GPEN Practice Questions: Exploitation Fundamentals & Escalation Domain

Correct Answer: B

Explanation: Creating a startup script is a common method to maintain persistence as it ensures that your payload runs on system startup. Modifying the bootloader and BIOS settings are risky and less practical, while disabling the firewall is noisy and easily detected.

Correct Answer: A

Explanation: Exploiting a vulnerable service running as SYSTEM is a common method for privilege escalation. Disabling UAC, password spraying, and modifying group policies are not typically used for privilege escalation.

Correct Answer: A

Explanation: The 'uname -r' command reveals the kernel version, which can be checked for known vulnerabilities. 'ifconfig', 'ps -ef', and 'netstat -tuln' provide network and process information, not kernel details.

Correct Answer: B

Explanation: Searching for misconfigured SUID binaries is a common and efficient method for privilege escalation on Linux systems. Exploiting a kernel vulnerability may not be feasible without a specific exploit, brute-forcing is noisy and often against rules of engagement, and scanning for open services is not directly related to privilege escalation.

Correct Answer: D

Explanation: The /usr/bin directory often contains binaries with SUID permissions. Misconfigured SUID binaries can be exploited for privilege escalation. /etc/passwd, /etc/shadow, and /etc/hosts do not typically contain SUID binaries.