OSCP Linux 5

Question 1

Which Linux command displays listening network sockets and the processes that own them, useful for identifying attack surfaces?

Accepted Answer

netstat -tulpn

Answer

netstat -tulpn (or ss -tulpn on modern systems) shows TCP/UDP listening ports along with the PID and program name for each socket.

Question 2

A root process executes a bash script that uses 'eval' on user-controlled input. What vulnerability does this create?

Accepted Answer

Arbitrary command execution via command injection

Answer

eval executes its argument as a shell command; if that argument includes attacker-controlled data, the attacker can inject arbitrary commands that run at the script's privilege level.

Question 3

What is the significance of a binary with both SUID bit and 'cap_setuid' capability set on Linux?

Accepted Answer

It can change its effective UID to any user including root, providing two independent escalation paths

Answer

SUID runs the binary as its owner's UID, while cap_setuid allows explicit UID changes; either alone provides privilege escalation potential if the binary is exploitable.

Question 4

An attacker has write access to a user's ~/.bashrc. What persistence technique can be used?

Accepted Answer

Add a reverse shell one-liner that executes every time the user opens a bash session

Answer

~/.bashrc is sourced on every interactive bash session, so inserting a reverse shell payload establishes persistent callback access whenever the target user logs in.

Question 5

Which command would reveal kernel version information useful for finding local privilege escalation CVEs?

Accepted Answer

uname -a

Answer

uname -a prints the kernel name, hostname, kernel release, version, machine hardware, and OS, providing the key version details needed to search for kernel exploits.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Linux 5