nerdexam
GIAC

GCIH · Question #649

What happened in the following screenshot?

The correct answer is C. The btmp logs are not stored in ASCII. The btmp file is a binary log that records failed login attempts and produces garbled output when read with a plain text command.

Incident Response & Cyber Kill Chain

Question

What happened in the following screenshot?

Options

  • AThe user does not have permissions to access btmp
  • BThere was a overflow condition
  • CThe btmp logs are not stored in ASCII
  • DAn attacker corrupted the file to cover their tracks

How the community answered

(21 responses)
  • A
    10% (2)
  • B
    5% (1)
  • C
    86% (18)

Why each option

The btmp file is a binary log that records failed login attempts and produces garbled output when read with a plain text command.

AThe user does not have permissions to access btmp

A permissions error would produce a clear 'Permission denied' message rather than garbled or binary output.

BThere was a overflow condition

A buffer overflow would cause the reading program to crash or behave unexpectedly, not display binary characters from a log file.

CThe btmp logs are not stored in ASCIICorrect

The /var/log/btmp file stores failed authentication attempts in the binary utmp structure, not as plain ASCII text. Attempting to display it with a command like cat produces unreadable characters; the correct tool to parse it is lastb, which interprets the binary format and renders it as human-readable output.

DAn attacker corrupted the file to cover their tracks

While log tampering is a real attacker technique, the garbled display here is the expected, normal result of misreading a binary-format file with a text viewer.

Concept tested: Linux binary log files and the lastb command

Source: https://man7.org/linux/man-pages/man5/utmp.5.html

Topics

#btmp logs#Linux authentication#binary log format#failed logins

Community Discussion

No community discussion yet for this question.

Full GCIH Practice