During an assessment, a penetration tester found a suspicious script that could indicate a prior compromise. While reading the script, the penetration tester noticed the following lines of code…

The correct answer is D. Change the MAC address. This Python script uses the subprocess.call function to execute shell commands that first bring down the network interface eth0 (though it seems there's a typo with "etho0"), change its MAC address to "2a:33:41:56:21:34", and then bring the interface back up. The purpose of…

Post-exploitation and lateral movement

Question

During an assessment, a penetration tester found a suspicious script that could indicate a prior compromise. While reading the script, the penetration tester noticed the following lines of code:

Which of the following was the script author trying to do?

Options

ASpawn a local shell.
BDisable NIC.
CList processes.
DChange the MAC address.

How the community answered

(46 responses)

A
2% (1)
B
4% (2)
C
9% (4)
D
85% (39)

Explanation

This Python script uses the subprocess.call function to execute shell commands that first bring down the network interface eth0 (though it seems there's a typo with "etho0"), change its MAC address to "2a:33:41:56:21:34", and then bring the interface back up. The purpose of these actions is to change the MAC address of the network interface card (NIC) associated with eth0. Changing a MAC address can be used for various reasons, including bypassing MAC address filters or anonymizing the device on the network.

Topics

#MAC address spoofing#Post-exploitation#Evasion#Script analysis

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice