PT0-003 · Question #248
A penetration tester gains access to a chrooted environment and runs service --status-all on a target host. The tester reviews the following output: [ + ] cron [ + ] dhcp [ - ] tomcat [ - ] xserver…
The correct answer is A. Validate write access to and add a reverse shell. The cron service is running ([ + ] cron), and the tester has access to the crontab command. If the tester can write to the crontab file, they can schedule a reverse shell or malicious script to execute periodically, making this the most effective and reliable method for…
Question
A penetration tester gains access to a chrooted environment and runs service --status-all on a target host. The tester reviews the following output:
[ + ] cron [ + ] dhcp [ - ] tomcat [ - ] xserver [ + ] ssh The only other commands that the tester can execute are ps, nc, tcpdump, and crontab. Which of the following is the best method to maintain persistence?
Options
- AValidate write access to and add a reverse shell.
- BCapture credentials to use with tcpdump.
- CScan the X11 server from the outside for unauthenticated connectivity.
- DCheck access to the tomcat default manager page and use an LFI payload.
How the community answered
(57 responses)- A67% (38)
- B9% (5)
- C19% (11)
- D5% (3)
Explanation
The cron service is running ([ + ] cron), and the tester has access to the crontab command. If the tester can write to the crontab file, they can schedule a reverse shell or malicious script to execute periodically, making this the most effective and reliable method for persistence in this constrained environment.
Topics
Community Discussion
No community discussion yet for this question.