CEH Enumeration and System Hacking Practice Question
A security analyst is investigating a compromised Linux system and finds the following: - A binary with SUID bit set owned by root that is not a standard system binary - The file /etc/ld.so.preload contains a reference to a shared object in /tmp - The system logs show gaps of several minutes during peak hours. Which TWO techniques has the attacker MOST likely used to maintain access and evade detection?
⚠ Common exam trap
EC-Council expects candidates to distinguish between user-space rootkits (like LD_PRELOAD) and kernel-level rootkits (like kernel modules); the trap here is that candidates may confuse the /etc/ld.so.preload mechanism with a kernel module rootkit, but the file path and preload technique are hallmarks of a user-space rootkit, not a kernel module.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SUID privilege escalation
The SUID bit set on a non-standard binary owned by root allows an attacker to execute that binary with root privileges, providing a persistent privilege escalation mechanism. The reference in /etc/ld.so.preload to a shared object in /tmp indicates an LD_PRELOAD rootkit, which forces the dynamic linker to load a malicious library before all others, enabling hooking of system calls to hide processes, files, or network connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SUID privilege escalation
Why this is correct
SUID privilege escalation occurs when a root-owned executable has its SUID bit set, allowing any user to execute it with the effective privileges of the file owner, typically root. Attackers can exploit this by finding or creating such binaries, then using them to spawn a root shell or execute arbitrary commands with elevated privileges. This is a common post-exploitation technique for maintaining root access or escalating from a low-privileged user, making it a highly plausible method for a compromised Linux system.
- ✗
Password cracking
Why it's wrong here
Password cracking involves systematically attempting to guess user credentials, often by brute-forcing or dictionary attacks against hashed passwords stored in files like /etc/shadow or network authentication services. While a common initial access or lateral movement technique, the presence of artifacts like ld.so.preload modifications or SUID binaries points towards post-exploitation persistence and evasion rather than the act of cracking passwords itself. There is no direct evidence in the scenario indicating such an attack.
- ✗
Kernel module rootkit
Why it's wrong here
A kernel module rootkit operates at the kernel level, typically by loading a malicious .ko (kernel object) file using `insmod` or `modprobe` to modify system call tables or hide processes, files, and network connections. Unlike userland techniques, these rootkits directly manipulate the operating system's core, making them extremely stealthy and difficult to detect. The `ld.so.preload` mechanism, however, is a userland library loading technique, fundamentally distinct from kernel module injection.
- ✓
LD_PRELOAD rootkit
Why this is correct
An LD_PRELOAD rootkit leverages the dynamic linker's ability to load a specified shared library before any other libraries, either via the `LD_PRELOAD` environment variable or the `/etc/ld.so.preload` configuration file. This allows the malicious library to intercept and hook standard C library functions and system calls, enabling it to hide files, processes, or network activity from system utilities. It's a highly effective userland rootkit technique for maintaining stealth and persistence post-compromise by subverting legitimate system functions.
- ✗
Steganography
Why it's wrong here
Steganography involves concealing data within other legitimate, non-secret files, such as images, audio, or document files, to avoid detection. Its primary purpose is covert communication or data exfiltration, not system-level persistence or privilege escalation. The indicators typically associated with a compromised Linux system, like modifications to dynamic linker configurations or SUID binaries, are unrelated to hiding information within media files and do not suggest steganography was employed.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.