A penetration tester exploits a vulnerability and gains an unprivileged shell on a Linux server. The next step is privilege escalation. Which technique involves exploiting a SUID binary with an unintended capability?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — exploiting a SUID binary is right because those binaries run with the file owner's privileges, often root. If you can make a SUID binary like find, vim, or python run shell commands or write files, you can escalate to root.
Full Explanation
Exploiting a SUID binary, such as find, vim, or python, is correct because SUID binaries execute with the file owner's privileges, often root. If an attacker can coerce a SUID binary into running shell commands or writing files, the attacker can gain root access. The pass-the-hash attack using stolen NTLM credentials is wrong because it is a Windows credential reuse attack and does not apply to Linux privilege escalation via SUID. The kernel exploit to overwrite the credential store is wrong because kernel exploits are a separate privilege escalation technique, while SUID exploitation uses application-level misconfigurations. ARP cache poisoning to redirect traffic to a rogue server is wrong because it is a network-level man-in-the-middle technique, not a privilege escalation method.