Linux Exploitation and Privilege Escalation CPENT Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is a common technique to identify services running with elevated privileges on a Linux system?

   • ARunning 'ls -la /home' to list home directories
   • BRunning 'ifconfig' to see network interfaces
   • CRunning 'ps aux' and looking for processes owned by root
   • DRunning 'cat /etc/passwd' to see which users are root
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   You discover a vulnerable service running as root on a Linux server. The service is protected by a restrictive firewall that only allows access from a specific management IP. You have a low-privilege shell on the server. What is the most effective way to exploit the service?

   • AUse a network scanner to find another open port on the service.
   • BUse a reverse shell to connect to the service from the server itself.
   • CUse SSH local port forwarding to tunnel traffic from your machine to the service through the shell.
   • DUse a kernel exploit to gain root and then access the service locally.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   How can manipulating the PATH environment variable lead to privilege escalation on Linux?

   • ABy exporting PATH to the root user's home directory, which grants root privileges
   • BBy placing a malicious executable earlier in the PATH than the legitimate command, causing a privileged script to execute it
   • CBy changing the PATH to include the current directory, which is always a safe practice
   • DBy setting PATH to a non-existent directory, which causes the system to run commands as root
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which file or directory typically contains system-wide cron job definitions on a Linux system?

   • A/etc/shadow
   • B/var/log/syslog
   • C/etc/crontab
   • D/etc/passwd
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   You have write access to /etc/cron.d/backup, but the cron job runs a script /opt/backup.sh that is not writable. The cron job runs as root. What is the most effective way to escalate privileges?

   • AModify the cron job to run a different command that you control.
   • BWait for the cron job to run and intercept its output.
   • CCreate a symlink from /opt/backup.sh to a file you control.
   • DOverwrite /opt/backup.sh with a malicious script.
   Reveal Solution Discussion Select an answer first