> For the complete documentation index, see [llms.txt](https://security.navidnaf.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security.navidnaf.com/marauders-boost/linux-privesc/exploiting-suid-binaries.md).

# Exploiting SUID Binaries

Linux has three main file permissions: read, write, and execute. But there are also special permissions for certain situations. One of these is **SUID (Set Owner User ID).**

**What does SUID do?** If a file has SUID set, when a user runs it, the file will execute **with the permissions of the file owner** instead of the user running it.

**Why is SUID used?** It allows normal users to run specific programs with higher privileges, often with **root permissions**.

**Security Concern:** SUID only applies while running the file—it doesn’t permanently give higher privileges. However, if misconfigured, attackers can **exploit vulnerabilities** in these files to gain full system control.

## Exploitation

We will try to exploit this functionality to gain higher privileges. However, our success will depend on a few key factors:

* **Owner of the SUID Binary** – Since we want to elevate our privileges, we will only target SUID binaries owned by the **root user** or other privileged users.
* **Access Permissions** – We must have **execute permissions** to run the SUID binary.

{% code overflow="wrap" %}

```bash
ls -al # the permission having 's' is the SUID permission
file [FILE]
strings [FILE]
 - check binary names, 'setuid'
 - remove the binary

cp /bin/bash [REMOVED BINARY NAME]
```

{% endcode %}