nerdexam
GIAC

GPEN · Question #465

You are pen testing a network and have shell access to a machine via Netcat. You try to use ssh to access another machine from the first machine. What is the expected result?

The correct answer is C. The ssh connection will succeed. A Netcat shell provides a fully functional interactive shell on the remote host, and SSH is an independent application that can be executed from within any shell regardless of how that shell was obtained.

Cloud & Pivoting Techniques

Question

You are pen testing a network and have shell access to a machine via Netcat. You try to use ssh to access another machine from the first machine. What is the expected result?

Options

  • AThe ssh connection will succeed If you have root access on the intermediate machine
  • BThe ssh connection will fail
  • CThe ssh connection will succeed
  • DThe ssh connection will succeed if no password required

How the community answered

(37 responses)
  • A
    3% (1)
  • B
    5% (2)
  • C
    76% (28)
  • D
    16% (6)

Why each option

A Netcat shell provides a fully functional interactive shell on the remote host, and SSH is an independent application that can be executed from within any shell regardless of how that shell was obtained.

AThe ssh connection will succeed If you have root access on the intermediate machine

Root access on the intermediate machine is not required to initiate an outbound SSH client connection; any user account with shell access can invoke the SSH binary.

BThe ssh connection will fail

There is no technical barrier preventing an SSH client invocation from within a Netcat shell, as both tools operate independently at the application layer.

CThe ssh connection will succeedCorrect

Netcat delivers a live shell session on the remote machine, giving the user the ability to execute any program installed on that host, including the SSH client binary. SSH authentication and network connectivity depend only on reachability of the next target and valid credentials, not on the mechanism used to establish the initial shell, so the SSH session proceeds as normal.

DThe ssh connection will succeed if no password required

SSH supports multiple authentication methods including passwords, so the absence of a passwordless configuration is not a prerequisite for a successful connection.

Concept tested: Initiating SSH lateral movement from a Netcat shell

Source: https://www.openssh.com/manual.html

Topics

#pivoting#SSH tunneling#lateral movement#Netcat

Community Discussion

No community discussion yet for this question.

Full GPEN Practice