CEH Enumeration and System Hacking Practice Question

A penetration tester gains access to a Linux server and attempts to escalate privileges. They run `sudo -l` and see that the user can run `/usr/bin/vim` as root without a password. Which privilege escalation technique should the tester use?

⚠ Common exam trap

CEH exams often test the distinction between sudo-based privilege escalation and SUID-based escalation; the trap here is that candidates may incorrectly focus on the SUID bit (Option D) when the actual vector is the sudo rule allowing arbitrary command execution via vim's shell escape.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use vim's shell escape via `:!bash` to get a root shell

The `sudo -l` output shows that the user can run `/usr/bin/vim` as root without a password. Vim has a built-in shell escape feature: from within vim, typing `:!bash` (or `:!sh`) executes a shell with the privileges of the user running vim. Since vim is run via sudo as root, the spawned shell will be a root shell, directly escalating privileges without needing additional exploits.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Perform token impersonation using SeImpersonatePrivilege
Why it's wrong here
Performing token impersonation using SeImpersonatePrivilege is entirely irrelevant in a Linux server environment. This specific privilege is a core component of the Windows security model, enabling a service or process to assume the security context of another user or client. Linux systems utilize a fundamentally different privilege and access control mechanism, rendering Windows-specific token manipulation techniques ineffective and inapplicable for privilege escalation.
✓
Use vim's shell escape via `:!bash` to get a root shell
Why this is correct
This is the correct approach because if vim is launched with sudo privileges, even if sudo is configured to require a password, the vim process itself will be running as root. Within vim, the :!bash command allows the user to execute an arbitrary shell command. Since vim is already running as root, the spawned bash shell will inherit these root privileges, effectively granting a root shell without needing to know the root password directly.
✗
Exploit a kernel vulnerability (CVE-2023-xxxx)
Why it's wrong here
Exploiting a kernel vulnerability, such as a hypothetical CVE-2023-xxxx, is an overly complex and often unnecessary method for privilege escalation when a simpler path, like a sudo misconfiguration, is available. Kernel exploits typically require specific conditions, often involve significant research or pre-existing exploits, and carry a higher risk of system instability or detection. Ethical hackers prioritize the most straightforward and reliable methods, making a kernel exploit a last resort rather than a primary option in this scenario.
✗
Abuse the SUID bit on vim
Why it's wrong here
Abusing the SUID bit on vim is not applicable here because vim typically does not have the SUID bit set by default on Linux systems. The SUID bit allows an executable to run with the permissions of its owner, usually root, regardless of who executes it. In this scenario, the privilege escalation vector explicitly involves sudo, which is a distinct mechanism for temporarily granting elevated privileges to specific users or commands, rather than relying on a persistent SUID permission on the vim binary itself.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question