312-50V11 · Question #410
After trying multiple exploits, you've gained root access to a Centos 6 server. To ensure you maintain access, what would you do first?
The correct answer is A. Create User Account. Creating a backdoor user account is the first post-exploitation persistence step because it survives reboots and patch cycles without requiring re-exploitation.
Question
After trying multiple exploits, you've gained root access to a Centos 6 server. To ensure you maintain access, what would you do first?
Options
- ACreate User Account
- BDisable Key Services
- CDisable IPTables
- DDownload and Install Netcat
How the community answered
(39 responses)- A85% (33)
- B8% (3)
- C3% (1)
- D5% (2)
Why each option
Creating a backdoor user account is the first post-exploitation persistence step because it survives reboots and patch cycles without requiring re-exploitation.
Creating a legitimate-looking local user account gives the attacker a stable, stealthy re-entry path that persists across reboots and is unaffected by patching the original vulnerability. It requires no additional tooling to maintain and is less likely to trigger security alerts than installing software or changing firewall rules.
Disabling key services degrades system functionality and will likely trigger administrator alerts or automated monitoring, which undermines the goal of maintaining covert, long-term access.
Disabling IPTables removes host-based firewall protection but does not itself establish a persistent access mechanism, and the sudden policy change can be detected by security monitoring tools.
Downloading and installing Netcat can create a backdoor channel but requires an active listener session to be useful and is more readily flagged by endpoint detection tools than a dormant user account.
Concept tested: Post-exploitation persistence via backdoor user account
Source: https://owasp.org/www-project-testing-guide/
Topics
Community Discussion
No community discussion yet for this question.