-- Find unexpected setuid binaries on disk -- -- false positives: -- * new software -- -- tags: persistent seldom -- platform: posix SELECT GROUP_CONCAT(path) AS paths, gid, uid, mode, type, size, data, sha256 FROM ( SELECT file.path, file.gid, file.uid, file.inode, file.mode, file.type, file.size, magic.data, hash.sha256 FROM file LEFT JOIN hash ON file.path = hash.path LEFT JOIN magic ON file.path = magic.path WHERE file.directory IN ( '/bin', '/opt/google-cloud-sdk/bin', '/opt/homebrew/bin', '/opt/homebrew/sbin', '/sbin', '/etc', '/tmp', '/var/lib', '/usr/libexec', '/usr/bin', '/usr/lib', '/usr/lib64', '/usr/libexec', '/usr/lib/jvm/default/bin', '/usr/local/bin', '/usr/local/lib', '/usr/local/lib64', '/usr/local/libexec', '/usr/local/sbin', '/usr/sbin', '/var/tmp' ) AND type = 'regular' AND mode NOT LIKE '0%' AND mode NOT LIKE '1%' AND mode NOT LIKE '2%' AND NOT ( mode LIKE '4%11' AND uid = 0 AND gid = 0 AND file.path IN ( '/bin/cdda2wav', '/bin/cdrecord', '/bin/icedax', '/bin/mount.nfs', '/bin/mount.nfs4', '/bin/readcd', '/bin/readom', '/bin/rscsi', '/bin/staprun', '/bin/sudo', '/bin/sudoedit', '/bin/umount.nfs', '/bin/umount.nfs4', '/bin/wodim', '/sbin/cdda2wav', '/sbin/cdrecord', '/sbin/icedax', '/sbin/mount.nfs', '/sbin/mount.nfs4', '/sbin/readcd', '/sbin/readom', '/sbin/rscsi', '/sbin/umount.nfs', '/sbin/umount.nfs4', '/sbin/userhelper', '/sbin/wodim', '/usr/bin/cdda2wav', '/usr/bin/cdrecord', '/usr/bin/icedax', '/usr/bin/mount.nfs', '/usr/bin/mount.nfs4', '/usr/bin/readcd', '/usr/bin/readom', '/usr/bin/rscsi', '/usr/bin/staprun', '/usr/bin/sudo', '/usr/bin/sudoedit', '/usr/bin/umount.nfs', '/usr/bin/umount.nfs4', '/usr/bin/wodim', '/usr/libexec/security_authtrampoline', '/usr/sbin/cdda2wav', '/usr/sbin/cdrecord', '/usr/sbin/icedax', '/usr/sbin/mount.nfs', '/usr/sbin/mount.nfs4', '/usr/sbin/readcd', '/usr/sbin/readom', '/usr/sbin/rscsi', '/usr/bin/chsh', '/usr/bin/chfn', '/bin/chsh', '/bin/chfn', '/usr/sbin/umount.nfs', '/usr/sbin/umount.nfs4', '/usr/sbin/userhelper', '/usr/sbin/wodim' ) ) AND NOT ( mode LIKE '4%55' AND uid = 0 AND gid = 0 AND file.path IN ( '/bin/at', '/bin/atq', '/bin/atrm', '/bin/chage', '/bin/chfn', '/bin/chsh', '/bin/crontab', '/bin/expiry', '/bin/fusermount-glusterfs', '/bin/fusermount', '/bin/fusermount3', '/bin/gpasswd', '/bin/ksu', '/bin/mount', '/bin/ndisc6', '/bin/newgidmap', '/bin/newgrp', '/bin/newuidmap', '/sbin/doas', '/bin/doas', '/usr/bin/newgidmap', '/bin/nvidia-modprobe', '/bin/passwd', '/bin/pkexec', '/bin/ps', '/bin/rdisc6', '/bin/rltraceroute6', '/bin/sg', '/bin/su', '/bin/sudo', '/bin/firejail', '/sbin/firejail', '/usr/bin/firejail', '/usr/sbin/firejail', '/bin/sudoedit', '/bin/suexec', '/bin/ubuntu-core-launcher', '/bin/umount', '/bin/vmware-user-suid-wrapper', '/bin/vmware-user', '/sbin/chage', '/sbin/chfn', '/sbin/chsh', '/sbin/crontab', '/sbin/usernetctl', '/usr/sbin/usernetctl', '/sbin/expiry', '/sbin/fusermount', '/sbin/fusermount3', '/sbin/gpasswd', '/sbin/grub2-set