Abstract:

This article explains binfmt_misc, a Linux kernel feature that allows the system to execute non-native binary formats by registering custom handlers. While a legitimate feature, it can be exploited to create a stealthy persistence and privilege escalation backdoor, a technique referred to as "Shadow SUID."

The attack involves an adversary with root access registering a new binfmt_misc handler. This handler is configured to match the "magic bytes" (the initial bytes) of a legitimate, but rarely used, SUID binary like chfn. The handler then redirects execution to a malicious interpreter. By using the special 'C' (credentials) flag, the kernel runs this malicious interpreter with the SUID binary's root privileges, effectively granting any user who runs chfn a root shell. This technique is highly evasive because the malicious interpreter itself does not have the SUID bit set, rendering standard permission-based detection methods ineffective. Detection relies on actively monitoring the /proc/sys/fs/binfmt_misc/ directory for suspicious handlers. The persistence is not reboot-persistent by default, requiring attackers to establish a separate mechanism to re-register the handler, which offers an additional opportunity for detection.

Today I learned: binfmt_misc for Stealthy Persistence

• Introduction: What is binfmt_misc? A Linux kernel feature that extends the system's ability to execute files. It allows custom handlers to be registered, which tell the kernel how to run specific file types (based on magic bytes or extensions) by passing them to a designated interpreter or emulator.
• Why care?: The "Shadow SUID" Attack. binfmt_misc can be abused to create a stealthy backdoor. An attacker with root can make a non-SUID binary inherit root privileges from a legitimate SUID file. This technique is hard to detect as it doesn't appear in standard SUID file scans and is not widely covered in security frameworks like MITRE ATT&CK.
• Setting up our backdoor: How the Attack Works.
  • An attacker first compiles a simple C program (the "interpreter") designed to spawn a root shell.
  • They identify a rarely used SUID binary on the system, such as chfn, to avoid disrupting normal system functionality.
  • The attacker extracts the first few bytes (the "magic bytes") of the chfn binary.
  • A new handler is registered in /proc/sys/fs/binfmt_misc/register. This handler links the magic bytes of chfn to the attacker's malicious interpreter and uses the crucial C (credentials) flag.
  • Key Takeaway: The C flag instructs the kernel to execute the interpreter with the permissions of the original file (chfn), not the interpreter itself. As a result, any unprivileged user can now simply type chfn to gain a root shell.
• Hunting: Detection Strategies.
  • Standard find / -perm -4000 commands will not find the malicious interpreter because it does not have the SUID bit set.
  • Primary Detection: The most effective method is to monitor the virtual directory /proc/sys/fs/binfmt_misc/ for new or suspicious handlers, particularly those pointing to interpreters in ephemeral locations like /dev/shm or /tmp.
  • Impermanence: Handlers registered this way are temporary and are cleared upon reboot. An attacker must use a separate persistence mechanism to re-register the handler, providing another chance for detection.
• Let’s ask an expert: Why It's So Stealthy. Security expert Ruben Groenewoud confirms the difficulty of detection. The technique is a "proxy execution"—the SUID binary (chfn) is used to trigger the handler but is never actually executed itself. This bypasses security rules designed to detect the direct execution of SUID binaries.