nerdexam
GIAC

GCIH · Question #829

An attacker compromises a user account on a Linux host. Running "sudo -l" gives the output shown in the screenshot. Which of the following commands would the attacker run next to continue the attack a

The correct answer is C. sudo gdb -q. When sudo rights grant access to gdb, an attacker can run 'sudo gdb -q' and use gdb's built-in shell command to spawn an interactive root shell.

Vulnerability Exploitation & Privilege Escalation

Question

An attacker compromises a user account on a Linux host. Running "sudo -l" gives the output shown in the screenshot. Which of the following commands would the attacker run next to continue the attack and gain shell access?

Exhibit

GCIH question #829 exhibit

Options

  • Aps -efw
  • Blast -f /var/log/btmp
  • Csudo gdb -q
  • Dshell

How the community answered

(20 responses)
  • A
    10% (2)
  • B
    5% (1)
  • C
    70% (14)
  • D
    15% (3)

Why each option

When sudo rights grant access to gdb, an attacker can run 'sudo gdb -q' and use gdb's built-in shell command to spawn an interactive root shell.

Aps -efw

ps -efw lists running processes with full details and serves as a reconnaissance command, not a privilege escalation technique.

Blast -f /var/log/btmp

last -f /var/log/btmp displays failed login attempts and is used for log analysis, not for gaining elevated shell access.

Csudo gdb -qCorrect

If sudo -l reveals the user can run gdb as root, 'sudo gdb -q' launches gdb with elevated privileges. Once inside gdb, typing 'shell' invokes an interactive shell inheriting root permissions, effectively bypassing privilege restrictions. This is a documented GTFOBins privilege escalation technique that exploits debuggers permitted in the sudoers configuration.

Dshell

'shell' is a subcommand typed inside an already-running gdb session and cannot be executed as a standalone terminal command.

Concept tested: Linux privilege escalation via sudo gdb GTFOBins

Source: https://gtfobins.github.io/gtfobins/gdb/

Topics

#sudo exploitation#Linux privilege escalation#GTFOBins#gdb

Community Discussion

No community discussion yet for this question.

Full GCIH Practice