Linux Privesc Playground
Enumerate SUID binaries on a simulated box and find the one GTFOBins turns straight into a root shell.
Enumerate SUID binaries on a simulated machine and find the one that GTFOBins turns into a root shell. SUID means "run as the file's owner", and a single unnecessary SUID binary is often the whole path to root.
How to use it
- List SUID binaries on the system.
- Identify the one that should not be there.
- Use its documented capability to become root.
What to take away
Many normal tools escalate when SUID
find, vim, less and awk can all run commands. Harmless normally; a root shell when SUID.
GTFOBins is the reference
It catalogues exactly how each binary can be abused for shell access, file read and file write. Both sides use it.
Check sudo too
sudo -l often reveals a permitted command that shells out — the same escalation by a different route.
Frequently asked questions
What does the SUID bit do?
Runs the program as its owner rather than as you. Necessary for a few tools like passwd; dangerous on anything that can execute arbitrary commands.
How do I find SUID binaries?
find / -perm -4000 -type f 2>/dev/null. Comparing that against a known-good baseline is what makes the result meaningful.
Where this fits in the course
This security lab pairs with Path 16 — Advanced — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Windows Privesc Playground — A misconfigured service runs as SYSTEM with a writable binary path. Replace it and escalate — no exploit needed.
- Terminal Simulator — A safe, in-browser Linux terminal with a fake filesystem. Practice ls, cd, cat, grep, find, whoami and more without spinning up a VM.
- Docker Escape Playground — A container mounts the host's Docker socket. Use it to spin up a privileged container and step onto the host itself.
- Command Injection Sandbox — A "ping this host" tool glues your input into a real shell command. Chain a second command onto the intended one.