Question

During a post-exploitation phase on a Linux server, you have a low-privileged shell as the user 'svc-app'. Running 'sudo -l' returns that the user may run '/usr/bin/find' as root without a password. Which action MOST directly leverages this misconfiguration to obtain a root shell?

Accepted Answer

Execute 'sudo find . -exec /bin/sh \; -quit' to spawn a shell running with root privileges

Answer

Run 'sudo find / -perm -4000' to locate all SUID binaries and manually replace one with a payload

Answer

Add the 'svc-app' account to the sudo group by editing /etc/group after re-authenticating

Answer

Use 'find' to search for readable SSH private keys in /home and reuse them against other hosts