nerdexam
GIAC

GCIH · Question #837

An organization has an SSH server that was compromised. Given the following evidence, what most likely occurred?

The correct answer is D. An attacker accessed the system through a backdoor using netcat. This question tests recognition of netcat as a backdoor tool commonly used by attackers after gaining initial access to a compromised SSH server.

Incident Response & Cyber Kill Chain

Question

An organization has an SSH server that was compromised. Given the following evidence, what most likely occurred?

Exhibit

GCIH question #837 exhibit

Options

  • AThe kworker thread was exploited using process injection
  • BThe SSH user account credentials have been compromised
  • CAn attacker uploaded a malicious python library to a well-known repository
  • DAn attacker accessed the system through a backdoor using netcat

How the community answered

(21 responses)
  • A
    5% (1)
  • B
    10% (2)
  • C
    19% (4)
  • D
    67% (14)

Why each option

This question tests recognition of netcat as a backdoor tool commonly used by attackers after gaining initial access to a compromised SSH server.

AThe kworker thread was exploited using process injection

Process injection into kworker threads is a kernel-level privilege escalation technique, not the primary mechanism for maintaining persistent remote access to a compromised SSH server.

BThe SSH user account credentials have been compromised

Compromised SSH credentials would result in login events visible in auth logs via the SSH daemon itself, not evidence of a separate backdoor channel.

CAn attacker uploaded a malicious python library to a well-known repository

Uploading a malicious library to a public repository is a supply chain attack and would not directly explain a compromise of a specific SSH server.

DAn attacker accessed the system through a backdoor using netcatCorrect

Netcat (nc) is a well-known utility that attackers use to create persistent backdoors by binding a shell to a listening port, allowing remote command execution without using the SSH service itself. After compromising an SSH server, attackers frequently install a netcat listener as a secondary access method. This explains why the intrusion persists even if SSH credentials are reset.

Concept tested: Netcat backdoor persistence after SSH compromise

Source: https://attack.mitre.org/techniques/T1059/004/

Topics

#SSH compromise#netcat backdoor#incident analysis#backdoor detection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIH Practice