Lesson 2 of 8

File System & Permissions

Linux's permission system is both a security feature and a common source of privilege escalation vulnerabilities. You will learn how file ownership, read/write/execute permissions, and special bits like SUID work, and why misconfigurations in these settings are frequently exploited by attackers. Understanding permissions is essential for both hardening systems and finding weaknesses in them.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "Linux file system hierarchy and permissions" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

Almost every professional security tool runs on Linux, and almost every server you will ever test runs Linux. Fluency in the terminal is not optional — it is the foundation that every other skill in this field is built on.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Navigate a Linux system confidently from the command line, write basic automation scripts to speed up repetitive tasks, and use the terminal-based security tools that are standard in professional penetration testing.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

File System & Permissions · Objective 1 of 4

VIDEO

Loading video…

Examine file permissions

Run 'ls -la /etc/passwd /etc/shadow /etc/sudoers' to see the permission bits on critical system files. The output shows permissions in the format '-rw-r--r--' where the first character is the file type, the next three are owner permissions (read/write/execute), the next three are group permissions, and the last three are world permissions. The /etc/shadow file should show '---------- 1 root shadow' — readable only by root and the shadow group. A misconfigured /etc/shadow that is world-readable is a critical finding because it exposes password hashes to any local user.

Create a file and set permissions

Run 'touch testfile.txt' to create an empty file, then 'chmod 600 testfile.txt' to set it so only the owner can read and write it. The chmod command accepts either octal notation (600 = rw-------) or symbolic notation (chmod u=rw,go= testfile.txt). Practice with common permission sets: 755 (rwxr-xr-x) for executable scripts, 644 (rw-r--r--) for regular files, and 700 (rwx------) for private directories. Run 'ls -la testfile.txt' after each chmod to verify the permissions changed correctly.

touch testfile.txt && chmod 600 testfile.txt && ls -la testfile.txt

Find SUID binaries

Run 'find / -perm -4000 -type f 2>/dev/null' to enumerate all SUID binaries, then cross-reference each result against GTFOBins at gtfobins.github.io. GTFOBins documents how legitimate Unix binaries can be abused to escalate privileges, escape restricted shells, or read/write files outside their intended purpose. Common SUID binaries that appear on GTFOBins include find, vim, python, nmap, and bash. A non-standard SUID binary in /tmp or a user's home directory is a strong indicator of a previously planted backdoor.

find / -perm -4000 -type f 2>/dev/null

Find world-writable files

Run 'find / -perm -002 -type f 2>/dev/null' to find all world-writable files — files that any user on the system can modify. World-writable scripts that are executed by cron jobs or other privileged processes are a classic privilege escalation vector: if you can write to a script that root runs, you can inject malicious commands. Also run 'find / -perm -002 -type d 2>/dev/null' to find world-writable directories, which allow any user to create or delete files within them. Document every world-writable file owned by root as a potential finding.

find / -perm -002 -type f 2>/dev/null

Previous: Terminal Basics & Navigation Next Lesson