CEH Enumeration and System Hacking Practice Question

A security analyst observes a suspicious SUID binary /usr/bin/evil in a Linux system. Which type of vulnerability does this indicate, and what is the MOST likely objective of an attacker who placed it?

⚠ Common exam trap

EC-Council often tests the distinction between a vulnerability (like a buffer overflow) and an indicator of a completed exploit (like a SUID binary), causing candidates to confuse the attack vector with the attacker's objective.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Privilege escalation; gain root access

A SUID binary owned by root that is not part of the standard OS distribution (like /usr/bin/evil) is a classic indicator of a privilege escalation backdoor. The SUID bit allows any user who executes the binary to run it with the owner's permissions—in this case, root—so the attacker's objective is to gain root access by executing this binary.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Information disclosure; read sensitive files
Why it's wrong here
While a compromised SUID binary could potentially be leveraged to read sensitive files if it executes with elevated privileges, information disclosure is typically a secondary objective or a consequence of exploiting such a binary. The fundamental vulnerability associated with SUID binaries is the ability to execute code with the owner's permissions, which directly leads to privilege escalation, making information disclosure a subsequent action rather than the primary goal of SUID abuse itself.
✓
Privilege escalation; gain root access
Why this is correct
A SUID (Set User ID) bit on an executable allows it to run with the permissions of its owner, regardless of the user executing it. If a binary is owned by the root user and has the SUID bit set, any user executing it will temporarily gain root privileges for the duration of that execution. This mechanism is specifically designed for privilege escalation, enabling a low-privileged user to perform actions typically reserved for root, such as gaining a root shell or modifying system configurations.
✗
Denial of service; crash the system
Why it's wrong here
SUID binaries are fundamentally designed to grant elevated permissions for specific tasks, not to induce system instability or crashes. While an improperly coded SUID binary could potentially lead to a system crash due to bugs or resource exhaustion, its primary security implication and the intended method of exploitation do not involve denial of service. Exploiting SUID vulnerabilities focuses on leveraging the elevated privileges for unauthorized access or control, rather than disrupting system availability.
✗
Buffer overflow; execute arbitrary code
Why it's wrong here
A buffer overflow is a memory corruption vulnerability where a program writes data beyond the allocated buffer, potentially overwriting adjacent memory and altering program execution flow. While a buffer overflow *within* an SUID binary could be extremely dangerous, allowing arbitrary code execution with elevated privileges, SUID itself is a *permission mechanism*, not a vulnerability type. The question refers to the *suspicious SUID binary* as the primary observation, implying the SUID bit's inherent risk, not a specific memory corruption flaw within the binary's code.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question