312-50 Question 140
Single answer▪ Escalating PrivilegesDuring an authorized internal assessment, you obtain a low-privileged shell on a Linux web server running Ubuntu. The engagement rules allow local privilege-escalation checks, but prohibit kernel exploits that could crash the host. You notice that the account can run one command with sudo without a password: sudo /usr/bin/find. Which action is the most appropriate way to escalate privileges while staying within scope and minimizing operational risk?
- A
Run
sudo find . -exec /bin/sh \; -quitto spawn a shell through the allowed sudo command - B
Upload and execute a public Dirty COW exploit because it is a well-known Linux privilege-escalation method
- C
Use
sudo find / -name shadow -exec cat {} \;to read/etc/shadowand crack the root password offline - D
Modify
/etc/sudoersdirectly from the low-privileged shell to grant the current user full sudo access
Show answer and explanation
Correct answer: A
Explanation
This question tests practical privilege escalation using a sudo misconfiguration on Linux. In real assessments, enumerating sudo -l is a standard step after obtaining a shell. If a user is allowed to run a binary like find as root without a password, the tester should evaluate whether that binary permits shell execution or file write operations. GNU find supports -exec, which can be abused to launch a shell when executed via sudo. This is a common privilege-escalation technique and is documented in widely used operator references such as GTFOBins for find under sudo contexts. From a best-practice and rules-of-engagement perspective, using an already-authorized sudo path is preferable to unstable kernel exploits. It is also more efficient and defensible than attempting offline password cracking when direct root command execution is available. The key CEH concept is recognizing insecure sudoers entries as a practical and low-risk privilege-escalation vector.
- A. Correct.
Correct. If
findis permitted via sudo, it can execute other programs using its-execaction. Running/bin/shthrough the authorized sudo-enabled binary is a classic and reliable privilege-escalation path when permitted by sudoers configuration. This approach is lower risk than kernel exploitation and directly leverages the misconfiguration already identified. - B. Incorrect.
Incorrect. Dirty COW (CVE-2016-5195) is a kernel privilege-escalation exploit, and the scenario explicitly prohibits kernel exploits due to stability concerns. Even if potentially effective, it would violate the rules of engagement and introduce unnecessary operational risk.
- C. Incorrect.
Incorrect. Reading
/etc/shadowmay help with credential attacks, but it is indirect, slower, and unnecessary when a direct sudo misconfiguration already allows command execution as root. In addition, cracking may take time and may not succeed if the root password is strong or locked. - D. Incorrect.
Incorrect. A low-privileged shell cannot normally modify
/etc/sudoerswithout elevated rights. Attempting to edit it directly from the unprivileged context misunderstands the access controls involved. The proper path is to use the existing sudo privilege onfindto obtain elevated execution first.