A penetration tester gains access to a system and is able to migrate to a user process: Given the output above, which of the following actions is the penetration tester performing? (Choose two.)

Question

Options

• ARedirecting output from a file to a remote system
• BBuilding a scheduled task for execution
• CMapping a share to a remote system
• DExecuting a file on the remote system
• ECreating a new process on all domain systems
• FSetting up a reverse shell from a remote system
• GAdding an additional IP address on the compromised system

• A
  10% (4)
• B
  5% (2)
• C
  79% (31)
• E
  3% (1)
• F
  3% (1)

Explanation

After migrating into a user process, the penetration tester is performing lateral movement using two complementary steps: (C) Mapping a share to a remote system - typically using a command like 'net use' to connect a network drive to a remote host, establishing a file-system bridge; and (D) Executing a file on the remote system - once the share is mapped, the tester can copy and run an executable (e.g., a payload or tool) on the remote machine. Together, these represent a classic pivot technique: mount a remote share, drop a file, and execute it. The other options describe different attack primitives that do not match the described user-process migration context.

No community discussion yet for this question.