hunting-setuid-and-capability-escalationlisted

# Hunting setuid and capability escalation: elevated identity plus a primitive A program that runs as a more privileged identity is only safe if it does exactly one narrow thing and exposes no way to turn that privilege into an arbitrary action. The bug is the pairing: an elevated identity (the setuid or setgid bit, or a file capability) next to a reachable primitive (spawn a shell or command, read or write a file, load a library) that an unprivileged user can steer. You find it by enumerating everything that carries elevated identity on the host, and for each asking what an unprivileged caller can make it do as that identity. ## When to use - You are auditing a host, container image, or package for local privilege escalation. - Binaries carry the setuid or setgid bit, or files are granted per-file capabilities. - Some of those programs are custom, bundled by a vendor, or left over from install. ## Scope check Audit local privilege escalation only on hosts or images you own or are authorized to test, with an unprivileged account you may escalate from. If you can't name the authorization, stop. ## The loop 1. **Enumerate every carrier of elevated identity.** Inventory all setuid and setgid binaries and all files granted a capability, across the whole filesystem including mounted images and package payloads. Note the owning identity each escalates to and the specific capability granted (changing user id, overriding file-permission checks, raw disk or memory a