I85PREP
⌘ K
CEH Practical study materials
CEH Practical study resources

CEH Practical practice questions

One question at a time. Build your CEH Practical understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Wireless, cloud and IoT assessment responsibility boundaries

In the supplied supported airmon-ng lab model with an authorized compatible adapter named wlan0, which listed command requests monitor-mode setup?

  1. airmon-ng start wlan0 Correct answer.
  2. iwconfig wlan0 essid hidden
  3. ifconfig wlan0 promisc
  4. modprobe -r ath9k

Explanation

The listed start command requests the supported monitor-mode setup in this lab model. Actual adapter/interface naming and conflicting processes require their own checks. Starting the mode does not universally perform every process-kill action; check/kill workflows are distinct, and no command is executed here.

Question 2Wireless, cloud and IoT assessment responsibility boundaries

Which tool captures a WPA2 4-way handshake to a file for offline cracking?

  1. airodump-ng -c <ch> --bssid <ap> -w cap wlan0mon Correct answer.
  2. aireplay-ng --fakeauth
  3. iwconfig
  4. macchanger -r wlan0

Explanation

airodump-ng on the AP's channel, filtered by BSSID, writes a .cap/.pcap to disk. Once a client associates (or you deauth one), the 4-way handshake is recorded and can be cracked with aircrack-ng or hashcat (-m 22000).

Question 3Wireless, cloud and IoT assessment responsibility boundaries

Which aireplay-ng attack disconnects a target client from its AP to force re-authentication and capture the handshake?

  1. Deauthentication (-0) Correct answer.
  2. Fake authentication (-1)
  3. Caffe Latte (-6)
  4. ARP request replay (-3)

Explanation

aireplay-ng -0 <count> -a <BSSID> -c <client> wlan0mon sends 802.11 deauth frames, kicking the client off so it reconnects and produces a captureable handshake.

Question 4Wireless, cloud and IoT assessment responsibility boundaries

Which WPS attack exploits a flawed pseudo-random number generator in some chipsets to recover the WPS PIN offline from a single transaction?

  1. Pixie Dust Correct answer.
  2. KRACK
  3. Caffe Latte
  4. Hirte

Explanation

Pixie Dust (Reaver --pixie-dust, Bully) attacks weak nonce generation in WPS implementations from Ralink, Realtek, and Broadcom. When vulnerable, the PIN is recovered offline in seconds, bypassing AP rate-limiting.

Question 5Wireless, cloud and IoT assessment responsibility boundaries

Which WPS brute-force tool tries all 8-digit PINs by issuing M1-M4 messages sequentially against the AP?

  1. Reaver / Bully Correct answer.
  2. Hashcat
  3. Aircrack-ng
  4. Hydra

Explanation

Reaver and Bully implement the original Viehbock WPS PIN brute force, exploiting the fact that the PIN is verified in two halves (4 + 3 digits + checksum), reducing the search space to about 11,000 attempts.

Question 6Wireless, cloud and IoT assessment responsibility boundaries

What is an Evil Twin attack against Wi-Fi clients?

  1. Standing up a rogue AP with the same SSID as the legitimate one to lure clients Correct answer.
  2. Cracking WEP IVs offline with aircrack-ng
  3. Exploiting WPS pin reuse
  4. Deauthing all devices on a SSID

Explanation

An Evil Twin clones the SSID (and often BSSID) of a legitimate network with stronger signal. Combined with deauth of the real AP, clients roam to the rogue AP, which captures credentials, runs captive portals, or MITMs the traffic.

Question 7Wireless, cloud and IoT assessment responsibility boundaries

Which AWS misconfiguration is exploited when an S3 bucket policy grants s3:GetObject to AllUsers?

  1. Public bucket leaks all objects to anyone with the URL Correct answer.
  2. Bucket replication breaks across regions
  3. Server-side encryption is bypassed
  4. Bucket versioning is disabled

Explanation

AllUsers means anyone, anywhere, including unauthenticated requesters. Granting s3:GetObject to AllUsers exposes every object for public read, the cause of countless breach headlines. Tools like aws s3 ls --no-sign-request and bucket-finder/ScoutSuite identify this quickly.

Question 8Wireless, cloud and IoT assessment responsibility boundaries

Which cloud penetration testing framework targets AWS and supports modules for IAM enumeration, lateral movement, and persistence?

  1. Pacu Correct answer.
  2. Burp Suite
  3. Wireshark
  4. Hydra

Explanation

Pacu (Rhino Security Labs) is the AWS exploitation framework. Modules enumerate IAM, escalate privileges via known IAM permission combinations, persist via Lambda backdoors and access keys, and exfiltrate S3 data.

Question 9Wireless, cloud and IoT assessment responsibility boundaries

Which audit tool inspects AWS, GCP, and Azure tenants for misconfigured services using the cloud APIs?

  1. ScoutSuite Correct answer.
  2. Mimikatz
  3. Hashcat
  4. John the Ripper

Explanation

ScoutSuite (NCC Group) authenticates with cloud provider APIs and produces a multi-domain audit covering IAM, networking, storage, compute, logging, and key management. It is widely used in CEH cloud lab tasks.

Question 10Wireless, cloud and IoT assessment responsibility boundaries

Which symmetric cipher is the standard for AES-256 with Galois/Counter Mode used in TLS 1.2/1.3 and disk encryption?

  1. AES-256-GCM Correct answer.
  2. DES
  3. RC4
  4. MD5

Explanation

AES-256-GCM is an authenticated cipher that combines AES counter mode with GHASH for integrity. It is widely used in TLS 1.2/1.3, IPsec, BitLocker (XTS variant), and SSH.

Question 11Wireless, cloud and IoT assessment responsibility boundaries

Which hashing algorithm is considered cryptographically broken for collision resistance and should not be used for digital signatures or password storage?

  1. MD5 Correct answer.
  2. SHA-256
  3. SHA-3-512
  4. BLAKE2b

Explanation

Practical MD5 collisions have been demonstrated since 2004 (Wang et al.) and chosen-prefix collisions since 2008 (Stevens). MD5 is unsafe for signatures and TLS certificates. For passwords, use bcrypt/scrypt/argon2 - not even SHA-256.

Question 12Wireless, cloud and IoT assessment responsibility boundaries

Which tool identifies the algorithm of an unknown hash from its format?

  1. hash-identifier / hashid Correct answer.
  2. tcpdump
  3. responder
  4. msfconsole

Explanation

hash-identifier (Python interactive) and hashid (CLI) examine length and characteristic prefixes to suggest possible algorithms, then map to hashcat -m modes - useful when you find a hash and don't yet know what to feed hashcat.

Question 13Wireless, cloud and IoT assessment responsibility boundaries

Which IoT-specific reconnaissance technique uses Shodan filters to find exposed cameras, routers, or ICS PLCs?

  1. Search filters like 'port:502 country:US' for Modbus PLCs Correct answer.
  2. Running aircrack-ng on a packet capture
  3. Submitting a CSRF token to a login page
  4. Brute-forcing Active Directory accounts

Explanation

Shodan filters such as `port:502` (Modbus), `port:47808` (BACnet), `product:Hikvision`, and `country:US` reveal exposed industrial and IoT devices. CEH Practical may ask which Shodan filter finds a given device.

Question 14Wireless, cloud and IoT assessment responsibility boundaries

Which protocol is commonly used in OT/ICS environments and runs over TCP/502, making it a frequent CEH IoT target?

  1. Modbus TCP Correct answer.
  2. DHCP
  3. RDP
  4. SMB

Explanation

Modbus TCP is a clear-text industrial protocol on TCP/502 with no built-in authentication. PLCs that expose it allow function-code 5/6/15/16 writes to coils and registers, giving attackers process control.

Question 15Wireless, cloud and IoT assessment responsibility boundaries

Which weak Wi-Fi protocol uses RC4 with a 24-bit IV and is trivially broken by collecting enough IVs for a statistical attack?

  1. WEP Correct answer.
  2. WPA2-Personal
  3. WPA3-SAE
  4. EAP-TLS

Explanation

WEP's tiny 24-bit IV space and RC4 key scheduling weaknesses (FMS, KoreK, PTW) let aircrack-ng recover keys after collecting tens of thousands of unique IVs. WEP is deprecated; networks should use at least WPA2.

Question 16Wireless, cloud and IoT assessment responsibility boundaries

Which utility extracts and inspects EXIF metadata (camera model, GPS coordinates) embedded in a JPEG file?

  1. exiftool Correct answer.
  2. tcpdump
  3. ettercap
  4. snort

Explanation

exiftool reads and writes metadata in many formats (JPEG, PNG, PDF, MP4). It is invaluable for OSINT, file-forensics, and detecting steganography indicators (unusual fields, comment blocks).

Question 17Wireless, cloud and IoT assessment responsibility boundaries

Which AWS service stores temporary credentials available to EC2 instances via the metadata endpoint at 169.254.169.254 and is frequently abused via SSRF?

  1. Instance Metadata Service (IMDS) v1 Correct answer.
  2. AWS KMS
  3. AWS WAF
  4. AWS GuardDuty

Explanation

IMDSv1 returns instance role credentials with a simple HTTP GET, making it a common SSRF target. IMDSv2 mitigates with a session-token requirement, but instances pinned to v1 remain widely exploitable.

Question 18Wireless, cloud and IoT assessment responsibility boundaries

Which encryption scheme is asymmetric (public/private key pair) and is commonly used to exchange a symmetric key over an insecure channel?

  1. RSA Correct answer.
  2. AES
  3. ChaCha20
  4. Blowfish

Explanation

RSA uses the difficulty of factoring large semiprimes. With a 2048+ bit key, it is widely used for TLS key exchange (legacy) and digital signatures. AES, ChaCha20, and Blowfish are symmetric ciphers.

Question 19Wireless, cloud and IoT assessment responsibility boundaries

Which attack against TLS exploits CBC-mode padding oracle responses to decrypt ciphertext without the key?

  1. POODLE / Padding Oracle (Vaudenay) Correct answer.
  2. Heartbleed
  3. Sweet32
  4. FREAK

Explanation

Padding-oracle attacks like POODLE recover plaintext by submitting modified CBC ciphertexts and observing whether the server returns 'bad padding' vs 'bad MAC'. Defenses include disabling SSLv3 and using AEAD ciphers like AES-GCM.

Question 20Wireless, cloud and IoT assessment responsibility boundaries

Which hashcat option processes a wordlist with rules and is commonly paired with rockyou.txt + best64.rule?

  1. -a 0 -r best64.rule Correct answer.
  2. -a 3
  3. -a 6
  4. -a 7

Explanation

-a 0 is straight (dictionary) attack; combined with -r ruleset it applies word mangling rules. -a 3 is mask brute force; -a 6/7 are hybrid wordlist+mask combinations.

Question 21Wireless, cloud and IoT assessment responsibility boundaries

Which cryptographic primitive produces a fixed-size digest, is one-way, and is used to verify file integrity (e.g., SHA-256)?

  1. Cryptographic hash function Correct answer.
  2. Symmetric cipher
  3. Asymmetric cipher
  4. Key derivation function

Explanation

Cryptographic hash functions (SHA-256, SHA-3) produce a fixed-length digest with the properties of pre-image, second pre-image, and collision resistance. They are used for integrity, signatures, and (with KDFs) password storage.

Question 22Wireless, cloud and IoT assessment responsibility boundaries

Which attack on the WPA2 4-way handshake forces nonce reuse on the supplicant, allowing decryption of frames?

  1. KRACK (Key Reinstallation Attack) Correct answer.
  2. Pixie Dust
  3. Caffe Latte
  4. Sweet32

Explanation

KRACK (Vanhoef, 2017) replays message 3 of the 4-way handshake to force the supplicant to reinstall a previously used PTK, resetting the packet number and enabling decryption/forgery in some implementations.

Question 23Wireless, cloud and IoT assessment responsibility boundaries

Which utility lets you mount a remote AWS S3 bucket as a filesystem to exfiltrate data once you have credentials?

  1. s3fs / aws s3 sync Correct answer.
  2. smbmount
  3. nfsmount
  4. sshfs

Explanation

s3fs mounts a bucket as a FUSE filesystem; `aws s3 sync s3://bucket .` copies contents locally. Both are common post-compromise exfiltration paths once IAM credentials are obtained.

Question 24Wireless, cloud and IoT assessment responsibility boundaries

Which binwalk option extracts identified embedded files from a firmware image automatically?

  1. -e (--extract) Correct answer.
  2. -B (--signature)
  3. -A (--opcodes)
  4. -E (--entropy)

Explanation

binwalk -e (or --extract) walks the input, identifies known signatures, and uses associated extractors (sasquatch for squashfs, jefferson for JFFS2, dd for raw blobs). Add -M for recursive extraction.

Question 25Wireless, cloud and IoT assessment responsibility boundaries

Which attack recovers data from improperly secured Bluetooth Low Energy (BLE) IoT devices by sniffing pairing or replaying GATT writes?

  1. BLE sniffing/replay (e.g., gatttool, btlejack) Correct answer.
  2. WPS Pixie Dust
  3. ARP spoofing
  4. Slowloris

Explanation

Tools such as gatttool, bettercap (ble.recon), and btlejack capture BLE advertisements, pair, and replay GATT characteristic writes. Many low-end BLE IoT devices use 'Just Works' pairing with no MITM protection.

Question 26Reconnaissance, enumeration and confidence in observations

In the supplied authorized Nmap recognition exercise, which scan requests the classic TCP SYN half-open approach rather than completing the ordinary three-way handshake?

  1. -sT
  2. -sS Correct answer.
  3. -sU
  4. -sn

Explanation

The classic SYN scan option is -sS among these choices. It observes relevant responses without completing the ordinary connection handshake under its supported model. Detection, privileges, defaults and performance depend on environment and version; it is not guaranteed stealthy or universally faster.

Question 27Reconnaissance, enumeration and confidence in observations

Which Nmap option enables OS fingerprinting based on TCP/IP stack behavior?

  1. -sV
  2. -O Correct answer.
  3. -A
  4. -Pn

Explanation

The -O flag enables Nmap operating system detection. Nmap sends a series of TCP and UDP probes and compares responses (TTL, window size, options, sequence generation) against its OS fingerprint database to identify the target operating system.

Question 28Reconnaissance, enumeration and confidence in observations

You need to enumerate SMB shares on a Windows host without authentication. Which command is most appropriate?

  1. smbclient -L //10.10.10.5 -N Correct answer.
  2. nmap -sU -p 445 10.10.10.5
  3. ssh [email protected]
  4. ftp 10.10.10.5

Explanation

smbclient -L //target -N lists shares on a remote host using a null session (-N = no password). If the server permits guest/null SMB browsing, this enumerates available shares without credentials.

Question 29Reconnaissance, enumeration and confidence in observations

Which tool is specifically designed to enumerate Windows hosts via SMB null sessions, returning users, groups, shares, and password policy?

  1. enum4linux Correct answer.
  2. dirb
  3. hydra
  4. nikto

Explanation

enum4linux is a Perl wrapper around the Samba tools (smbclient, rpcclient, net) that automates SMB enumeration: users (RID cycling), groups, shares, OS info, password policy, and printer info. It is a staple CEH Practical reconnaissance tool.

Question 30Reconnaissance, enumeration and confidence in observations

You want to perform a DNS zone transfer against ns1.example.com for the domain example.com. Which command is correct?

  1. dig @ns1.example.com example.com AXFR Correct answer.
  2. dig example.com MX
  3. nslookup -type=A example.com
  4. host example.com

Explanation

The AXFR query type performs a DNS zone transfer. The syntax `dig @<nameserver> <domain> AXFR` requests a full copy of the zone from the specified authoritative server. Misconfigured servers that allow AXFR to anyone will leak every record in the zone.

Question 31Reconnaissance, enumeration and confidence in observations

Which tool is best known for brute-forcing DNS subdomains using a wordlist and detecting wildcard records?

  1. dnsenum Correct answer.
  2. tcpdump
  3. ettercap
  4. john

Explanation

dnsenum (and its cousin fierce/dnsrecon) automates DNS reconnaissance: NS/MX/A enumeration, AXFR attempts, reverse lookups, and dictionary-based subdomain brute forcing. It also detects wildcard DNS configurations to avoid false positives.

Question 32Reconnaissance, enumeration and confidence in observations

Which Nmap NSE script category runs scripts that may crash a vulnerable service or be considered intrusive?

  1. default
  2. safe
  3. intrusive Correct answer.
  4. discovery

Explanation

NSE categories include safe, default, discovery, version, vuln, exploit, brute, dos, and intrusive. The intrusive category groups scripts that are likely to be flagged or to crash the target. Use --script intrusive only with explicit authorization.

Question 33Reconnaissance, enumeration and confidence in observations

You suspect SNMP is running on UDP/161 with the default community string. Which command enumerates the entire MIB tree using snmpwalk v2c with community 'public'?

  1. snmpwalk -v 2c -c public 10.10.10.5 Correct answer.
  2. snmpwalk -v 1 -c admin 10.10.10.5
  3. snmpget -v 3 10.10.10.5
  4. snmptrap -c public 10.10.10.5

Explanation

snmpwalk -v 2c -c public <target> walks the MIB tree starting from the default OID using SNMP version 2c with the community string 'public'. Because SNMP v1/v2c send the community string in cleartext, default community strings are a classic information-disclosure vector.

Question 34Reconnaissance, enumeration and confidence in observations

Which command grabs the HTTP banner of a web server using netcat?

  1. nc -lvp 80
  2. echo -e 'HEAD / HTTP/1.0\r\n\r\n' | nc target 80 Correct answer.
  3. nc -e /bin/sh target 80
  4. nc -u target 53

Explanation

Sending a HEAD request through netcat to TCP/80 returns the response headers, including the Server banner. This is a classic banner-grabbing technique for fingerprinting web server software and version.

Question 35Reconnaissance, enumeration and confidence in observations

Which Nmap flag combines OS detection, version detection, default scripts, and traceroute in one option?

  1. -A Correct answer.
  2. -T4
  3. -Pn
  4. -F

Explanation

The -A (aggressive) flag is shorthand for -O (OS detection), -sV (version detection), -sC (default scripts), and --traceroute. It is the fastest way to gather a thorough fingerprint but is also noisy.

Question 36Reconnaissance, enumeration and confidence in observations

Which NSE script attempts to detect Windows machines vulnerable to MS17-010 (EternalBlue)?

  1. smb-vuln-ms17-010 Correct answer.
  2. http-enum
  3. ssl-cert
  4. ftp-anon

Explanation

The smb-vuln-ms17-010 NSE script in the vuln category checks SMBv1 servers for the MS17-010 vulnerability that EternalBlue exploits. Run it with `nmap -p 445 --script smb-vuln-ms17-010 <target>`.

Question 37Reconnaissance, enumeration and confidence in observations

While performing reconnaissance you find an open TCP/445 port. Which protocol is most commonly running on this port?

  1. RDP
  2. LDAP
  3. SMB over TCP (Microsoft-DS) Correct answer.
  4. SSH

Explanation

TCP/445 is Microsoft-DS, the SMB-over-TCP port used by modern Windows file/print sharing and many lateral-movement techniques (PsExec, EternalBlue, SMB null sessions).

Question 38Reconnaissance, enumeration and confidence in observations

Which tool maps share-level permissions across multiple hosts and is often used after enum4linux to identify writable shares?

  1. smbmap Correct answer.
  2. tcpdump
  3. responder
  4. wireshark

Explanation

smbmap enumerates SMB shares across hosts and reports READ/WRITE permissions, supports authentication (-u/-p) or null sessions, and can execute commands via WMI. It complements enum4linux by focusing on access rights.

Question 39Reconnaissance, enumeration and confidence in observations

Which rpcclient command lists user accounts on a Windows host over a SMB null session?

  1. enumdomusers Correct answer.
  2. lsa lookup
  3. shares
  4. querydispinfo3

Explanation

Inside rpcclient (run with `rpcclient -U "" target`), the enumdomusers command lists all domain user accounts via the SAMR pipe. Other useful commands include enumdomgroups, queryuser <RID>, and lsaquery.

Question 40Reconnaissance, enumeration and confidence in observations

Which Nmap technique fragments TCP packets to evade simple stateless firewalls and IDS signatures?

  1. -f Correct answer.
  2. -O
  3. -sV
  4. -sn

Explanation

The -f flag tells Nmap to split probe packets into 8-byte (or smaller, with --mtu) IP fragments. Some legacy firewalls and IDSes only inspect the first fragment, so fragmentation can bypass naive signature matching.

Question 41Reconnaissance, enumeration and confidence in observations

What does the Nmap option --top-ports 100 do?

  1. Scans the 100 most commonly open ports based on Nmap's services file frequencies Correct answer.
  2. Scans ports 1-100
  3. Scans ports 65436-65535
  4. Limits scan rate to 100 packets per second

Explanation

--top-ports N scans the N most-frequently-open ports as ranked in nmap-services. --top-ports 100 is roughly equivalent to -F (fast scan) and is a quick triage option for large networks.

Question 42Reconnaissance, enumeration and confidence in observations

Which command-line tool checks a target's web server for known vulnerabilities and misconfigurations using a signature database?

