nerdexam
GIAC

GCIH · Question #196

You execute the following netcat command: c:\target\nc -1 -p 53 -d -e cmd.exe What action do you want to perform by issuing the above command?

The correct answer is D. Listen the incoming traffic on port 53 and execute the remote shell. The netcat command uses listen mode on port 53 with cmd.exe execution, creating a backdoor remote shell that accepts incoming connections on the DNS port.

Vulnerability Exploitation & Privilege Escalation

Question

You execute the following netcat command:

c:\target\nc -1 -p 53 -d -e cmd.exe What action do you want to perform by issuing the above command?

Options

  • AListen the incoming data and performing port scanning
  • BCapture data on port 53 and performing banner grabbing
  • CCapture data on port 53 and delete the remote shell
  • DListen the incoming traffic on port 53 and execute the remote shell

How the community answered

(47 responses)
  • A
    6% (3)
  • B
    15% (7)
  • C
    4% (2)
  • D
    74% (35)

Why each option

The netcat command uses listen mode on port 53 with cmd.exe execution, creating a backdoor remote shell that accepts incoming connections on the DNS port.

AListen the incoming data and performing port scanning

The command uses listen mode (-l) and executes a shell (-e cmd.exe), which is a backdoor operation - not port scanning, which requires connecting outbound to multiple target ports.

BCapture data on port 53 and performing banner grabbing

Banner grabbing involves initiating an outbound connection to a service to capture its identification string; this command listens for inbound connections and executes a shell rather than connecting and reading a banner.

CCapture data on port 53 and delete the remote shell

The -d flag in netcat means detach from stdin so the process runs in the background in stealth mode - it does not delete anything, so no shell is removed by this command.

DListen the incoming traffic on port 53 and execute the remote shellCorrect

The -l flag places netcat in listen mode, waiting for an incoming connection; -p 53 binds the listener to port 53, which is commonly associated with DNS traffic and is often permitted through firewalls, helping evade detection. The -e cmd.exe flag causes netcat to pipe the input and output of the Windows command shell over the network connection, giving the connecting party a full interactive remote shell.

Concept tested: Netcat backdoor listener with remote shell on port 53

Topics

#netcat#reverse shell#command execution#port 53 tunneling

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice