nerdexam
CompTIA

PT0-001 · Question #242

During the exploitation phase of a penetration test, a vulnerability is discovered that allows command execution on a Linux web server. A cursory review confirms the system access is only in a…

The correct answer is A. Only members of the Linux admin group, OPERATORS, ADMINS, jedwards, and operator can. Analyzing the /etc/sudoers file identifies which users and groups can run privileged commands, guiding the tester toward accounts worth compromising for privilege escalation.

Post-exploitation and lateral movement

Question

During the exploitation phase of a penetration test, a vulnerability is discovered that allows command execution on a Linux web server. A cursory review confirms the system access is only in a low-privilege user context: www-data. After reviewing, the following output from /etc/sudoers:

Which of the following users should be targeted for privilege escalation?

Exhibit

PT0-001 question #242 exhibit

Options

  • AOnly members of the Linux admin group, OPERATORS, ADMINS, jedwards, and operator can
  • BAll users on the machine can execute privileged commands useful for privilege escalation.
  • CBfranks, emann, members of the Linux admin group, OPERATORS, and ADMINS can execute
  • DJedwards, operator, bfranks, emann, OPERATOR, and ADMINS can execute commands useful

How the community answered

(31 responses)
  • A
    81% (25)
  • B
    6% (2)
  • C
    10% (3)
  • D
    3% (1)

Why each option

Analyzing the /etc/sudoers file identifies which users and groups can run privileged commands, guiding the tester toward accounts worth compromising for privilege escalation.

AOnly members of the Linux admin group, OPERATORS, ADMINS, jedwards, and operator canCorrect

The sudoers output, as reflected in the answer choices, limits elevated command execution to specific named users (jedwards, operator) and group members (Linux admin, OPERATORS, ADMINS). Targeting these identities gives the tester a path to escalate from the low-privilege www-data context by pivoting to or impersonating a user who has sudo rights. Users or groups not listed cannot run privileged commands and are therefore lower-value targets for escalation.

BAll users on the machine can execute privileged commands useful for privilege escalation.

A permissive sudoers configuration granting all users privilege escalation rights is not indicated by the described output; the output restricts access to specific users and groups.

CBfranks, emann, members of the Linux admin group, OPERATORS, and ADMINS can execute

This choice omits jedwards and operator, who are explicitly named in the sudoers file and are valid escalation targets alongside the group members.

DJedwards, operator, bfranks, emann, OPERATOR, and ADMINS can execute commands useful

This choice misidentifies the group name as OPERATOR (singular) rather than OPERATORS and conflates separately listed entries, making it an inaccurate reading of the sudoers output.

Concept tested: Sudoers file analysis for privilege escalation targeting

Source: https://www.sudo.ws/docs/man/sudoers.man/

Topics

#privilege escalation#sudoers#Linux#www-data

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice