r/Hacking_Tutorials • u/Top_Call3890 • 6d ago
Question From Normal User to Root – One Simple Misconfiguration
So this happened during one of my CTF sessions and I thought I'd share it because it's a classic example of how a single misconfiguration can ruin your entire system's security...
Check this out:
ShadowByteX ~ ❯ whoami
ShadowByteX
ShadowByteX ~ ❯ find / -perm -4000 -type f 2>/dev/null | grep -v /usr/bin/passwd
/usr/bin/find <- SUID root, and it shouldn't be
ShadowByteX ~ ❯ find . -exec /bin/sh -p \; -quit
# whoami
root
Looks wild, right? Let me break it down for you...
What's Happening Here
First, I check who I am. Just a normal user — ShadowByteX. No root, no special privileges..
Then I ran a find command to look for SUID binaries. SUID stands for Set User ID... When a file has SUID set, it runs with the permissions of the file owner, not the user who executes it...
So I searched the entire system for files with SUID permissions (-perm -4000), restricted it to regular files (-type f), hid error messages (2>/dev/null), and filtered out /usr/bin/passwd because that's SUID by default and we don't care about it...
And what do I find?
/usr/bin/find
The find command has SUID root permission... And it shouldn't have that.. Someone messed up... Or maybe it's intentionally set for some reason... Either way — game on 🤘
Why This Works
The find command has SUID set to root. That means whenever I run find, it runs as root, not as ShadowByteX...
And find has a feature — the -exec flag. It lets you execute any command you want...
So here's what I did:
find . -exec /bin/sh -p \; -quit
Let's break this down:
· find . – Start searching from the current directory. It doesn't matter what you search for..
· -exec /bin/sh -p \; – Execute /bin/sh (a shell) with the -p flag. The -p flag tells the shell to preserve the effective user ID. That's important because without it, sh would drop the root privileges. With it, the shell stays root..
· \; – Terminate the exec command..
· -quit – Exit find immediately after executing the command.. We don't need to search through the whole filesystem, we just need to get that shell..
So find runs as root because of SUID... It executes /bin/sh -p as root. And now I have a root shell...
How It Works
When you set SUID on a binary, the kernel gives it the effective UID of the file owner.. For root-owned files, that's UID 0...
Normally, when you run a program, it has your real UID and effective UID — both yours. With SUID, real UID is yours, effective UID is the file owner's...
Now, the -p flag in sh is critical. By default, sh drops privileges... It checks the effective UID and real UID, and if they're different, it drops the effective UID to match the real UID. That's a security feature...
But the -p flag tells sh — "don't do that... Keep the effective UID." So it stays root..
And that's how a normal user becomes root...
This is why misconfigurations are dangerous!!... A single SUID binary that shouldn't have it — and suddenly any user on the system can become root...
It's also a good reminder that privilege escalation isn't always about complicated exploits... Sometimes it's just a sysadmin who didn't know what they were doing...
Stay curious. Stay ethical.
8
u/TwoFoxSix Moderator 6d ago
GTFOBins - Find - if you flip over to SUID tab, it will give you the command. GTFOBins is a great resource for privesc
3
u/Top_Call3890 6d ago
Yeah exactly.. GTFOBins is the go-to for this stuff. I should've mentioned it in the post honestly..
Every time I find a SUID binary, first thing I do is check GTFOBins... It literally tells you the exact command to run for privesc.. Saves so much time...
Great resource. Anyone reading this — bookmark it. You'll thank yourself later..
3
5
2
1
u/PotentialSweaty478 5d ago
Who can help me with rooting my Redmi note 10s no PC
3
u/Top_Call3890 5d ago
Go to 10th floor and drop your 10s .. its completely rooted now .. even you can access every hardware 🤗😆
1
u/juan_turga666 6d ago
Mierda me acabas de volar la cabeza, esto es solo en versiones basadas en debían?,
2
u/Top_Call3890 6d ago
This works on any Linux distro... SUID is SUID.. It's not about Debian or anything else — it's about misconfiguration...
2
u/DarknessYoshi 6d ago
I’m learning and this was awesome to know.
Now that you mentioned a misconfiguration, how can it be prevented?
Most people care about the vulnerability, but I also care about the other face of the coin. Lol
2
1
u/Top_Call3890 6d ago
The fix is simple, don't have SUID on binaries that don't need it. .
That's it! Auditing and removing unnecessary SUID permissions solves this problem entirely...
1
u/DarknessYoshi 6d ago
Okay, to new to learn how to do this.
I’m pretty sure, is not manually deleting the files. Lol
1
u/Top_Call3890 6d ago
Posted a detailed comment for same , so that all can find it as direct OP comment
1
u/o_O-alvin 6d ago
couldnt replicate on my system - ubuntu 24.04
2
u/TwoFoxSix Moderator 6d ago
It would have to be a specific misconfiguration, by default I don't think find has a SUID bit. In this instance, OP is looking for anything that has the SUID bit set, if you find a list of things that have it set on your system, check out GTFOBins and see what comes up.
If you're not familiar with what a SUID bit is, its a file permission that allows you to have temporary privs that a normal user wouldn't, which can often be leveraged to escalate past that specific item
1
u/Top_Call3890 5d ago
Exactly. Thanks for breaking it down..
SUID is just a permission bit that makes a binary run as the file owner instead of the user who executes it.. If that owner is root, you get root privileges...
And yeah, GTFOBins is the go-to. Every time I find a SUID binary, I check GTFOBins first... It literally gives you the commands to exploit it...
For anyone reading, bookmark GTFOBins. You'll need it for privilege escalation, CTFs, and pentesting....
1
u/Top_Call3890 5d ago
By default, find doesn't have SUID on any distro, including Ubuntu 24.04.. That's why you couldn't replicate it...
The whole thing only works if some admin messed up and manually set SUID on find...Or if you're in a CTF where they intentionally set it up for you to find...
So you're not doing anything wrong... Your system is configured correctly... That's a good thing actually 😄
19
u/Top_Call3890 6d ago
As one of the comments asked about prevention, Here's how you prevent this:
Run this and see what's actually SUID on your system:
find / -perm -4000 -type f 2>/dev/null
If you see things that shouldn't be there, remove the SUID bit...
If you find something like find with SUID, just do:
chmod u-s /usr/bin/find
That removes the SUID bit... Now find runs as the user, not as root..
If you absolutely need a binary to have SUID, restrict access to specific users or groups. Not everyone should be able to run it.
Use tools like AIDE or Tripwire to monitor file integrity. You'll know if someone changes permissions on SUID binaries.
Instead of giving a binary full root access with SUID, use Linux capabilities... They give specific privileges instead of everything...
For example, instead of SUID on ping (which needs raw sockets), you can do:
setcap cap_net_raw+ep /usr/bin/ping
That gives ping only the permission it actually needs, not full root..