Linux Exploitation and Privilege Escalation CPENT Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   You have write access to a script that is executed by a cron job as root. However, the cron job runs with a minimal PATH and the script uses absolute paths for all commands. What is the best way to escalate privileges?

   • ACreate a malicious binary in a directory and manipulate PATH.
   • BWait for the script to run and then use its output to escalate.
   • CReplace the cron job definition in /etc/crontab.
   • DModify the script to include a reverse shell command.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You have a low-privilege shell on a Linux server. Running 'sudo -l' shows that the current user can run '/usr/bin/vim' as root without a password. Which action would you take to escalate privileges to a root shell?

   • ARun 'sudo vim /etc/shadow' and change the root password hash.
   • BRun 'sudo vim -c ':!bash'' to spawn a root shell from within vim.
   • CRun 'sudo vim' and use the ':read /etc/shadow' command to view the file.
   • DRun 'sudo vim' and then press 'Esc' and type ':w !sudo tee' to write to a root-owned file.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a prerequisite for a PATH hijacking attack to succeed?

   • AThe attacker must have root privileges already
   • BThe privileged script or binary must call commands using relative paths or bare command names
   • CThe system must be running a specific Linux distribution
   • DThe attacker must have write access to /usr/bin
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a common Linux persistence mechanism that involves creating a new service that starts automatically on boot?

   • AChanging the root password
   • BDeleting the /etc/shadow file
   • CAdding a user to the sudo group
   • DAdding a systemd service unit file
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You discover that the root-owned cron job /etc/cron.d/cleanup runs the script /opt/cleanup.sh every hour. The script is writable by your user. What is the most effective way to escalate privileges?

   • AChange the permissions of /etc/cron.d/cleanup to 777.
   • BAppend a command to /opt/cleanup.sh that adds your SSH key to /root/.ssh/authorized_keys.
   • CCreate a new file named /opt/cleanup.sh with a different script.
   • DDelete the cron job file to prevent it from running.
   Reveal Solution Discussion Select an answer first