PEN-200 Linux Privilege Escalation Practice Test 2 — 15 Questions

Question 1

An assessor gains a low-privileged shell on a Linux host and wants to escalate privileges by exploiting a misconfigured SUID binary. Which TWO of the following conditions would MOST likely allow privilege escalation? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SUID binary is owned by root and has the SUID bit set, and it calls a system command using a relative path.. SUID binaries that execute external commands using relative paths or without absolute paths are vulnerable to PATH manipulation. An attacker can place a malicious executable in a directory they control and adjust the PATH variable so that the SUID binary executes their code as root. These are classic privilege escalation vectors.

Answer

The SUID binary is owned by root and has the SUID bit set, and it is writable by the current user.

Answer

The SUID binary is owned by root and has the SUID bit set, and it uses the setuid() function to drop privileges before executing commands.

Answer

The SUID binary is owned by root and has the SUID bit set, and it reads a configuration file from a world-writable directory.

Question 2

During a post-exploitation assessment on a Linux host, you discover that the current user can run `/usr/bin/find` as root without a password, as shown in the sudoers output: `(root) NOPASSWD: /usr/bin/find`. Which command will most reliably escalate to a root shell?

Accepted Answer

sudo find / -exec /bin/bash -p \; -quit. The sudoers entry permits running /usr/bin/find as root without a password. The find utility's -exec action can execute arbitrary commands, and when combined with sudo, those commands run as root. Using /bin/bash with the -p flag preserves the effective root privileges, and the -quit action terminates find immediately after spawning the shell, providing a clean root shell. This is a classic GTFOBins technique for sudo find.

Answer

sudo find / -exec /bin/sh -p \; -quit

Answer

sudo find / -perm -4000 -exec /bin/bash \;

Answer

sudo find / -exec /bin/bash \;

Question 3

You are enumerating a Linux system and find that the `sudo` version is 1.8.25. You also notice that the user `www-data` has sudo privileges to run `/usr/bin/awk` as root without a password. Which of the following commands will successfully spawn a root shell?

Accepted Answer

sudo awk 'BEGIN {system("/bin/bash")}'. When a user has sudo privileges to run awk as root, it is possible to execute shell commands through awk's system() function. The command `sudo awk 'BEGIN {system("/bin/bash")}'` will spawn an interactive bash shell with root privileges. This is a classic privilege escalation technique. Other options either do not spawn a shell or attempt to modify system files, which is less direct and may not be desired.

Answer

sudo awk 'BEGIN {print "root::0:0:root:/root:/bin/bash" >> "/etc/passwd"}'

Answer

sudo awk -f /etc/passwd

Answer

sudo awk '/root/ {print $0}' /etc/shadow

Question 4

You have a low-privileged shell on a Linux system and discover that the /etc/passwd file is writable by your user. Which of the following methods is most reliable for escalating to root by modifying /etc/passwd?

Accepted Answer

Add a new user with UID 0 and a known password hash, then switch to that user using su.. If /etc/passwd is writable, the most straightforward escalation is to add a new user with UID 0 and a known password hash. Since the system may still use /etc/passwd for authentication or you can set the hash directly, you can then use su to switch to that user. This grants root privileges without needing to modify existing accounts, which might be monitored or use shadowed hashes.

Answer

Set the root user's UID to 0 and add your user to the root group, then re-login.

Answer

Modify the root user's password hash to a known value, then use su root to log in.

Answer

Change the root user's shell to /bin/bash, then run 'su root' without a password.

Question 5

You have obtained a low-privileged shell on a Linux system. You run `sudo -l` and see the following output: `(ALL) NOPASSWD: /usr/bin/vi`. Which command will allow you to escalate to root?

Accepted Answer

sudo vi -c ':!sh'. When sudo allows running vi as root, you can use vi's ability to execute shell commands. The -c option runs a command after opening vi. Using ':!sh' executes an interactive shell. Because vi runs with root privileges, the shell is a root shell. This is a standard privilege escalation method.

