OSCP Linux 5 — Questions and Answers
Question 1: Which Linux command displays listening network sockets and the processes that own them, useful for identifying attack surfaces?
- netstat -tulpn (Correct answer)
- ifconfig -a
- route -n
- arp -a
Correct answer: netstat -tulpn
netstat -tulpn (or ss -tulpn on modern systems) shows TCP/UDP listening ports along with the PID and program name for each socket.
Question 2: A root process executes a bash script that uses 'eval' on user-controlled input. What vulnerability does this create?
- Race condition
- Arbitrary command execution via command injection (Correct answer)
- Integer overflow
- Directory traversal
Correct answer: Arbitrary command execution via command injection
eval executes its argument as a shell command; if that argument includes attacker-controlled data, the attacker can inject arbitrary commands that run at the script's privilege level.
Question 3: What is the significance of a binary with both SUID bit and 'cap_setuid' capability set on Linux?
- It can only be run by root
- It can change its effective UID to any user including root, providing two independent escalation paths (Correct answer)
- It runs in a sandbox
- It requires a password to execute
Correct answer: It can change its effective UID to any user including root, providing two independent escalation paths
SUID runs the binary as its owner's UID, while cap_setuid allows explicit UID changes; either alone provides privilege escalation potential if the binary is exploitable.
Question 4: An attacker has write access to a user's ~/.bashrc. What persistence technique can be used?
- Add a reverse shell one-liner that executes every time the user opens a bash session (Correct answer)
- Modify /etc/passwd via the file
- Install a kernel module
- Create a new user account
Correct answer: Add a reverse shell one-liner that executes every time the user opens a bash session
~/.bashrc is sourced on every interactive bash session, so inserting a reverse shell payload establishes persistent callback access whenever the target user logs in.
Question 5: Which command would reveal kernel version information useful for finding local privilege escalation CVEs?
- uname -a (Correct answer)
- cat /etc/os-release
- dmesg | head
- lsmod
Correct answer: uname -a
uname -a prints the kernel name, hostname, kernel release, version, machine hardware, and OS, providing the key version details needed to search for kernel exploits.
Question 6: During post-exploitation on Linux, which directory often contains bash history files for multiple users that may reveal credentials or internal commands?
- /var/log/auth.log
- /home/*/.bash_history and /root/.bash_history (Correct answer)
- /etc/profile.d/
- /var/spool/mail/
Correct answer: /home/*/.bash_history and /root/.bash_history
Bash history files in each user's home directory often capture previously entered commands including passwords typed as arguments and internal hostnames.
Question 7: What technique allows an attacker to maintain a persistent rootkit-level backdoor without modifying disk-resident files on Linux?
- Editing /etc/rc.local
- Loading a malicious kernel module (LKM rootkit) (Correct answer)
- Creating a SUID bash copy
- Adding a crontab entry
Correct answer: Loading a malicious kernel module (LKM rootkit)
Loadable kernel modules (LKMs) run in kernel space and can hide processes, files, and network connections; they can be loaded without leaving obvious file-system artifacts.
OSCP Linux 5
Which Linux command displays listening network sockets and the processes that own them, useful for identifying attack surfaces?