CEH Enumeration and System Hacking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Abuse the SUID bit on find

  Why it's wrong here

  While a SUID (Set User ID) bit on the `find` binary would indeed allow it to run with elevated privileges, `find` is not typically configured with the SUID bit by default on most modern Linux systems. Therefore, simply "abusing" a non-existent SUID bit is not a viable or common privilege escalation path in a standard low-privilege shell scenario. The technique described in the correct answer is what one would use *if* `find` were SUID, but the SUID bit itself isn't the *method* of exploitation.

• ✓

  Use find with the -exec flag to spawn a shell

  Why this is correct

  This is a well-known and highly effective privilege escalation vector. If the `find` binary has the SUID (Set User ID) bit set, or if a low-privilege user can execute `find` with `sudo` privileges without a password, the `-exec` flag can be leveraged to execute arbitrary commands as the owner of the `find` binary (typically root). For example, `find . -exec /bin/sh -p \;` would spawn a privileged shell, effectively escalating privileges from the low-privilege shell.

• ✗

  Exploit a kernel vulnerability

  Why it's wrong here

  Exploiting a kernel vulnerability for privilege escalation is a valid, but highly specific and complex, method. It typically requires identifying a specific, unpatched Common Vulnerabilities and Exposures (CVE) in the operating system's kernel, often involving custom exploit code. This approach is far less common and generally more difficult than leveraging misconfigurations or features of userland binaries like `find` during a standard penetration test.

• ✗

  Run a buffer overflow on the find binary

  Why it's wrong here

  Performing a buffer overflow on the `find` binary would necessitate discovering a specific memory corruption vulnerability within its code that allows for arbitrary code execution. While buffer overflows can lead to privilege escalation, standard system utilities like `find` are generally mature, well-audited, and hardened against such exploits. This method is highly unlikely to be a viable or practical approach in a typical penetration test scenario compared to leveraging existing functionality or misconfigurations.

Go deeper

Related to this question