A SUID binary is not inherently exploitable for privilege escalation. The problem is when there is a vulnerability in the software (ex. many CTFs have a SUID binary that contains a buffer overflow vulnerability that can be exploited for privilege escalation) or an administrator sets the SUID bit on a binary that should not have it set. An extreme example of the latter would be an admin setting
vim to SUID with owner
root, allowing users to execute bash commands as root within a vim session (
A quick reference check on this led me to this article on Linux privesc. You may find the section
3. Exploiting SUID Executables helpful.
ping utility requires the binary to be owned by root and the SUID bit set because it sends/receives ICMP requests using "raw sockets" which only root can do. You would need to find either a vulnerable version of
ping (I assume this is why @Arminius asked for the version) or a way to inject code/commands. Personally I have never been able to leverage
ping in pentests or CTFs for privilege escalation, but that certainly doesn't mean it's not possible :)
A famous similar example is older versions of
nmap which supported the
--interactive mode. If the SUID bit was set (many scans such as the default syn scan
-sS "require raw-packet privileges") then you could drop to a root shell from the interactive mode. More info is in the privesc link above on this if you're interested.
If you are looking at a CTF challenge, I typically start looking for obvious non-default SUID programs (ex.
/opt/myprog/test.bin) first, and then come back to the "normal" suid programs like
/bin/ping as a last resort after other checks are fruitless.
pingare you dealing with? (
cap_net_rawinstead of using the suid...