{"version":"1.0","provider_name":"MacroSEC","provider_url":"https:\/\/macrosec.tech","title":"Linux Privilege Escalation Techniques using SUID &#8212; MacroSEC","type":"rich","width":600,"height":338,"html":"<blockquote class=\"wp-embedded-content\" data-secret=\"WJDMeyelsA\"><a href=\"https:\/\/macrosec.tech\/index.php\/2021\/06\/08\/linux-privilege-escalation-techniques-using-suid\/\">Linux Privilege Escalation Techniques using SUID<\/a><\/blockquote><iframe sandbox=\"allow-scripts\" security=\"restricted\" src=\"https:\/\/macrosec.tech\/index.php\/2021\/06\/08\/linux-privilege-escalation-techniques-using-suid\/embed\/#?secret=WJDMeyelsA\" width=\"600\" height=\"338\" title=\"&#8220;Linux Privilege Escalation Techniques using SUID&#8221; &#8212; MacroSEC\" data-secret=\"WJDMeyelsA\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\" class=\"wp-embedded-content\"><\/iframe><script>\n\/*! This file is auto-generated *\/\n!function(d,l){\"use strict\";l.querySelector&&d.addEventListener&&\"undefined\"!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!\/[^a-zA-Z0-9]\/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll('iframe[data-secret=\"'+t.secret+'\"]'),o=l.querySelectorAll('blockquote[data-secret=\"'+t.secret+'\"]'),c=new RegExp(\"^https?:$\",\"i\"),i=0;i<o.length;i++)o[i].style.display=\"none\";for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute(\"style\"),\"height\"===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):\"link\"===t.message&&(r=new URL(s.getAttribute(\"src\")),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener(\"message\",d.wp.receiveEmbedMessage,!1),l.addEventListener(\"DOMContentLoaded\",function(){for(var e,t,s=l.querySelectorAll(\"iframe.wp-embedded-content\"),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute(\"data-secret\"))||(t=Math.random().toString(36).substring(2,12),e.src+=\"#?secret=\"+t,e.setAttribute(\"data-secret\",t)),e.contentWindow.postMessage({message:\"ready\",secret:t},\"*\")},!1)))}(window,document);\n\/\/# sourceURL=https:\/\/macrosec.tech\/wp-includes\/js\/wp-embed.min.js\n<\/script>\n","thumbnail_url":"https:\/\/macrosec.tech\/wp-content\/uploads\/2021\/05\/226772.png","thumbnail_width":400,"thumbnail_height":400,"description":"What is SUID? The Set User ID. This has to do with permission settings.So if we look at ls -la, we can see we have, RWX (Read, Write, Execute) and some have Read, then a blank, and then execute permissions. These are the permissions, and we can tell whether it is a directory or a file from the first initial. For example \u201cd\u201d means it is a directory and if it is blank with a dash, it means it is a file. So how does this operate or how do we read and understand these? There are 3 sets of groups. The first is the RWX of the file owner, the second is for the group, and the third is for everybody else. Lets try ls -la on \/etc\/shadow which Is something that is definitely owned by root. So root has RW privileges on it, the group only has read permissions, and the user does not have any permission on this folder. There is the SUID permission, or the Set User ID which allows users to execute a file with permissions of a specified user. So the file with SUID permissions run with higher privileges. If we were to set-UID (SUID) permissions, we would be able to see a \u201cS\u201d in the permissions as shown below.So in this blog we will be looking at hunting down the S in this location.NOTE: Not everything is vulnerable which has the SUID permission set. So we have to basically dig and understand what files have these permissions and why they have these permissions and if it is vulnerable or not."}