Which of the following is the reason why a penetration tester would run the chkconfig --del servicename command at the end of an engagement?

The correct answer is A. To remove the persistence. The chkconfig --del servicename command removes a service from the system's startup configuration on Linux systems. During a penetration test, testers often install malicious or backdoor services as persistence mechanisms - ensuring they survive reboots. At the end of an…

Post-exploitation and lateral movement

Question

Options

ATo remove the persistence
BTo enable penitence
CTo report persistence
DTo check for persistence

How the community answered

(55 responses)

A
89% (49)
B
2% (1)
C
2% (1)
D
7% (4)

Explanation

The chkconfig --del servicename command removes a service from the system's startup configuration on Linux systems. During a penetration test, testers often install malicious or backdoor services as persistence mechanisms - ensuring they survive reboots. At the end of an engagement, thorough cleanup is required. Running chkconfig --del removes that service from startup, effectively eliminating the persistence the tester established. This is part of responsible post-engagement remediation to leave the system in its original state.

Topics

#persistence removal#Linux services#chkconfig#post-exploitation cleanup

Community Discussion

No community discussion yet for this question.

Full PT0-001 Practice