So they're a pretty niche attack vector, and oftentimes crop up as a result of lazy/incompetent sysadmins.

It doesn't make it easier to "hack" servers, it's just a list of things that you could use once you're already inside.

It's a pretty niche circumstance. Unless an admin allows users on a server to execute some of these random types of binaries as root, it's not going to be a concern. And, if it wasn't already obvious, distros are almost never configured this way OOTB

But you can't "hack a server" using just these techniques: they would be a (small) part of a chain of exploits.

So yes, the end result is just `cat` with extra steps.

A very simple version of this would be if you set a user's default shell to "rbash" but the user can just run "bash" to get a real shell.

Or maybe you give Claude Code permission to run `base64` without review without realizing this lets it read any file, including maybe your secrets in .env or something.

I once accidentally gave my claude "powershell" permissions in one session, and after that any time it found it was blocked from using a tool, e.g. git, it would write a powershell script that did the same thing and execute the script to work around the blocked permission.

Obviously no sane system would have "powershell" in a generic allow-list, but you could imagine some discrepancy in allowed levels between tools which can be worked around with the techniques on this page.