After gaining an initial foothold on a Linux system during a penetration test, a tester runs 'id' and receives 'uid=33(www-data)'. The tester wants to escalate to root. Which enumeration step is most likely to reveal a quick privilege escalation path?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the most common local privilege escalation paths on Linux are: misconfigured sudo rules (NOPASSWD), SUID binaries with GTFOBins-exploitable capabilities, cron jobs running scripts writable by www-data, and outdated kernel/service CVEs. Systematic enumeration of these surfaces finds the quickest path to root.
Full explanation below image
Full Explanation
B is correct because the most common local privilege escalation paths on Linux are: misconfigured sudo rules (NOPASSWD), SUID binaries with GTFOBins-exploitable capabilities, cron jobs running scripts writable by www-data, and outdated kernel/service CVEs. Systematic enumeration of these surfaces finds the quickest path to root. A is wrong because internal network scanning is lateral movement, not privilege escalation. C is wrong because /etc/passwd is world-readable and its exfiltration is a low-value finding; /etc/shadow (root-only) is the target, but that requires escalation first. D is wrong because adding a user is a post-exploitation persistence action, not privilege escalation.