Linux Privilege Escalation: Exploiting SUID Binaries

Set User ID (SUID) Fundamentals

In Unix-like systems, SUID (Set Owner User ID upon execution) is a special type of file permission given to a file. It allows users to execute the file with the permissions of the file owner, rather than the user running it.

1. Enumerating SUID Binaries

To identify all files with the SUID permission bit set that are owned by the root user, run the following find command:

find / -perm -4000 -type f 2>/dev/null

• /: Search from root directory.
• -perm -4000: Match files with SUID bit set.
• -type f: Search for files only.
• 2>/dev/null: Redirect permission errors to void.

2. Abuse Vectors & GTFOBins

If standard utilities like find, vim, nano, or cp are given SUID bits, they can be abused to read sensitive files or spawn shells. GTFOBins is a curated list of such binaries.

# Example: If "find" is SUID, execute to get root shell:
find . -exec /bin/sh -p \; -quit