SUID binaries: running with the owner's privileges

The SUID bit runs a program with the owner's privileges, not the launcher's. A SUID-root binary run by a user runs as root.

Finding and exploiting them

find / -perm -4000 -type f 2>/dev/null   # list SUID binaries

If a SUID-root binary has a shell escape or arbitrary read/write (again GTFOBins), you become root. Poorly written custom SUID (calling system() with a relative PATH) are hijacked by manipulating PATH:

# the SUID calls 'service' without an absolute path
export PATH=/tmp:$PATH; echo '/bin/sh' > /tmp/service; chmod +x /tmp/service

Defence

Minimize SUID binaries (remove the bit where unneeded). In your SUID programs: absolute paths, drop privileges as soon as possible, no shell calls, sanitize the environment. Mount with nosuid where appropriate. Periodic audit of the SUID list.