Educational Lab Only
This lab simulates a system where an attacker has set SUID bits on strategic binaries. All commands execute in a safe sandbox. Abusing SUID binaries on systems you do not own is illegal under the Computer Fraud and Abuse Act and equivalent laws.
Briefing
An attacker with temporary root access often plants SUID backdoors for later use. The SUID (Set User ID) bit causes a binary to execute with the file owner's privileges rather than the caller's. When set on a root-owned binary, any user who runs it gains root-level execution. Your mission: find the planted SUID files, understand what they do, and remediate the most dangerous one.
type
-
rwsr-xr-x
= SUID set (s replaces x for owner execute)
-rwsr-xr-x
→
runs as file owner (often root)
-rwxr-xr-x
→
runs as caller (normal)
MITRE ATT&CK
T1548.001 - Abuse Elevation Control: Setuid and Setgid
— Adversaries can set the setuid or setgid bits of a binary to run it with elevated privileges.
This is a common persistence and privilege escalation technique on Unix-based systems.
Objectives
Inspect /usr/local/bin
Find all SUID files
Read the trojan script
Confirm root ownership
Remove the SUID bit