Why a stray SUID bit is dangerous

The risk in one line

A file with the SUID bit runs with the privileges of its owner. When the owner is root, the program runs as root for anyone who starts it. For a tool that can launch other commands — like find — that is a gift to an attacker:

ls -l /usr/bin/find

In the terminal (the 's' in the owner's slot is the SUID bit — find runs as root)

student@vulntech:~$ ls -l /usr/bin/find
-rwsr-xr-x 1 root root 256220 Jan  8  2023 /usr/bin/find

With that bit set, any user can run find . -exec /bin/sh -p \; and land a root shell. passwd and mount are SUID for good reasons; a search tool is not. Your job is to spot the ones that do not belong and remove the bit.

Tip: Audit SUID binaries regularly with find / -perm -4000 -type f and compare the list against what you expect. Anything unfamiliar is worth investigating.