EC-Council
EC0-350 · Question #748
After studying the following log entries, what is the attacker ultimately trying to achieve as inferred from the log sequence? 1. mkdir -p /etc/X11/applnk/Internet/.etc 2. mkdir -p…
The correct answer is C. Change the files Modification Access Creation times. See the full explanation below for the reasoning.
Question
After studying the following log entries, what is the attacker ultimately trying to achieve as inferred from the log sequence? 1. mkdir -p /etc/X11/applnk/Internet/.etc 2. mkdir -p /etc/X11/applnk/Internet/.etcpasswd 3. touch -acmr /etc/passwd /etc/X11/applnk/Internet/.etcpasswd 4. touch -acmr /etc /etc/X11/applnk/Internet/.etc 5. passwd nobody -d 6. /usr/sbin/adduser dns -d/bin -u 0 -g 0 -s/bin/bash 7. passwd dns -d 8. touch -acmr /etc/X11/applnk/Internet/.etcpasswd /etc/passwd 9. touch -acmr /etc/X11/applnk/Internet/.etc /etc
Options
- AChange password of user nobody
- BExtract information from a local directory
- CChange the files Modification Access Creation times
- DDownload rootkits and passwords into a new directory
How the community answered
(52 responses)- A13% (7)
- B2% (1)
- C79% (41)
- D6% (3)
Community Discussion
No community discussion yet for this question.