hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: During a penetration test, a tester gains access…
During a penetration test, a tester gains access to a Linux server as a low-privileged user. The server has a cron job that executes a script owned by root but writable by the tester's group. Which privilege escalation technique should the tester use?
⚠ Common exam trap
Many candidates confuse path hijacking (which exploits an unqualified command in the script) with direct script modification (which exploits writable permissions on the script file itself), but the question explicitly states the script is writable, making modification the correct choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cron job exploitation via script modification
The cron job executes a script owned by root but writable by the tester's group. This means the tester can modify the script's contents. When the cron job runs (as root), the modified script executes with root privileges, allowing the tester to gain a root shell or execute arbitrary commands as root. This is a classic cron job exploitation via script modification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Kernel exploit
Why it's wrong here
Kernel exploits are a privilege escalation strategy that relies on a specific kernel vulnerability (e.g., a CVE with a known proof-of-concept) and usually requires matching kernel version and mitigation state. In this scenario, no kernel version, patch level, or vulnerability indicator is mentioned; there is no evidence an outdated kernel is installed. The root cause is a cron job executing a group-writable script, which is directly and reliably exploitable without the risk or complexity of a kernel exploit.
- ✗
Misconfigured sudo permissions
Why it's wrong here
Misconfigured sudo permissions would require a visible sudoers rule such as a user or group allowed to run a command as root with NOPASSWD or a specific binary listed as sudo-allowed. The scenario describes only that the tester's group has write access to a script; it does not mention sudo commands, sudoers entries, or user privilege to invoke sudo on that script. Without an underlying sudo policy, there is no sudo-based escalation here; the vulnerability lies in the script's file permissions and its execution by root through cron.
- ✓
Cron job exploitation via script modification
Why this is correct
The cron job runs as root and executes a script that is owned by root but writable by the tester's group. Because the tester can modify the script's contents, they can inject an attacker-controlled command (e.g., a reverse shell or a command to modify /etc/passwd) that will be executed with root privileges when the cron job next triggers. This direct file modification bypasses any restrictions on interactive login and provides identical privileges to the cron job's owner, making it a simple, reliable privilege escalation path.
- ✗
Path hijacking in the cron job
Why it's wrong here
Path hijacking would require the cron job to call a command or script using a relative path, allowing the tester to place a malicious executable earlier in the `$PATH`. In this scenario, the cron job executes a script owned by root but writable by the tester's group, so the tester can directly modify the script’s contents without needing to manipulate the path. This technique is tempting because it is a standard privilege escalation method when a cron job runs a binary or script via an unqualified name, but here the script’s writability makes direct file modification the correct vector.
Go deeper
Related to this question
Learn chapter
Penetration Testing Methodology
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
Key term
Privilege escalation
Privilege escalation is when a user or attacker gains more access or control over a system than they are supposed to have.
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.