Question

During post-exploitation on a compromised Linux web server, you have a low-privileged shell as the user 'www-data'. You run 'getcap -r / 2>/dev/null' and notice that '/usr/bin/python3.9' has 'cap_setuid+ep' set. What is the most effective next step to escalate to root?

Accepted Answer

Execute python3.9 with a one-liner that calls os.setuid(0) followed by spawning a shell, e.g. python3.9 -c 'import os; os.setuid(0); os.system("/bin/bash")'

Answer

Add the www-data user to the sudoers file by editing /etc/sudoers directly with a text editor

Answer

Run 'python3.9 -c "import pty; pty.spawn(\'/bin/bash\')"' to upgrade to a fully interactive TTY session

Answer

Replace /usr/bin/python3.9 with a malicious binary that runs a reverse shell to your attacker machine