Linux Privilege Escalation: Why One SUID Binary Gives Attackers Root (And How to Fix It)

This article explains why a single SUID binary can grant attackers root access on Linux systems, alongside how to prevent this vulnerability. The SUID bit is a special permission that allows a file to run with the privileges of its owner instead of the user who executes it. When SUID is enabled on a binary, running the program as a regular user gives them the permissions of the file's owner.

In the example provided, the passwd binary is set to SUID and owned by root, so when a standard user runs passwd, it temporarily operates with root privileges to modify the password hash in /etc/shadow. The article highlights how administrators often misuse the SUID bit, such as granting developers or support staff a way to search system logs without handing over the root password.

This can inadvertently provide all accounts on the server the ability to run binaries with root permissions. Attackers can easily discover SUID binaries by running a command like 'find / -perm -4000 -type f' which lists all files with the SUID bit active. Seeing common utilities like find, sudo, or bash on this list is a significant warning sign.

Once an attacker identifies a SUID binary, they can exploit it using tools from the GTFOBins catalog. For example, with find's -exec parameter, an attacker can spawn an unrestricted shell, elevating their privileges to root. To secure systems against such escalation, the article advises three steps: 1) Conduct regular SUID audits by searching for misconfigured binaries; 2) Remove the SUID bit from problematic files; and 3) Mount temporary partitions with the nosuid option in /etc/fstab to prevent attackers from dropping SUID binaries in writable directories.