Question 344 of 870
Privilege Escalation by Exploiting Vulnerable SUID Binaries on Linux
During a penetration test, you gain initial access to a Linux server as a low-privileged user. The target runs a vulnerable SUID binary owned by root. Which of the following is the MOST effective method to escalate privileges?
Quick Answer
The answer is exploiting the SUID binary to execute commands as root. This is correct because a Set User ID (SUID) binary owned by root runs with the file owner’s elevated privileges, regardless of who executes it. When such a binary is vulnerable—for example, through command injection, path hijacking, or improper argument handling—a low-privileged user can leverage it to spawn a root shell or run arbitrary commands with root-level access. On the Certified Ethical Hacker CEH exam, this technique tests your understanding of Linux file permissions and post-exploitation enumeration, often appearing in scenario-based questions where you must identify the fastest path to root after initial access. A common trap is confusing SUID with SGID or overlooking binaries like `find`, `vim`, or `nmap` that have known privilege escalation vectors. Memory tip: “SUID + root owner + vulnerable = instant root shell.”
⚠ Common exam trap
Candidates often confuse enumeration techniques (SMTP VRFY, enum4linux) or standard sudo checks with direct privilege escalation methods, overlooking the immediate root-level access provided by exploiting a vulnerable SUID binary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Exploit the SUID binary to execute commands as root
The SUID binary owned by root runs with root privileges regardless of the user executing it. Exploiting a vulnerable SUID binary (e.g., via command injection, buffer overflow, or misconfigured capabilities) allows the low-privileged user to execute arbitrary commands as root, directly escalating privileges. This is the most effective method because it leverages a known privilege escalation vector specific to Linux SUID binaries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform an SMTP VRFY attack to enumerate users
Why it's wrong here
SMTP VRFY is for user enumeration, not privilege escalation.
- ✓
Exploit the SUID binary to execute commands as root
Why this is correct
Exploiting a vulnerable SUID binary is a direct privilege escalation vector.
- ✗
Use enum4linux to enumerate SMB shares
Why it's wrong here
enum4linux is for SMB enumeration on Windows, not Linux privilege escalation.
- ✗
Run 'sudo -l' to list sudo privileges
Why it's wrong here
sudo -l requires sudo access, which the low-privileged user may not have.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a penetration test, you gain access to a Linux server as a low-privileged user. Which of the following is an effective technique to escalate privileges by exploiting misconfigured file permissions?
medium- A.Pass-the-hash
- B.Token impersonation
- ✓ C.SUID/GUID abuse
- D.Kerberoasting
Why C: SUID (Set User ID) and GUID (Group ID) bits allow a binary to execute with the privileges of the file owner (often root) rather than the calling user. If a low-privileged user can run a binary with the SUID bit set that performs unsafe operations (e.g., spawning a shell, reading arbitrary files, or executing commands), they can leverage it to gain root-level access. This is a classic privilege escalation vector on Linux systems when file permissions are misconfigured.
Last reviewed: Jul 4, 2026
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.