CEH Vulnerability Analysis and System Hacking Practice Question
During a penetration test, a tester gains access to a Linux system and needs to escalate privileges. The tester finds that the user has sudo privileges to run /usr/bin/less as root without a password. Which technique should the tester use to escalate privileges?
⚠ Common exam trap
The trap here is that candidates may overlook the command execution capability of less and instead focus on kernel exploits or cron jobs, missing the direct and simplest path to root via the sudo misconfiguration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell
When a user has sudo privileges to run /usr/bin/less as root without a password, the tester can leverage the fact that less can execute shell commands from within its interface. By running 'sudo /usr/bin/less' and then typing '!/bin/bash', the tester spawns a root shell, effectively escalating privileges to root.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exploit a kernel vulnerability using a local exploit
Why it's wrong here
Exploiting a kernel vulnerability with a local exploit is generally a complex and high-risk endeavor. Such exploits often require specific kernel versions and configurations, making them unreliable and potentially causing system instability or crashes. Furthermore, kernel exploits are typically a last resort when other, simpler privilege escalation methods, such as misconfigured SUID binaries or sudo permissions, are unavailable or have been exhausted.
- ✓
Run /usr/bin/less with sudo, then type !/bin/bash to spawn a root shell
Why this is correct
This method correctly leverages a common sudo misconfiguration where a user is permitted to execute /usr/bin/less with root privileges. Inside less, typing '!' allows the execution of arbitrary shell commands. Since less is running as root via sudo, any command executed through '!', such as !/bin/bash, will also inherit root privileges, effectively spawning a root shell.
- ✗
Use the find command with -exec to execute a shell
Why it's wrong here
Using the find command with the -exec option to execute a shell would only grant the privileges of the user running find. For this technique to achieve privilege escalation, the find binary itself would need to be executed with elevated privileges, either by being a SUID (Set User ID) root binary or by being explicitly allowed to run via sudo. Without find having these elevated permissions, -exec simply runs commands as the current, unprivileged user.
- ✗
Check for world-writable scripts in cron jobs
Why it's wrong here
Checking for world-writable scripts in cron jobs is a legitimate privilege escalation vector, as an attacker could modify such a script to execute malicious code when the cron job runs. However, this method relies on the cron job's scheduled execution, meaning it's not an immediate way to gain a root shell. Given the availability of a more direct sudo privilege escalation path (as suggested by the correct answer), this approach is less immediate and efficient.
Go deeper
Related to this question
About these practice questions
This CEH question is part of Courseiva's 870-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.