Linux Exploitation and Privilege Escalation CPENT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   You find a script owned by root that is executed by a cron job. The script calls 'ls' without an absolute path. Your user has write access to one directory in the PATH. How can you exploit this to gain root?

   • ACreate a malicious 'ls' executable in the writable directory and ensure it appears earlier in PATH than /bin/ls.
   • BModify the script to include a reverse shell command.
   • CReplace /bin/ls with your malicious binary.
   • DUse the SUID bit on the malicious 'ls' to run as root.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   You have extracted a root password hash from /etc/shadow, but it is a very strong password. You also have write access to a root cron job. Which approach is more efficient for gaining root?

   • ATry the hash as a password for other services.
   • BUse the hash to pass-the-hash in SSH.
   • CSpend time cracking the hash with a large wordlist and rules.
   • DExploit the writable cron job to execute a reverse shell as root.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which file on a Linux system defines the sudo permissions for users and groups?

   • A/etc/shadow
   • B/etc/group
   • C/etc/sudoers
   • D/etc/passwd
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   You have a low-privilege shell on a Linux host. Running 'sudo -l' shows the current user can run '/usr/bin/find' as root without a password. Which command would you use to spawn a root shell?

   • Asudo find / -exec /bin/bash \;
   • Bsudo find / -name '*.conf' -exec cat {} \;
   • Csudo /bin/bash
   • Dsudo cat /etc/shadow
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What does the 'no_root_squash' option in an NFS export do?

   • AIt allows root users on NFS clients to have root access to the exported filesystem
   • BIt hides the exported directory from other clients
   • CIt forces all clients to authenticate as root
   • DIt prevents users from writing to the exported directory
   Reveal Solution Discussion Select an answer first