OSCP Linux 3 — Questions and Answers
Question 1: A script runs as root and calls 'python' without an absolute path. An attacker has write access to /tmp which is in root's PATH before /usr/bin. What attack is possible?
- Buffer overflow
- PATH hijacking by placing a malicious 'python' binary in /tmp (Correct answer)
- SQL injection
- Format string attack
Correct answer: PATH hijacking by placing a malicious 'python' binary in /tmp
If a directory the attacker controls appears before the real binary location in PATH, placing a malicious file with the same name causes the script to execute the attacker's code.
Question 2: Which /proc entry reveals the full command line of a running process, useful for finding credentials passed as arguments?
- /proc/<PID>/status
- /proc/<PID>/cmdline (Correct answer)
- /proc/<PID>/maps
- /proc/<PID>/fd
Correct answer: /proc/<PID>/cmdline
/proc/<PID>/cmdline contains the null-delimited command line that was used to start the process, including any arguments like passwords.
Question 3: What does the command 'sudo -l' reveal during a Linux privilege escalation assessment?
- All users with sudo access
- Commands the current user can run with elevated privileges (Correct answer)
- The sudo version installed
- Failed sudo attempts
Correct answer: Commands the current user can run with elevated privileges
sudo -l lists the specific commands the current user is allowed to run as root or other users without a password, often revealing escalation paths.
Question 4: An OSCP candidate finds a writable /etc/passwd file. Which entry would add a passwordless root-equivalent account?
- hacker:x:0:0::/root:/bin/bash
- hacker::0:0::/root:/bin/bash (Correct answer)
- hacker:*:1001:1001::/home/hacker:/bin/bash
- hacker:!:0:0::/root:/bin/bash
Correct answer: hacker::0:0::/root:/bin/bash
An empty password field (::) in /etc/passwd means no password is required, and UID/GID of 0 grants root-level privileges.
Question 5: What Linux kernel feature does a container escape typically exploit when the container runs as root with excessive capabilities?
- iptables rules
- Namespaces and cgroups misconfiguration (Correct answer)
- NFS exports
- PAM modules
Correct answer: Namespaces and cgroups misconfiguration
Linux namespaces and cgroups provide container isolation; misconfigurations (e.g., privileged containers or mounted host /proc) allow escapes to the host.
Question 6: Which tool is most commonly used to enumerate Linux privilege escalation vectors automatically during an OSCP exam?
- Metasploit post/multi/recon/local_exploit_suggester
- LinPEAS (Correct answer)
- Nikto
- SQLmap
Correct answer: LinPEAS
LinPEAS (Linux Privilege Escalation Awesome Script) automates checks for SUID binaries, writable paths, weak permissions, and hundreds of other escalation vectors.
Question 7: An attacker reads /etc/crontab and sees a root cron job running /opt/backup.sh which is world-writable. What is the simplest exploit?
- Modify the crontab timing
- Append a reverse shell command to /opt/backup.sh (Correct answer)
- Replace cron with a malicious binary
- Edit /etc/cron.deny
Correct answer: Append a reverse shell command to /opt/backup.sh
Since root executes /opt/backup.sh and the script is world-writable, appending a reverse shell payload will execute it as root when the cron job fires.
OSCP Linux 3
A script runs as root and calls 'python' without an absolute path.
An attacker has write access to /tmp which is in root's PATH before /usr/bin.
What attack is possible?