Lion Cipher Lab
Linux file permissions, ownership, and the SUID bit
- Foundations
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Almost every Linux privilege-escalation writeup you will ever read hinges on two things a beginner is never actually taught: how to read a file's permissions, and what the SUID bit does. People memorise 'run find / -perm -4000' as a magic incantation without understanding that they are listing every program on the machine that runs as its owner instead of as them -- and that a single abusable one is the difference between a normal shell and root. This lab teaches the fundamental from zero. You learn to decode the 10-character mode string that ls -l prints (the type, then read/write/execute…
What you'll learn
- decoding the 10-character ls -l mode string: file type plus read/write/execute for owner, group, and other
- reading and writing permissions in BOTH symbolic form (u+x, go-w) and octal form (644, 755, 700), and predicting the result before you check it
- understanding the octal math where read=4, write=2, execute=1, and each digit is owner / group / other
- changing ownership and group with chown and chgrp, and telling 'Permission denied' apart from 'Operation not permitted'
- understanding the SUID bit: a set-user-ID program runs with the FILE OWNER's privileges, not the caller's -- which is why passwd and sudo are SUID root
- enumerating every SUID-root binary on a machine with find / -perm -4000 -type f, the first move in privilege-escalation triage
- using GTFOBins to judge whether an SUID or sudo-allowed binary is abusable, and why any writable or shell-spawning SUID-root binary is instant root
- recognising SGID and the sticky bit (why /tmp is drwxrwxrwt), and the modern safer alternative to blanket SUID-root: Linux capabilities plus removing the bit with chmod u-s
Steps in this lab
- Read the mode string: what ls -l is actually telling you
- chmod in symbolic form: change permissions by name
- chmod in octal form: the numbers 644, 755, 700
- Ownership: chown, chgrp, and two very different errors
- The SUID bit: a program that runs as its OWNER, not as you
- The attacker's lens: enumerate SUID binaries and meet GTFOBins
- SGID, the sticky bit, and the judgment: when SUID is wrong, and the better way
- What you did, and the reflex to keep