Defuse a SUID privilege escalation

Scenario

During an audit of web1 you find this in /usr/local/bin:

$ ls -l /usr/local/bin/legacy-report
-rwsrwxrwx 1 root staff 48120 Mar  3  2024 /usr/local/bin/legacy-report

Two problems are stacked on top of each other:

• the setuid bit is on (s in the owner's execute slot): whoever runs this file, it executes as root;
• the file is group- and world-writable: anyone on the box can replace its contents.

Together that's a complete privilege escalation: write a shell into the file, run it, you're root. This exact pattern (a forgotten in-house tool with sloppy permissions) is one of the most common findings in real privesc audits.

Your job

Write the commands in fix.sh that defuse the binary without breaking it:

• remove the setuid bit; the tool works fine as a normal user
• make sure only root can modify it (no group write, no world write)
• regular users must still be able to run it
• it stays owned by root (root:staff or root:root; the owner is what matters)

How it's graded

Evaluated: your chmod/chown commands are applied to a model of the filesystem, then the resulting mode, ownership, and per-user access are checked, the same resolution a real kernel does.

Teaches: SUID auditing and least-privilege file modes, a staple of every Linux hardening checklist and privesc CTF.