PT0-001 · Question #87
A penetration tester has successfully exploited an application vulnerability and wants to remove the command history from the Linux session. Which of the following will accomplish this successfully?
The correct answer is D. history -c. The bash built-in command 'history -c' clears the in-memory command history list for the active session, preventing those commands from being persisted to the history file on exit.
Question
A penetration tester has successfully exploited an application vulnerability and wants to remove the command history from the Linux session. Which of the following will accomplish this successfully?
Options
- Ahistory --remove
- Bcat history I clear
- Crm -f ./history
- Dhistory -c
How the community answered
(25 responses)- B8% (2)
- C4% (1)
- D88% (22)
Why each option
The bash built-in command 'history -c' clears the in-memory command history list for the active session, preventing those commands from being persisted to the history file on exit.
'history --remove' is not a valid flag for the bash history built-in; no such option exists in the bash manual.
'cat history | clear' is a nonsensical command - 'clear' redraws the terminal screen and does not accept piped input or interact with shell history in any way.
'rm -f ./history' attempts to delete a file named 'history' in the current working directory, which is not the bash history file; the actual history file is located at ~/.bash_history.
The '-c' flag for the bash 'history' built-in clears all entries from the current session's in-memory history list. Because bash writes history to ~/.bash_history only when the session exits, clearing it in-memory with 'history -c' ensures no commands from the session are saved, effectively covering the attacker's tracks for that session.
Concept tested: Linux bash history clearing for session anti-forensics
Source: https://www.gnu.org/software/bash/manual/html_node/Bash-History-Builtins.html
Topics
Community Discussion
No community discussion yet for this question.