In Linux privilege escalation testing, why are SUID binaries commonly checked?

• A. SUID binaries are always safe and cannot be exploited.
• B. SUID binaries control file permissions for the owner.
• C. SUID binaries ensure system stability.
• D. Listing and examining SUID binaries for misconfigurations that could grant elevated privileges.

Answer: (D)

SUID binaries run with the privileges of the file owner, typically root, because of the set-user-ID-on-execution bit. In privilege escalation testing, you enumerate these binaries to spot misconfigurations or vulnerabilities that could let a user execute code with elevated rights. Legitimate SUID programs exist to perform privileged tasks, but bugs or insecure handling—such as improper input validation, reliance on environment variables, or calling other programs without strict checks—can create paths to privilege escalation. By listing and examining SUID binaries for misconfigurations or weaknesses, you can identify potential vectors to gain higher privileges. The other statements aren’t correct because SUID binaries are not inherently safe, they don’t simply control file permissions, and they aren’t about guaranteeing system stability.