What the SUID bit means

Who do programs run as?

Normally a program runs as you: it can touch only what your account can touch. The SUID bit (Set-owner User ID) changes that — a SUID program runs with the privileges of the file's owner. When the owner is root, the program runs as root no matter who starts it.

You can see the bit in a long listing: an s where the owner's x would be. Compare a normal binary with a SUID one:

ls -l /usr/bin/whoami
ls -l /usr/bin/passwd

In the terminal

student@vulntech:~$ ls -l /usr/bin/whoami
-rwxr-xr-x 1 root root 38760 Sep 20  2022 /usr/bin/whoami
student@vulntech:~$ ls -l /usr/bin/passwd
-rwsr-xr-x 1 root root 70476 Dec 14  2025 /usr/bin/passwd

passwd is SUID-root on purpose — changing your password needs to edit a root-owned file. The danger is a program that is SUID-root by mistake and can be made to do something its author never intended.

Find the odd one out

From Module 1 you know how to list every SUID file. Run it again and look for a tool that has no business running as root:

find / -perm -4000 -type f 2>/dev/null

In the terminal

student@vulntech:~$ find / -perm -4000 -type f 2>/dev/null
/usr/bin/chfn
/usr/bin/chsh
/usr/bin/find
/usr/bin/gpasswd
/usr/bin/mount
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/su
/usr/bin/sudo
/usr/bin/umount
/usr/lib/dbus-1.0/dbus-daemon-launch-helper

• su, sudo, passwd, mount, chsh — expected, these genuinely need root.
• /usr/bin/find — a file-search tool. There is no good reason for this to be SUID-root. That is your way in.