OSCP Linux 2

Question 1

Which command finds SUID binaries on a Linux system that could be leveraged for privilege escalation?

Accepted Answer

find / -perm -u=s -type f 2>/dev/null

Answer

The find command with -perm -u=s locates all files with the SUID bit set, which run as the file owner regardless of who executes them.

Question 2

What does the /etc/passwd file store in a modern Linux system?

Accepted Answer

User account information including username, UID, GID, home directory, and shell

Answer

In modern Linux, /etc/passwd stores user account metadata but passwords are stored as 'x' with actual hashes in /etc/shadow.

Question 3

An attacker has a low-privilege shell. Which file, if world-readable, would allow them to crack user password hashes offline?

Accepted Answer

/etc/shadow

Answer

/etc/shadow contains hashed passwords and is normally readable only by root, making it a high-value target for privilege escalation.

Question 4

Which Linux capability, if assigned to a binary, allows it to bypass file permission checks and is dangerous from a security perspective?

Accepted Answer

cap_dac_override

Answer

cap_dac_override allows a process to bypass discretionary access control (DAC) file read/write/execute permission checks, enabling access to any file.

Question 5

How do you list all running cron jobs for all users on a Linux system as root?

Accepted Answer

ls -la /var/spool/cron/crontabs/ && cat /etc/cron*

Answer

Cron jobs per user live in /var/spool/cron/crontabs/ and system-wide jobs are in /etc/cron*, so both locations must be checked.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Linux 2