312-50V13 · Question #38
An attacker has installed a RAT on a host. The attacker wants to ensure that when a user Which file does the attacker need to modify?
The correct answer is D. Hosts. The attacker wants to redirect a user to a different website when a legitimate URL is typed, which is achieved by modifying the host-to-IP mapping on the local machine.
Question
Options
- ABoot.ini
- BSudoers
- CNetworks
- DHosts
How the community answered
(38 responses)- A8% (3)
- B5% (2)
- C16% (6)
- D71% (27)
Why each option
The attacker wants to redirect a user to a different website when a legitimate URL is typed, which is achieved by modifying the host-to-IP mapping on the local machine.
`Boot.ini` is a legacy file used in older Windows versions to configure boot options and has no role in hostname resolution or URL redirection.
`Sudoers` is a configuration file found on Unix-like operating systems (e.g., Linux) that defines user permissions for executing commands as another user, and is irrelevant to Windows hostname resolution.
`Networks` is typically a Unix/Linux configuration file (`/etc/networks`) that lists network names and their associated IP addresses, not a Windows file for hostname redirection.
The `hosts` file (on Windows, located at `%SystemRoot%\System32\drivers\etc\hosts`) is a local plain text file that maps hostnames to IP addresses. By modifying this file, an attacker can redirect legitimate domain names to a malicious IP address, causing the user's browser to connect to the attacker's server instead of the intended site.
Concept tested: Hosts file for hostname redirection
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/tcpip-hosts-file-not-working
Topics
Community Discussion
No community discussion yet for this question.