nerdexam
GIAC

GPEN · Question #393

A penetration tester obtains telnet access to a target machine using a captured credential. While trying to transfer her exploit to the target machine, the network intrusion detection systems keeps…

The correct answer is D. Use the ftp service in passive mode to push the file onto the target machine. Transferring exploit source code via FTP passive mode and compiling it on the target machine evades NIDS signature detection by using dynamic high-numbered data ports and avoiding binary exploit patterns in transit.

Exploitation & Post-Exploitation Techniques

Question

A penetration tester obtains telnet access to a target machine using a captured credential. While trying to transfer her exploit to the target machine, the network intrusion detection systems keeps detecting her exploit and terminating her connection. Which of the following actions will help the penetration tester transfer an exploit and compile it in the target system?

Options

  • AUse the http service's PUT command to push the file onto the target machine.
  • BUse the scp service, protocol SSHv2 to pull the file onto the target machine.
  • CUse the telnet service's ECHO option to pull the file onto the target machine
  • DUse the ftp service in passive mode to push the file onto the target machine.

How the community answered

(40 responses)
  • A
    15% (6)
  • B
    5% (2)
  • C
    8% (3)
  • D
    73% (29)

Why each option

Transferring exploit source code via FTP passive mode and compiling it on the target machine evades NIDS signature detection by using dynamic high-numbered data ports and avoiding binary exploit patterns in transit.

AUse the http service's PUT command to push the file onto the target machine.

HTTP PUT transmits the payload over a monitored channel on standard ports that the NIDS is already inspecting, and does not change the exploit's detectable content or delivery path.

BUse the scp service, protocol SSHv2 to pull the file onto the target machine.

SCP over SSHv2 encrypts the transfer and would hide payload content from the NIDS, but it requires an SSH server to be running on the target - unlikely given that access was gained only via telnet using a captured credential.

CUse the telnet service's ECHO option to pull the file onto the target machine

Telnet's ECHO option operates over the same existing telnet session the NIDS is already monitoring and terminating, so it provides no evasion of the detection mechanism that is disrupting the transfer.

DUse the ftp service in passive mode to push the file onto the target machine.Correct

FTP passive mode (PASV) instructs the server to open a random, high-numbered ephemeral port for the data connection, which NIDS rules targeting well-known ports or binary exploit signatures may not be configured to inspect. Sending source code rather than a compiled binary avoids triggering file-signature-based alerts, and compiling on the target produces a functional executable without ever transferring a detectable binary payload across the monitored network.

Concept tested: FTP passive mode NIDS evasion during exploit transfer

Source: https://www.rfc-editor.org/rfc/rfc959

Topics

#IDS evasion#file transfer#FTP passive mode#exploit delivery

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GPEN Practice