By performing a penetration test, you gained access under a user account. During the test, you established a connection with your own machine via the SMB service and occasionally entered your login an

The correct answer is A. .X session-log. .bash_history is the correct answer. When a user types commands in a bash shell - including commands like 'smbclient //server/share -U username%password' that include credentials in plaintext - those commands are recorded verbatim in the ~/.bash_history file. An attacker or foren

System Hacking

Question

By performing a penetration test, you gained access under a user account. During the test, you established a connection with your own machine via the SMB service and occasionally entered your login and password in plaintext. Which file do you have to clean to clear the password?

Options

A.X session-log
B.bashrc
C.profile
D.bash_history

How the community answered

(38 responses)

A
71% (27)
B
8% (3)
C
16% (6)
D
5% (2)

Explanation

.bash_history is the correct answer. When a user types commands in a bash shell - including commands like 'smbclient //server/share -U username%password' that include credentials in plaintext - those commands are recorded verbatim in the ~/.bash_history file. An attacker or forensic analyst can retrieve plaintext passwords directly from this file. To cover tracks, a penetration tester must clear or edit this file. The other options are not relevant to this scenario: .X session-log records X Window System graphical session events, not shell commands; .bashrc and .profile are shell configuration/initialization scripts that store settings and environment variables, not command history.

Topics

#covering tracks#bash history#log clearing#SMB

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice