Linux

Question 1

Linux Privilege Escalation Techniques

Answer 1

Kernel Exploits
Programs or Services running as root - could allow you to execute a command
Scripts running as root user - maybe they’re writeable
Vulnerable installed software
Weak/reused/plaintext passwords
SUID/SGID misconfiguration
Abusing sudo rights
World writeable scripts invoked by root
Bad path configuration
cronjobs
unmounted filesystems

Question 2

What are the 5 steps of incident response?

Answer 2

1. Preparation - policies, guidelines, exercises
2. Detection and reporting - monitor, detect, alert, report
3. Triage and Analysis - endpoint analysis, binary analysis, analyze logs
4. Containment and neutralization - identify affected systems and shut down, wipe infected devices, block requests from malicious ips, etc
5. Post-incident activity - monitor, incident report