Enumerating and Attacking Privileges GRTP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After enumerating a Linux host, you find that the `sudoers` file allows the current user to run `/usr/bin/vim` as root without a password. What is the most effective way to escalate privileges?

   • ARun `sudo cat /etc/shadow` to retrieve password hashes.
   • BRun `sudo vim /etc/sudoers` to add yourself as a sudo user.
   • CRun `sudo vim -c ':!bash'` to spawn a root shell from within vim.
   • DUse `sudo -u root /bin/bash` to get a root shell directly.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   After enumerating that a Windows service runs with SYSTEM privileges and has a weak file permission allowing the current user to modify its executable, what is the most direct post-enumeration exploitation step?

   • AReplace the service executable with a malicious binary and restart the service
   • BExploit an unquoted service path
   • CUse token impersonation to steal the SYSTEM token
   • DCreate a scheduled task that runs as SYSTEM
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You have access to a Windows system and find that the 'SeDebugPrivilege' is enabled for your user. What is a common privilege escalation technique that leverages this privilege?

   • AUse the privilege to impersonate a token from another process.
   • BInject code into a process running as SYSTEM, such as winlogon.exe, and execute a payload.
   • CUse the privilege to modify service configurations.
   • DUse the privilege to read the SAM database directly.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   You are on a Windows host and need to enumerate all services that are running with elevated privileges and check if any have weak permissions that could be abused. Which command or tool would you use to list services and their permissions?

   • Asc query
   • BGet-Service | Format-List *
   • Caccesschk.exe -uwcqv "%USERNAME%" *
   • Dtasklist /svc
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You have a low-privilege shell on a Linux host. You find that the current user can write to a directory that is in the PATH for a cron job running as root. However, the cron job uses an absolute path to the command. What is the most effective way to escalate privileges?

   • AUse `chmod` to make a SUID copy of `/bin/bash`.
   • BUse `sudo -l` to check for sudo rights and run a command as root.
   • CCheck if the cron job's script or binary itself is writable and modify it.
   • DPlace a malicious script in the writable directory with the same name as the command.
   Reveal Solution Discussion Select an answer first