nerdexam
GIAC

GSEC · Question #68

You are doing some analysis of malware on a Unix computer in a closed test network. The IP address of the computer is 192.168.1.120. From a packet capture, you see the malware is attempting to do a…

The correct answer is B. You modify the HOSTS file on the Unix computer your malware is running on and add an entry. To redirect a malware DNS lookup without a DNS server, you add an entry to the HOSTS file on the machine where the malware is running, since name resolution is performed locally by the requesting host.

Windows and Malware

Question

You are doing some analysis of malware on a Unix computer in a closed test network. The IP address of the computer is 192.168.1.120. From a packet capture, you see the malware is attempting to do a DNS query for a server called iamabadserver.com so that it can connect to it. There is no DNS server on the test network to do name resolution. You have another computer, whose IP is 192.168.1.115, available on the test network that you would like for the malware connect to it instead. How do you get the malware to connect to that computer on the test network?

Options

  • AYou modify the HOSTS file on the computer you want the malware to connect to and add an entry
  • BYou modify the HOSTS file on the Unix computer your malware is running on and add an entry
  • CYou modify the HOSTS file on the Unix computer your malware is running on and add an entry
  • DYou modify the HOSTS file on the computer you want the malware to connect to and add an entry

How the community answered

(30 responses)
  • A
    7% (2)
  • B
    70% (21)
  • C
    20% (6)
  • D
    3% (1)

Why each option

To redirect a malware DNS lookup without a DNS server, you add an entry to the HOSTS file on the machine where the malware is running, since name resolution is performed locally by the requesting host.

AYou modify the HOSTS file on the computer you want the malware to connect to and add an entry

Modifying the HOSTS file on the destination machine (192.168.1.115) has no effect on name resolution because DNS lookups are performed by the requesting host, not the server being contacted.

BYou modify the HOSTS file on the Unix computer your malware is running on and add an entryCorrect

The operating system checks the local HOSTS file before sending any DNS query to an external resolver. By adding the entry 'iamabadserver.com 192.168.1.115' to /etc/hosts on the Unix machine running the malware, the malware's DNS lookup will resolve to the controlled test machine at 192.168.1.115 without requiring a DNS server on the test network.

CYou modify the HOSTS file on the Unix computer your malware is running on and add an entry

This choice is functionally identical to choice A - editing the HOSTS file on the target machine does not influence how the malware's host resolves domain names.

DYou modify the HOSTS file on the computer you want the malware to connect to and add an entry

As with choice A, modifying the HOSTS file on the destination machine cannot redirect name resolution performed by a different host on the network.

Concept tested: HOSTS file DNS override for malware sandbox redirection

Source: https://man7.org/linux/man-pages/man5/hosts.5.html

Topics

#HOSTS file#DNS resolution#malware analysis#network redirection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSEC Practice