SUID in the Weeds
MediumLinux Security20-30 minSomeone left a way to become root without a password: a SUID-root copy of a shell, tucked into a hidden maintenance directory well off the beaten path. A SUID-root executable runs as root no matter who launches it — a classic privilege-escalation foothold. Hunt it down among the box's legitimate SUID binaries, neutralize it, and recover the receipt left beside it.
Record your findings under /root/case:
1. Record the full path of the rogue SUID binary to /root/case/finding.txt. (The legitimate SUID binaries — sudo, su, passwd, mount — live under /usr/bin, /bin, /usr/sbin, with a couple of system helpers under /usr/lib (ssh-keysign, dbus-daemon-launch-helper); the rogue one is in none of these.)
2. Neutralize it: strip the SUID bit (chmod u-s) or remove the file entirely.
3. Recover the flag from the receipt beside it to /root/case/flag.txt.
See /root/case/brief.txt. Grading reads the filesystem directly.
- Enumerate SUID-root binaries and tell a rogue one from the legitimate system set
- Record the rogue binary's path, then neutralize the privilege-escalation foothold
- Recover the flag left beside it
Hands-on lab: you work on a real Linux box in your browser, graded on the machine's actual state.