About

Imported from CyberStrikeus/CyberStrike (.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-12-04-lts-server-benchmark/cis-ubuntu1204-v110-12-11/SKILL.md). Install upstream with npx skills add CyberStrikeus/CyberStrike --skill cis-ubuntu1204-v110-12-11. Copyright stays with the author.

12.11 Find SGID System Executables (Not Scored)

Name: cis-ubuntu1204-v110-12-11
Author: CyberStrikeus

Profile Applicability

Level 1

Description

The owner of a file can set the file's permissions to run with the owner's or group's permissions, even if the user running the program is not the owner or a member of the group. The most common reason for a SGID program is to enable users to perform functions (such as changing their password) that require root privileges.

Rationale

There are valid reasons for SGID programs, but it is important to identify and review such programs to ensure they are legitimate. Review the files returned by the action in the audit section and check to see if system binaries have a different md5 checksum than what from the package. This is an indication that the binary may have been replaced.

Audit Procedure

Using Command Line

#!/bin/bash
df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -2000 -print

Expected Result

Review the list of SGID executables returned. All SGID files should be legitimate system binaries. Investigate any unexpected or unauthorized SGID files.

Remediation

Using Command Line

Ensure that no rogue set-GID programs have been introduced into the system. Review the files returned by the action in the Audit section and confirm the integrity of these binaries.

Default Value

Various system binaries have SGID set by default (e.g., /usr/bin/wall, /usr/bin/write).

References

CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0

Profile

Level 1 - Not Scored

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/cyberstrikeus-cyberstrike-cis-ubuntu1204-v110-12-11/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

cyberstrikeus-cyberstrike-cis-ubuntu1204-v110-12-11.ocm.jsonjson

{
  "ocm": "1",
  "id": "cyberstrikeus-cyberstrike-cis-ubuntu1204-v110-12-11",
  "kind": "skill",
  "name": "cis-ubuntu1204-v110-12-11",
  "description": "Find SGID System Executables",
  "publisher": "CyberStrikeus",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "cis",
      "ubuntu",
      "12-04",
      "linux",
      "sgid",
      "file-permissions",
      "privilege-escalation",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Find SGID System Executables"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/CyberStrikeus/CyberStrike",
      "path": ".cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-12-04-lts-server-benchmark/cis-ubuntu1204-v110-12-11/SKILL.md",
      "ref": "df28ccd3dc6d6c02391169121ee2dcdf4a6a132b",
      "url": "https://github.com/CyberStrikeus/CyberStrike/blob/df28ccd3dc6d6c02391169121ee2dcdf4a6a132b/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-12-04-lts-server-benchmark/cis-ubuntu1204-v110-12-11/SKILL.md",
      "key": "CyberStrikeus/CyberStrike/.cyberstrike/skill/CIS_benchmarks/Operating_Systems/Ubuntu/cis-ubuntu-12-04-lts-server-benchmark/cis-ubuntu1204-v110-12-11/SKILL.md"
    }
  },
  "instructions": "# 12.11 Find SGID System Executables (Not Scored)\n\n## Profile Applicability\n\n- Level 1\n\n## Description\n\nThe owner of a file can set the file's permissions to run with the owner's or group's permissions, even if the user running the program is not the owner or a member of the group. The most common reason for a SGID program is to enable users to perform functions (such as changing their password) that require root privileges.\n\n## Rationale\n\nThere are valid reasons for SGID programs, but it is important to identify and review such programs to ensure they are legitimate. Review the files returned",
  "cost": {
    "context_tokens": 391
  }
}

Fetch it by URL: GET /api/v1/registry/cyberstrikeus-cyberstrike-cis-ubuntu1204-v110-12-11/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.