CAPTEST:(8)

💅 CAPTEST — a program to demonstrate capabilities ✨

ok so bestie, welcome to captest — it's from section 8 of the manual (System Administration Utilities, iykyk) and it's literally the cutest lil tool for peeking at what your process is allowed to do. let's get into it 🫶

---

🌸 NAME 🌸

captest — a program to demonstrate capabilities. that's it, that's the whole vibe 💖

---

✨ SYNOPSIS ✨

captest [ --ambient --drop-all | --drop-caps | --id ] [ --init-grp ] [
--lock ] [ --text ]

---

🎀 DESCRIPTION 🎀

okay so captest is a program that demonstrates and prints out the current process capabilities. it's giving "show me what i'm working with" energy 👑

here's the tea: every single option prints the same report. like, the flags change how it sets up the process, but the report itself? same every time. no cap. here's what it does, in order:

1. it outputs the current capabilities.
2. then it tries to access /etc/shadow directly, just to show if that can even be done 👀
3. then it creates a child process that attempts to read /etc/shadow and outputs the results of that.
4. then it outputs the capabilities that a child process would have.

so basically a whole little capability saga in one run, slay 💅

---

you can also apply file system capabilities to this program to study how they work, which is lowkey the most fun part. for example:

filecap /usr/bin/captest chown

then run captest as a normal user. iconic.

another interesting test is to make captest suid root so you can see what the interaction is between root's credentials and capabilities. for example:

chmod 4755 /usr/bin/captest

when run as a normal user, the program will see if privilege escalation is possible. spicy 🌶️

bestie i need you to hear me on this one: do not leave this app setuid root after you are done testing, so that an attacker cannot take advantage of it. seriously. that's not a vibe. clean up after yourself fr fr 🚨

---

🌈 OPTIONS 🌈

• --ambient — this attempts to add CAP_CHOWN ambient capability. ambitious of it ✨
• --drop-all — this drops all capabilities including ambient, and clears the bounding set. scorched earth, no survivors 💀
• --drop-caps — this drops just traditional capabilities. a lil more chill about it.
• --id — this changes to uid and gid 99, drops supplemental groups, and clears the bounding set. full identity crisis speedrun 🦋
• --init-grp — this changes to uid and gid 99 and then adds any supplemental groups that comes with that account. heads up tho: you would have add them prior to testing, because by default there are no supplemental groups on account 99. so like, plan ahead bestie 🙈
• --text — this option outputs the effective capabilities in text rather than numerically. way easier on the eyes ngl 👀
• --lock — this prevents the ability for child processes to regain privileges if the uid is 0. lock it down, periodt 🔒

---

🦋 SEE ALSO 🦋

• filecap(8)
• capabilities(7)

---

👑 AUTHOR 👑

Steve Grubb 💜

---

and that's the whole page, bestie!! this one came from Red Hat, dated Sept 2020 — so when you're out here checking your capabilities, just know you're standing on some classic Red Hat documentation shoulders. go forth, drop some caps (responsibly!!), and don't forget to un-suid that binary. mwah 💖✨