PEN-200 Linux Privilege Escalation — 20 Questions

Question 1

You are performing enumeration on a Linux host. Which TWO of the following methods are effective for discovering potentially exploitable Cron jobs that run with elevated privileges?

Accepted Answer

Check the permissions of scripts referenced in /etc/crontab to see if they are world-writable.. Identifying insecure Cron jobs involves inspecting both system-wide and user-specific task schedulers. By analyzing /etc/crontab and the contents of /etc/cron.d/, an attacker can find scripts that execute with root privileges but are writable by low-privileged users. This is a critical enumeration step, as misconfigured Cron jobs are frequent vectors for achieving persistence and privilege escalation when permissions are not strictly enforced on the underlying script files.

Answer

Run 'ls -la /root/' to list all hidden files and check for sensitive configuration scripts.

Answer

Search for files with the SUID bit set within the /etc/cron.daily/ directory.

Answer

Use 'netstat' to find which ports are open and infer what Cron jobs are running.

Question 2

You find a binary that uses the 'system()' function to call an absolute path, such as '/usr/bin/whois'. The binary is SUID root. How could you potentially exploit this if the system is not vulnerable to PATH manipulation?

Accepted Answer

Use 'LD_PRELOAD' to inject a custom library that overrides a function call.. If PATH manipulation is blocked, you can use Shared Object Injection. By using 'strace' or 'ldd', you can determine which shared libraries the binary loads. If you can modify the environment variable LD_PRELOAD to point to a malicious library, you can force the binary to load your code before the original library functions, allowing for arbitrary execution with the SUID binary's permissions.

Answer

Use the 'strings' utility to find hardcoded passwords in the binary.

Answer

Perform a race condition attack by deleting the binary and replacing it with a symbolic link.

Answer

Send a malformed signal to the process to trigger a core dump.

Question 3

During your post-exploitation phase, you want to identify writable configuration files or directories that could lead to privilege escalation. Which THREE of the following locations should you prioritize checking?

Accepted Answer

/etc/passwd. Identifying misconfigured permissions on system configuration files is critical. Files like /etc/passwd or /etc/shadow, or directories that control system services, are prime targets. If a low-privileged user can modify these files, they can add new users with UID 0 or change existing passwords. Proper enumeration of permissions ensures that you find these weak points, which are often overlooked by system administrators during standard configuration hardening processes.

Answer

/var/log/apache2/

Answer

/home/user/.bash_history

Question 4

You discover a world-writable file that is being read by a root-owned service. What is the most reliable way to escalate privileges in this scenario?

Accepted Answer

Inject a reverse shell payload if the file is a script or configuration that supports command execution.. If a root-owned service reads a world-writable configuration file, you can inject malicious directives into that file. When the service restarts or reloads its configuration, it will execute or apply the injected commands with root privileges. This is a high-impact vulnerability because it leverages the legitimate service behavior to gain system control, demonstrating the necessity of restricting write access to configuration files that are consumed by privileged processes.

Answer

Overwrite the file with a symlink to /etc/shadow.

Answer

Wait for the service to crash and then perform a local buffer overflow.

Answer

Use the 'chmod' command to make the file execute-only.

Question 5

You have gained a low-privileged shell on a Linux system and find a custom binary in /opt/scripts owned by root with the SUID bit set. The binary executes a system command using a relative path. Which method is most effective for gaining root privileges?

Accepted Answer

Manipulate the PATH variable to point to a fake binary.. Exploiting relative path vulnerabilities in SUID binaries relies on path hijacking. By modifying the PATH environment variable to point to a malicious directory and placing a fake executable there, the SUID binary executes the attacker's code with root permissions. This is a classic privilege escalation technique that demonstrates how misconfigured execution environments lead to total system compromise, a critical concept tested frequently during the OSCP exam.

Answer

Overwrite the binary with a malicious payload.

Answer

Use LD_PRELOAD to inject a shared library.

Answer

Run strings on the binary to find hardcoded credentials.

Question 6

You find a user has sudo privileges to run a specific binary without a password. Which TWO of the following should you investigate to escalate privileges?

