Linux Exploitation and Privilege Escalation CPENT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You discover that the MySQL service is running as root on a Linux host. The MySQL version has a known vulnerability that allows writing files to arbitrary locations. What is the most likely privilege escalation path?

   • AConnect to MySQL and run 'SELECT ... INTO OUTFILE' to create a new user.
   • BRestart the MySQL service to trigger a kernel exploit.
   • CUse MySQL to read /etc/shadow and crack the root password.
   • DUse the MySQL vulnerability to write a malicious shared library or script that gets executed by root.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of a persistence mechanism that relies on a user's login process?

   • AAdding a command to a user's .bashrc file
   • BCreating a new user account
   • CModifying the /etc/hosts file
   • DAdding a cron job that runs every minute
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a penetration test, you gain access to a Linux server as user 'dev'. You find a custom SUID binary at /usr/local/bin/backup that runs the command 'tar' without an absolute path. The binary is owned by root and has the SUID bit set. You have write access to /usr/local/bin. What is the most direct way to escalate privileges?

   • ACreate a malicious executable named 'tar' in /usr/local/bin and execute the SUID binary.
   • BUse the SUID binary to read /etc/shadow directly.
   • CModify the /etc/passwd file to add a new root user.
   • DRun 'sudo tar' to execute commands as root.
   Reveal Solution Discussion Select an answer first
5. 24application · easy

   You have read access to /etc/shadow on a Linux system. The root hash is a SHA-512 hash. Which tool would you use to crack it offline?

   • Ahydra with the -l root option
   • BJohn the Ripper with a wordlist
   • Cnmap with the --script http-enum
   • Dsqlmap with --dump
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which command would a penetration tester use to find all SUID or SGID binaries on a Linux system?

   • Als -la /usr/bin | grep '^...s'
   • Bfind / -perm -4000 -o -perm -2000 2>/dev/null
   • Ccat /etc/passwd | grep '/bin/bash'
   • Dps aux | grep root
   Reveal Solution Discussion Select an answer first