nerdexam
GIAC

GCIH · Question #312

Which of the following actions is performed by the netcat command given below? nc 55555 < /etc/passwd

The correct answer is D. It grabs the /etc/passwd file when connected to UDP port 55555. The netcat command with input redirection sends the local /etc/passwd file contents to a remote host on port 55555, functioning as a simple file exfiltration mechanism.

Vulnerability Exploitation & Privilege Escalation

Question

Which of the following actions is performed by the netcat command given below? nc 55555 < /etc/passwd

Options

  • AIt changes the /etc/passwd file when connected to the UDP port 55555.
  • BIt resets the /etc/passwd file to the UDP port 55555.
  • CIt fills the incoming connections to /etc/passwd file.
  • DIt grabs the /etc/passwd file when connected to UDP port 55555.

How the community answered

(35 responses)
  • A
    6% (2)
  • B
    9% (3)
  • C
    14% (5)
  • D
    71% (25)

Why each option

The netcat command with input redirection sends the local /etc/passwd file contents to a remote host on port 55555, functioning as a simple file exfiltration mechanism.

AIt changes the /etc/passwd file when connected to the UDP port 55555.

Input redirection with '<' sends file contents outward over the network and does not modify or alter the local /etc/passwd file.

BIt resets the /etc/passwd file to the UDP port 55555.

The command does not reset or restore /etc/passwd in any way; it reads the file and sends its contents to the remote host.

CIt fills the incoming connections to /etc/passwd file.

The '<' operator directs file contents outbound to the remote connection; it does not populate or overwrite the file with data from incoming connections.

DIt grabs the /etc/passwd file when connected to UDP port 55555.Correct

The shell redirection operator '<' feeds the contents of /etc/passwd as standard input to nc, which transmits those bytes to the remote endpoint on port 55555, effectively exfiltrating the file. Note that nc uses TCP by default (not UDP) unless the -u flag is specified, making the 'UDP' reference in this answer technically inaccurate, but D is the only option that correctly identifies the file transmission behavior. Among all choices, D best describes the actual network data transfer the command performs.

Concept tested: Netcat file exfiltration via input redirection

Source: https://linux.die.net/man/1/nc

Topics

#netcat#/etc/passwd exfiltration#post-exploitation#file transfer

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice