PT0-002 · Question #299
A penetration tester opened a reverse shell on a Linux web server and successfully escalated privileges to root. During the engagement, the tester noticed that another user logged in frequently as…
The correct answer is C. Add a new user with ID 0 to the /etc/passwd file. Adding a new user with UID 0 to /etc/passwd is the best option because Linux grants root-level privileges to any account with UID 0, regardless of the username. This creates a persistent backdoor account that does not interfere with the existing root user's sessions, password…
Question
A penetration tester opened a reverse shell on a Linux web server and successfully escalated privileges to root. During the engagement, the tester noticed that another user logged in frequently as root to perform work tasks. To avoid disrupting this user's work, which of the following is the BEST option for the penetration tester to maintain root-level persistence on this server during the test?
Options
- AAdd a web shell to the root of the website.
- BUpgrade the reverse shell to a true TTY terminal.
- CAdd a new user with ID 0 to the /etc/passwd file.
- DChange the password of the root user and revert after the test.
How the community answered
(32 responses)- A13% (4)
- B6% (2)
- C59% (19)
- D22% (7)
Explanation
Adding a new user with UID 0 to /etc/passwd is the best option because Linux grants root-level privileges to any account with UID 0, regardless of the username. This creates a persistent backdoor account that does not interfere with the existing root user's sessions, password, or workflow. Adding a web shell (A) is easily discovered, fragile, and limited to web-context execution. Upgrading to a TTY (B) improves shell interactivity but provides no persistence. Changing the root password (D) would immediately lock out the legitimate root user, causing disruption - and is also noisy and potentially irreversible if forgotten.
Topics
Community Discussion
No community discussion yet for this question.