Stripping the SUID bit

Remove the bit

Removing the SUID bit is one command, run as root. u-s means ‘take the set-user-ID bit off the owner’:

sudo chmod u-s /usr/bin/find
ls -l /usr/bin/find

In the terminal (the 's' is gone — find now runs as whoever starts it)

student@vulntech:~$ sudo chmod u-s /usr/bin/find
[sudo] password for student:
student@vulntech:~$ ls -l /usr/bin/find
-rwxr-xr-x 1 root root 256220 Jan  8  2023 /usr/bin/find

That is the whole fix. find still works for everyone; it simply no longer carries root's power. The escalation path is closed.