HTB Academy - Permission Management Quick Notes

Clean, copy-pasteable reminders for changing ownership and permissions, plus a short note on SUID/SGID and why they matter.

chmod: change permissions

Who, What, and How

• Who (classes): u = user/owner, g = group, o = others, a = all
• What (bits): r = read, w = write, x = execute
• How (operators): + add, - remove, = set exactly

Examples

Give read to everyone (keep existing bits otherwise):

chmod a+r shell && ls -l shell
# ...rw-r--r--  ... shell   (example)

Make a script executable only for the owner:

chmod u+x shell && ls -l shell
# ...rwxr--r--  ... shell   (example)

Give read/write to owner and group, read to others (octal):

chmod 664 notes.txt && ls -l notes.txt
# ...rw-rw-r--  ... notes.txt

Set rwx for owner, r-x for group, r-- for others (octal):

#               u   g   o
# Binary (rwx): 111 101 100
# Octal:          7   5   4
# String:        rwx r-x r--
chmod 754 app && ls -l app
# ...rwxr-xr--  ... app

Tip: Symbolic (u+rx,g-w) is great for tweaks; octal (754) is great when you know the exact target.

Quick reference: permission math

Add the values per class (owner/group/others) to get the octal digit.

chown: change owner and/or group

Syntax

chown <user>:<group> <file|directory>
# Either side can be omitted: chown user: file  |  chown :group file

Example

chown root:root shell && ls -l shell
# -rwxr-xr-- 1 root root 0 May  4 22:12 shell  (example output)

SUID & SGID (special permission bits)

Often mislabeled “GUID” — the correct term for the group bit is SGID.

• SUID (set-user-ID): run the program with the file owner’s effective UID.
• SGID (set-group-ID): run the program with the file group’s effective GID (on directories, it also makes new files inherit the directory’s group).

How they look in ls -l:

• SUID replaces the owner x with s (or S if execute isn’t set). Example: -rwsr-xr-x
• SGID replaces the group x with s (or S if execute isn’t set). Example: -rwxr-sr-x

How to set/unset:

# SUID on, SGID on
chmod u+s file
chmod g+s file

# Remove them
chmod u-s file
chmod g-s file

# Octal forms: SUID=4xxx, SGID=2xxx, sticky=1xxx
chmod 4755 file   # SUID + 755
chmod 2755 dir    # SGID + 755 (common for shared group dirs)

Why care?
SUID/SGID binaries execute with elevated privileges. If such a program lets a user escape to a shell or write files in sensitive locations, that’s a serious risk. Admins sometimes set these bits on unfamiliar tools “to make something work,” which can backfire.

• Example risky target discussed in the community: pagers/viewers or maintenance tools that can spawn shells.
• Curated lists of binaries with known escalation techniques live on GTFOBins:
  https://gtfobins.github.io/gtfobins/journalctl/

Hunting for them:

# World-readable search for SUID/SGID files
find / -perm -4000 -type f -exec ls -l {} \; 2>/dev/null   # SUID
find / -perm -2000 -type f -exec ls -l {} \; 2>/dev/null   # SGID

Sticky bit (bonus)

On directories, +t prevents users from deleting others’ files within shared dirs (e.g., /tmp):

chmod +t /shared
# ...rwxrwxrwt  (note the trailing 't')

Cheat line for a fresh script:

# owner: rwx, group: r-x, others: r-- ; ensure owner is you
chown "$USER":"$USER" ./script.sh && chmod 754 ./script.sh