Signal9Signal9 — home
online
back to labs

Find SUID Binaries

MediumRHCSA Prep20-30 min
The brief

A security audit turned up a suspicious setuid-root binary hiding on this host — a classic privilege-escalation backdoor. Hunt down every SUID binary, identify the planted one (it lives somewhere it has no business being), record its full path to /root/case/suid.txt (just that one path; its own ls -l line is accepted too, the whole SUID listing is not), then neutralize it by removing the setuid bit.

What you'll do
  • Enumerate SUID binaries with find
  • Record the planted backdoor's path to /root/case/suid.txt
  • Neutralize it by stripping the SUID bit

Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.