PT0-003: CompTIA PenTest+Demo

Question

A penetration tester discovers an unauthenticated RCE vulnerability on a web server and wants to use it to enumerate other servers on the local network. The web server is behind a firewall that permits only incoming connections to TCP ports 443 and 53, with unrestricted outbound TCP connections. The target web server is https://target.comptia.org. Which of the following should the tester use to accomplish the task with the fewest web requests?

A nc -e /bin/sh -lp 53
B /bin/sh -c 'nc -l -p 443'
C nc -e /bin/sh 53
D /bin/sh -c 'nc 443'

Explanation

A bind shell listening on TCP port 53 permits an inbound connection through the firewall and supplies an interactive /bin/sh session. The tester can use that session to enumerate the local network after a single RCE request.

PT0-003: CompTIA PenTest+Demo

AstroTutor

Notes

Readiness

QuestionQ132

Community Discussion