A penetration tester was able to gain access to a system using an exploit. The following is a snippet of the code that was utilized: Which of the following commands should the penetration tester run p

The correct answer is B. rm -rf /tmp/apache. Post-engagement cleanup requires removing all artifacts, tools, and payloads left on target systems. The exploit placed a file at /tmp/apache, and 'rm -rf /tmp/apache' permanently deletes it, restoring the system to its pre-engagement state. This is an ethical and contractual obl

Post-exploitation and lateral movement

Question

A penetration tester was able to gain access to a system using an exploit. The following is a snippet of the code that was utilized:

Which of the following commands should the penetration tester run post-engagement?

Exhibit

Options

Agrep -v apache ~/.bash_history > ~/.bash_history
Brm -rf /tmp/apache
Cchmod 600 /tmp/apache
Dtaskkill /IM "apache" /F

How the community answered

(31 responses)

A
10% (3)
B
84% (26)
C
3% (1)
D
3% (1)

Explanation

Post-engagement cleanup requires removing all artifacts, tools, and payloads left on target systems. The exploit placed a file at /tmp/apache, and 'rm -rf /tmp/apache' permanently deletes it, restoring the system to its pre-engagement state. This is an ethical and contractual obligation. Option A attempts bash history manipulation but the redirection syntax ('> ~/.bash_history' while reading it) would zero out the file - incorrect technique and scope. Option C (chmod 600) only restricts permissions, leaving the artifact in place. Option D (taskkill) is a Windows command; the /tmp/ path confirms a Linux target, making it invalid.

Topics

#Post-exploitation cleanup#Temporary file management#Ethical hacking#Command-line utilities

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice