Linux Privilege Escalation via Misconfigured SUID Binary

Overview

After gaining an initial foothold as www-data on a Linux target through a web shell, the next objective is to escalate privileges to root. The system runs Ubuntu 22.04 with standard hardening, but a custom maintenance binary with the SUID bit set introduces a critical misconfiguration.

Reconnaissance

Post-exploitation enumeration began with LinPEAS, which flagged an unusual SUID binary at /opt/maintenance/cleanup. Running find / -perm -4000 -type f 2>/dev/null confirmed the binary. File analysis with strings revealed it calls cat /var/log/app.log and rm /tmp/cache/* — but critically, it invokes service apache2 restart without an absolute path for the service command.

Discovery

The discovery that service is called without its full path (/usr/sbin/service) means the binary relies on the PATH environment variable to locate the command. Since the SUID binary executes as root, and the user can control the PATH variable, this creates a PATH hijacking opportunity.

Exploitation

A malicious script named service was created in /tmp containing /bin/bash -p, which spawns a bash shell preserving the effective UID (root). The PATH was prepended with /tmp so the SUID binary finds the malicious service before the real one. Executing the cleanup binary triggered the fake service script, dropping into a root shell.

Explanation

SUID binaries execute with the file owner permissions (root in this case). When such a binary invokes external commands using relative paths, it searches the PATH environment variable. An attacker who controls PATH can place a malicious executable earlier in the search order, causing the SUID binary to execute arbitrary code as root.

Mitigation

Always use absolute paths in SUID binaries when invoking external commands. Minimize the number of SUID binaries on the system. Audit SUID files regularly with automated scanning tools. Consider using capabilities (setcap) instead of SUID where possible.

Code Samples

1# Find SUID binaries on the system
2find / -perm -4000 -type f 2>/dev/null
3
4# Analyze strings in the binary
5strings /opt/maintenance/cleanup

1# Create malicious service binary
2echo '/bin/bash -p' > /tmp/service
3chmod +x /tmp/service
4
5# Prepend /tmp to PATH
6export PATH=/tmp:$PATH
7
8# Execute the vulnerable SUID binary
9/opt/maintenance/cleanup

References

• https://gtfobins.github.io/
• https://book.hacktricks.xyz/linux-hardening/privilege-escalation
• https://www.hackingarticles.in/linux-privilege-escalation-using-suid-binaries/