CEH Enumeration and System Hacking Practice Question
During a security assessment, you find a Linux binary with the SUID bit set and owned by root. You execute it and obtain a root shell. This is an example of which privilege escalation technique?
⚠ Common exam trap
Candidates often confuse SUID abuse with a kernel exploit, thinking any root shell from a binary must involve a kernel vulnerability, but SUID abuse is a misconfiguration-based technique that does not require exploiting kernel code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SUID abuse
The SUID (Set User ID) bit on a binary owned by root allows it to execute with root privileges regardless of the user running it. When you execute such a binary and it spawns a shell, that shell inherits the elevated privileges, effectively granting you a root shell. This is a classic example of SUID abuse, a common privilege escalation technique on Linux systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DLL hijacking
Why it's wrong here
DLL hijacking is a Windows-specific attack vector where an attacker manipulates the search order or path to trick a legitimate application into loading a malicious Dynamic Link Library (DLL) instead of its intended one. This technique typically grants the attacker code execution within the context of the legitimate application. Since the scenario explicitly involves a Linux binary, DLL hijacking is entirely inapplicable as Linux systems utilize shared objects (.so files) and a different loading mechanism, not Windows DLLs.
- ✗
Kernel exploit
Why it's wrong here
A kernel exploit specifically targets vulnerabilities within the operating system's kernel itself, aiming to gain elevated privileges or execute arbitrary code at the highest privilege level (ring 0). While successful kernel exploits can grant root access, the scenario describes exploiting a SUID binary, which leverages a misconfiguration or vulnerability in a user-space program to inherit its owner's privileges, rather than directly attacking the kernel's integrity.
- ✗
Token impersonation
Why it's wrong here
Token impersonation is a Windows-specific privilege escalation technique where a process attempts to duplicate or steal an existing access token from another process, often one running with higher privileges. This allows the impersonating process to execute code or access resources with the permissions associated with the stolen token. This method is fundamentally distinct from SUID abuse, which relies on a specific file permission bit in Linux to temporarily elevate a process's effective user ID, and does not involve Windows access tokens.
- ✓
SUID abuse
Why this is correct
SUID (Set User ID) abuse is the correct technique because the SUID permission bit, when set on an executable file in Linux, allows any user to execute that binary with the effective user ID (EUID) of the file's owner, rather than the user who invoked it. If a binary owned by root has the SUID bit set and contains a vulnerability (e.g., insecure command execution, buffer overflow), an attacker can exploit it to execute commands or gain a shell with root privileges. This directly matches the scenario of finding a Linux binary with the SUID bit during a security assessment.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.