Nebula: Level 00

The goal of this level is to find a Set User ID program that will run as the “flag00” account.

Setuid is a Unix access rights flag that allow users to run an executable with the file system permissions of the executable’s owner.

For example the following executable:

$ stat /usr/bin/passwd
  File: /usr/bin/passwd
  Size: 63736     	Blocks: 128        IO Block: 4096   regular file
Device: 801h/2049d	Inode: 2237        Links: 1
Access: (4755/-rwsr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)

will be executed as root (Uid 0), no matter what the current user is. This allows un-privileged user to change their password by editing /etc/shadow (root owner) using passwd.

Now going back to the challenge, we can use find to search for programs that have SUID by using the flag -perm -u=s, where the flag -perm checks for the file permission bits and -u=s defines that check to SPECIAL BIT (X000), so in short the command will bring any file that has a special bit, including SUID.

Now joining everything, and piping errors to 2>/dev/null for better readability:

find / -perm -u=s 2>/dev/null

OR

find / -perm 4000 2>/dev/null

This is enough to find the file, but we can filter even more by using grep and passing the user flag00 as requested by the challenge.

find / -perm -u=s 2>/dev/null | grep flag00