0Pricing
Ethical Hacking Academy · Lesson

SUID and Sudo Abuse

Misconfigurations.

SUID and Sudo Abuse is a free Ethical Hacking Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

The SUID Bit

The SUID permission bit makes a file run with the privileges of its owner rather than the user who launched it. When the owner is root, a SUID binary executes as root — useful for tools like passwd, but dangerous if abused.

-rwsr-xr-x  1 root root  /usr/bin/passwd
# the s in rws = SUID bit

Finding SUID Binaries

Enumerate every SUID file and compare against a known-safe baseline. Anything unusual — a text editor, an interpreter, a custom binary — is a candidate.

find / -perm -4000 -type f 2>/dev/null

GTFOBins

GTFOBins is a curated catalog of how standard Unix binaries can be abused to break out, escalate, or read/write files when given SUID or sudo rights. Always check a discovered binary against GTFOBins.

# gtfobins.github.io -> search the binary name

Abusing SUID find

If find has the SUID bit, its -exec option runs commands as root, granting a root shell instantly.

find . -exec /bin/sh -p \; -quit
# -p preserves the elevated privileges

SUID Shell Escapes

Many interpreters and pagers spawn shells. A SUID vim, less, awk, or python can drop you into a root shell.

awk "BEGIN {system(\"/bin/sh -p\")}"
# or in less:  !/bin/sh

Sudo Misconfigurations

Run sudo -l to list allowed commands. Entries that let you run an exploitable binary as root, or use NOPASSWD, are immediate wins. The command does not have to be a shell — GTFOBins shows escapes for many.

sudo -l
# (ALL) NOPASSWD: /usr/bin/vim

Sudo on an Editor or Pager

If you can sudo vim (or less, more, man, nano variants), you can shell out as root from inside the program.

sudo vim -c ":!/bin/sh"
# inside less:  sudo less file  ->  !/bin/sh

The LD_PRELOAD Trick

If sudo preserves LD_PRELOAD (via env_keep), you can load a malicious shared library that runs as root when the sudo command starts.

sudo -l  # look for env_keep+=LD_PRELOAD
sudo LD_PRELOAD=/tmp/evil.so program

Sudo Version Vulnerabilities

Specific sudo versions have flaws — e.g. Baron Samedit (CVE-2021-3156) heap overflow, and the -u#-1 bypass (CVE-2019-14287). Check sudo --version against known CVEs.

sudo --version
# vulnerable < 1.9.5p2 -> Baron Samedit

Custom SUID Binaries

Developers sometimes ship custom SUID helpers that call other programs by name without an absolute path. If you control PATH, you can hijack that call — bridging into the PATH-abuse techniques covered next.

Hardening and Ethics

Defenders should minimize SUID binaries, use absolute paths, drop privileges early, and keep sudo patched with tight rules. As a tester, exploit these only within your authorized scope.

Quick Check

Test your SUID/sudo knowledge.

Recap

You learned SUID and sudo abuse:

  • SUID runs a binary as its owner (often root)
  • Check discovered binaries against GTFOBins
  • Shell escapes via SUID/sudo find, vim, awk, less
  • LD_PRELOAD and sudo CVEs (Baron Samedit) escalate too

Next: cron jobs and PATH abuse.

Frequently asked questions

Is the “SUID and Sudo Abuse” lesson free?

Yes — the full text of “SUID and Sudo Abuse” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “SUID and Sudo Abuse”?

Misconfigurations. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “SUID and Sudo Abuse” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Enumeration
  2. SUID and Sudo Abuse
  3. Cron Jobs and PATH
  4. Kernel Exploits
← Back to Ethical Hacking Academy