← Back to Blog
Guide

Exploiting the SUID-Bit Binary on Linux

Tuesday, September 29, 2026

Workshop Recap

By Ray

Discussed:

  • When contesting or doing CTFs, getting initial access is ⅓ of the battle.
  • SUID binaries are the most common configuration on Linux servers, so it's important for penetration testing
  • Linux permissions are divided into three groups/triplets. Each group controls read, write and execute.
    • First group is the owner group. It controls what the owner of the file can do.
    • Second group is group. If a group is assigned to a file, it dictates what members of the file are allowed to do.
    • Third group is world which controls the permissions for everybody else.
  • The takeaway is that binaries run with the permissions of the executing user.
  • A Set User ID (SUID) is a replacement of S instead of an X in the last letter of the owner group.
    • An example is the password file, which requires SUID.
  • If any binary is owned by root, any user executes it as root. This is dangerous for anyone running as an administrator.
    • Since it's dangerous, it will be labeled in red.
    • Essentially, if August, our club leader, owned a file and someone lower than her rank executed a command, the command would technically be run under August's permission.
  • To find this binary, we run the command find / -perm -u=s 2>/dev/null to look through the entire filesystem for any binaries with the SUID bit set.
  • To discover if a binary with a SUID bit is able to escalate privileges, view files, or facilitate other post-exploitation tasks, we can use GTFOBins (For Linux) and see if the binary exists on there and has the SUID context tagged alongside it. For example, to spawn an elevated (root) shell using xargs (if the SUID bit it set, and the owner is root), then the following command is used: xargs -a /dev/null /bin/sh -p
  • If you want one for Windows, use LOLBAS.

Additional Clarifications and Comments:

  • You must break into the system first before finding the SUID. You can hack it through a home computer, web server, etc. Once you've exploited the website, you've got the flag for the CTF.
  • If you have a group of five people and you want people to do actions under your name, you'd use SUID.
  • Common loop places in Linux are the SSH keys.
  • Lateral movement is a technique hackers use to spread from an initial entry point to other parts of a network after gaining access.
    • In large domain environments, there's usually a single server which can talk to both the internal network and the external network, called the DMZ. Common DMZ points are company websites, since that server is able to talk to both the outside network (to get customers from google), as well as the internal network (to store sensitive passwords on another internal server, for example.)
    • Once you've gained access to the DMZ, you can perform lateral movement to discover other servers on the internal network. The main goal of hacking a domain environment is to compromise the Domain Controller, which holds all the keys to the kingdom.
    • All of this is like a chain reaction..