Attackers are trying to connect from an internal host they have compromised to their own host on the Internet. They can ping their external host, but cannot connect. What should the attackers do to…

The correct answer is D. Hide TCP connections within ICMP traffic. The fact that the attacker can ping their external hosts indicates that they are communicating with their host via ICMP; the attacker could use a tool like ptunnel to create TCP connections within ICMP. Each of the other options requires a TCP connection of which there is no…

Malware Analysis & Advanced Persistent Threats

Question

Attackers are trying to connect from an internal host they have compromised to their own host on the Internet. They can ping their external host, but cannot connect. What should the attackers do to try and exfiltrate data to their external host?

Options

ATransfer ASCII files within TCP/IP headers
BTunnel ICMP echos and replies inside SSH
CSetup a reverse HTTP shell session
DHide TCP connections within ICMP traffic

How the community answered

(24 responses)

A
17% (4)
B
4% (1)
C
13% (3)
D
67% (16)

Explanation

The fact that the attacker can ping their external hosts indicates that they are communicating with their host via ICMP; the attacker could use a tool like ptunnel to create TCP connections within ICMP. Each of the other options requires a TCP connection of which there is no indication of

Topics

#ICMP tunneling#data exfiltration#covert channel#firewall evasion

Community Discussion

No community discussion yet for this question.

Full GCIH Practice