CEH Enumeration and System Hacking Practice Question

After gaining initial access to a Linux server, an attacker runs `find / -perm -4000 -o -perm -2000 2>/dev/null`. What is the primary objective of this command?

⚠ Common exam trap

Many candidates confuse the permission masks for SUID/SGID (4000/2000) with world-writable (0002) or setuid root ownership, leading them to incorrectly select options about data exfiltration or root-owned files instead of recognizing the command's specific purpose for privilege escalation enumeration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Identify files with SUID or GUID bits set for privilege escalation

The command `find / -perm -4000 -o -perm -2000 2>/dev/null` searches the entire filesystem for files with the SUID (setuid, permission 4000) or SGID (setgid, permission 2000) bits set. These special permission bits allow a file to execute with the privileges of its owner (often root) or group, respectively. An attacker's primary objective is to identify such files because they can be exploited to escalate privileges from a low-privileged user to a higher-privileged user (e.g., root) by running a vulnerable SUID/SGID binary.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Locate world-writable files for data exfiltration
Why it's wrong here
Locating world-writable files is a distinct reconnaissance step, primarily useful for staging data, planting backdoors, or potentially modifying system behavior if critical files are writable. However, these files are not typically the direct vector for privilege escalation to root, nor are they the primary target for data exfiltration itself, which usually involves reading sensitive data from more restricted locations. Their utility lies in writing data, not inherently reading privileged information or executing code with elevated permissions.
✗
List all files owned by the root user
Why it's wrong here
Simply listing all files owned by the root user, without examining their specific permissions or attributes, does not directly facilitate privilege escalation. While root-owned files are critical, the mere ownership does not inherently reveal a vulnerability that an attacker can immediately exploit. An attacker needs to identify how they can interact with these files in a way that grants elevated privileges, which often involves specific permission bits like SUID/GUID, not just ownership.
✗
Find configuration files containing passwords
Why it's wrong here
Finding configuration files containing passwords, while a valuable discovery for lateral movement or accessing other services, is not a direct method for privilege escalation on the current system via SUID/GUID exploitation. Configuration files are static data files and do not possess the SUID or GUID bits, which are attributes of executable binaries. Therefore, exploiting such files would involve using the credentials found to log into another service or account, rather than elevating privileges on the compromised host itself through an executable vulnerability.
✓
Identify files with SUID or GUID bits set for privilege escalation
Why this is correct
Identifying files with SUID (Set User ID) or GUID (Set Group ID) bits set is a critical step for privilege escalation on Linux systems. When a program with the SUID bit is executed, it runs with the permissions of its owner, typically root, regardless of the user who initiated it. This allows a low-privileged attacker to execute specific binaries with elevated privileges, potentially exploiting vulnerabilities within those programs to gain a root shell or execute arbitrary commands as root.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question