OSCP Linux Privilege Escalation Quiz

1. What is a race condition in privilege escalation?

Exploiting a time gap between a permission check and file access

Running multiple exploits simultaneously

Accessing files faster than the system can protect them

Competing with other users for root access

2. How can checking /etc/sudoers reveal privilege escalation opportunities?

It shows commands users can run with elevated privileges without password prompts

It contains all system passwords

It lists all installed software

It shows network configuration

3. What is the primary risk of a binary calling 'system()' with unsanitized user input?

Command injection leading to arbitrary code execution

Memory leak

Denial of service

File corruption

4. A script with a wildcard in a system command can be exploited how?

Create files with names that match the wildcard and contain command flags

Modify the script directly

Change the script's permissions

Delete the script

5. How can you verify if a binary has SGID permissions?

Look for an 's' in the group execute position when running 'ls -l'

Check the file size

Use the 'file' command

Run 'strings' on the binary

6. Which environment variable can be manipulated to hijack library loading in vulnerable binaries?

LD_PRELOAD or LD_LIBRARY_PATH

PATH only

SHELL

HOME

7. What does the 'noexec' mount option prevent?

Execution of binaries from that mounted filesystem

Reading files from the filesystem

Writing files to the filesystem

Mounting the filesystem

8. How would you exploit a world-writable /tmp directory for privilege escalation?

Place a malicious script there and wait for a privileged process to execute it

Directly modify system files in /tmp

Change the ownership of all files

/tmp is never a privilege escalation vector

9. A binary has the capability CAP_NET_BIND_SERVICE. What does this allow?

Binding to network ports below 1024 without root privileges

Accessing the network interface directly

Modifying firewall rules

Capturing network traffic

10. Which tool can enumerate potential privilege escalation vectors on a Linux system?

LinEnum or linenum.sh

Nmap

Aircrack-ng

Hashcat

11. What does the SUID bit allow a binary to do when executed?

Run with the permissions of the file owner

Run only with root permissions

Bypass firewall restrictions

Access files in the /root directory

12. How can you escalate privileges if a script runs as root and uses the 'input()' function in Python?

Inject shell commands through the input() prompt

Modify the Python interpreter

Delete the script file

Change the file permissions

13. Which file contains scheduled tasks that run with specific user privileges?

/etc/crontab and user crontab files in /var/spool/cron/

/etc/passwd

/proc/systemd

/etc/services

14. A setuid binary calls a relative path to an external program. What vulnerability could exist?

Path hijacking: attacker can place a malicious binary in a directory earlier in PATH

The binary will refuse to execute

The system will crash

Only the root user can exploit this

15. What does the command 'sudo -l' do?

Lists commands the current user can run with sudo

Lists all sudo configuration files

Logs all sudo activities

Changes the sudo timeout value

16. How can you check if a binary is vulnerable to library hijacking?

Use ldd to see which libraries it loads and check for writable directories in LD_LIBRARY_PATH

Run the binary with strace

Check the file size of the binary

Examine the ASLR configuration

17. Which Linux kernel versions are commonly vulnerable to the Dirty COW exploit?

Versions before 4.8.3 and 3.2.73

Only kernel 5.x versions

Kernel versions after 5.10

All 64-bit kernels

18. What vulnerability exists when a cron job runs a script with world-writable permissions?

An attacker can modify the script and gain the privileges of the cron job owner

The cron job will fail to execute

The system will automatically patch the vulnerability

The script cannot be read by other users

19. A user can run /usr/bin/wget as root via sudo without a password. How could this lead to privilege escalation?

Download and execute a malicious script with root privileges

Modify system files directly

Change the root password

Access the shadow file directly

20. Which command displays files with SUID permissions set?

Find / -perm -4000 2>/dev/null

Ls -la /usr/bin

Chmod +s filename

Stat -c %A filename