Gaining Access, Maintaining Access, and Covering Tracks EHE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An attacker compromised a Linux server via a vulnerable web application and wants to maintain access without creating new user accounts or modifying system binaries that might trigger integrity checks. Which approach best meets these constraints?

   • AReplace `/bin/login` with a backdoored version that accepts a secret password and delete the `/var/log/wtmp` file.
   • BInstall a userland rootkit that hooks the `ls` command to hide a directory and add a cron job that connects back to the attacker's server.
   • CDeploy a reverse shell as a systemd service that restarts on failure and use `LD_PRELOAD` to hide the service's process from `ps`.
   • DAdd the attacker's SSH public key to the root user's `authorized_keys` file and clear the `auth.log` entries.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An advanced persistent threat (APT) group has compromised a Linux server and needs to maintain access for a long-term operation. The group's C2 infrastructure is monitored by the target's security team, and the server has a host-based intrusion detection system (HIDS) that monitors file integrity and process lists. The group wants to avoid detection while ensuring the backdoor survives reboots and is not tied to a single C2 address. Which approach best meets these requirements?

   • AInstall a kernel rootkit that hides the backdoor process and use a domain generation algorithm (DGA) to resolve C2 addresses.
   • BCreate a systemd service that runs a reverse shell and use a fast-flux network to rotate C2 IP addresses.
   • CModify the `/etc/ld.so.preload` file to load a malicious library that hooks `readdir` and `getdents` to hide files, and use a peer-to-peer C2 network.
   • DUse a memory-only backdoor that is injected into a legitimate process and communicate via DNS tunneling to a fixed C2 domain.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An attacker has compromised a cloud-based Linux VM and wants to maintain access. The VM's security group only allows inbound SSH from a specific IP range. The attacker wants to ensure access even if the VM is rebooted and the SSH key is rotated. Which method is most resilient?

   • AUse a cron job to periodically change the SSH password to a known value.
   • BInstall a reverse shell that connects outbound to the attacker's server on a non-standard port.
   • CCreate a new user account and add an SSH key to the `authorized_keys` file.
   • DModify the security group to allow inbound SSH from any IP address.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which technique for gaining unauthorized access involves systematically trying many possible passwords against a single user account until the correct one is found?

   • ASession hijacking
   • BBrute-force attack
   • CPhishing
   • DSQL injection
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A penetration tester is assessing a company's web application and has discovered that the password reset function sends a reset link to the user's email without verifying the user's identity. The tester wants to gain access to a victim's account. Which technique is most appropriate?

   • AInstall a keylogger on the victim's machine to capture the new password.
   • BClear the web server logs to hide the password reset request.
   • CUse a Trojan horse to intercept the password reset email.
   • DExploit the password reset vulnerability to reset the victim's password and log in.
   Reveal Solution Discussion Select an answer first