Lion Cipher Lab
Escalate to root on your own Linux VM: SUID binaries, sudo rules, and GTFOBins
- Penetration Testing / Red Team
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Reading that a SUID binary or a NOPASSWD sudo rule 'could lead to privilege escalation' is abstract until you have actually turned one into a root shell with your own hands. This lab makes it concrete on a VM you own and can safely break: you deliberately plant the two most common real-world Linux privesc misconfigurations, then walk the exact path an attacker walks — enumerate the vector, look it up in GTFOBins, and run the one line that drops you to root. Doing it once permanently changes how you read a system: you stop seeing `find` or a sudo rule as 'just a tool' and start seeing…
What you'll learn
- what the SUID bit actually is: a binary runs with the FILE OWNER's privileges, not the caller's
- finding SUID-root binaries with `find / -perm -4000 -type f 2>/dev/null`
- using the exact GTFOBins SUID technique to spawn a root shell (and why `-p` matters on bash)
- enumerating your sudo rights with `sudo -l` and reading a NOPASSWD entry
- using a GTFOBins Sudo entry to break out of a permitted binary into a root shell
- the difference between enumeration (finding a vector) and exploitation (using it)
- the defense: dropping needless SUID bits, scoping sudo to exact non-shell-spawning commands, and reverting cleanly
Steps in this lab
- The one rule: your own throwaway VM, and nothing else
- What the SUID bit is — the idea the whole lab turns on
- Plant the SUID misconfiguration (deliberate, on your VM)
- Enumerate: find every SUID-root binary the way an attacker would
- Exploit the SUID bash — and why `-p` is the whole trick
- Fix and revert the SUID vector — leave no vulnerability armed
- Plant the second vector: a NOPASSWD sudo rule
- Enumerate and exploit the sudo rule with GTFOBins
- Fix and revert the sudo vector — and the least-privilege lesson
- What you actually did — enumeration vs exploitation vs defense