A user can run the command 'sudo /usr/bin/vim' without a password. Which of the following is a common technique to escalate privileges using this misconfiguration?

Use vim's shell escape feature to spawn a root shell

You have root access on a Linux server and want to maintain persistence that is stealthy and survives reboots. Which mechanism would be the most stealthy?

Add a cron job that runs a reverse shell every minute.

Add a reverse shell to /etc/rc.local

Place a malicious binary in /usr/bin and hope it gets executed.

Create a systemd service that starts a reverse shell and is masked as a legitimate service.

You have a low-privilege shell on a Linux server. The kernel is version 3.13.0-24-generic, which is vulnerable to CVE-2013-2094. However, the server has SELinux enforcing and a restrictive seccomp filter in place. Which approach is most likely to succeed?

Disable SELinux and seccomp from the low-privilege shell.

Compile and run the standard Dirty COW exploit.

Use a kernel exploit that is compatible with SELinux and seccomp, or find an alternative vector such as a misconfigured service.

Restart the server to boot with 'selinux=0'.

You are performing a penetration test and have a low-privilege shell on a Linux host. You need to escalate to root. Which of the following is the MOST efficient first step to identify potential privilege escalation vectors?

Immediately try a kernel exploit for the detected kernel version.

Look for writable files in /etc/cron.d.

Run a script like LinEnum or linux-exploit-suggester to gather system information.

Check the bash history for passwords.

EC-CouncilCertified Penetration Testing Professional

Domain 4Objective 3

Linux Exploitation and Privilege Escalation CPENT Practice Questions (Page 3)

Part of the Perimeter Evasion and Host Exploitation domain, which makes up ~13% of our current practice bank.

48questions here

10free pages

10concepts

Questions 11–15

11foundation · easy
A user can run the command 'sudo /usr/bin/vim' without a password. Which of the following is a common technique to escalate privileges using this misconfiguration?
Select an answer first
12expert · hard
You have root access on a Linux server and want to maintain persistence that is stealthy and survives reboots. Which mechanism would be the most stealthy?
Select an answer first
13expert · hard
You have a low-privilege shell on a Linux server. The kernel is version 3.13.0-24-generic, which is vulnerable to CVE-2013-2094. However, the server has SELinux enforcing and a restrictive seccomp filter in place. Which approach is most likely to succeed?
Select an answer first
14application · medium
You are performing a penetration test and have a low-privilege shell on a Linux host. You need to escalate to root. Which of the following is the MOST efficient first step to identify potential privilege escalation vectors?
Select an answer first
15foundation · easy
Which file on a Linux system contains password hashes for user accounts?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.