Privilege Escalation CEH Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An attacker finds that a Windows scheduled task runs as SYSTEM and its associated executable is stored in a folder where the attacker has write permissions. How can the attacker exploit this misconfiguration?

   • AReplace the executable with a malicious payload that runs with SYSTEM privileges
   • BModify the system registry to disable the task
   • CChange the task's schedule to run more frequently
   • DUse the task to run a command as the current user
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After escalating to root on a Linux server, a penetration tester wants to maintain access even if the server is rebooted. Which technique would best achieve persistence?

   • AKill the current shell process
   • BChange the root password to a known value
   • CAdd an SSH public key to the root user's authorized_keys file
   • DDelete the /var/log/auth.log file
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A Windows system has a service 'HelperSvc' that runs as SYSTEM. The service's executable path is 'C:\Program Files\Helper\helper.exe'. The 'C:\Program Files\Helper' directory is writable by the 'Users' group. A low-privileged user wants to escalate privileges. Which action would achieve this?

   • AUse the unquoted service path to execute a malicious file
   • BCreate a new service that runs a malicious binary
   • CReplace 'helper.exe' with a malicious executable
   • DModify the service's registry entry to point to a malicious executable
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During a Windows privilege escalation assessment, a tester discovers that the 'C:\Program Files\ImportantApp' directory has the following ACL: 'Everyone:(OI)(CI)(F)'. The application runs as SYSTEM and is configured to start automatically. Which action would allow the tester to gain SYSTEM privileges?

   • ACreate a new service that runs a malicious binary
   • BModify the service's executable path in the registry
   • CUse the unquoted service path to execute a malicious file
   • DReplace an application DLL in that directory with a malicious DLL that is loaded by the service
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the context of system hacking, what is the primary difference between horizontal and vertical privilege escalation?

   • AHorizontal escalation involves gaining access to another account at the same privilege level, while vertical escalation involves gaining higher privileges than the current account.
   • BHorizontal escalation is only possible on Linux systems, while vertical escalation is only possible on Windows systems.
   • CHorizontal escalation grants the attacker administrative rights, while vertical escalation grants access to another user's account.
   • DHorizontal escalation involves moving from a lower-privileged account to a higher-privileged one, while vertical escalation involves moving to an account of the same privilege level.
   Reveal Solution Discussion Select an answer first