OSCP Linux 2 — Questions and Answers
Question 1: Which command finds SUID binaries on a Linux system that could be leveraged for privilege escalation?
- find / -perm -u=s -type f 2>/dev/null (Correct answer)
- ls -la /usr/bin | grep s
- ps aux | grep suid
- chmod u+s /bin/bash
Correct answer: find / -perm -u=s -type f 2>/dev/null
The find command with -perm -u=s locates all files with the SUID bit set, which run as the file owner regardless of who executes them.
Question 2: What does the /etc/passwd file store in a modern Linux system?
- Encrypted user passwords only
- User account information including username, UID, GID, home directory, and shell (Correct answer)
- Only root account details
- SSH authorized keys
Correct answer: User account information including username, UID, GID, home directory, and shell
In modern Linux, /etc/passwd stores user account metadata but passwords are stored as 'x' with actual hashes in /etc/shadow.
Question 3: An attacker has a low-privilege shell. Which file, if world-readable, would allow them to crack user password hashes offline?
- /etc/passwd
- /etc/shadow (Correct answer)
- /etc/group
- /etc/sudoers
Correct answer: /etc/shadow
/etc/shadow contains hashed passwords and is normally readable only by root, making it a high-value target for privilege escalation.
Question 4: Which Linux capability, if assigned to a binary, allows it to bypass file permission checks and is dangerous from a security perspective?
- cap_net_raw
- cap_dac_override (Correct answer)
- cap_sys_time
- cap_audit_write
Correct answer: cap_dac_override
cap_dac_override allows a process to bypass discretionary access control (DAC) file read/write/execute permission checks, enabling access to any file.
Question 5: How do you list all running cron jobs for all users on a Linux system as root?
- crontab -l
- cat /etc/cron.d/*
- ls -la /var/spool/cron/crontabs/ && cat /etc/cron* (Correct answer)
- ps aux | grep cron
Correct answer: ls -la /var/spool/cron/crontabs/ && cat /etc/cron*
Cron jobs per user live in /var/spool/cron/crontabs/ and system-wide jobs are in /etc/cron*, so both locations must be checked.
Question 6: What is the purpose of the 'sticky bit' on a directory like /tmp?
- Prevents any user from deleting the directory
- Only the file owner or root can delete files within the directory (Correct answer)
- Makes files in the directory execute as root
- Encrypts files stored in the directory
Correct answer: Only the file owner or root can delete files within the directory
The sticky bit on a directory means that only the file's owner, the directory's owner, or root can delete or rename files within it.
Question 7: Which command would an attacker use to enumerate writable directories in the PATH that could enable a path hijacking attack?
- echo $PATH | tr ':' '\n' | xargs ls -ld (Correct answer)
- find / -name PATH
- env | grep PATH
- which env
Correct answer: echo $PATH | tr ':' '\n' | xargs ls -ld
Splitting $PATH and checking directory permissions reveals writable entries where a malicious binary can be placed to hijack script execution.
OSCP Linux 2
Which command finds SUID binaries on a Linux system that could be leveraged for privilege escalation?