capabilities abuse (python)

python3 -c 'import os; os.setuid(0); os.system("/bin/sh")'

Exploits a binary with the cap_setuid capability (python, perl, ruby) to elevate the process to root: setuid(0) + shell. A single line turns a misassigned capability into full root.

When getcap shows you python3 (or perl, ruby) with cap_setuid+ep. It's the cleanest escalation in capabilities: the interpreted binary lets you execute arbitrary code with the capability active, so setuid(0) works directly.

If the capability is cap_dac_read_search or cap_dac_override on a native binary (tar, cp), this trick doesn't apply: there the vector is reading protected files, not elevating. Also not if the binary runs under a seccomp profile or AppArmor that blocks setuid.