PT0-002 · Question #257
A penetration tester exploited a vulnerability on a server and remotely ran a payload to gain a shell. However, a connection was not established, and no errors were shown on the payload execution…
The correct answer is A. windows/x64/meterpreter/reverse_tcp. A reverse tcp connection is usually used to bypass firewall restrictions on open ports. A firewall usually blocks incoming connections on open ports, but does not block outgoing traffic. windows/meterpreter/reverse_tcp allows you to remotely control the file system, sniff…
Question
A penetration tester exploited a vulnerability on a server and remotely ran a payload to gain a shell. However, a connection was not established, and no errors were shown on the payload execution. The penetration tester suspected that a network device, like an IPS or next-generation firewall, was dropping the connection. Which of the following payloads are MOST likely to establish a shell successfully?
Options
- Awindows/x64/meterpreter/reverse_tcp
- Bwindows/x64/meterpreter/reverse_http
- Cwindows/x64/shell_reverse_tcp
- Dwindows/x64/powershell_reverse_tcp
- Ewindows/x64/meterpreter/reverse_https
How the community answered
(34 responses)- A59% (20)
- B21% (7)
- C12% (4)
- D6% (2)
- E3% (1)
Explanation
A reverse tcp connection is usually used to bypass firewall restrictions on open ports. A firewall usually blocks incoming connections on open ports, but does not block outgoing traffic. windows/meterpreter/reverse_tcp allows you to remotely control the file system, sniff, keylog, hashdump, perform network pivoting, control the webcam and microphone, etc.
Topics
Community Discussion
No community discussion yet for this question.