A penetration tester gains access to a system and establishes persistence, and then runs the following commands: Which of the following actions is the tester MOST likely performing?

The correct answer is C. Covering tracks by clearing the Bash history. https://null-byte.wonderhowto.com/how-to/clear-logs-bash-history-hacked-linux-systems-cover- your-tracks-remain-undetected-0244768/

Post-exploitation and lateral movement

Question

A penetration tester gains access to a system and establishes persistence, and then runs the following commands:

Which of the following actions is the tester MOST likely performing?

Options

ARedirecting Bash history to /dev/null
BMaking a copy of the user's Bash history for further enumeration
CCovering tracks by clearing the Bash history
DMaking decoy files on the system to confuse incident responders

How the community answered

(27 responses)

A
19% (5)
B
4% (1)
C
70% (19)
D
7% (2)

Explanation

https://null-byte.wonderhowto.com/how-to/clear-logs-bash-history-hacked-linux-systems-cover- your-tracks-remain-undetected-0244768/

Topics

#Post-exploitation#Covering tracks#Bash history#Operational security

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice