Give an example of a Linux privilege escalation vector commonly checked during pentests.

• A. Using password spraying to gain root access.
• B. Exploiting cron jobs to escalate privileges.
• C. Enumerating kernel modules for privilege escalation.
• D. Listing and examining SUID binaries for misconfigurations that could grant elevated privileges.

Answer: (D)

Privilege escalation on Linux often hinges on how programs run with elevated rights. A set-user-ID (SUID) program runs with the owner’s privileges (typically root) regardless of who executes it. If such a binary is insecure or misconfigured, a non-privileged user can exploit it to gain root access. That makes SUID binaries a go-to focus during a pentest: they’re directly tied to how privileges are granted and can reveal clear paths to elevation.

Searching for SUID binaries and then inspecting them is a core step because many systems inadvertently expose risky SUID programs or wrappers. You’d typically locate them with a broad scan and then analyze each candidate for weaknesses, such as a binary that invokes a shell, uses unvalidated input, or calls system functions in unsafe ways. If you find a misconfigured or vulnerable SUID binary, it often provides a straightforward route to escalate privileges.

Other options describe legitimate credential or persistence concepts, or require specific misconfigurations or kernel-level bugs to be exploitable. While cron job misconfigurations or kernel module vulnerabilities can enable privilege escalation, they’re less universal as a baseline tactic compared to the standard, widely applicable check of SUID binaries.