Linux Exploitation and Privilege Escalation CPENT Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   You discover a network service running as root on a Linux server. The service has a known remote code execution vulnerability. What is the most direct way to gain a root shell?

   • AUse a public exploit for the service to execute a command that spawns a reverse shell.
   • BRestart the service with a modified configuration to run a different binary.
   • CUse the service to read /etc/shadow and then crack the root password.
   • DUse a kernel exploit instead of the service exploit.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   You find an NFS export /data that is configured with 'no_root_squash' and is writable by your user. You have root access on your own machine. What is the most effective way to escalate privileges on the NFS server?

   • ACreate a SUID-root binary on the NFS share and execute it on the server.
   • BCreate a symlink from /data to /etc.
   • CMount the share and read /etc/shadow directly.
   • DUse the share to overwrite /etc/crontab.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   You have a low-privilege shell on a Linux host. 'sudo -l' shows you can run '/usr/bin/passwd' as root without a password. However, the system has 'Defaults requiretty' enabled in sudoers. What is the most likely impact?

   • AYou can still run sudo commands but they will not have root privileges.
   • BYou can use 'sudo -u root' to bypass requiretty.
   • CYou can use 'sudo -S' to provide the password via stdin.
   • DYou cannot run sudo commands from a non-interactive shell, such as a reverse shell.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   You have a low-privilege shell on a Linux host. 'sudo -l' shows you can run '/usr/bin/find' as root without a password. However, the system has 'sudo' configured with 'secure_path' that does not include your writable directory. What is the best way to escalate privileges?

   • ACreate a malicious 'find' binary in your writable directory and modify PATH.
   • BUse 'sudo find / -exec /bin/bash \;' to execute a root shell.
   • CUse 'sudo find / -name shadow -exec cat {} \;' to read /etc/shadow.
   • DUse 'sudo find / -perm -4000' to list SUID binaries and then exploit one.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of using a tool like John the Ripper or Hashcat in a Linux privilege escalation scenario?

   • ATo create reverse shells
   • BTo enumerate open ports on the target
   • CTo crack password hashes obtained from the target system
   • DTo exploit kernel vulnerabilities
   Reveal Solution Discussion Select an answer first