A penetration tester has obtained root access to a Linux-based file server and would like to maintain persistence after reboot. Which of the following techniques would BEST support this objective?

The correct answer is A. Create a one-shot systemd service to establish a reverse shell. systemd is the init system on most modern Linux distributions and manages services that start at boot. By creating a malicious systemd service unit configured to start automatically, the reverse shell will re-establish itself every time the system reboots, providing persistent…

Post-exploitation and lateral movement

Question

Options

ACreate a one-shot systemd service to establish a reverse shell.
BObtain /etc/shadow and brute force the root password.
CRun the nc -e /bin/sh <...> command.
DMove laterally to create a user account on LDAP

How the community answered

(25 responses)

A
80% (20)
B
4% (1)
C
4% (1)
D
12% (3)

Explanation

systemd is the init system on most modern Linux distributions and manages services that start at boot. By creating a malicious systemd service unit configured to start automatically, the reverse shell will re-establish itself every time the system reboots, providing persistent access. Running 'nc -e /bin/sh' (option C) only works for the current session and is lost after reboot. Brute forcing /etc/shadow (option B) is about credential theft, not persistence. Lateral movement to LDAP (option D) does not ensure local persistence on the compromised server.

Topics

#Persistence#Linux Post-exploitation#Systemd#Reverse Shell

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice