A penetration tester exploits a vulnerability and gains an unprivileged shell on a Linux server. The next step is privilege escalation. Which technique involves exploiting a SUID binary with an unintended capability?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because SUID (Set User ID) binaries execute with the file owner's privileges (often root); if a SUID binary can be coerced into running shell commands or writing files, an attacker gains root access. A is wrong because pass-the-hash is a Windows credential reuse attack and does not apply to Linux privilege escalation via SUID.
Full explanation below image
Full Explanation
B is correct because SUID (Set User ID) binaries execute with the file owner's privileges (often root); if a SUID binary can be coerced into running shell commands or writing files, an attacker gains root access. A is wrong because pass-the-hash is a Windows credential reuse attack and does not apply to Linux privilege escalation via SUID. C is wrong because kernel exploits are a separate privilege escalation technique; SUID exploitation uses application-level misconfigurations. D is wrong because ARP cache poisoning is a network-level man-in-the-middle technique, not a privilege escalation method.