Privilege Escalation CEH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You have gained access to a Windows server as a standard user. You notice that a scheduled task named 'UpdateTask' runs as SYSTEM and the task's action is to execute 'C:\Program Files\Updater\update.exe'. The folder 'C:\Program Files\Updater' is writable by your user. What is the most effective way to escalate privileges?

   • AModify the scheduled task's XML to change the user to your account
   • BReplace 'update.exe' with a malicious executable and wait for the task to run
   • CUse WinPEAS to exploit a kernel vulnerability
   • DUse 'schtasks /create' to create a new task that runs as SYSTEM
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An attacker finds a plaintext password in a web application's configuration file. The same password is used for the administrator account on the server. Which technique does this represent?

   • ACredential harvesting and reuse
   • BKernel exploitation
   • CPass-the-hash
   • DToken impersonation
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A Linux administrator discovers that a configuration file for a service running as root is writable by all users. Which of the following is the most likely privilege escalation technique an attacker could use?

   • ADelete the configuration file to cause a denial of service
   • BChange the file's ownership to the attacker
   • CModify the configuration file to make the service run arbitrary commands as root
   • DRead the configuration file to harvest credentials
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Windows system has a scheduled task that runs as SYSTEM and executes a batch file from 'C:\Tasks\cleanup.bat'. The 'C:\Tasks' directory is writable by the 'Users' group. A low-privileged user wants to escalate privileges. Which action would achieve this?

   • AReplace 'cleanup.bat' with a malicious batch file that creates a new admin user
   • BDelete the scheduled task
   • CModify the scheduled task's trigger to run more frequently
   • DCreate a new scheduled task that runs as SYSTEM
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   You are performing a penetration test on a Linux server. You have unprivileged access. LinPEAS shows two escalation paths: (1) a SUID binary '/usr/bin/find' owned by root; (2) a cron job that runs as root and executes a script in a directory writable by your user. The server is a production system, and you must avoid disrupting services. Which path is more appropriate?

   • AUse LinPEAS to enumerate more and decide later
   • BExploit the SUID 'find' binary to spawn a root shell
   • CModify the cron job script to add a reverse shell
   • DUse a kernel exploit to gain root
   Reveal Solution Discussion Select an answer first