312-50 Question 139
Single answer▪ Escalating PrivilegesDuring an authorized internal penetration test of a Linux web server, you gain a low-privileged shell as the www-data user through a web application flaw. The customer has prohibited kernel exploits because the server is production-critical. You enumerate the host and find the following sudoers entry: (ALL) NOPASSWD: /usr/bin/find. Which action is the most appropriate way to escalate privileges while staying within scope and minimizing operational risk?
- A
Run
sudo find / -exec /bin/sh \; -quitto spawn a root shell through the permitted binary - B
Upload and execute a local privilege escalation kernel exploit because it is faster than abusing sudo
- C
Modify
/etc/sudoersdirectly as www-data to add full sudo rights for your user - D
Dump
/etc/shadowas www-data and crack the root password offline before usingsu
Show answer and explanation
Correct answer: A
Explanation
This question tests practical Linux privilege escalation decision-making under real engagement constraints. When a tester has limited shell access and discovers a sudo rule permitting execution of a powerful binary such as find with NOPASSWD, the preferred approach is to abuse that binary's legitimate functionality to execute a shell as root. This is a well-known class of escalation issue: overly permissive sudoers entries for binaries that can spawn commands or shells. The find binary supports -exec, which can invoke /bin/sh when run through sudo. Resources such as the sudoers manual (man sudoers), the find manual (man find), and GTFOBins document this behavior. From a CEH perspective, the key is not just knowing the technique, but selecting the safest, most scoped, and operationally appropriate method. Kernel exploits are often riskier and may violate rules of engagement, while attempts to modify protected files or crack credentials are either infeasible from the current privilege level or less efficient than exploiting the identified sudo misconfiguration.
- A. Correct.
Correct. If
/usr/bin/findis allowed via sudo withNOPASSWD, it can be abused to execute a shell command as root using its-execfunctionality. A common method issudo find . -exec /bin/sh \; -quit, which spawns a root shell with minimal changes to the system. This is a classic privilege escalation path documented in sudo and commonly referenced in privilege escalation guidance such as GTFOBins. It is also aligned with the scenario constraints because it avoids risky kernel exploitation on a production system. - B. Incorrect.
Incorrect. The scenario explicitly states that kernel exploits are out of scope because the target is production-critical. Even aside from scope, kernel exploits are higher risk and can destabilize or crash a system. A tester should prefer a built-in, authorized escalation path like the misconfigured sudo rule rather than using a more intrusive technique.
- C. Incorrect.
Incorrect. A low-privileged
www-datauser cannot normally edit/etc/sudoersdirectly because the file is root-owned and tightly permissioned. Even if a tester later obtained elevated access, directly editing sudoers on a production host would be a more invasive action than necessary and could introduce configuration errors. The question asks for the most appropriate escalation path from the current state. - D. Incorrect.
Incorrect. Standard permissions prevent
www-datafrom reading/etc/shadow, so this action is not feasible from the stated access level. In addition, offline password cracking is slower, noisier from an engagement perspective, and unnecessary when a direct sudo misconfiguration already provides a safer and more immediate route to privilege escalation.