nerdexam
CompTIA

PT0-001 · Question #87

A penetration tester has successfully exploited an application vulnerability and wants to remove the command history from the Linux session. Which of the following will accomplish this successfully?

The correct answer is D. history -c. The bash built-in command 'history -c' clears the in-memory command history list for the active session, preventing those commands from being persisted to the history file on exit.

Post-exploitation and lateral movement

Question

A penetration tester has successfully exploited an application vulnerability and wants to remove the command history from the Linux session. Which of the following will accomplish this successfully?

Options

  • Ahistory --remove
  • Bcat history I clear
  • Crm -f ./history
  • Dhistory -c

How the community answered

(25 responses)
  • B
    8% (2)
  • C
    4% (1)
  • D
    88% (22)

Why each option

The bash built-in command 'history -c' clears the in-memory command history list for the active session, preventing those commands from being persisted to the history file on exit.

Ahistory --remove

'history --remove' is not a valid flag for the bash history built-in; no such option exists in the bash manual.

Bcat history I clear

'cat history | clear' is a nonsensical command - 'clear' redraws the terminal screen and does not accept piped input or interact with shell history in any way.

Crm -f ./history

'rm -f ./history' attempts to delete a file named 'history' in the current working directory, which is not the bash history file; the actual history file is located at ~/.bash_history.

Dhistory -cCorrect

The '-c' flag for the bash 'history' built-in clears all entries from the current session's in-memory history list. Because bash writes history to ~/.bash_history only when the session exits, clearing it in-memory with 'history -c' ensures no commands from the session are saved, effectively covering the attacker's tracks for that session.

Concept tested: Linux bash history clearing for session anti-forensics

Source: https://www.gnu.org/software/bash/manual/html_node/Bash-History-Builtins.html

Topics

#command history#anti-forensics#Linux shell#evidence removal

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice