OSCP Linux 3

Question 1

A script runs as root and calls 'python' without an absolute path. An attacker has write access to /tmp which is in root's PATH before /usr/bin. What attack is possible?

Accepted Answer

PATH hijacking by placing a malicious 'python' binary in /tmp

Answer

If a directory the attacker controls appears before the real binary location in PATH, placing a malicious file with the same name causes the script to execute the attacker's code.

Question 2

Which /proc entry reveals the full command line of a running process, useful for finding credentials passed as arguments?

Accepted Answer

/proc/<PID>/cmdline

Answer

/proc/<PID>/cmdline contains the null-delimited command line that was used to start the process, including any arguments like passwords.

Question 3

What does the command 'sudo -l' reveal during a Linux privilege escalation assessment?

Accepted Answer

Commands the current user can run with elevated privileges

Answer

sudo -l lists the specific commands the current user is allowed to run as root or other users without a password, often revealing escalation paths.

Question 4

An OSCP candidate finds a writable /etc/passwd file. Which entry would add a passwordless root-equivalent account?

Accepted Answer

hacker::0:0::/root:/bin/bash

Answer

An empty password field (::) in /etc/passwd means no password is required, and UID/GID of 0 grants root-level privileges.

Question 5

What Linux kernel feature does a container escape typically exploit when the container runs as root with excessive capabilities?

Accepted Answer

Namespaces and cgroups misconfiguration

Answer

Linux namespaces and cgroups provide container isolation; misconfigurations (e.g., privileged containers or mounted host /proc) allow escapes to the host.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Linux 3