Accepted Answer

Check if the binary is on GTFOBins for shell escape vectors.. When sudoers are configured to allow specific binaries, the security boundary depends entirely on the binary's functionality. If the binary supports file reads, writes, or shell escapes, it can be leveraged to gain root access. Identifying such binaries is a core requirement for OSCP students, as it distinguishes between a secure configuration and a trivial misconfiguration that leads to full system compromise through privilege escalation techniques.

Answer

Check if the binary is a symbolic link to a sensitive file.

Answer

Verify if the binary is compiled with debug symbols.

Answer

Search for hardcoded passwords within the binary using strings.

Question 7

Refer to the exhibit. You are investigating the /usr/local/bin/backup binary. It performs a system-wide backup by executing 'tar' without an absolute path. How can you leverage this to gain root?

Accepted Answer

Create a malicious 'tar' file in /tmp, then add /tmp to the PATH.. The binary is SUID root, meaning it executes with root permissions regardless of the user. Because it calls 'tar' using a relative path, the system looks for the 'tar' executable in the directories listed in the PATH variable. By manipulating the PATH, you can force the binary to execute a malicious file named 'tar', which will then be run with root privileges, effectively granting you a root shell.

Answer

Use the 'strings' utility to identify the hardcoded password in the binary.

Answer

Execute the binary with the --path argument set to /tmp.

Answer

Overwrite /usr/local/bin/backup with a shell script.

Question 8

An ethical hacker discovers that a custom binary has the SUID permission set and is owned by root. Running strings on the binary reveals that it executes the system command 'service networking restart' without using an absolute path. Which technique can the hacker leverage to escalate privileges?

Accepted Answer

Creating a malicious script named networking in a writable directory, updating the PATH variable, and running the SUID binary.. Manipulating the PATH environment variable allows an attacker to hijack relative binary execution within SUID contexts. When a SUID binary calls a command using a relative path instead of an absolute path, the shell searches directories listed in the PATH variable. By prepending a directory containing a malicious binary named networking, the attacker forces the program to execute arbitrary commands with root privileges.

Answer

Injecting malicious commands directly into the LD_PRELOAD environment variable before executing the binary.

Answer

Modifying the IFS variable to include forward slashes and altering argument parsing during execution.

Answer

Appending arbitrary shell commands to the command line arguments passed directly to the vulnerable SUID binary.

Question 9

An analyst is reviewing a Linux system for potential kernel vulnerabilities and local privilege escalation vectors. Which TWO of the following misconfigurations or components represent viable methods for achieving local privilege escalation?

Accepted Answer

Identifying a missing security patch for a local privilege escalation exploit affecting the running Linux kernel version.. Kernel vulnerabilities allow local users to execute arbitrary ring 0 code, directly yielding root access. Additionally, overly permissive file permissions on critical configuration files like /etc/passwd allow low-privileged accounts to append new user accounts with UID 0. Both vectors represent classic and highly effective privilege escalation pathways taught extensively in foundational penetration testing methodologies.

Answer

Finding that the user's home directory has standard 755 permissions and contains a readable .bash_history file.

Answer

Observing that the system time zone file is owned by root but readable by all authenticated system users.

Answer

Confirming that the local firewall blocks all incoming external TCP connections while allowing outgoing traffic.

Question 10

Refer to the exhibit. A penetration tester analyzing a Linux host finds the SUID binary shown in the exhibit. Running 'ltrace /usr/local/bin/check_logs' reveals that the program invokes the C library function system("tail -n 10 /var/log/syslog"). How can this SUID binary be exploited?

Accepted Answer

Exporting a custom PATH variable containing a malicious script named tail and executing the SUID binary.. When a SUID binary executes a command via the C system() function without providing an absolute path to the target executable, it spawns a shell that relies on the PATH environment variable. In older or misconfigured environments, or when debugging wrappers fail to scrub PATH properly, attackers can manipulate PATH to execute a malicious binary named tail, resulting in elevated command execution.

Answer

Supplying a crafted format string as an argument to the binary to overwrite the Global Offset Table and hijack execution flow.

Answer

Injecting arbitrary shell metacharacters such as semicolons directly into the system log file to break out of the tail command.

Answer

Triggering a buffer overflow by supplying an excessively long filename as an argument to the check_logs binary execution.

Question 11

During a post-exploitation enumeration phase on a Linux target, an assessor investigates scheduled tasks and background automation. Which TWO locations or mechanisms should be examined for potential privilege escalation vectors?