-bootflag', '/sbin/ksu', '/sbin/mount.nfs', '/sbin/mount.nfs4', '/sbin/mount', '/sbin/ndisc6', '/sbin/newgrp', '/sbin/nvidia-modprobe', '/sbin/pam_timestamp_check', '/sbin/passwd', '/sbin/pkexec', '/sbin/rdisc6', '/sbin/rltraceroute6', '/sbin/sg', '/sbin/su', '/sbin/sudo', '/sbin/sudoedit', '/sbin/suexec', '/sbin/umount.nfs', '/sbin/umount.nfs4', '/sbin/umount', '/sbin/unix_chkpwd', '/usr/bin/at', '/usr/bin/atq', '/usr/bin/atrm', '/usr/bin/batch', '/usr/bin/chage', '/usr/bin/chfn', '/usr/bin/chsh', '/usr/bin/crontab', '/usr/bin/doas', '/usr/bin/expiry', '/usr/bin/fusermount-glusterfs', '/usr/bin/fusermount', '/usr/bin/fusermount3', '/usr/bin/gpasswd', '/usr/bin/ksu', '/usr/bin/login', '/usr/bin/mount', '/usr/bin/ndisc6', '/usr/bin/newgrp', '/usr/bin/newuidmap', '/usr/bin/nvidia-modprobe', '/usr/bin/passwd', '/usr/bin/pkexec', '/usr/bin/quota', '/usr/bin/mullvad-exclude', '/usr/sbin/mullvad-exclude', '/usr/bin/rdisc6', '/usr/bin/rltraceroute6', '/usr/bin/sg', '/sbin/mullvad-exclude', '/bin/mullvad-exclude', '/usr/bin/su', '/usr/local/bin/doas', '/usr/bin/sudo', '/usr/bin/sudoedit', '/usr/bin/keybase-redirector', '/bin/keybase-redirector', '/usr/bin/suexec', '/usr/bin/top', '/usr/bin/ubuntu-core-launcher', '/usr/bin/umount', '/usr/bin/vmware-user-suid-wrapper', '/usr/bin/vmware-user', '/usr/libexec/libgtop_server2', '/usr/lib/mail-dotlock', '/usr/lib/xf86-video-intel-backlight-helper', '/usr/lib/Xorg.wrap', '/usr/lib64/mail-dotlock', '/usr/lib64/xf86-video-intel-backlight-helper', '/usr/lib64/Xorg.wrap', '/usr/libexec/authopen', '/usr/libexec/polkit-agent-helper-1', '/usr/libexec/qemu-bridge-helper', '/usr/libexec/Xorg.wrap', '/usr/sbin/chage', '/usr/sbin/chfn', '/usr/sbin/chsh', '/usr/sbin/crontab', '/usr/sbin/doas', '/usr/sbin/expiry', '/usr/sbin/fusermount', '/usr/sbin/fusermount3', '/usr/sbin/gpasswd', '/usr/sbin/grub2-set-bootflag', '/usr/sbin/ksu', '/usr/sbin/mount.nfs', '/usr/sbin/mount.nfs4', '/usr/sbin/mount', '/usr/sbin/ndisc6', '/usr/sbin/newgrp', '/usr/sbin/nvidia-modprobe', '/usr/sbin/pam_timestamp_check', '/usr/sbin/passwd', '/usr/sbin/pkexec', '/usr/sbin/rdisc6', '/usr/sbin/rltraceroute6', '/usr/sbin/sg', '/usr/sbin/su', '/usr/sbin/sudo', '/usr/sbin/sudoedit', '/usr/sbin/suexec', '/usr/sbin/traceroute', '/usr/sbin/traceroute6', '/usr/sbin/umount.nfs', '/usr/sbin/umount.nfs4', '/usr/sbin/umount', '/usr/sbin/unix_chkpwd' ) ) AND NOT ( mode = '4754' AND uid = 0 AND gid = 30 AND file.path IN ('/usr/sbin/pppd', '/sbin/pppd') ) AND NOT ( mode = '6755' AND uid = 0 AND gid = 0 AND file.path IN ( '/bin/mount.cifs', '/bin/mount.smb3', '/bin/unix_chkpwd', '/sbin/mount.cifs', '/sbin/mount.smb3', '/sbin/unix_chkpwd', '/usr/bin/mount.cifs', '/usr/bin/mount.smb3', '/usr/bin/unix_chkpwd', '/usr/lib/xtest', '/usr/lib64/xtest', '/usr/sbin/mount.cifs', '/usr/sbin/mount.smb3', '/usr/sbin/unix_chkpwd' ) ) AND NOT ( mode = '4110' AND uid = 0 AND gid = 156 AND file.path IN ('/bin/staprun', '/usr/bin/staprun') ) ) GROUP BY inode