After gaining an initial foothold on a Linux system during a penetration test, a tester runs 'id' and receives 'uid=33(www-data)'. The tester wants to escalate to root. Which enumeration step is most likely to reveal a quick privilege escalation path?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — checking sudo permissions, SUID/SGID binaries, world-writable cron scripts, and software versions against known CVEs is the quickest way to find a local privilege escalation path. You're hunting for misconfigured sudo rules, exploitable SUID binaries, writable cron scripts, and outdated services that can take you from www-data to root.
Full Explanation
The correct step is checking sudo permissions (sudo -l), SUID/SGID binaries (find / -perm -4000), world-writable scripts run by cron jobs (cat /etc/crontab; ls -la /etc/cron.*), and installed software versions against known local privilege escalation CVEs, because the most common local privilege escalation paths on Linux are: misconfigured sudo rules (NOPASSWD), SUID binaries with GTFOBins-exploitable capabilities, cron jobs running scripts writable by www-data, and outdated kernel/service CVEs. Systematic enumeration of these surfaces finds the quickest path to root. Running nmap against the internal network to find other hosts is wrong because internal network scanning is lateral movement, not privilege escalation. Exfiltrating /etc/passwd immediately is wrong because /etc/passwd is world-readable and its exfiltration is a low-value finding; /etc/shadow (root-only) is the target, but that requires escalation first. Adding a new user account and reporting the finding is wrong because adding a user is a post-exploitation persistence action, not privilege escalation.