Introduction
In Linux and Unix-based systems, file permissions are a fundamental aspect of security. One special type of permission is the SUID (Set Owner User ID) bit. When a binary file has the SUID bit set, it executes with the privileges of the file's owner, rather than the privileges of the user who ran it.
While this is necessary for certain legitimate system functions (like the passwd command, which needs root access to update your password), it becomes a severe security risk if misconfigured. If a system administrator accidentally sets the SUID bit on a standard utility like find, vim, or bash, an attacker can leverage these tools to execute commands as the root user, leading to a complete system compromise known as Privilege Escalation.
What makes SUID dangerous is that it changes the privilege context of the program execution itself. If the program can then launch other commands or shells, that privilege can leak outward.
In this lab, you will step into the shoes of a security researcher. You will scan a Linux file system to locate binaries with the SUID bit set, identify a vulnerable misconfiguration, and use techniques from the famous GTFOBins project to escalate your privileges to root.
Search for SUID Binaries (find)
In this step, you will learn how to search the Linux file system for binaries that have the SUID permission bit set.
To find these files, we use the built-in find command. The find command is incredibly powerful and allows us to search for files based on their specific permissions. We will look for files starting from the root directory / that have the SUID bit (represented by the octal value 4000) enabled.
Enumeration of SUID files is a standard privilege escalation habit because it quickly reveals programs that execute with elevated privilege on behalf of ordinary users.
Run the following command in your terminal to search for SUID binaries and save the results to a text file named suid_results.txt in your project directory:
find / -perm -4000 -type f 2> /dev/null > ~/project/suid_results.txt
Let's break down this command so you understand exactly what it does. The / tells the command to start searching from the very top of the file system. The -perm -4000 flag specifically looks for files with the SUID bit set. The -type f flag ensures we are only looking for regular files, not directories. Finally, 2>/dev/null is a neat trick that takes any "Permission denied" error messages and throws them away into a black hole (/dev/null), keeping our output clean. The > symbol redirects the clean output into our text file.
Now, let's view the contents of the file you just created to see which binaries have the SUID bit set:
cat ~/project/suid_results.txt
You will see an output similar to this:
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/bin/chfn
/usr/bin/find
/usr/bin/chsh
/usr/bin/passwd
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/su
/usr/bin/mount
/usr/bin/umount
Take a close look at the list. Many of these, like passwd and su, are expected to have the SUID bit set. However, one of these binaries stands out as highly unusual and potentially dangerous.
Identify Exploitable Binaries (GTFOBins)
In this step, you will analyze the results from your search and identify which binary can be exploited.
Looking at the output from the previous step, you might notice /usr/bin/find in the list. The find command is a standard utility used for searching files, and it absolutely does not need root privileges to function normally. The fact that it has the SUID bit set is a major security misconfiguration.
That judgment call is important. Not every SUID binary is exploitable, but unusual ones deserve special scrutiny because they may provide capabilities their designers never meant to expose with elevated rights.
To understand how we can exploit this, security professionals use a resource called GTFOBins. GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems. If you were to visit the GTFOBins website and search for "find", you would discover that find has a feature that allows it to execute other commands.
Because our find binary has the SUID bit set, any command it executes will be run with the privileges of the binary's owner (which is root).
To confirm your finding, create a file named vulnerable_binary.txt and write the name of the exploitable binary into it. Run the following command:
echo "find" > ~/project/vulnerable_binary.txt
You can verify the contents of the file by printing it to the terminal:
cat ~/project/vulnerable_binary.txt
The output should simply be:
find
By identifying this misconfiguration, you have found the entry point for your privilege escalation attack.
Craft the Exploit Command
In this step, you will prepare the specific command payload needed to exploit the SUID misconfiguration on the find binary.
According to GTFOBins, the find command has an -exec parameter. This parameter is normally used to execute a specific action on every file that find locates. However, attackers can abuse this parameter to execute a system shell (/bin/sh).
The standard exploit payload looks like this: find . -exec /bin/sh -p \; -quit.
Let's break down why this payload works. The . tells find to start looking in the current directory. The -exec flag tells it to run the following command. We provide /bin/sh to launch a shell. The -p flag is crucial; it tells the shell to preserve the privileges it was launched with (in this case, the root privileges granted by the SUID bit). The \; signifies the end of the command we want to execute. Finally, -quit tells find to stop searching immediately after executing the command once, rather than repeating it for every file in the directory.
To prepare for the final execution, let's save this exploit payload into a shell script file named exploit.sh. Run the following command:
echo 'find . -exec /bin/sh -p \; -quit' > ~/project/exploit.sh
You can view the script you just created to ensure the payload is correct:
cat ~/project/exploit.sh
The output will display your crafted payload:
find . -exec /bin/sh -p \; -quit
You now have the exact command required to trick the find binary into giving you a root shell.
Execute the Privilege Escalation
In this final step, you will execute the exploit and prove that you have successfully escalated your privileges to the root user.
Instead of dropping directly into an interactive shell (which can be tricky to verify in an automated lab environment), we will modify our payload slightly to execute a single command as root and save the output. We will use the whoami command, which prints the username of the currently effective user.
Run the following command to execute whoami through the vulnerable find binary and redirect the output to a file named root_proof.txt:
/usr/bin/find . -exec whoami \; -quit > ~/project/root_proof.txt
Notice that we used the absolute path /usr/bin/find to ensure we are executing the specific binary we identified earlier. The find command runs, triggers the -exec flag, executes whoami with root privileges (thanks to the SUID bit), and saves the result.
Now, let's check the contents of your proof file to see if the exploit was successful:
cat ~/project/root_proof.txt
If the exploit worked correctly, the output will be:
root
Congratulations! You have successfully exploited a misconfigured SUID binary to execute commands as the root user.
If you want to experience getting an actual interactive root shell, you can run the payload you crafted in the previous step directly in your terminal:
/usr/bin/find . -exec /bin/sh -p \; -quit
Your command prompt will change to a # symbol, indicating you are now operating as the root user. You can type exit to leave the root shell and return to your normal user prompt.
Summary
In this lab, you successfully learned how to identify and exploit SUID misconfigurations on a Linux system. You started by using the find command to hunt for binaries with the SUID permission bit set. After identifying /usr/bin/find as an anomaly, you learned how resources like GTFOBins can be used to discover exploit payloads. Finally, you crafted and executed a command that abused the -exec parameter of the find binary, allowing you to execute commands with root privileges.
This exercise highlights the critical importance of proper permission management in Linux. System administrators must regularly audit SUID binaries to ensure that standard utilities are not inadvertently granting a pathway for privilege escalation.
