I know that /bin/bash has certain built-in protections that prevent the abuse of the Set-UID mechanism. So if I create a custom binary and execute it, it won't run with SUID 0 (refer the below image). Then how does running passwd in bash shell runs with root privilege?
C code of system file in the above image:
#include <stdlib.h>
int main() {
system("ls");
}
system()
runs/bin/sh
, and if that's Bash, there's your issue. – ilkkachu Mar 17 '24 at 13:14