fork()call, the child thread will have the same capabilities as the parent thread.
capset()syscall allows to
execve()on a binary file, its capabilities will be modified following the pattern described in the man pages (see
/path/to/file =epit means it has
allcapabilities and will run as
pythonbinary has the
cap_setuidthen it becomes trivial to get a root shell :