A penetration tester executes the following commands: Which of the following is a local host vulnerability that the attacker is exploiting?

When critical files such as scripts, service binaries, or configuration files have overly permissive access controls (e.g., world-writable permissions), a low-privileged attacker can modify them to execute arbitrary code under a higher-privileged context such as root or SYSTEM, making insecure file permissions a classic local privilege escalation vector.

Application whitelisting is a defensive security control that restricts which programs can execute - it is not a vulnerability being exploited in a local privilege escalation scenario.

Shell escape involves breaking out of a restricted shell environment (such as rbash) to gain a full shell, which is a different technique not centered on file permission weaknesses.

A writable service refers specifically to a service whose binary path can be replaced due to incorrect ACLs on the executable itself - this is a narrower and distinct misconfiguration from general insecure file permissions affecting scripts or config files.