312-50 Question 141
Single answer▪ Escalating PrivilegesDuring an authorized internal assessment of a Linux web server, you obtain a low-privileged shell as the www-data user through a vulnerable web application. The client has approved privilege-escalation testing, but wants you to avoid disruptive techniques such as kernel exploits unless clearly necessary. While enumerating the host, you discover that the sudoers configuration allows www-data to run /usr/bin/find as root without a password: '(root) NOPASSWD: /usr/bin/find'. What is the most appropriate next step to escalate privileges while staying within the least disruptive approach?
- A
Use sudo to run find with the -exec action and spawn a root shell
- B
Dump /etc/shadow directly as www-data and crack the root password offline
- C
Upload and execute a local kernel exploit to obtain root immediately
- D
Modify the SUID bit on /bin/bash as www-data so it executes as root later
Show answer and explanation
Correct answer: A
Explanation
The best answer is to leverage the existing sudoers misconfiguration. In Linux privilege escalation, misconfigured sudo permissions are among the first items to check because they often provide direct, reliable, and low-impact paths to elevated privileges. Allowing an account to run a powerful binary such as find via sudo can be dangerous because some binaries support command execution features. This aligns with common enumeration guidance used in ethical hacking and with defensive best practices in sudoers hardening: only permit narrowly scoped commands that cannot be abused to execute arbitrary programs. The sudoers policy behavior is documented in sudo and sudoers documentation, and the abuse potential of certain allowed binaries is well known in practitioner references such as GTFOBins, which catalogs legitimate Unix binaries that can be used in unintended ways when granted elevated execution rights. From a testing methodology perspective, configuration-based escalation should typically be attempted before riskier actions like kernel exploitation.
- A. Correct.
Correct. If sudoers explicitly permits www-data to run /usr/bin/find as root without a password, a tester can use the allowed binary's legitimate functionality to execute commands as root. A common technique is to invoke find with -exec to launch a shell, for example via sudo find . -exec /bin/sh ; -quit. This is a classic privilege-escalation path based on misconfigured sudo rights and is less disruptive than exploiting the kernel.
- B. Incorrect.
Incorrect. The www-data account normally cannot read /etc/shadow directly unless additional misconfigurations exist. Even if shadow hashes could somehow be obtained, offline cracking is slower, less direct, and unnecessary when a valid sudo-based privilege-escalation path already exists. This option reflects the misconception that password dumping is the first or best path to root whenever privilege escalation is needed.
- C. Incorrect.
Incorrect. Kernel exploits are generally higher risk, can destabilize systems, and should usually be reserved for situations where safer, configuration-based escalation paths do not exist. In this scenario, a clearly authorized and less disruptive sudo misconfiguration is already available, so a local kernel exploit would not be the most appropriate next step.
- D. Incorrect.
Incorrect. A low-privileged user such as www-data cannot arbitrarily set the SUID bit on /bin/bash unless they already have sufficient privileges to modify the file and its mode. This option confuses post-escalation persistence or privilege abuse with an actual viable initial escalation step.