CEH Enumeration and System Hacking Practice Question

During a penetration test, you successfully gain access to a web server with a low-privileged shell. You want to escalate privileges to root. Which of the following techniques is MOST likely to achieve privilege escalation on a misconfigured Linux system?

⚠ Common exam trap

Test-takers frequently confuse establishing a reverse shell (which maintains the current privilege level) with privilege escalation, or they assume password cracking is feasible without first obtaining the hashed password file.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Search for and exploit a SUID binary that allows privilege escalation

SUID (Set User ID) binaries execute with the privileges of the file owner, typically root. On a misconfigured Linux system, a low-privileged user can run a SUID-root binary (e.g., `find`, `vim`, `nmap`) to spawn a shell with root privileges, directly achieving privilege escalation without needing credentials or additional exploits.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use the `netcat` tool to establish a reverse shell back to the attacker
Why it's wrong here
Establishing a reverse shell with `netcat` from a compromised low-privileged system simply provides another remote access point, inheriting the exact same user privileges as the initial shell. This action does not elevate the current user's permissions on the target system. Therefore, it fails to achieve privilege escalation, which requires gaining higher access rights, such as root or administrator, not just another connection.
✓
Search for and exploit a SUID binary that allows privilege escalation
Why this is correct
SUID (Set User ID) is a special permission bit on executable files that allows them to run with the permissions of the file's owner, rather than the user executing it. If a binary owned by root, like `find` or `nmap`, has SUID set and can be manipulated to execute arbitrary commands or spawn a shell, a low-privileged user can exploit this to gain root privileges. This is a highly effective and common method for local privilege escalation on Linux/Unix systems.
✗
Use a password cracking tool like John the Ripper on the system's shadow file
Why it's wrong here
While extracting and cracking password hashes from the `/etc/shadow` file using tools like John the Ripper *could* eventually yield root credentials, this process is often time-consuming and not guaranteed to succeed against strong passwords. Even if successful, directly using these credentials from a low-privileged shell might be detectable or require specific commands like `su` or `sudo` that could be restricted. Exploiting a SUID binary offers a more direct, immediate, and often stealthier path to privilege escalation without relying on password strength or interactive login.
✗
Perform a brute force attack on the root password
Why it's wrong here
Brute-forcing the root password is ineffective here because the low-privileged shell lacks interactive login capabilities and rate-limiting or account lockout policies on the server will block repeated authentication attempts, making the attack impractical. This technique is tempting because password brute-forcing is a standard method for gaining unauthorised access to accounts; it would be correct if the tester had network-level access to a login service, such as SSH, without prior shell access.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question