Lesson 2.11: SUID programs and baselines
SUID programs run with their owner's rights, usually root's, whoever starts them. A few are necessary (passwd, sudo); any other one is a potential path to root, especially general-purpose tools that can run commands or edit files. How to keep a baseline of SUID files and compare against it, what makes a program dangerous with SUID (the GTFOBins project documents them for defenders and testers alike), and how to remove the bit safely. In the lab you compare today's SUID list with last month's baseline, find two additions, and remove both.
16 min
You will learn to
- Explain SUID and SGID
- Keep and compare a baseline with diff
- Explain why general-purpose tools must never be SUID
- Remove the SUID bit
- Prove the system matches the baseline again
Key terms
- SUID and SGID
- Permission bits that make a program run with the file owner's (SUID) or group's (SGID) rights.
- Baseline
- A recorded known-good state to compare against later.
- GTFOBins
- A public catalogue of Unix programs that can be abused to bypass restrictions when given extra rights (SUID, sudo, capabilities).
- Capabilities
- Linux splits root's power into pieces (for example cap_net_bind_service) that can be given to a program instead of full SUID root.
← IPv4 addresses, binary and the subnet mask · All lessons · Security headers →