Levram
Privilege Escalation via Python Binary with cap_setuid
Summary
Discovered only two open ports: SSH (22) and a web server (8000) running Gerapy.
Gerapy was running a vulnerable version, which led to authenticated command execution.
Exploited CVE-2021-43857 to gain an initial foothold.
Privilege escalation achieved using cap_setuid capability assigned to Python3 binary, allowing elevation to root.
🧵 Let's Unpack
Enumeration
Open Ports:
22/tcp→ OpenSSH 8.9p1 Ubuntu8000/tcp→ Gerapy (WSGIServer/0.2 CPython/3.10.6)
📌 Interesting Findings:
Gerapy panel hosted on port 8000.
Web title confirmed it was running Gerapy.
robots.txtor web paths not exposed; had to manually verify version and exploit.
Initial Foothold
The exploit chain allowed remote code execution by abusing insecure project configuration and file inclusion.
✅ Received reverse shell from Gerapy web context.
Privilege Escalation
Found this:
This capability allows the binary to change its user ID — effectively enabling escalation to root.
🧨 Boom! Got a root shell.
Last updated
Was this helpful?