Set-user-ID and Linux capabilities

Mechanism

Set-user-ID changes effective identity when an executable is started, subject to mount and tracing conditions. File capabilities grant selected privileges instead of the entire root identity. Exploitability depends on how the program uses and drops these privileges, whether it launches helpers, and what attacker-controlled state it trusts.

Practical method

Inventory candidate executables, inspect ownership and mode, and query file capabilities. Trace the application privilege lifecycle in the isolated challenge. Identify operations requiring the granted authority and whether untrusted paths, environment values, or input influence them.

find /opt/challenge -type f -perm -4000 -ls
getcap -r /opt/challenge 2>/dev/null

Interpreting evidence

A privilege bit is a starting point. Confirm the effective credentials or capabilities at the sensitive operation and whether the program intentionally drops them before processing input.

Pitfalls and limits

Scripts do not generally receive ordinary set-user-ID execution semantics on Linux. no_new_privs and nosuid affect elevation. Capability sets interact across execution and namespaces, so a file label alone is incomplete.