Privilege Escalation CEH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A Linux administrator suspects a local user can escalate privileges. The user 'alice' can run the command '/usr/bin/find' via sudo without a password. The sudoers entry is: 'alice ALL=(ALL) NOPASSWD: /usr/bin/find'. Which technique would allow alice to gain a root shell?

   • ARun 'sudo su'
   • BRun 'sudo find / -exec /bin/bash \;'
   • CRun 'sudo chmod 777 /etc/shadow'
   • DRun 'sudo /usr/bin/find /etc/shadow'
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A penetration tester has a low-privileged shell on a Windows machine. The tester wants to harvest credentials from memory to escalate privileges. Which tool is specifically designed for this?

   • ALinPEAS
   • BNmap
   • CMimikatz
   • DJohn the Ripper
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   You have unprivileged access to a Windows 10 machine. WinPEAS shows two potential escalation paths: (1) a service 'VulnSvc' runs as SYSTEM with an unquoted path 'C:\Program Files\VulnApp\vuln service.exe', and the 'C:\Program Files\VulnApp' folder is writable; (2) the 'HKLM\SYSTEM\CurrentControlSet\Services\VulnSvc' registry key is writable by your user. The service is currently running. Which path is more reliable?

   • AExploit the unquoted service path by placing a malicious 'vuln.exe' in 'C:\Program Files\VulnApp' and restarting the service
   • BModify the registry ImagePath to point to your payload and restart the service
   • CUse a kernel exploit to gain SYSTEM
   • DUse WinPEAS to enumerate more and decide later
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A penetration tester has a low-privileged shell on a Linux server as user 'bob'. The tester discovers that the user 'alice' has access to a sensitive file that bob needs. Bob finds that he can read alice's home directory and copy the file. Which type of privilege escalation is this?

   • APersistence
   • BLateral movement
   • CVertical privilege escalation
   • DHorizontal privilege escalation
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A Linux system has a SUID binary at '/usr/bin/status' that runs a script located at '/opt/status/check.sh'. The script is writable by all users. A low-privileged user wants to escalate to root. What is the most effective way to exploit this?

   • AUse 'sudo /usr/bin/status'
   • BReplace '/usr/bin/status' with a malicious binary
   • CModify '/opt/status/check.sh' to include a reverse shell command
   • DRun '/usr/bin/status' with a crafted argument
   Reveal Solution Discussion Select an answer first