Linux Exploitation and Privilege Escalation CPENT Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   You have read access to /etc/passwd and /etc/shadow on a Linux system. Which approach would most likely yield a plaintext password for the root account?

   • AUse a tool like unshadow to combine the files and then run John the Ripper with a wordlist.
   • BUse 'cat /etc/shadow' to directly read the root password hash and then use it to log in.
   • CUse a dictionary attack on the /etc/passwd file only.
   • DUse 'su root' with the hash as the password.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   You discover that the root-owned cron job /etc/cron.d/backup runs the script /opt/backup.sh every 5 minutes. The script is writable by your user. What is the most effective way to escalate privileges?

   • AAppend a reverse shell command to /opt/backup.sh.
   • BDelete the cron job file to prevent it from running.
   • CChange the permissions of /etc/cron.d/backup to 777.
   • DCreate a new file named /opt/backup.sh with a different script.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   You have root access on a client that mounts an NFS share from a server. The share is exported with 'no_root_squash' but also with 'noexec'. You need to escalate privileges on the server. Which approach is most likely to succeed?

   • AMount the share with the 'exec' option to bypass noexec.
   • BUse a kernel exploit on the client to gain root on the server.
   • CCreate a SUID binary on the share and execute it on the server.
   • DUse the share to overwrite a root-owned file on the server, such as a cron script.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which of the following is an example of a Linux privilege escalation vector that relies on a flaw in the operating system's core component rather than a misconfiguration?

   • AAn outdated kernel with a known local privilege escalation exploit
   • BA sudoers entry allowing a user to run all commands as root
   • CAn NFS share exported with no_root_squash
   • DA world-writable script executed by a cron job
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   After gaining root on a Linux server, you want to establish persistence that is stealthy and survives reboots. The server has SELinux enforcing and a host-based intrusion detection system (HIDS) that monitors cron jobs and systemd services. Which persistence mechanism is most likely to evade detection?

   • ACreate a systemd service that starts a reverse shell.
   • BCreate a cron job that runs a reverse shell.
   • CAdd an SSH key to root's authorized_keys.
   • DAdd a rootkit kernel module that hides itself and provides a backdoor.
   Reveal Solution Discussion Select an answer first