es propiedad del usuario ra\u00edz, pero para el resto de usuario se le permite la ejecuci\u00f3n, pero al tener los permisos de las capacidades de Linux, esta ejecuci\u00f3n se realizar\u00e1 como root, en este caso, vamos a ejecutar un bash con Python y al ejecutar este binario (python) con privilegios root, nos devolver\u00e1 una sesi\u00f3n la cual ser\u00e1 de \u201croot\u201d:<\/p>\n\n\n\n

.\/python3 -C \u2018import os; os.setuid(0); os.system(“\/bin\/bash”)\u2019<\/p><\/blockquote>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Como se puede observar en la captura, la sesi\u00f3n que nos ha devuelto es de root, pero al ser escalado desde soporte el GUID sigue siendo de \u201csoporte\u201d, pero el UID es \u201croot\u201d. Esto ser\u00eda un ejemplo de una escalada de privilegios de las capacidades de Linux.<\/p>\n\n\n\n

Considero que esto ser\u00e1 una t\u00e9cnica m\u00e1s valorada en el futuro, ya que en teor\u00eda es una manera m\u00e1s segura de gestionar\/dividir los permisos del usuario ra\u00edz sobre los binarios. Esto har\u00e1 que las capacidades de Linux se implementen en m\u00e1s sistemas para su seguridad y as\u00ed de esta manera se encontrar los auditores de seguridad malas configuraciones que podr\u00e1n aprovechar para el escalado de privilegios.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Fuentes:<\/p>\n\n\n\n

https:\/\/book.hacktricks.xyz\/linux-unix\/privilege-escalation<\/a><\/p>\n\n\n\n

http:\/\/manpages.ubuntu.com\/manpages\/bionic\/es\/man7\/capabilities.7.html<\/a><\/p>\n\n\n\n

https:\/\/www.vultr.com\/docs\/working-with-linux-capabilities\/<\/a><\/p>\n\n\n\n

