Concepts to consider

Understanding `setuid`

The setuid (Set User ID) permission is a special type of file permission in Unix and Linux systems that allows users to run an executable file with the permissions of the file's owner rather than the permissions of the user running the file. Here’s a detailed explanation:

Basics of File Permissions

In Unix and Linux, every file and directory has associated permissions that control who can read, write, or execute them. These permissions are represented for three categories:

Owner: The user who owns the file.
Group: The group that owns the file.
Others: All other users.

Permissions are typically displayed as a string of ten characters (e.g., -rwxr-xr-x):

The first character indicates the type of file (- for regular file, d for directory, l for symbolic link, etc.).
The next three characters are the owner's permissions (read, write, execute).
The next three characters are the group's permissions.
The final three characters are the others' permissions.

Special Permissions: `setuid`, `setgid`, and `sticky bit`

In addition to the basic permissions, there are special permissions that provide additional capabilities:

setuid (Set User ID on execution): When set on an executable file, this permission allows users to execute the file with the privileges of the file’s owner.
setgid (Set Group ID on execution): When set on an executable file, this permission allows users to execute the file with the privileges of the file’s group.
Sticky bit: Typically used on directories, it allows files within the directory to be deleted or renamed only by their owner.

The `setuid` Permission

When setuid is set on an executable file, it changes the execution user context. Here’s how it works:

Without setuid: When a user executes a file, it runs with the user's permissions.
With setuid: When a user executes a file, it runs with the permissions of the file's owner, which is often the root user.

This mechanism is used for tasks that require elevated privileges. A common example is the passwd command, which allows users to change their passwords. The passwd command needs to update system files that are writable only by root, so it is set with the setuid permission.

bandit 19

Task

To gain access to the next level, you should use the setuid binary in the homedirectory. Execute it without arguments to find out how to use it. The password for this level can be found in the usual place (/etc/bandit_pass), after you have used the setuid binary.

Solution

When we access to the machine we can see a setuid called bandit20-do in the home directory. Run this setuid

bandit19@bandit:~$ ./bandit20-do
Run a command as another user.
 Example: ./bandit20-do id

Then knowing that we can run this for get the password

bandit19@bandit:~$ ./bandit20-do cat /etc/bandit_pass/bandit20
VxCazJaVykI6W36BkBU0mJTCM8rR95XT
bandit19@bandit:~$