Skip to main content
Capabilities grant processes or binaries certain privileges that would otherwise be restricted.

​
Capability Sets

CapabilityDescription
cap_setuidAllows a process to set its effective user ID, which can be used to gain the privileges of another user, including the root user.
cap_setgidAllows toset its effective group ID , which can be used to gain the privileges of another group, including the root group.
cap_sys_adminThis capability provides a broad range of administrative privileges, including the ability to perform many actions reserved for the root user, such as modifying system settings and mounting and unmounting file systems.
cap_dac_overrideAllows bypassing of file read, write, and execute permission checks.
=epThe binary has **ALL **capabilities permitted and effective from the start.
# getcap /usr/bin/ping
/usr/bin/ping cap_net_raw=ep

​
Enumerating Capabilities

Option 1:
  getcap -r / 2>/dev/null

Option 2 (does not include snap results):
  find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -type f -exec getcap {} \;
Depending on the capability and binary, it might have an entry in GTFOBins. If there is no entry, it might not be a common binary but still has potential to elevate privileges.

​
References

https://unix.stackexchange.com/questions/515881/what-does-the-ep-capability-mean