CEH Enumeration and System Hacking Practice Question
A security analyst is investigating a compromised Linux system and finds the following: - A binary with SUID bit set owned by root that is not a standard system binary - The file /etc/ld.so.preload contains a reference to a shared object in /tmp - The system logs show gaps of several minutes during peak hours. Which TWO techniques has the attacker MOST likely used to maintain access and evade detection?
⚠ Common exam trap
EC-Council expects candidates to distinguish between user-space rootkits (like LD_PRELOAD) and kernel-level rootkits (like kernel modules); the trap here is that candidates may confuse the /etc/ld.so.preload mechanism with a kernel module rootkit, but the file path and preload technique are hallmarks of a user-space rootkit, not a kernel module.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SUID privilege escalation
Option A (SUID privilege escalation) is correct because the non-standard binary owned by root with the SUID bit set allows any user executing it to run with root privileges, which is a classic persistence and privilege-escalation mechanism an attacker leaves behind to regain elevated access. Option D (LD_PRELOAD rootkit) is correct because /etc/ld.so.preload forces the dynamic linker to load the referenced shared object from /tmp into every dynamically linked process, letting the attacker hook libc functions to hide files, processes, and connections; the log gaps during peak hours are consistent with such userland hooking that suppresses or filters logging. Option B (password cracking) is not indicated: cracking offline hashes does not create SUID binaries, ld.so.preload entries, or log gaps. Option C (kernel module rootkit) is not indicated because the evidence points to userland dynamic-linker hijacking via ld.so.preload rather than a loadable kernel module. Option E (steganography) is not indicated since no covert data hiding in files or images is described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SUID privilege escalation
Why this is correct
SUID privilege escalation occurs when a root-owned executable has its SUID bit set, allowing any user to execute it with the effective privileges of the file owner, typically root. Attackers can exploit this by finding or creating such binaries, then using them to spawn a root shell or execute arbitrary commands with elevated privileges. This is a common post-exploitation technique for maintaining root access or escalating from a low-privileged user, making it a highly plausible method for a compromised Linux system.
- ✗
Password cracking
Why it's wrong here
Password cracking involves systematically attempting to guess user credentials, often by brute-forcing or dictionary attacks against hashed passwords stored in files like /etc/shadow or network authentication services. While a common initial access or lateral movement technique, the presence of artifacts like ld.so.preload modifications or SUID binaries points towards post-exploitation persistence and evasion rather than the act of cracking passwords itself. There is no direct evidence in the scenario indicating such an attack.
- ✗
Kernel module rootkit
Why it's wrong here
A kernel module rootkit hides itself within the running kernel, whereas the evidence here points to userland dynamic-linker hijacking via /etc/ld.so.preload plus a rogue SUID binary; the log gaps indicate log tampering rather than kernel-level concealment. It is tempting because kernel rootkits are the classic explanation for an intruder hiding files and processes on a Linux host.
- ✓
LD_PRELOAD rootkit
Why this is correct
An LD_PRELOAD rootkit leverages the dynamic linker's ability to load a specified shared library before any other libraries, either via the `LD_PRELOAD` environment variable or the `/etc/ld.so.preload` configuration file. This allows the malicious library to intercept and hook standard C library functions and system calls, enabling it to hide files, processes, or network activity from system utilities. It's a highly effective userland rootkit technique for maintaining stealth and persistence post-compromise by subverting legitimate system functions.
- ✗
Steganography
Why it's wrong here
Steganography involves concealing data within other legitimate, non-secret files, such as images, audio, or document files, to avoid detection. Its primary purpose is covert communication or data exfiltration, not system-level persistence or privilege escalation. The indicators typically associated with a compromised Linux system, like modifications to dynamic linker configurations or SUID binaries, are unrelated to hiding information within media files and do not suggest steganography was employed.
Go deeper
Related to this question
Learn chapter
System Hacking
Key term
Password Cracking
Password cracking is the process of using software tools or techniques to recover unknown passwords from stored data or by guessing them systematically.
Key term
Steganography
Steganography is the practice of hiding a secret message inside an ordinary, non-secret file such as an image, audio, or video to keep the message hidden from casual observers.
About these practice questions
This CEH question is part of Courseiva's 913-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.