2

I'm looking this interesting project

https://gtfobins.github.io/

But I don't understand some assumption. For example, if you consider the mv command:

https://gtfobins.github.io/gtfobins/mv/

They say it can be exploited to access filesystem and escalate privileges. Then they make an example about SUID:

sudo sh -c 'cp $(which mv) .; chmod +s ./mv'
LFILE=file_to_write 
TF=$(mktemp) 
echo "DATA" > $TF 
./mv $TF $LFILE

Ok, I gave SUID permissions to mv and it can be used to write in a non-permitted file.

Why is it so strange?Every SUID file can potentially do it, or not?

Moreover I've never seen any default configuration of mv with SUID bit set. Why is it considered dangerous?

3
  • 4
    Yeah, that page makes no sense. "If you give it root privileges, or use sudo, then you can do damage as root!" In other news, if you dump a bucket of water over your head, you'll be wet.
    – gowenfawr
    Nov 17, 2018 at 22:18
  • No sense indeed. Wrong SUID is the problem, not mv. Or vim, or ping. And this example makes even less sense. If you can run sudo sh, why bother creating a suid mv? Create a SUID bash instead!
    – ThoriumBR
    Dec 10, 2020 at 0:16

4 Answers 4

3

Looks like you got your question answered by a project member on the project's issue tracker:

I think you already have you question answered, but let me add something.

"Every file with the SUID bit can be potentially dangerous"

Well not exactly, there are perfectly legit binaries that can only operate as SUID (root), e.g., passwd, ping, etc. even su or sudo and that are not considered dangerous at all as is (unless bugged on misconfigured). For example, only who knows the root password can use su.

"I've never seen mv with SUID bit set in any distribution"

That's right, but misconfigurations happens. GTFOBins may help the following example workflow:

enumerate all the SUIDs and programs executable via sudo (with known credentials);

look them up in GTFOBins;

understand what you can do with them and exploit them (attack scenario) or fix them (defense scenario).

I agree that binaries like mv are trivial, but are there mainly for completeness.

Unfortunately, I see a lot of people online misinterpreting the site, and assuming that they can "exploit" one of those binaries by following the PoC verbatim (i.e. trying to set a binary as SUID when it is not already that way). But if you know the appropriate usage of the site, it can be a useful tool in your toolbox for both attack and defense, and may be quicker than digging through the manpage for the binary (although this should likely be something you do anyway).

1

It is important to note that this is not a list of exploits, and the programs listed here are not vulnerable per se, rather, GTFOBins is a compendium about how to live off the land when you only have certain binaries available.

You're completely misunderstanding the purpose of the site. Those tools are not exploitable. The site explicitly says that it's not a list of exploits.

What that site is for is, once you have already gained privileges you shouldn't have, how to leverage them for more access using the binaries already present on an ordinary system. The assumption is that you either cannot retrieve other binaries, or are limited in what commands you can execute. GTFOBins is about helping you get as far as possible under those constraints.

Using mv is a kind of silly example, but also illustrative in a sense: suppose you've got the ability to launch a process as root / add setuid to a binary, and you need to move a file? Well, you can use mv for that. This is obvious, in one sense - moving files is what mv is for, after all - but also some people might not realize that you can SUID it and then use it to move files that aren't normally movable.

1
  • I don't think the case of being able to add SUID to something is very likely.. it's much more likely that it will already be in sudoers Dec 10, 2020 at 21:40
0

SUID (Set User ID) allows a user to run a program as owner of the program file rather than themselves.

So for example consider command passwd in general it changes user password, but actually it modifies shadow file.

If you look at permission set of a shadow file then notice the file is being owned by root and you don't have any permission on this file as the last three bit are not set.

$ ls -l /etc/shadow

-rw-r----- 1 root shadow 1134 Dec 1 11:45 /etc/shadow

Now if you look at permission set of passwd command then you can notice a new permission bit s.

$ ls -l /usr/bin/passwd

-rwsr-xr-x 1 root root 47032 Dec 1 11:45 /usr/bin/passwd

So this permission bit (-rws) is SUID which allows the users who launched the program to get the file owner's permission as well as execution permission, so when you are running this command you are running this as a root.

Similarly if you check permission bit of mv command you will have read & execute permission like passwd, but using that script you are assigning SUID to mv which will allow you to move or rename files that usually requires elevated access (for e.g. /etc/shadow)

1
  • I don't think this answers the question. The OP already knows what SUID does, but is asking about a specific scenario portrayed by a website. Dec 10, 2020 at 0:15
-4

Because it could be used for privilege escalation and the attacker would be able to get root on your system using SUID on this program.

1
  • 1
    This is not an answer. The question already states what it can be used for. The question is why this is strange.
    – schroeder
    Dec 6, 2020 at 13:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .