CEH Enumeration and System Hacking Practice Question
A penetration tester is attempting to escalate privileges on a Linux target. The tester runs `find / -perm -4000 -type f 2>/dev/null` and discovers that `/usr/bin/pkexec` has the SUID bit set. The target runs Ubuntu 20.04 with default configurations. Which of the following is the MOST likely next step?
⚠ Common exam trap
A common mix-up: candidates assume pkexec requires a password for all commands (Option C) or think that removing the SUID bit is a valid escalation step (Option D), when in fact the vulnerability bypasses authentication entirely and the goal is exploitation, not hardening.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exploit the pkexec vulnerability (CVE-2021-4034) to gain root access
CVE-2021-4034 (PwnKit) is a memory corruption vulnerability in pkexec that allows unprivileged users to escalate privileges to root by exploiting an out-of-bounds write in the argument parsing logic. On Ubuntu 20.04 with default configurations, the pkexec binary is SUID root and vulnerable to this exploit, making it the most direct and effective next step for privilege escalation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Exploit the pkexec vulnerability (CVE-2021-4034) to gain root access
Why this is correct
This option is correct because CVE-2021-4034, known as "PwnKit," is a critical local privilege escalation vulnerability in the `pkexec` utility. It allows an unprivileged local attacker to gain full root privileges on a vulnerable Linux system by exploiting a memory corruption bug (out-of-bounds write) in how `pkexec` handles command-line arguments. This specific exploit path directly provides the means to achieve root access, fulfilling the objective of privilege escalation.
- ✗
Change the ownership of the pkexec binary to root:root
Why it's wrong here
This action is ineffective for privilege escalation because the `pkexec` binary is inherently designed to be owned by `root` and typically has the SUID bit set, allowing it to execute with root privileges. Attempting to change its ownership to `root:root` would be redundant, as it is already the default and secure configuration. Such an action would not introduce any new vulnerability or exploit path to gain higher privileges.
- ✗
Use pkexec to execute a command as root directly
Why it's wrong here
Directly using `pkexec` to execute an arbitrary command as root without exploiting a specific vulnerability is not possible for an unprivileged user. The `pkexec` utility is designed to enforce policy and typically prompts for the user's password or requires specific `polkit` rules to be met before allowing a command to run with elevated privileges. Therefore, simply invoking `pkexec` with a command will result in an authentication prompt, not immediate root access.
- ✗
Remove the SUID bit from pkexec to prevent misuse
Why it's wrong here
Removing the SUID (Set User ID) bit from the `pkexec` binary would prevent it from executing with root privileges when invoked by a non-root user. While this is a valid system hardening measure to mitigate potential vulnerabilities by reducing the attack surface, it directly counteracts the goal of privilege escalation. A penetration tester aims to gain higher privileges, not to reduce the capabilities of a system utility or prevent its privileged execution.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.