Linux Exploitation and Privilege Escalation CPENT Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   You have sudo rights to run 'less' as root. Which command would you use to read /etc/shadow?

   • Asudo less /etc/passwd
   • Bsudo cat /etc/shadow
   • Csudo less -c ':!/bin/bash'
   • Dsudo less /etc/shadow
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   You have root access on your own machine and an NFS export /data is mounted with 'root_squash' enabled. The export is writable by your user. What is the most effective way to escalate privileges on the NFS server?

   • ACreate a file with the same name as a root-owned binary in the share and hope the server executes it.
   • BLook for other misconfigurations on the server, such as writable cron jobs or SUID binaries.
   • CCreate a SUID binary as a normal user on the share and execute it on the server.
   • DUse the share to overwrite a root-owned file on the server.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the first step a penetration tester should take when attempting to exploit a kernel vulnerability for privilege escalation?

   • AIdentify the exact kernel version and distribution
   • BCompile the exploit from source code
   • CUpload the exploit to the target machine
   • DCheck the current user's sudo privileges
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why are services running as root often attractive targets for privilege escalation?

   • AThey always listen on port 80, which is easy to attack
   • BThey are always accessible from the internet
   • CThey may have vulnerabilities that allow remote or local code execution with root privileges
   • DThey never require authentication
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A root-owned script /usr/local/bin/status runs the command 'top' without an absolute path. Your user has write access to /tmp. What is the simplest way to exploit this?

   • AUse 'export PATH=/usr/bin' to ensure the real top runs.
   • BRun the script with 'sudo' to execute as root.
   • CCreate a malicious 'top' in /tmp and prepend /tmp to your PATH, then run the script.
   • DModify the script to use an absolute path for 'top'.
   Reveal Solution Discussion Select an answer first