Executables with the SUID bit
Rotonda & Co. Printing House has not checked its program permissions since 2023. List the programs that run with root privileges no matter who launches them, find the one that should not be there and see what it does.
Lab 3 of 5 in the Privilege Escalation path. If you get stuck you have 3 hints, from the vaguest to the most precise: they cost 0, 50 and 150 XP.
What you learn
Objectives complete themselves while you work in the terminal; each one is worth experience points:
- List the programs with the SUID bit (150 XP)
- Compare them with the standard list in audit/suid-standard.txt (100 XP)
- Run the non-standard program and see which privileges it runs with (200 XP)
Topics: privesc, suid, audit.
Commands you will use
The terminal is simulated and understands about forty Linux commands. In this lab you will mostly need these:
find: searches for files by name, type or permissions across a whole folder tree; in an audit it turns up keys, forgotten copies and programs with dangerous permissions.cat: prints the contents of a file: the most direct way to read configurations, notes and logs.file: recognises what kind of file you are looking at (text, executable, image) from its contents, not its name.
The simulated environment
You work in a simulated Linux shell, in the home folder of the user runner: invented files and folders, no network target.
Besides the home folder there is a complete simulated system, with configuration files, logs, users and permissions to examine.
The defensive lesson
Once the lab is solved, the write-up explains what went wrong and how to protect yourself:
The SUID bit makes a program run with the privileges of its owner, whoever launches it: passwd and sudo need it, but every extra SUID program is a piece of root handed to everybody, especially if it reads restricted files. Defensive lesson: audit periodically (find / -perm -4000 compared against a baseline), remove the bit where it is not needed (chmod u-s), use sudo with targeted rules instead of home-made SUID programs and mount with nosuid the partitions that do not need it.
Before and after this lab
To unlock it you must have solved:
- Who am I and what can I do? (Privilege Escalation, medium)
- Finding files (Linux Fundamentals, medium)
After this lab you can move on to:
- Sudo and SUID audit (Privilege Escalation, hard)
- Responding to an incident (Blue Team / Defense, hard)
The Privilege Escalation path
Privilege Escalation is an audit path here: you are on a server as a normal user and you check whether some misconfiguration lets you gain more privileges than you should have. You examine sudo rules, programs with the SUID bit, credentials forgotten in the history and in files, and secrets passed as process arguments. These are the same checks that people who harden systems run, and each lab ends with the principle that sums them all up: least privilege.