Linux Security Bypass

This is a post-exploitation playbook for breaking out of Linux security restrictions. It walks through rbash escapes (via editors, language interpreters, SSH tricks), noexec filesystem bypasses (DDexec for fileless execution, memfd_create, ld.so tricks), and evasion techniques for AppArmor, SELinux, seccomp filters, and audit logs. The seccomp section covers architecture confusion attacks where 32-bit syscalls slip past 64-bit filters. Honestly, this is pure red team material. If you're doing authorized pentesting or CTFs where you've landed a shell but hit restrictions, it's a solid reference. The techniques are real and widely used, but this is explicitly offensive security content with no defensive angle.

skills.sh installs: 3.7K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill linux-security-bypass --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Linux Security Bypass — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert techniques for bypassing Linux security mechanisms. Covers restricted shell escape, noexec bypass, AppArmor/SELinux evasion, seccomp circumvention, and audit evasion. Base models miss DDexec, memfd_create fileless execution, and architecture-confusion seccomp bypass.

0. RELATED ROUTING

Before going deep, consider loading:

linux-privilege-escalation once you've broken out of restrictions and need to escalate
container-escape-techniques when security mechanisms are container-specific (seccomp profiles, AppArmor docker-default)
linux-lateral-movement after bypassing restrictions for pivoting
cmdi-command-injection when the restriction is on command execution from a web application context

1. RESTRICTED BASH (rbash) BYPASS

1.1 SSH-Based Bypass

# Force a different shell via SSH
ssh user@host -t "bash --noprofile --norc"
ssh user@host -t "/bin/sh"
ssh user@host -t "bash -l"

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
Categories: Security, DevOps & CI/CD, CLI & Terminal
First seen: Jun 3, 2026