What determines the level of access a hacker gains when they exploit a system?

Why do most initial exploits result in unprivileged access?

In Linux, what command is used to check the current user identity?

What does the 'www-data' user typically represent?

Why is privilege escalation important for hackers?

In Linux, what are the three types of file permissions?

What does the command sudo chown root:root ./demo do?

What does the SUID permission do?

What command sets the SUID bit on a file?

How can you check if a file has the SUID permission set?

What does the 'ps auxf' command do?

How can an attacker find an exploit for a specific Linux kernel version?

Which file stores Linux user account information?

What does the find / -perm -4000 -user root -type f -print command do?

How can an attacker abuse a cron job for privilege escalation?

What is wildcard injection?

Why is the export SCRIPT_PATH method useful for privilege escalation?

What is the purpose of the /etc/shadow file?

Which Linux command displays the kernel version?

How does the DirtyCOW exploit work?

What is the significance of the chmod u+s command in privilege escalation?

What does the -rf flag do in the rm command?

What is a common method of escalating privileges using the find command?

Which command helps locate files with the SGID permission?

What happens when an attacker modifies a script executed by a cron job running as root?

What is the primary function of the rsync command?

How does wildcard injection work in Linux?

What is the risk of running sudo commands without password authentication?

What is the best way to prevent privilege escalation attacks?

You gain access to a system through an exploited web server. What is the most likely privilege level you have?

A user unknowingly runs your malware as a standard user. What immediate action should you take to gain higher privileges?

You exploited a service and now need to determine what privileges you have. What command should you run first?

You exploited MyBB forum software and got access as www-data. What directory are you most likely restricted to?

If you find an SUID binary owned by root, what privilege escalation method could be effective?

A system administrator changes a file’s ownership using sudo chown root:root ./demo. What impact does this have?

You suspect a scheduled cron job is running as root. What command can help you verify this?

. If you find a writable script being executed by root’s cron job, what action could escalate privileges?

Why does running a program as a different owner not automatically change its execution privileges?

Why would an attacker search for ps auxf output on a compromised machine?

Why is export SCRIPT_PATH=/home/user/malicious.sh a potential privilege escalation technique?

Why is wildcard injection (rm *) a dangerous misconfiguration?

You find a file /usr/bin/vuln_bin with the following permissions: -rwsr-xr-x 1 root root 12345 Feb 10 12:34 vuln_bin. What should your next step be?

A cron job runs /usr/local/bin/backup.sh every hour as root. The script is world-writable. What is a possible attack?

You find an SUID binary that calls /usr/bin/editor using system(). What can you do?

Why is a writable /etc/shadow file a severe security risk?