nerdexam
CompTIA

PT0-002 · Question #190

A penetration tester is conducting a penetration test. The tester obtains a root-level shell on a Linux server and discovers the following data in a file named password.txt in the /home/svsacct…

The correct answer is A. echo U3VQZXIkM2NyZXQhCg== | base64 -d. The data 'U3VQZXIkM2NyZXQhCg==' is Base64 encoded, indicated by the trailing '=='. The base64 -d command on Linux is the correct utility to decode this string to its original plaintext.

Post-exploitation and lateral movement

Question

A penetration tester is conducting a penetration test. The tester obtains a root-level shell on a Linux server and discovers the following data in a file named password.txt in the /home/svsacct directory:

U3VQZXIkM2NyZXQhCg== Which of the following commands should the tester use NEXT to decode the contents of the file?

Options

  • Aecho U3VQZXIkM2NyZXQhCg== | base64 -d
  • Btar zxvf password.txt
  • Chydra -l svsacct -p U3VQZXIkM2NyZXQhCg== ssh://192.168.1.0/24
  • Djohn --wordlist /usr/share/seclists/rockyou.txt password.txt

How the community answered

(25 responses)
  • A
    88% (22)
  • B
    4% (1)
  • D
    8% (2)

Why each option

The data 'U3VQZXIkM2NyZXQhCg==' is Base64 encoded, indicated by the trailing '=='. The `base64 -d` command on Linux is the correct utility to decode this string to its original plaintext.

Aecho U3VQZXIkM2NyZXQhCg== | base64 -dCorrect

The string 'U3VQZXIkM2NyZXQhCg==' is a Base64 encoded string, commonly identified by the trailing '==' characters which are used for padding. The `echo` command prints the string, which is then piped to `base64 -d` (decode) to reveal its original plaintext content.

Btar zxvf password.txt

`tar` is a utility for archiving and extracting files, typically used for compressed file archives, not for decoding text strings like Base64.

Chydra -l svsacct -p U3VQZXIkM2NyZXQhCg== ssh://192.168.1.0/24

Hydra is a network logon cracker used for brute-forcing authentication; it is not designed to decode Base64 strings.

Djohn --wordlist /usr/share/seclists/rockyou.txt password.txt

John the Ripper is a password cracking tool that works with hashes, not directly with Base64 encoded strings which need to be decoded first to reveal potential plaintext passwords.

Concept tested: Base64 decoding, Linux command-line utilities

Source: https://www.gnu.org/software/coreutils/manual/html_node/base64-invocation.html

Topics

#Base64 encoding#Linux commands#Data decoding#Post-exploitation

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice