CEH Enumeration and System Hacking Practice Question

Which TWO of the following are examples of privilege escalation on Linux? (Select 2)

⚠ Common exam trap

EC-Council often tests the distinction between Windows and Linux privilege escalation techniques, and the trap here is that candidates confuse cross-platform attacks like token impersonation or DLL hijacking as applicable to Linux, when they are strictly Windows-based.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SUID bit abuse

SUID bit abuse (C) is a privilege escalation technique because when the SUID (Set User ID) bit is set on an executable, it runs with the permissions of the file owner (often root), regardless of the user who executes it. An attacker can exploit misconfigured SUID binaries to execute commands with elevated privileges, gaining root access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Pass-the-Hash
Why it's wrong here
Pass-the-Hash (PtH) is a post-exploitation technique primarily used for lateral movement within a network, not for elevating privileges on the compromised host itself. It involves capturing a user's NTLM hash and reusing it to authenticate to other systems or services without needing the plaintext password. While it grants access to other resources, it does not directly escalate the privileges of the current user account on the local machine.
✗
Token impersonation
Why it's wrong here
Token impersonation is a Windows-specific technique where a thread can temporarily run in the security context of another user's access token, often a more privileged one. While it can be a component in a privilege escalation chain by allowing a low-privileged process to act as a higher-privileged one, the question's correct answers point towards Unix/Linux-centric privilege escalation examples. Therefore, in this specific context, it is not considered one of the primary examples sought.
✓
SUID bit abuse
Why this is correct
SUID (Set User ID) bit abuse is a common Unix/Linux privilege escalation method. When the SUID bit is set on an executable file, it runs with the permissions of the file owner, rather than the user executing it. If a program owned by root has the SUID bit set and can be manipulated (e.g., through arguments or environment variables) to execute arbitrary commands, a low-privileged user can leverage this to execute commands as root, thereby escalating privileges.
✓
Exploiting a local vulnerability in a setuid binary
Why this is correct
Exploiting a local vulnerability in a setuid binary is a direct and potent privilege escalation technique on Unix-like systems. If a program with the SUID bit set (typically owned by root) contains a vulnerability like a buffer overflow, format string bug, or path injection, a local attacker can exploit this flaw. By triggering the vulnerability, the attacker can execute arbitrary code with the elevated privileges of the binary's owner, typically gaining root access on the system.
✗
DLL hijacking
Why it's wrong here
DLL hijacking is a Windows-specific privilege escalation technique where an attacker places a malicious Dynamic Link Library (DLL) in a location where a legitimate application expects to load a different, benign DLL. If the application is running with elevated privileges (e.g., as an administrator or system service), it will load and execute the malicious DLL with those same elevated privileges. As the question's correct answers are Unix/Linux-focused, this Windows-specific method is not the intended example.

Go deeper

CEH Enumeration and System Hacking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question