Privilege Escalation CEH Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a penetration test, you gain initial access to a Windows 10 workstation as a standard domain user. You run WinPEAS and discover that the 'VulnSvc' service runs as SYSTEM and its binary path is 'C:\Program Files\VulnApp\vuln service.exe'. The directory 'C:\Program Files\VulnApp' has write permissions for the Everyone group. Which action would most reliably escalate privileges to SYSTEM?

   • AStop the service and create a scheduled task that runs as SYSTEM
   • BReplace the service binary with a reverse-shell executable and restart the service
   • CUse Metasploit's 'exploit/windows/local/ms10_015_kitrap0d' module
   • DModify the registry key 'HKLM\SYSTEM\CurrentControlSet\Services\VulnSvc' to change the service account to your user
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A Linux system has a SUID binary at '/usr/bin/backup' that runs a script located at '/opt/backup/run.sh'. The script is writable by all users. A low-privileged user wants to escalate to root. What is the most effective way to exploit this?

   • AModify '/opt/backup/run.sh' to include a reverse shell command
   • BRun '/usr/bin/backup' with a crafted argument
   • CUse 'sudo /usr/bin/backup'
   • DReplace '/usr/bin/backup' with a malicious binary
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A Windows system has a scheduled task that runs as SYSTEM and executes a PowerShell script from 'C:\Scripts\main.ps1'. The 'C:\Scripts' directory is writable by the 'Users' group. A low-privileged user wants to escalate privileges. Which action would achieve this?

   • ADelete the scheduled task
   • BCreate a new scheduled task that runs as SYSTEM
   • CReplace 'main.ps1' with a malicious script that creates a new admin user
   • DModify the scheduled task's trigger to run more frequently
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a common Linux privilege escalation vector that involves a binary with the setuid bit set, allowing a user to run it with the file owner's privileges?

   • ASUID binary
   • BCron job misconfiguration
   • CSudo misconfiguration
   • DKernel exploit
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After successfully escalating to SYSTEM on a Windows server, a penetration tester wants to maintain elevated access even if the server is rebooted. Which technique would best achieve persistence?

   • ADisable the Windows Firewall
   • BClear the event logs
   • CTerminate the current shell session
   • DCreate a new local user account and add it to the Administrators group
   Reveal Solution Discussion Select an answer first