0

I'm trying to check how the SUID works, and I have created a binary with the shc compiler from this script:

#!/bin/bash
echo "I'm the script"
sleep 5
cat /srv/test/secret

The binary is owned by user kali (/usr/bin/hehe). I added execution permissions and the SUID bit.

.rwsrwxr-x kali kali 15 KB Fri Feb  9 00:49:58 2024  /usr/bin/hehe

I'm trying to execute it with franlol user.

As far as I understand, with the s bit, the file should be run by the user kali because he is the owner, even if it is executed by user franlol.

Why the binary/script cannot do the cat to a file owned by the same user than the binary owner?

What is not correct in this flow?

┌──(franlol㉿kali)-[~]
└─$ lsa -l /srv/test/secret
.rwx------ kali kali 26 B Fri Feb  9 00:46:01 2024  /srv/test/secret

┌──(franlol㉿kali)-[~] └─$ lsa -l /usr/bin/hehe
.rwsrwxr-x kali kali 15 KB Fri Feb 9 00:49:58 2024  /usr/bin/hehe

┌──(franlol㉿kali)-[~] └─$ hehe I'm the script cat: /srv/test/secret: Permission denied

Also, while the execution is doing the 5s sleep, If I do a ps aux | grep hehe I see that the execution user is not Kali, and as far as I understand, if the hehe script is owned by the user kali, it should be run by the same owner.

0 Answers0