1

This question already has an answer here:

I am trying to learn about SUIDs and have run into bit of a stumbling block - I have a ubuntu 16.04 system. I have set a few default binaries such as vim, find et al. to have SUID permissions as follows:

-rwsr-xr-x 1 root root 1064592 11月 25  2016 /usr/bin/vim.tiny
-rws--x--x 1 root root 221768  2月  8  2016 /usr/bin/find

now in my mind when these binaries are run they should be run with an EUID of root. So with vim.tiny as a low privileged user I try a simple escape to get a bash shell:

:!bash

I then run id and I do not have a EUID of root - which is confusing me. Output of id is as follows:

uid=1001(lowpriv) gid=1001(lowpriv) groups=1001(lowpriv)

However if I use the same binary and create a simple file it will end up with the following permissions and ownership:

-rw-rw-r-- 1 root    lowpriv   56  4月 13 12:58 test

can anyone explain to me what is going on? I checked where the system is mounted and it's clear that the nosuid permission is not set.

/dev/sda1 on / type ext4 (rw,relatime,errors=remount-ro,data=ordered)

So I thought maybe this is some catch of vim.tiny which enumerates obtains the UIDs and RIDs and does some sort of comparison and that's why my lame escape attempt doesn't work?

I then try to exploit find in a similar fashion using find:

find / -exec /usr/bin/awk 'BEGIN {system("/bin/bash")}' \;

in my mind this should drop me a nice bash shell with my lowpriv account with a EUID of root - again I get the same result. Can someone explain why having the SUID bit set in these instances is not actually giving me EUID root permissions?

As another test I tried using the same command to cat /etc/shadow - still no luck:

$ find / -exec /usr/bin/awk 'BEGIN {system("/bin/cat /etc/shadow")}' \;
/bin/cat: /etc/shadow: Permission denied

can someone in the linux world please explain to me the super-noob why this is so?

EDIT: I understand the solution here: SUID not used after exploit

However if someone could provide me some actual commands/code to use the vulnerable SUIDS and achieve root that would be much appreciated. e

marked as duplicate by Steffen Ullrich, Community Apr 13 '18 at 5:20

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Could you post the output of stat on the files? – forest Apr 13 '18 at 4:59
  • Stat Outputs: lowpriv@rootme-VirtualBox:~$ stat /usr/bin/find File: '/usr/bin/find' Size: 221768 Blocks: 440 IO Block: 4096 regular file Device: 801h/2049d Inode: 133231 Links: 1 Access: (4711/-rws--x--x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2018-04-13 13:01:07.780000000 +0900 Modify: 2016-02-08 08:18:24.000000000 +0900 Change: 2018-04-13 12:53:23.208000000 +0900 Birth: - – SlimeyToad Apr 13 '18 at 5:11
  • stat output2: lowpriv@rootme-VirtualBox:~$ stat /usr/bin/vim.tiny File: '/usr/bin/vim.tiny' Size: 1064592 Blocks: 2080 IO Block: 4096 regular file Device: 801h/2049d Inode: 134444 Links: 1 Access: (4755/-rwsr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2018-04-13 11:40:17.300000000 +0900 Modify: 2016-11-25 05:51:22.000000000 +0900 Change: 2018-04-13 11:39:14.724000000 +0900 Birth: - – SlimeyToad Apr 13 '18 at 5:12