A CentOS computer was exploited during a penetration test. During initial reconnaissance, the penetration tester discovered that port 25 was open on an internal Sendmail server. To remain stealthy…

The correct answer is C. nc 127.0.0.1 5555. Port 25 from the remote host is forwarded to local port 5555 (to IP: 10.10.1.2). So if you have forwarded the port to yourself, it means you can access it by connecting to 127.0.0.1 or 10.10.1.2. Next part of the pentester task is to determine what service is opened on 25 or…

Post-exploitation and lateral movement

Question

A CentOS computer was exploited during a penetration test. During initial reconnaissance, the penetration tester discovered that port 25 was open on an internal Sendmail server. To remain stealthy, the tester ran the following command from the attack machine:

Which of the following would be the BEST command to use for further progress into the targeted network?

Options

Anc 10.10.1.2
Bssh 10.10.1.2
Cnc 127.0.0.1 5555
Dssh 127.0.0.1 5555

How the community answered

(17 responses)

A
18% (3)
B
6% (1)
C
71% (12)
D
6% (1)

Explanation

Port 25 from the remote host is forwarded to local port 5555 (to IP: 10.10.1.2). So if you have forwarded the port to yourself, it means you can access it by connecting to 127.0.0.1 or 10.10.1.2. Next part of the pentester task is to determine what service is opened on 25 or what communication is sent on internal service. Quickest way to do this is to use netcat. A - port 5555 is not specified B - port 5555 is not specified, why would you ssh to smtp port with sendmail server? C - correct, netcat may be utilized to “progress into the targeted network” and test SMTP. D - if there is no ssh connection on port 25 it is useless as above in B. Syntax is wrong, to specify port on ssh you need to use -p.

Topics

#Netcat#Post-exploitation#Local Host Interaction#Stealth

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice