Linux SUID Binary Privilege Escalation Triage

Stage 01 - Concept

Understanding SUID and Execution Context

POSIX permissions define read (4), write (2), and execute (1) access for owner, group, and others. A special permission bit known as SUID (Set User ID, octal 4000) instructs the Linux kernel to run the process with the permissions of the file owner rather than the user invoking the binary.

Legitimate SUID binaries include `/usr/bin/passwd` (which allows users to update their own hash in `/etc/shadow`) and `/usr/bin/sudo`. However, if an administrative tool or scripting interpreter is inadvertently granted the SUID bit owned by root (UID 0), any local unprivileged user can abuse its built-in functionality to read arbitrary files or spawn a root shell.

Stage 02 - Why It Matters

Why SUID Misconfigurations Matter

Local Privilege Escalation (LPE) is a cornerstone of post-exploitation methodology.

Stage 03 - Environment Setup

Environment Preparation

To safely audit and simulate an SUID vector without altering system-critical binaries, create a sandboxed test directory.

Execute the following commands in your local shell to create a dedicated sandbox directory with a simulated vulnerable binary.

# Create an isolated working directory

COMMANDLOCAL

$mkdir -p /tmp/suid-lab && cd /tmp/suid-lab

# Copy find binary to local sandbox

COMMANDLOCAL

$cp /usr/bin/find ./find-sandbox

# Apply SUID bit to test binary

COMMANDLOCAL

$chmod u+s ./find-sandbox

Stage 04 - Execution

Scanning the Filesystem for SUID Binaries

Audit the local system to identify all binaries carrying the SUID permission bit.

Run a filtered `find` search starting from root or your current sandbox. Redirect standard error (`2>/dev/null`) to suppress permission denied errors on inaccessible system directories.

# Locate SUID files and filter for our sandbox binary

COMMANDTASK

$find / -perm -4000 -type f -exec ls -la {} + 2>/dev/null | grep 'find-sandbox'

# Inspect the permission string for the 's' bit

COMMANDTASK

$ls -l /tmp/suid-lab/find-sandbox

Stage 05 - Output & Telemetry

Command Output & Binary Attributes

Notice the fourth character in the permission string: '-rwsr-xr-x'. The 's' indicates that the SUID bit is set and the owner execute bit is active.

TELEMETRY / COMMAND OUTPUT

-rwsr-xr-x 1 root root 234120 Oct 02 10:14 /tmp/suid-lab/find-sandbox

Stage 06 - Analysis & Interpretation

Interpreting the GTFOBins Vector

The `find` utility includes an `-exec` parameter designed to invoke external programs for matching files.

›Because the binary runs with the SUID bit of root, commands spawned via `-exec` inherit the effective root UID.
›Invoking `./find-sandbox . -exec /bin/sh -p \; -quit` forces the shell to run in privileged mode (`-p`), preserving the effective UID.
›Standard secure distributions mount user partitions with `nosuid` to prevent unauthorized execution.

Stage 07 - Security Impact

Security Impact & Remediation

Vulnerability Exposure & Attack Vectors

✕Complete compromise of confidentiality, integrity, and availability on the host.
✕Ability to read sensitive credential files such as /etc/shadow or SSH private keys.
✕Persistence installation via cron or systemd service tampering.

Hardening & Remediation Guidance

✓Audit all SUID files using automated CIS benchmark scanners or custom audit scripts.
✓Remove unnecessary SUID bits using `chmod u-s <path_to_binary>`.
✓Mount `/tmp`, `/dev/shm`, and user-writable home partitions with the `nosuid,nodev` options in `/etc/fstab`.

Stage 08 - Validation Checkpoint

Validation Checkpoint

FREE ACCOUNT REQUIRED

100% Free Access

READY TO PRACTICE?

Create a free account to start this lab, record your attempt, and track your progress.

Continue with Google

No credit card required. Public educational platform.

Stage 09 - Next Steps & Hardening

Next Steps & Hardening

Now that you understand how SUID binaries operate and how unprivileged users can exploit them:

Recommended Actions:

→Clean up your sandbox: `rm -rf /tmp/suid-lab`.
→Review your production systems for non-standard SUID binaries using `find / -perm -4000 -type f 2>/dev/null`.
→Explore POSIX Linux capabilities (`getcap -r / 2>/dev/null`) as the modern, fine-grained replacement for SUID binaries.