https:\/\/unix.stackexchange.com\/questions\/515881\/what-does-the-ep-capability-mean<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Hola a tod@s, hoy os traigo un nuevo caso pr\u00e1ctico el cual se requiere la demostraci\u00f3n de un escalado de privilegios en Linux, en mi caso he decidido seleccionar una …<\/p>\n","protected":false},"author":1,"featured_media":2682,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":false,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[7],"tags":[306,309,34,305,304,303,302,308,307],"class_list":["post-2680","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-seguridad-informatica","tag-capability","tag-escalation","tag-linux","tag-linux-capability","tag-linuxlinux-cpability","tag-privesc","tag-privesc-linux","tag-privilege","tag-privilege-escalation"],"yoast_head":"\nPrivilege Escalation - Linux Capability - Hardsoft Security<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Privilege Escalation - Linux Capability - Hardsoft Security\" \/>\n<meta property=\"og:description\" content=\"Hola a tod@s, hoy os traigo un nuevo caso pr\u00e1ctico el cual se requiere la demostraci\u00f3n de un escalado de privilegios en Linux, en mi caso he decidido seleccionar una ...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/\" \/>\n<meta property=\"og:site_name\" content=\"Hardsoft Security\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/HardSoftDavid\" \/>\n<meta property=\"article:published_time\" content=\"2022-03-11T23:34:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-03-11T23:41:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/03\/linux_encryption.png?fit=680%2C400&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"680\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"david\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:site\" content=\"@DavidDeMaya\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"david\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/\"},\"author\":{\"name\":\"david\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"headline\":\"Privilege Escalation – Linux Capability\",\"datePublished\":\"2022-03-11T23:34:42+00:00\",\"dateModified\":\"2022-03-11T23:41:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/\"},\"wordCount\":1090,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2022\\\/03\\\/linux_encryption.png?fit=680%2C400&ssl=1\",\"keywords\":[\"Capability\",\"Escalation\",\"Linux\",\"Linux Capability\",\"LinuxLinux Cpability\",\"PrivEsc\",\"PrivEsc Linux\",\"Privilege\",\"Privilege Escalation\"],\"articleSection\":[\"Seguridad inform\u00e1tica\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/\",\"name\":\"Privilege Escalation - Linux Capability - Hardsoft Security\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2022\\\/03\\\/linux_encryption.png?fit=680%2C400&ssl=1\",\"datePublished\":\"2022-03-11T23:34:42+00:00\",\"dateModified\":\"2022-03-11T23:41:59+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2022\\\/03\\\/linux_encryption.png?fit=680%2C400&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/hardsoftsecurity.es\\\/wp-content\\\/uploads\\\/2022\\\/03\\\/linux_encryption.png?fit=680%2C400&ssl=1\",\"width\":680,\"height\":400},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/index.php\\\/2022\\\/03\\\/11\\\/privilege-escalation-linux-capability\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Privilege Escalation – Linux Capability\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#website\",\"url\":\"https:\\\/\\\/hardsoftsecurity.es\\\/\",\"name\":\"Hardsoft Security\",\"description\":\"Chasing (In)Security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hardsoftsecurity.es\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hardsoftsecurity.es\\\/#\\\/schema\\\/person\\\/dfe289b1e4ae2daf72695e85a8b3dd7a\",\"name\":\"david\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g\",\"caption\":\"david\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Privilege Escalation - Linux Capability - Hardsoft Security","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/","og_locale":"es_ES","og_type":"article","og_title":"Privilege Escalation - Linux Capability - Hardsoft Security","og_description":"Hola a tod@s, hoy os traigo un nuevo caso pr\u00e1ctico el cual se requiere la demostraci\u00f3n de un escalado de privilegios en Linux, en mi caso he decidido seleccionar una ...","og_url":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/","og_site_name":"Hardsoft Security","article_publisher":"https:\/\/www.facebook.com\/HardSoftDavid","article_published_time":"2022-03-11T23:34:42+00:00","article_modified_time":"2022-03-11T23:41:59+00:00","og_image":[{"width":680,"height":400,"url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/03\/linux_encryption.png?fit=680%2C400&ssl=1","type":"image\/png"}],"author":"david","twitter_card":"summary_large_image","twitter_creator":"@DavidDeMaya","twitter_site":"@DavidDeMaya","twitter_misc":{"Escrito por":"david","Tiempo de lectura":"5 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/#article","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/"},"author":{"name":"david","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"headline":"Privilege Escalation – Linux Capability","datePublished":"2022-03-11T23:34:42+00:00","dateModified":"2022-03-11T23:41:59+00:00","mainEntityOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/"},"wordCount":1090,"commentCount":0,"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/03\/linux_encryption.png?fit=680%2C400&ssl=1","keywords":["Capability","Escalation","Linux","Linux Capability","LinuxLinux Cpability","PrivEsc","PrivEsc Linux","Privilege","Privilege Escalation"],"articleSection":["Seguridad inform\u00e1tica"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/","url":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/","name":"Privilege Escalation - Linux Capability - Hardsoft Security","isPartOf":{"@id":"https:\/\/hardsoftsecurity.es\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/#primaryimage"},"image":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/03\/linux_encryption.png?fit=680%2C400&ssl=1","datePublished":"2022-03-11T23:34:42+00:00","dateModified":"2022-03-11T23:41:59+00:00","author":{"@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a"},"breadcrumb":{"@id":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/#primaryimage","url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/03\/linux_encryption.png?fit=680%2C400&ssl=1","contentUrl":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/03\/linux_encryption.png?fit=680%2C400&ssl=1","width":680,"height":400},{"@type":"BreadcrumbList","@id":"https:\/\/hardsoftsecurity.es\/index.php\/2022\/03\/11\/privilege-escalation-linux-capability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/hardsoftsecurity.es\/"},{"@type":"ListItem","position":2,"name":"Privilege Escalation – Linux Capability"}]},{"@type":"WebSite","@id":"https:\/\/hardsoftsecurity.es\/#website","url":"https:\/\/hardsoftsecurity.es\/","name":"Hardsoft Security","description":"Chasing (In)Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hardsoftsecurity.es\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Person","@id":"https:\/\/hardsoftsecurity.es\/#\/schema\/person\/dfe289b1e4ae2daf72695e85a8b3dd7a","name":"david","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/868972cb4e72674a12503e080ee081285c7df2fde82787c96a74bca20781cad7?s=96&d=mm&r=g","caption":"david"}}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p7xGFx-He","jetpack-related-posts":[{"id":1465,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2018\/02\/13\/como-hacer-mysql-mas-seguro\/","url_meta":{"origin":2680,"position":0},"title":"\u00bfC\u00f3mo