CEH Enumeration and System Hacking Practice Question

A security analyst reviews the following command output from a Linux system: `uid=0(root) gid=0(root) groups=0(root)`. The analyst suspects a privilege escalation attack. Which of the following techniques could have been used to achieve root access from a standard user account?

⚠ Common exam trap

Test-takers frequently confuse Windows-specific attacks (token impersonation, pass-the-hash, LLMNR poisoning) with Linux privilege escalation, failing to recognize that the `uid=0` output is a direct indicator of root access achieved via SUID/GUID abuse.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SUID/GUID abuse

The command output shows the current user has UID 0, which is the root user. On Linux, SUID (Set User ID) and GUID (Group ID) bits allow executables to run with the permissions of the file owner (e.g., root). A standard user can exploit a misconfigured SUID binary (like `passwd` or a custom script) to execute commands with root privileges, achieving privilege escalation. This is a classic Linux privilege escalation technique directly tied to the UID/GID output shown.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Token impersonation
Why it's wrong here
Token impersonation is a Windows-specific privilege escalation technique where an attacker exploits a process with elevated privileges to duplicate or steal an access token from another process, often a system service or an administrator. This allows the attacker to execute code with the security context of the impersonated token, bypassing User Account Control (UAC) or gaining SYSTEM-level access. Since Linux systems utilize a different security model based on UIDs, GIDs, and capabilities, this Windows-centric method is irrelevant in a Linux environment.
✗
Pass-the-hash attack
Why it's wrong here
Pass-the-hash (PtH) is a post-exploitation technique primarily used in Windows environments to authenticate to remote services or systems using a user's NTLM hash instead of their plaintext password. An attacker who obtains a user's password hash can "pass" it directly to an authentication protocol, such as SMB or WinRM, to gain access to network resources without ever needing to crack the hash. This is a network-based lateral movement technique, not a local privilege escalation method on a single Linux machine.
✗
LLMNR/NBT-NS poisoning
Why it's wrong here
LLMNR (Link-Local Multicast Name Resolution) and NBT-NS (NetBIOS Name Service) poisoning are network-based attacks that exploit fallback name resolution protocols in Windows environments. When a client fails to resolve a hostname via DNS, it broadcasts LLMNR/NBT-NS queries, which an attacker can intercept and respond to, impersonating the requested resource. This redirects the client to the attacker's machine, prompting it to send NTLM authentication hashes, which can then be captured and cracked offline for credential harvesting, not local privilege escalation on a compromised host.
✓
SUID/GUID abuse
Why this is correct
SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow an executable file to run with the permissions of its owner (SUID) or group (SGID), rather than the user executing it. If a program owned by root has the SUID bit set, any user executing it will temporarily gain root privileges for the duration of that program's execution. Attackers can exploit misconfigured or vulnerable SUID/SGID binaries, such as those that allow arbitrary command execution or shell escapes, to elevate their privileges to root or another privileged user.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question