A municipal host has a custom script wrapper marked SUID root that is not a standard system binary. What should the tester conclude?
Select an answer to reveal the explanation.
Short Explanation
A homemade "run me as root" badge on a script wrapper deserves a hard look. Unusual SUID/SGID programs are high-value enum targets — the kernel does not bless custom wrappers just for existing. Filename vibes are not a risk model.
Full Explanation
A municipal host with a custom script wrapper marked SUID root (not a standard system binary) is a high-value privilege-escalation enumeration target. Non-standard SUID/SGID programs often lack the hardening assumptions of vetted system tools and deserve careful review for unsafe file operations, command injection, or path issues.
The kernel does not make any SUID bit automatically harmless for custom binaries. Custom SUID wrappers are not limited to printer queues. Ignoring SUID findings unless the filename contains the word exploit is an arbitrary and unsafe heuristic.
Exam caveat: inventory both standard and custom SUID/SGID files; prioritize unusual ownership and writable dependencies.
Operational check: locate non-standard SUID binaries on the civic host, note permissions and wrappers, and assess whether unprivileged users can influence their inputs or dependent paths. Recommend removing unnecessary SUID bits from municipal custom tooling. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.