Privilege Escalation CEH Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following tools can be used to automate both enumeration and exploitation of privilege escalation vulnerabilities?

   • ABurp Suite
   • BWireshark
   • CMetasploit
   • DNmap
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A penetration tester has gained access to a Windows workstation as a standard user. The tester wants to escalate privileges to a local administrator. During enumeration, the tester finds that the local administrator's password is stored in plaintext in a configuration file. Which technique would most directly achieve privilege escalation?

   • AModify the configuration file to include a malicious command
   • BUse a service with weak permissions to execute a command
   • CRun a kernel exploit to gain SYSTEM privileges
   • DUse the harvested credentials to authenticate as the local administrator
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You have unprivileged access to a Windows 10 machine. WinPEAS shows that the service 'VulnSvc' runs as SYSTEM and its binary path is 'C:\Program Files\VulnApp\vulnservice.exe'. The registry key 'HKLM\SYSTEM\CurrentControlSet\Services\VulnSvc' has weak permissions that allow your user to modify the 'ImagePath' value. What is the most reliable way to escalate privileges?

   • AChange the ImagePath to 'C:\temp\payload.exe' and restart the service
   • BDelete the service and create a new service that runs as SYSTEM
   • CUse Metasploit's 'exploit/windows/local/ms16_032_secondary_logon_handle_privesc' module
   • DChange the service account to your user and restart the service
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a common Windows privilege escalation vector that involves a service executable path not enclosed in quotes and containing spaces?

   • AWeak service permissions
   • BDLL hijacking
   • CKernel exploit
   • DUnquoted service path
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   You have unprivileged access to a Linux server. LinPEAS reports that the file '/usr/local/bin/backup' has the SUID bit set and is owned by root. When you run it, it executes 'cp /etc/passwd /tmp/backup' using the system() function. Which action would allow you to gain a root shell?

   • ARun 'sudo /usr/local/bin/backup' to execute it with root privileges
   • BUse the 'chmod u+s /bin/bash' command to make bash SUID
   • COverwrite '/usr/local/bin/backup' with a shell script that spawns a root shell
   • DCreate a malicious 'cp' executable in a directory earlier in your PATH and run '/usr/local/bin/backup'
   Reveal Solution Discussion Select an answer first