uid-bit-set-trzo8","questionText":"Refer to the exhibit. The 'find' binary has the SUID bit set. How can you leverage this to gain a root shell?","explanation":"The 'find' command includes an '-exec' flag that allows executing arbitrary commands on the files it locates. When an SUID-bit 'find' binary is used with the '-exec' flag, the command spawned by '-exec' will also run with the SUID owner's privileges. This is a well-documented technique for privilege escalation, demonstrating why SUID binaries must be audited to ensure they do not offer functionality that can be abused for command execution.","domainId":"00ad13f0-a515-4338-bd9a-81cfba5e2883","difficulty":"hard","questionType":"multiple_choice","pbqConfig":null,"exhibitText":"id\nuid=1001(web) gid=1001(web) groups=1001(web)\nfind / -perm -u=s -type f 2>/dev/null\n/usr/bin/find\n/usr/bin/passwd\n/usr/bin/sudo","options":[{"id":"966327af-b759-4633-8395-88712386aef2","label":null,"text":"find . -exec /bin/sh -p \\;","isCorrect":true},{"id":"7434c0cd-89a9-4394-8002-fec9a6176c4d","label":null,"text":"find . -name \"*\" -delete","isCorrect":false},{"id":"788f2e3e-2b35-4fdd-95e4-370625286e2a","label":null,"text":"find . -exec chmod 777 /etc/shadow \\;","isCorrect":false},{"id":"3d43e991-6553-435f-ae9f-0d88c1ab8a96","label":null,"text":"find / -user web -exec ls -l {}","isCorrect":false}],"domainName":"Linux Privilege Escalation","domainSlug":"linux-privilege-escalation"},{"id":"a35c92d1-dc1d-48cf-ad11-9af116adb02f","slug":"you-have-obtained-a-windows-domain-user-s-ntlm-hash-and-want-z877s","questionText":"You have obtained a Windows domain user's NTLM hash and want to authenticate to a remote SMB service without cracking the hash or knowing the plaintext. Which tool and technique should you use to perform pass-the-hash against the target?","explanation":"Pass-the-hash allows an attacker to authenticate using the NTLM hash directly, bypassing the need to crack it. CrackMapExec (NetExec) is specifically designed for this and includes the `-H` flag to supply the hash. The other options either attempt to crack the hash, use tools that do not support hash authentication, or misconfigure the syntax. The correct approach leverages the hash as a credential in the NTLM challenge-response protocol.","domainId":"0b2b3f24-22b9-4500-b77c-73a67b264391","difficulty":"medium","questionType":"multiple_choice","pbqConfig":null,"exhibitText":null,"options":[{"id":"25277156-cfbe-4742-985f-4269bbb58aee","label":null,"text":"Use `crackmapexec smb -u -H ` to authenticate with the NTLM hash.","isCorrect":true},{"id":"75518f85-eaa6-4f1d-ad55-89b1adfefc46","label":null,"text":"Use `john --format=NT ` to crack the hash and then log in with the recovered password.","isCorrect":false},{"id":"59690cd1-aac0-44ed-8127-30891b56dc62","label":null,"text":"Use `smbclient -U % ///share` to authenticate with the hash.","isCorrect":false},{"id":"87b09bbc-2b89-4f43-9992-d0c9261c8e0a","label":null,"text":"Use `hydra -l -P smb://` to replay the hash as a password.","isCorrect":false}],"domainName":"Password Attacks","domainSlug":"password-attacks"},{"id":"9c98f08b-7f74-47d0-88a7-2664add5631b","slug":"you-have-compromised-a-domain-user-account-and-want-to-escal-1y6ge","questionText":"You have compromised a domain user account and want to escalate privileges by abusing a misconfigured Group Policy Object (GPO). You discover that the GPO is linked to an Organizational Unit (OU) containing privileged servers and that the domain user has write permissions on the GPO. Which action should you take to escalate privileges?","explanation":"With write permissions on a GPO linked to an OU containing privileged servers, modifying the GPO to add an immediate scheduled task that runs as SYSTEM allows code execution with elevated privileges on those servers. This directly escalates privileges by leveraging the GPO's application to all computers in the OU, achieving SYSTEM-level access.","domainId":"24e11fce-bc58-4171-851e-f0844b5c9568","difficulty":"me