EC-Council
EC0-350 · Question #744
After studying the following log entries, how many user IDs can you identify that the attacker has tampered with? 1. mkdir -p /etc/X11/applnk/Internet/.etc 2. mkdir -p…
The correct answer is C. nobody, dns. See the full explanation below for the reasoning.
Question
After studying the following log entries, how many user IDs can you identify that the attacker has tampered with? 1. mkdir -p /etc/X11/applnk/Internet/.etc 2. mkdir -p /etc/X11/applnk/Internet/.etcpasswd 3. touch -acmr /etc/passwd /etc/X11/applnk/Internet/.etcpasswd 4. touch -acmr /etc /etc/X11/applnk/Internet/.etc 5. passwd nobody -d 6. /usr/sbin/adduser dns -d/bin -u 0 -g 0 -s/bin/bash 7. passwd dns -d 8. touch -acmr /etc/X11/applnk/Internet/.etcpasswd /etc/passwd 9. touch -acmr /etc/X11/applnk/Internet/.etc /etc
Options
- AIUSR_
- Bacmr, dns
- Cnobody, dns
- Dnobody, IUSR_
How the community answered
(38 responses)- A8% (3)
- B5% (2)
- C84% (32)
- D3% (1)
Community Discussion
No community discussion yet for this question.