Linux Privilege Escalation Notes: SUID Binaries, Capabilities & Cron Jobs

Overview During post-exploitation on Linux hosts, privilege escalation often relies on misconfigured file permissions, overly permissive `sudo` rules, SUID binaries, or POSIX file capabilities. These notes summarize both the enumeration commands and the corresponding `auditd` rules used to detect exploitation.

1. SUID & SGID Binaries Files with the SUID bit execute with the effective UID of the file owner (often `root`).

bash

# Enumerate SUID binaries
find / -perm -4000 -type f 2>/dev/null

# Enumerate SGID binaries
find / -perm -2000 -type f 2>/dev/null

Cross-reference unusual binaries against GTFOBins to check if they spawn shells, read restricted files, or load shared libraries.

2. Linux File Capabilities Modern Linux distributions often replace full SUID bits with granular capabilities (such as `cap_setuid+ep` or `cap_dac_read_search+ep`). Many administrators overlook these during standard permission audits.

bash

# Enumerate all file capabilities recursively
getcap -r / 2>/dev/null

If a binary like python3, perl, or tar has cap_setuid+ep, it can trivially elevate to UID 0:

bash

python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

3. Defensive Visibility with Linux Auditd To detect privilege escalation attempts and unauthorized capability abuse on critical servers, configure `/etc/audit/rules.d/audit.rules`:

ini

# Monitor execution of setuid/setgid syscalls
-a always,exit -F arch=b64 -S setuid -S setgid -S setreuid -S setregid -k priv_esc_calls

# Monitor modifications to cron directories
-w /etc/crontab -p wa -k cron_mod
-w /etc/cron.d/ -p wa -k cron_mod

Key Takeaways - Always check `getcap -r /` alongside standard `find` SUID sweeps. - Use `pspy` in lab environments to observe unprivileged cron scripts executing on short intervals.