An incident handler sees the following lines in the shell history of a user on a machine:

mknod test p nc -l -p 11111 0<test | nc 10.1.1.10 54321 1>test What did this user implement?

Question

An incident handler sees the following lines in the shell history of a user on a machine: mknod test p nc -l -p 11111 0<test | nc 10.1.1.10 54321 1>test What did this user implement?

Accepted Answer

B. A Netcat backpipe relay, receiving data on port 11111 and sending it to 10.1.1.10 port 54321. mknod test p creates a FIFO named pipe. The first nc listens on port 11111 with stdin redirected from the pipe, and the second nc connects to 10.1.1.10:54321 with stdout redirected back into the pipe. This forms a bidirectional relay - data arriving on 11111 flows to 10.1.1.10:54321 and responses flow back - a classic Netcat backpipe used for traffic pivoting.

Answer

A. A Netcat listener that executes the contents of the file named test. No command execution flag (such as -e or -c) is present in either nc invocation, so no file contents are executed.

Answer

C. A Netcat client that stores its output in a file named test. A simple client storing output to a file would use nc host port > file; the named pipe and dual-listener construct here creates a relay, not a passive output capture.

Answer

D. A Netcat backdoor with a destination port of 11111 and source port of 54321. Neither nc invocation spawns a shell or binds a backdoor - the construct is a stateless relay with no command execution capability.

An incident handler sees the following lines in the shell history of a user on a machine: mknod test p nc -l -p 11111 0<test | nc 10.1.1.10 54321 1>test What did this user implement?

Question

Options

How the community answered

Why each option

Topics

Community Discussion