Typorithm · hard

Privilege Escalation & Hardening

privesc-hardeningsecuritypriveschardeningsuid

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Privilege Escalation & Hardening

Offensive (Authorized)

Privilege escalation abuses misconfigurations — overly broad sudo rights, risky SUID binaries, weak permissions — to gain higher access. Defenders run the same checks to harden: patch, enforce least privilege, and remove unnecessary SUID bits.

After gaining a low-privilege foothold, escalation looks for misconfigurations that hand out more access: a sudo rule that is too permissive, a SUID binary that can be tricked, world-writable files in the wrong place.

sudo -l reveals what the user can already run as root, and find / -perm -4000 lists SUID binaries that execute with their owner's privileges. Both are the first things an attacker — and a tester — checks.

The defensive flip side uses the very same commands. chmod u-s strips the SUID bit from a binary that does not need it, and the hardening rule is constant: patch promptly, grant least privilege, and drop every SUID bit you cannot justify.

sudo -l exposes overly broad root rights.

find / -perm -4000 lists abusable SUID binaries.

Harden by patching, least privilege, and dropping SUID.

sudo -l
find / -perm -4000 -type f 2>/dev/null
chmod u-s /usr/bin/legacy
# harden: patch, least privilege, drop SUID

Read the implementation

Connect each part of the code to the concept before you type.

1. List sudo rights

sudo -l shows what the current user may run as root — overly broad rules are a classic escalation path.

sudo -l

2. Find SUID binaries

This searches the filesystem for SUID files (the -4000 permission bit), which run as their owner and can be abused if misconfigured.

find / -perm -4000 -type f 2>/dev/null

3. Silence errors

2>/dev/null discards permission-denied errors so the real results stand out.

2>/dev/null

4. Drop the SUID bit

chmod u-s removes the SUID bit from an unneeded binary — a direct hardening step a defender takes.

chmod u-s /usr/bin/legacy

5. Hardening checklist

The defensive remedy: keep systems patched, grant least privilege, and remove unnecessary SUID bits.

# harden: patch, least privilege, drop SUID

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.