The SUID bit: a program that runs as its owner

A little 's' that means a lot

Normally a program runs with your powers. But a file can carry a special mark called the SUID bit, and then it runs with the powers of whoever owns the file. If root owns it, the program runs as root — even when you start it.

You can see the mark as a small s in the permissions. Let's make a harmless example and look at it:

ls -l /tmp/demo

In the terminal

student@vulntech:~$ ls -l /tmp/demo
-rwsr-xr-x 1 root root 34664 Oct 18 20:15 /tmp/demo

See the -rwsr-xr-x? That s where an x would be is the SUID bit. This is fine for a few trusted system tools (like sudo itself), but a SUID copy of a shell such as bash, owned by root, is a classic attacker trap: running it hands anyone a root shell.

Tip: You will often see attackers hide such a file with an innocent name in /tmp, /opt or /dev/shm. The giveaway is the s and the root owner.