Accepted Answer

System-wide cron configuration files located in /etc/crontab and script files inside /etc/cron.d/ directories.. Cron jobs managed via system-wide configuration files in /etc/crontab or scripts residing within /etc/cron.d often execute commands with elevated privileges. If a low-privileged user has write access to any script invoked by these automated root tasks, modifying the script allows the user to execute arbitrary commands as root when the cron job runs.

Answer

The personal crontab file of the currently logged-in low-privileged user accessible via the crontab command.

Answer

The /etc/profile environment configuration file loaded during standard login shell initialization.

Answer

User-specific shell configuration files such as .bashrc and .profile located inside home directories.

Question 12

You have a low-privileged shell on a Linux host. During enumeration, you notice that the /etc/passwd file is writable by your user. You want to obtain root access. Which of the following is the most reliable method to escalate privileges using this misconfiguration?

Accepted Answer

Add a new user with UID 0 and a known password hash to /etc/passwd, then switch to that user with su.. When /etc/passwd is writable, the most straightforward privilege escalation is to add a new user with UID 0 and a known password hash. Because /etc/passwd may still be used for authentication if shadow passwords are not enabled, or if the password field is not 'x', this grants immediate root access. Modifying existing entries like root's home or password hash is less reliable due to shadow file protections and interactive login requirements.

Answer

Change the UID of your current user to 0 in /etc/passwd, then re-login.

Answer

Modify the root user's home directory path in /etc/passwd to a directory you control, then place a malicious .bashrc that executes a reverse shell.

Answer

Replace the root user's password hash in /etc/passwd with a known hash, then use su to switch to root.

Question 13

During a penetration test on a Linux host, you obtain a low-privileged shell as user 'www-data'. You run the command 'getcap -r / 2>/dev/null' and notice that the Python 3 interpreter has the capability 'cap_setuid+ep' assigned. Which of the following commands will most directly leverage this capability to escalate privileges to root?

Accepted Answer

python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'. The Python interpreter has been granted the cap_setuid+ep capability, which permits it to change its effective user ID to any value, including 0. By executing a Python one-liner that calls os.setuid(0) and then spawns a shell, the attacker directly leverages this capability to become root. This is a common privilege escalation vector when capabilities are misconfigured.

Answer

python3 -c 'import os; os.setgid(0); os.system("/bin/bash")'

Answer

python3 -c 'import subprocess; subprocess.call(["/bin/bash", "-p"])'

Answer

python3 -c 'import os; os.setreuid(0,0); os.execl("/bin/sh", "sh")'

Question 14

During a penetration test, you obtain a low-privileged shell on a Linux host. You run `find / -perm -4000 -type f 2>/dev/null` and discover that `/usr/bin/passwd` is SUID root. You also notice that the system has an outdated version of `sudo` (1.8.16). Which of the following actions is MOST likely to yield privilege escalation?

Accepted Answer

Exploit a known vulnerability in the outdated sudo version, such as CVE-2017-1000367 (Sudo's get_process_ttyname() privilege escalation).. The outdated sudo version is a clear indicator of a potential privilege escalation vector. CVE-2017-1000367 affects sudo versions before 1.8.20 and allows users with sudo privileges to escalate to root by exploiting a flaw in get_process_ttyname(). The SUID passwd binary is standard and not exploitable in this manner. Therefore, targeting the sudo vulnerability is the most viable path.

Answer

Leverage the SUID binary to load a malicious shared library by setting LD_PRELOAD before execution.

Answer

Use the `passwd` command to change the root password by specifying `passwd root` and entering a new password.

Answer

Use the SUID bit on /usr/bin/passwd to read the /etc/shadow file by executing `passwd -f /etc/shadow`.

Question 15

You have obtained a low-privileged shell on a Linux system during a penetration test. You want to enumerate scheduled tasks that might run with higher privileges. Which TWO of the following commands or techniques are most effective for discovering such tasks? (Choose two.)

Accepted Answer

ls -la /etc/cron.d/. System-wide cron jobs are defined in /etc/crontab and /etc/cron.d/. Reading these files as a low-privileged user is possible because they are typically world-readable. They often contain entries that run scripts as root. If any referenced script is writable by the attacker, it can be modified to execute arbitrary code with root privileges, leading to escalation.

