GCIH · Question #649
What happened in the following screenshot?
The correct answer is C. The btmp logs are not stored in ASCII. The btmp file is a binary log that records failed login attempts and produces garbled output when read with a plain text command.
Question
What happened in the following screenshot?
Options
- AThe user does not have permissions to access btmp
- BThere was a overflow condition
- CThe btmp logs are not stored in ASCII
- DAn attacker corrupted the file to cover their tracks
How the community answered
(21 responses)- A10% (2)
- B5% (1)
- C86% (18)
Why each option
The btmp file is a binary log that records failed login attempts and produces garbled output when read with a plain text command.
A permissions error would produce a clear 'Permission denied' message rather than garbled or binary output.
A buffer overflow would cause the reading program to crash or behave unexpectedly, not display binary characters from a log file.
The /var/log/btmp file stores failed authentication attempts in the binary utmp structure, not as plain ASCII text. Attempting to display it with a command like cat produces unreadable characters; the correct tool to parse it is lastb, which interprets the binary format and renders it as human-readable output.
While log tampering is a real attacker technique, the garbled display here is the expected, normal result of misreading a binary-format file with a text viewer.
Concept tested: Linux binary log files and the lastb command
Source: https://man7.org/linux/man-pages/man5/utmp.5.html
Topics
Community Discussion
No community discussion yet for this question.