• https://linuxconfig.org/how-to-use-special-permissions-the-setuid-setgid-and-sticky-bits

setuid - Set User ID upon Execution

• if this permission bit is set, it can allow a user to execute a program or script with the permissions of another user (privesc)

ID these files

• find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
• eg: a stack overflow binary - we can reverse, id a vulnerability, exploit it

setgid - Set Group ID

• if this is set, we can run binaries as if we were part of the group that created them.

ID these files

• find / -uid 0 -perm -6000 -type f 2>/dev/null
• find / -user root -perm -6000 -exec ls -ldb {} \; 2>/dev/null

---

GTFOBins

• https://gtfobins.github.io/
• eg: apt-get
  • sudo apt-get update -o APT::Update::Pre-Invoke::=/bin/sh
• It is worth familiarizing ourselves with as many GTFOBins as possible to quickly identify misconfigurations when we land on a system that we must escalate our privileges to move further.