Answer

crontab -l -u root

Answer

atq

Answer

systemctl list-timers --all

Question 16

An assessor gains a low-privileged shell on a Linux host and wants to escalate privileges by exploiting a misconfigured SUID binary. Which TWO of the following conditions would MOST likely allow privilege escalation? (Choose two.)

Accepted Answer

The SUID binary is owned by root and has the SUID bit set, and it calls a system command using a relative path.. SUID binaries that execute external commands using relative paths or without absolute paths are vulnerable to PATH manipulation. An attacker can place a malicious executable in a directory they control and adjust the PATH variable so that the SUID binary executes their code as root. These are classic privilege escalation vectors.

Answer

The SUID binary is owned by root and has the SUID bit set, and it is writable by the current user.

Answer

The SUID binary is owned by root and has the SUID bit set, and it uses the setuid() function to drop privileges before executing commands.

Answer

The SUID binary is owned by root and has the SUID bit set, and it reads a configuration file from a world-writable directory.

Question 17

During a post-exploitation assessment on a Linux host, you discover that the current user can run `/usr/bin/find` as root without a password, as shown in the sudoers output: `(root) NOPASSWD: /usr/bin/find`. Which command will most reliably escalate to a root shell?

Accepted Answer

sudo find / -exec /bin/bash -p \; -quit. The sudoers entry permits running /usr/bin/find as root without a password. The find utility's -exec action can execute arbitrary commands, and when combined with sudo, those commands run as root. Using /bin/bash with the -p flag preserves the effective root privileges, and the -quit action terminates find immediately after spawning the shell, providing a clean root shell. This is a classic GTFOBins technique for sudo find.

Answer

sudo find / -exec /bin/sh -p \; -quit

Answer

sudo find / -perm -4000 -exec /bin/bash \;

Answer

sudo find / -exec /bin/bash \;

Question 18

You are enumerating a Linux system and find that the `sudo` version is 1.8.25. You also notice that the user `www-data` has sudo privileges to run `/usr/bin/awk` as root without a password. Which of the following commands will successfully spawn a root shell?

Accepted Answer

sudo awk 'BEGIN {system("/bin/bash")}'. When a user has sudo privileges to run awk as root, it is possible to execute shell commands through awk's system() function. The command `sudo awk 'BEGIN {system("/bin/bash")}'` will spawn an interactive bash shell with root privileges. This is a classic privilege escalation technique. Other options either do not spawn a shell or attempt to modify system files, which is less direct and may not be desired.

Answer

sudo awk 'BEGIN {print "root::0:0:root:/root:/bin/bash" >> "/etc/passwd"}'

Answer

sudo awk -f /etc/passwd

Answer

sudo awk '/root/ {print $0}' /etc/shadow

Question 19

You have a low-privileged shell on a Linux system and discover that the /etc/passwd file is writable by your user. Which of the following methods is most reliable for escalating to root by modifying /etc/passwd?

Accepted Answer

Add a new user with UID 0 and a known password hash, then switch to that user using su.. If /etc/passwd is writable, the most straightforward escalation is to add a new user with UID 0 and a known password hash. Since the system may still use /etc/passwd for authentication or you can set the hash directly, you can then use su to switch to that user. This grants root privileges without needing to modify existing accounts, which might be monitored or use shadowed hashes.

Answer

Set the root user's UID to 0 and add your user to the root group, then re-login.

Answer

Modify the root user's password hash to a known value, then use su root to log in.

Answer

Change the root user's shell to /bin/bash, then run 'su root' without a password.

Question 20

You have obtained a low-privileged shell on a Linux system. You run `sudo -l` and see the following output: `(ALL) NOPASSWD: /usr/bin/vi`. Which command will allow you to escalate to root?

Accepted Answer

sudo vi -c ':!sh'. When sudo allows running vi as root, you can use vi's ability to execute shell commands. The -c option runs a command after opening vi. Using ':!sh' executes an interactive shell. Because vi runs with root privileges, the shell is a root shell. This is a standard privilege escalation method.

Answer

sudo vi /etc/shadow

Answer

sudo vi -c ':e /etc/shadow'

Answer

sudo vi -c ':w !sh'