linux-security-bypass

An offensive-security playbook for evading Linux security controls during post-exploitation, intended for penetration testers and red teams operating in authorized engagements. It applies when a foothold is constrained by a restricted shell, a read-only or noexec filesystem, AppArmor, SELinux, seccomp filters, or audit logging. The content is organized by mechanism and routes to related privilege-escalation, container-escape, lateral-movement, and command-injection material once a restriction is broken.

Restricted-shell (rbash) escape is covered through SSH forcing an alternate shell, editor escapes in vi and ed, interpreter spawns from Python, Perl, Ruby, Lua, PHP, Node.js, and AWK, and environment tricks such as BASH_CMDS and env. For read-only or noexec filesystems it documents fileless and indirect execution: DDexec overwriting process memory through /proc/self/mem, memfd_create in-memory file descriptors, running binaries via the dynamic linker ld.so, executing scripts (which run even under noexec because the interpreter reads them as data), and locating writable, exec-capable mounts like /dev/shm.

The remaining sections enumerate and weaken mandatory access controls. AppArmor coverage includes profile enumeration, complain-mode detection, and common profile gaps. SELinux coverage checks enforcing versus permissive mode, permissive domains, contexts, and dangerous booleans. Seccomp coverage reads the filter status, explains the x86 versus x86_64 architecture-confusion bypass where a 32-bit binary uses different syscall numbers, notes abusable allowed syscalls, and references known kernel bugs. Audit evasion begins with timestamp manipulation via touch. Described factually, the same knowledge helps defenders understand and harden against these techniques.