Academy Node
Linux SUID and Capabilities
SUID and Linux capabilities can allow binaries to run with elevated privileges or special permissions.
Intermediate100 XPLinux PrivEsc
Why it matters
PEN-200 Linux privilege escalation covers abusing SUID binaries and capabilities as a core local escalation path.
How to identify it
- Find SUID files
- Enumerate capabilities
- Check GTFOBins
Linux commands
find / -perm -4000 -type f 2>/dev/nullgetcap -r / 2>/dev/nullstrings /path/to/suid-binaryfile /path/to/suid-binaryltrace /path/to/suid-binary 2>/dev/nullstrace /path/to/suid-binary 2>/dev/nullExpected output
- SUID binary list
- capabilities list
- Interesting custom binary
Success looks like
- Root shell
- Read protected file
- Privilege context changes
Failure looks like
- Only normal system SUID binaries
- Capability not useful
Troubleshooting
- Compare to GTFOBins
- Check strings/ltrace/strace
- Look for relative paths
Common mistakes
- Not checking custom paths like /opt
- Not checking PATH hijack inside SUID behavior
Alternative attacks
- sudo abuse
- cron abuse
- credential hunting
What to try next
- Check sudo -l
- Check cron
- Collect proof
Recommended next lessons
ASREP Roast
ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.
Kerberoast
Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.
GenericWrite
GenericWrite means you can modify certain attributes on the target AD object.
GenericAll
GenericAll is effectively full control over the target AD object.