GPEN · Question #461
You have connected to a Windows system remotely and have shell access via netcat. While connected to the remote system you notice that some Windows commands work normally while others do not An exampl
The correct answer is D. TheNetcat listener is running with system level privileges.. A netcat shell running under the SYSTEM account lacks a standard user environment, causing user-context-dependent commands to fail while system-level commands succeed.
Question
You have connected to a Windows system remotely and have shell access via netcat. While connected to the remote system you notice that some Windows commands work normally while others do not An example of this is shown in the picture below Which of the following best describes why tins is happening?
Exhibit
Options
- ANetcat cannot properly interpret certain control characters or Unicode sequences.
- BThe listener executed command.com instead of cmd.exe.
- CAnother application is already running on the port Netcat is listening on.
- DTheNetcat listener is running with system level privileges.
How the community answered
(28 responses)- A4% (1)
- B11% (3)
- C11% (3)
- D75% (21)
Why each option
A netcat shell running under the SYSTEM account lacks a standard user environment, causing user-context-dependent commands to fail while system-level commands succeed.
Netcat does not inherently misinterpret control characters or Unicode sequences; the selective command failure is caused by account context and missing user environment, not a character encoding limitation.
While command.com lacks features of cmd.exe and can cause similar symptoms, the scenario specifically attributes partial command failure to the privilege level (SYSTEM) and its missing user environment context.
A port conflict would prevent the netcat connection from being established entirely and would not produce a functioning shell with selectively failing commands.
The Windows SYSTEM account does not have a loaded user profile, user-specific environment variables, or access to user-context resources such as HKCU registry hives and user temp directories. Commands that depend on those user-level resources fail in a SYSTEM-context shell, while built-in OS commands that operate independently of user context continue to function normally, producing the mixed behavior observed.
Concept tested: Netcat shell behavior under Windows SYSTEM account
Source: https://learn.microsoft.com/en-us/windows/win32/services/localsystem-account
Topics
Community Discussion
No community discussion yet for this question.