Answer

sudo vi /etc/shadow

Answer

sudo vi -c ':e /etc/shadow'

Answer

sudo vi -c ':w !sh'

Question 6

You have a low-privileged shell on a Linux host. You discover that the system has the `CAP_SETUID` capability set on the `/usr/bin/python3.8` binary. Which of the following Python commands will allow you to escalate to root?

Accepted Answer

import os; os.setuid(0); os.system('/bin/bash'). The CAP_SETUID capability allows a process to change its user ID. In Python, os.setuid(0) sets the effective user ID to root. Once the effective UID is 0, the process has root privileges, and spawning a shell with os.system('/bin/bash') yields a root shell. This is the most straightforward exploitation. Other options either target the group ID, use unnecessary complexity, or attempt to set both real and effective UIDs, which may not be permitted.

Answer

import ctypes; libc = ctypes.CDLL('libc.so.6'); libc.setuid(0); os.system('/bin/bash')

Answer

import os; os.setreuid(0,0); os.system('/bin/bash')

Answer

import os; os.setgid(0); os.system('/bin/bash')

Question 7

During a Linux privilege escalation assessment, you are looking for misconfigured file permissions that could lead to root access. Which TWO of the following files, if world-writable, would MOST directly allow privilege escalation? (Choose two.)

Accepted Answer

/etc/passwd. World-writable /etc/passwd allows adding a root user or removing the root password, granting immediate root access. World-writable /etc/shadow allows replacing the root password hash, also granting immediate root access. Both are direct and severe. While /etc/crontab can lead to escalation, it requires a delay and is less direct. /etc/hosts and /etc/resolv.conf are not direct privilege escalation vectors.

Answer

/etc/resolv.conf

Answer

/etc/hosts

Answer

/etc/crontab

Question 8

You have a shell as user `www-data` on a Linux server. You discover that the `python3` binary has the capability `cap_setuid+ep` set. Which command will allow you to escalate to root?

Accepted Answer

python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'. The `cap_setuid` capability allows a process to change its effective user ID. By running Python with this capability, you can call `os.setuid(0)` to become root, then spawn a shell. This is a standard technique for exploiting Linux capabilities. The other options either change only the group ID, use a less direct method, or fail to change the UID at all.

Answer

python3 -c 'import os; os.setreuid(0,0); os.system("/bin/bash")'

Answer

python3 -c 'import os; os.setgid(0); os.system("/bin/bash")'

Answer

python3 -c 'import os; os.system("/bin/bash -p")'

Question 9

You are assessing a Linux host and find a binary with the SUID bit set owned by root. Running `ltrace` on it reveals that it calls `setuid(0)` but then immediately calls `setgid(getgid())` before executing a shell. What is the likely outcome?

Accepted Answer

The binary drops group privileges but retains root user privileges, and the shell runs with an effective UID of 0.. The binary calls setuid(0) to gain root user privileges, then setgid(getgid()) to drop group privileges. The effective user ID remains 0, so the spawned shell runs with root user privileges. The group ID change only affects group-based access, not user-based root access. Thus, privilege escalation is successful.

Answer

The binary drops both user and group privileges, so the shell runs with the privileges of the invoking user.

Answer

The binary drops group privileges but retains root user privileges, so the shell runs as root.

Answer

The binary fails to execute the shell because setgid cannot be called after setuid.

Question 10

During a Linux privilege escalation assessment, you are examining a system for misconfigured file permissions. Which two of the following files, if world-writable, would most directly allow a local attacker to escalate privileges to root? (Choose two.)

Accepted Answer

/etc/shadow. World-writable `/etc/passwd` and `/etc/shadow` are direct privilege escalation vectors. Modifying `/etc/passwd` allows adding a UID 0 user, while modifying `/etc/shadow` allows changing the root password hash. Both grant immediate root access. The other files, while potentially useful for other attacks, do not directly provide root privileges on the local system.