hacer MySQL m\u00e1s seguro?","author":"david","date":"febrero 13, 2018","format":false,"excerpt":"Hola a tod@s hoy os traigo una peque\u00f1a entrada donde vamos a ver como hacer nuestro servidor de MySQL m\u00e1s seguro, esto nos permitir\u00e1 tener un control completo de nuestro servidor, ya que en estos tiempos existen much\u00edsimos bots continuamente escaneando la red para atacar nuestros servicios. Voy a dar\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/06\/mysql-logo-1329320869.jpg?fit=800%2C413&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/06\/mysql-logo-1329320869.jpg?fit=800%2C413&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/06\/mysql-logo-1329320869.jpg?fit=800%2C413&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/06\/mysql-logo-1329320869.jpg?fit=800%2C413&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":3894,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2026\/01\/19\/python-cache-poisoning-privesc-linux\/","url_meta":{"origin":2680,"position":1},"title":"Python Cache Poisoning – PrivEsc – Linux","author":"david","date":"enero 19, 2026","format":false,"excerpt":"Introduction Python cache poisoning is a lesser-known but powerful technique that can lead to local privilege escalation (priv\u2011esc) in misconfigured environments. It abuses how Python compiles and caches bytecode (.pyc files) to speed up execution. When an attacker can influence which bytecode is loaded\u2014or where it is loaded from\u2014they may\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/01\/hacking.png?fit=1200%2C800&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/01\/hacking.png?fit=1200%2C800&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/01\/hacking.png?fit=1200%2C800&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/01\/hacking.png?fit=1200%2C800&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2026\/01\/hacking.png?fit=1200%2C800&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3583,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2023\/11\/27\/preparar-ecpptv2\/","url_meta":{"origin":2680,"position":2},"title":"\u00bfC\u00f3mo PREPARAR la certificaci\u00f3n eCPPTV2?","author":"david","date":"noviembre 27, 2023","format":false,"excerpt":"Hoy, me complace profundizar en \"\u00bfC\u00f3mo preparar la certificaci\u00f3n eCPPTv2 (Certified Professional Penetration Tester)?\", una credencial que he obtenido recientemente y que ha marcado un punto de inflexi\u00f3n significativo en mi carrera en seguridad inform\u00e1tica. Esta certificaci\u00f3n no solo ha ampliado mi conocimiento t\u00e9cnico sino que tambi\u00e9n ha reforzado mi\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image-13.png?fit=1200%2C569&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image-13.png?fit=1200%2C569&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image-13.png?fit=1200%2C569&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image-13.png?fit=1200%2C569&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/11\/image-13.png?fit=1200%2C569&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":329,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/01\/27\/instalacion-y-gestion-de-recursos-compartidos-con-samba-gnulinux\/","url_meta":{"origin":2680,"position":3},"title":"Instalaci\u00f3n y gesti\u00f3n de recursos compartidos con samba GNU\/Linux","author":"david","date":"enero 27, 2015","format":false,"excerpt":"INSTALACI\u00d3N DE SAMBA Comando: - sudo dpkg -l * Este comando realiza una lista de los paquetes instalados en el sistema. - sudo apt-get install samba * Este comando instala todos los paquetes samba. REINICIO DEL SERVICIO SAMBA Comando: - sudo service smbd start\/stop o restart * Este comando inicia,\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"Logo_Samba","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/01\/logo_samba.png?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/01\/logo_samba.png?resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/01\/logo_samba.png?resize=525%2C300 1.5x"},"classes":[]},{"id":1332,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2017\/07\/31\/hacking-basico-13-phishing-a-traves-de-internet-kali-linux\/","url_meta":{"origin":2680,"position":4},"title":"Phishing a trav\u00e9s de internet. Kali Linux – Hacking B\u00e1sico 13.","author":"david","date":"julio 31, 2017","format":false,"excerpt":"Hola buenas, hoy os traigo una gu\u00eda para saber como realizar un phishing a trav\u00e9s de internet, en este caso utilizo kali linux con la herramienta setoolkit. Aqu\u00ed os dejo el v\u00eddeo: Hacking B\u00e1sico 13. Phishing a trav\u00e9s de internet. Kali Linux. Servicio de copias de seguridad, visita backup.hardsoftsecurity.es Saludos,\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/06\/Phishing-Scam_iStock_000017435282Medium.jpg?fit=1197%2C705&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/06\/Phishing-Scam_iStock_000017435282Medium.jpg?fit=1197%2C705&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/06\/Phishing-Scam_iStock_000017435282Medium.jpg?fit=1197%2C705&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/06\/Phishing-Scam_iStock_000017435282Medium.jpg?fit=1197%2C705&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2016\/06\/Phishing-Scam_iStock_000017435282Medium.jpg?fit=1197%2C705&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":283,"url":"https:\/\/hardsoftsecurity.es\/index.php\/2015\/01\/12\/preocupado-por-tu-seguridad-virtual-encripta-tus-datos-gnulinux\/","url_meta":{"origin":2680,"position":5},"title":"\u00bfPreocupado por tu seguridad virtual? Encripta tus datos, GNU\/Linux","author":"david","date":"enero 12, 2015","format":false,"excerpt":"Encriptaci\u00f3n de datos en S.O GNU\/Linux Como es normal, hoy en d\u00eda la inform\u00e1tica ha avanzado tanto, que casi todas las empresas est\u00e1n informatizadas, esto tambi\u00e9n conlleva un riesgo y es que hay que proteger los datos que estas empresas albergan, con esto quiero decir que en el sector de\u2026","rel":"","context":"En \u00abGu\u00edas\u00bb","block_context":{"text":"Gu\u00edas","link":"https:\/\/hardsoftsecurity.es\/index.php\/category\/guias\/"},"img":{"alt_text":"The Dalles Server Room","src":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/01\/the-dalles-server-room.jpg?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/01\/the-dalles-server-room.jpg?resize=350%2C200 1x, https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2015\/01\/the-dalles-server-room.jpg?resize=525%2C300 1.5x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2022\/03\/linux_encryption.png?fit=680%2C400&ssl=1","_links":{"self":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/2680","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/comments?post=2680"}],"version-history":[{"count":2,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/2680\/revisions"}],"predecessor-version":[{"id":2694,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/posts\/2680\/revisions\/2694"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media\/2682"}],"wp:attachment":[{"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/media?parent=2680"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/categories?post=2680"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hardsoftsecurity.es\/index.php\/wp-json\/wp\/v2\/tags?post=2680"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}