  1. nikto Correct answer.
  2. tcpdump
  3. responder
  4. macof

Explanation

nikto is a web server scanner that checks for thousands of known dangerous files, outdated server software, server-configuration issues, and version-specific vulnerabilities. It's a standard go-to in CEH Practical for quick web triage.

Question 43Reconnaissance, enumeration and confidence in observations

Which Nmap option specifies a list of decoy IP addresses to obscure the true source of a scan?

  1. -D Correct answer.
  2. -S
  3. -e
  4. -g

Explanation

-D RND:5 or -D decoy1,decoy2,ME causes Nmap to spoof additional source IPs alongside your real one, making it harder for the target to identify the scanner. The target sees scans from multiple addresses.

Question 44Reconnaissance, enumeration and confidence in observations

Which technique discovers live hosts on a /24 without sending TCP/UDP probes by relying on ARP requests on the local segment?

  1. nmap -PR -sn 10.10.10.0/24 Correct answer.
  2. nmap -sU -p 53 10.10.10.0/24
  3. nmap -sV 10.10.10.0/24
  4. nmap -O 10.10.10.0/24

Explanation

On the same broadcast domain Nmap automatically uses ARP for host discovery; -PR forces ARP discovery and -sn disables port scanning. ARP responses are extremely reliable on a local LAN and cannot be filtered without breaking network function.

Question 45Reconnaissance, enumeration and confidence in observations

Which open-source intelligence (OSINT) search engine indexes Internet-facing devices and can identify exposed industrial control systems and IoT devices by banner?

  1. Shodan
  2. Censys
  3. Both Shodan and Censys Correct answer.
  4. Burp Suite

Explanation

Both Shodan and Censys continuously scan the public IPv4 space and index banners, certificates, and protocol fingerprints. Either can find exposed ICS/SCADA, webcams, IoT devices, and misconfigured services. CEH Practical typically references Shodan but Censys offers similar capability.

Question 46Host and middleware hardening foundations

After gaining a low-privileged shell on a Linux host, which script automates checks for kernel exploits, SUID binaries, sudo misconfigurations, and writable services?

  1. linPEAS Correct answer.
  2. Mimikatz
  3. BloodHound
  4. Responder

Explanation

linPEAS (Linux Privilege Escalation Awesome Script) enumerates kernel/version, SUID/SGID binaries, sudo -l, cron jobs, writable paths, capabilities, world-writable files, NFS, and dozens of other privesc vectors. It color-codes high-probability findings.

Question 47Host and middleware hardening foundations

Which Metasploit command searches for modules related to a specific CVE?

  1. search cve:2017-0144 Correct answer.
  2. find ms17-010
  3. lookup vuln
  4. info cve

Explanation

msfconsole's search command supports keyword filters such as cve:, type:, platform:, name:, and rank:. `search cve:2017-0144` finds the EternalBlue family of modules.

Question 48Host and middleware hardening foundations

Within a Meterpreter session on Windows, which command attempts to elevate privileges using a known UAC bypass module?

  1. getsystem Correct answer.
  2. hashdump
  3. screenshare
  4. background

Explanation

getsystem in Meterpreter tries several local privilege-escalation techniques (named-pipe impersonation, token manipulation) to elevate from a local admin to NT AUTHORITY\SYSTEM. If the current session is a low-priv user, it typically fails and a separate UAC-bypass post module is needed first.

Question 49Host and middleware hardening foundations

Which Meterpreter command migrates the running session into another process to maintain stability if the original process is killed?

  1. migrate <pid> Correct answer.
  2. ps
  3. kill <pid>
  4. execute -f cmd.exe

Explanation

migrate <pid> moves the Meterpreter DLL into another running process. This is useful to leave the exploited process (e.g., spoolsv) and embed in something more stable like explorer.exe, and to drop dependence on the originally exploited binary.

Question 50Host and middleware hardening foundations

Which Linux SUID binary, if marked SUID-root, can be abused to spawn a root shell using `find . -exec /bin/sh -p \; -quit`?

  1. find Correct answer.
  2. passwd
  3. ping
  4. ls

Explanation

When `find` has the SUID bit set and is owned by root, its -exec primitive runs commands with effective UID 0. The GTFOBins payload `find . -exec /bin/sh -p \; -quit` spawns a root shell. Many GTFOBins entries follow the same pattern (vim, awk, less, etc.).