Answer

/etc/hosts

Answer

/etc/crontab

Answer

/etc/resolv.conf

Question 11

You have gained a low-privileged shell on a Linux system and discovered a binary with the SUID bit set. The binary executes a system call to 'cat' without specifying an absolute path. How can you leverage this to escalate privileges?

Accepted Answer

Prepend a directory containing a malicious 'cat' script to the PATH variable and run the binary.. By manipulating the PATH environment variable, you can point the system to a malicious 'cat' executable created in a writable directory. When the SUID binary runs, it executes your script with the permissions of the file owner rather than yours. This technique exploits the insecure execution of external commands, a common vulnerability in improperly coded SUID binaries that allows for arbitrary command execution under an elevated security context.

Answer

Overwrite the SUID binary's source code in /usr/src to include a reverse shell.

Answer

Use 'chmod' to grant everyone execute permissions on the SUID binary to trigger a buffer overflow.

Answer

Modify the /etc/ld.so.preload file to inject a malicious library into the SUID binary's execution flow.

Question 12

Refer to the exhibit. Given the sudo privileges, which command will successfully spawn a root shell?

Accepted Answer

sudo /usr/bin/vim -c ':!/bin/sh'. The exhibit shows that the user can run 'vim' as root without a password. Since vim has a built-in shell execution feature, an attacker can escape the editor to a root-privileged command prompt. This is a classic example of misconfigured sudo rights, where allowing full access to a versatile utility that supports command execution effectively grants the user complete control over the system.

Answer

sudo /usr/bin/vim /etc/shadow

Answer

sudo /usr/bin/vim --version

Answer

sudo /usr/bin/vim -u NONE

Question 13

Which Linux kernel feature, if misconfigured or outdated, allows an unprivileged user to gain root access by exploiting a vulnerability in the handling of user namespaces?

Accepted Answer

Unprivileged user namespace clone functionality. User namespaces allow unprivileged processes to behave as root within a confined environment. Vulnerabilities in how the kernel manages these namespaces, such as improper capability checks, can be exploited to gain full root access on the host system. This highlights the importance of kernel patching and minimizing the attack surface by disabling unnecessary namespace features on production servers to prevent escapes.

Answer

AppArmor profile confinement

Answer

Shared memory segment access via IPC

Answer

Extended file attributes (xattr)

Question 14

Refer to the exhibit. The 'find' binary has the SUID bit set. How can you leverage this to gain a root shell?

Accepted Answer

find . -exec /bin/sh -p \;. The 'find' command includes an '-exec' flag that allows executing arbitrary commands on the files it locates. When an SUID-bit 'find' binary is used with the '-exec' flag, the command spawned by '-exec' will also run with the SUID owner's privileges. This is a well-documented technique for privilege escalation, demonstrating why SUID binaries must be audited to ensure they do not offer functionality that can be abused for command execution.

Answer

find . -name "*" -delete

Answer

find . -exec chmod 777 /etc/shadow \;

Answer

find / -user web -exec ls -l {}

Question 15

You find that a binary relies on a relative path to execute a secondary script. If you cannot modify the PATH variable, what is the best alternative to exploit this configuration?

Accepted Answer

Create the expected directory structure in a location you control and execute the binary from there.. If PATH modification is not possible, you can utilize symlinks or directory traversal to manipulate the binary's search logic. By creating a directory structure that mimics the expected relative path, you can place a malicious executable where the binary expects the legitimate one. This is effective because it exploits the binary's reliance on current working directory context, bypassing strict system-wide path settings entirely.

Answer

Modify the binary's ELF header to change the search path.

Answer

Use the 'ptrace' system call to attach to the binary and change its execution flow.

Answer

Inject environment variables like 'LD_LIBRARY_PATH' to overwrite the binary's functionality.