Agent skill · security · yaklang
linux-security-bypass
Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation.
Why this skill is useful
Adds advanced techniques for bypassing Linux security mechanisms, including executable scripts for fileless execution and environment manipulation that are not widely documented.
What it needs
Requires curl, perl, python installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Linux Security Bypass — Expert Attack Playbook AI LOAD INSTRUCTION: Expert techniques for bypassing Linux security mechanisms. Covers restricted shell escape, noexec bypass, AppArmor/SELinux evasion, seccomp circumvention, and audit evasion. Base models miss DDexec, memfdcreate fileless execution, and architecture-confusion seccomp bypass. 0. RELATED ROUTING Before going deep, consider loading: linux-privilege-escalation once you've broken out of restrictions and need to escalate container-escape-techniques when security mechanisms are container-specific (seccomp profiles, AppArmor docker-default) linux-lateral-movement after bypassing restrictions for pivoting cmdi-command-injection when the restriction is on command execution from a web application context --- 1. RESTRICTED BASH (rbash) BYPASS 1.1 SSH-Based Bypass 1.2 Editor-Based Escape 1.3 Language Interpreter Escape Interpreter Command --- --- Python python3 -c 'import pty; pty.spawn("/bin/bash")' Perl perl -e 'exec "/bin/bash";' Ruby ruby -e 'exec "/bin/bash"' Lua lua -e 'os.execute("/bin/bash")' PHP php -r 'system("/bin/bash");' Node.js node -e 'require("childprocess").spawn("/bin/bash",{stdio:[0,1,2]})' AWK awk 'BEGIN {system("/bin/bash")}' 1.4 Environment Variable Tricks 1.5 Other Escapes Method Command --- --- expect expect -c 'spawn /bin/bash; interact' script script -qc /bin/bash /dev/null rlwrap rlwrap /bin/bash nmap (old) nmap --interactive → !bash --- 2. READ-ONLY / NOEXEC FILESYSTEM EXECUTION 2.1 DDexec — Execute From stdin via /proc/self/mem 2.2 memfdcreate — In-Memory File Descriptor 2.3 ld.so Direct Execution 2.4 Script Interpreters on noexec 2.5 Writable Mount Points --- 3. APPARMOR BYPASS 3.1 Profile Enumeration 3.2 Exploitation Strategies Common AppArmor profile gaps: /proc/self/fd/ access, abstract Unix sockets, interpreter-based execution (python scripts bypass binary restrictions), and newly created paths. --- 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/linux-security-bypass