Privilege Escalation CEH Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A penetration tester discovers that a Windows service runs with SYSTEM privileges and the service's executable file is writable by the Everyone group. Which privilege escalation vector is most directly indicated?

   • AWeak service permissions
   • BUnquoted service path
   • CKernel exploit
   • DCredential harvesting
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A Linux system has a cron job that runs a script located in a world-writable directory. An attacker can replace the script with a malicious one. Which Linux privilege escalation vector does this exploit?

   • ACron job misconfiguration
   • BSudo misconfiguration
   • CSUID binary
   • DKernel exploit
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   After successfully escalating privileges on a Windows system, an attacker creates a new local user account and adds it to the Administrators group. What is the primary purpose of this action?

   • ATo establish persistence
   • BTo perform lateral movement
   • CTo clear logs
   • DTo harvest credentials
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Linux system has a cron job that runs as root every minute and executes '/usr/local/bin/cleanup.sh'. The script is writable by all users. A low-privileged user wants to escalate to root. Which action would achieve this?

   • ARun '/usr/local/bin/cleanup.sh' directly
   • BDelete the cron job from /etc/crontab
   • CModify '/usr/local/bin/cleanup.sh' to include a malicious command
   • DReplace '/usr/local/bin/cleanup.sh' with a symlink to /bin/bash
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You are on a penetration test with a strict time limit. You have unprivileged access to a Windows Server 2016. You find a scheduled task 'Cleanup' that runs as SYSTEM and executes 'C:\Scripts\cleanup.bat'. The 'C:\Scripts' folder is writable by your user. However, the task is scheduled to run only once a week. You also find that the service 'VulnSvc' runs as SYSTEM and its binary path is 'C:\Program Files\VulnApp\vuln.exe', and the folder is writable. Which path is more appropriate?

   • AUse WinPEAS to enumerate more and decide later
   • BModify the scheduled task's script and wait for the weekly trigger
   • CUse a kernel exploit to gain SYSTEM
   • DReplace the service binary and restart the service
   Reveal Solution Discussion Select an answer first