CEH Enumeration and System Hacking Practice Question
During a penetration test, you gain access to a Linux server as a low-privileged user. Which of the following is an effective technique to escalate privileges by exploiting misconfigured file permissions?
⚠ Common exam trap
It's easy for candidates to confuse SUID/GUID abuse with Windows-specific techniques like token impersonation or pass-the-hash, because the CEH exam often intermixes cross-platform attack vectors to test your ability to match the technique to the correct operating system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SUID/GUID abuse
SUID (Set User ID) and GUID (Group ID) bits allow a binary to execute with the privileges of the file owner (often root) rather than the calling user. If a low-privileged user can run a binary with the SUID bit set that performs unsafe operations (e.g., spawning a shell, reading arbitrary files, or executing commands), they can leverage it to gain root-level access. This is a classic privilege escalation vector on Linux systems when file permissions are misconfigured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pass-the-hash
Why it's wrong here
Pass-the-hash (PtH) is a Windows-specific post-exploitation technique where an attacker authenticates to a remote system or service using a user's NTLM hash instead of their plaintext password. This method bypasses the need to crack the hash and is primarily effective for lateral movement within Active Directory environments. It is not applicable to a standard Linux server, which does not use NTLM for local authentication.
- ✗
Token impersonation
Why it's wrong here
Token impersonation is a Windows-specific privilege escalation technique where a process can assume the security context of another user's access token. This allows the process to perform actions with the privileges of the impersonated user, often leveraging misconfigurations in services or applications. Linux operating systems do not utilize access tokens in the same manner, instead relying on UIDs, GIDs, and capabilities for privilege management.
- ✓
SUID/GUID abuse
Why this is correct
SUID (Set User ID) and SGID (Set Group ID) are special permissions in Linux that allow an executable to run with the privileges of the file's owner or group, respectively, rather than the user executing it. If a program with SUID permissions is owned by root and can be manipulated (e.g., by executing arbitrary commands or writing to sensitive files), it can be abused for privilege escalation. This is a common and effective technique on Linux systems.
- ✗
Kerberoasting
Why it's wrong here
Kerberoasting is an attack technique used to obtain service account hashes from Active Directory. Attackers request service tickets (TGS) for Service Principal Names (SPNs) and then extract the encrypted portion containing the service account's NTLM hash, which can be cracked offline. This method is exclusively relevant to Windows Active Directory environments and is not applicable to a standalone Linux server.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 870 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.