SUID env" Privilege Escalation (Quick Guide)

What SUID means

SUID (Set User ID) is a Linux permission that makes a program run with the privileges of its owner, not the user executing it.

When a binary looks like this:

-rwsr-xr-x

The s indicates SUID is set. If the owner is root, then the program runs with root privileges (effective UID = 0) regardless of who launched it.

Why /usr/bin/env becomes dangerous with SUID

env is normally a harmless utility used to run programs in a modified environment. Its core function is:

execute a command

So when env is SUID-root, it effectively becomes:

a root-privileged program launcher

This is dangerous because it allows execution of arbitrary commands using root privileges.

Exploitation concept

If /usr/bin/env has SUID set

running:

/usr/bin/env /bin/sh -p

results in:

• env executes with root privileges
• it launches /bin/sh
• -p prevents the shell from dropping privileges
• outcome: root shell

Why this is critical

SUID on execution utilities like env breaks system security because:

• it enables arbitrary command execution as root
• it bypasses normal privilege separation
• it can lead to full system compromise