CS0-003 Question 88

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose B1

  Im thinking B

• 9

  ased on the provided output: /etc/passwd: The http account has a /bin/bash shell assigned instead of the usual /usr/bin/nologin or /bin/false. This suggests that the adversary has potentially modified the http service account to allow for command execution, which typically wouldn't be possible with a service account. /var/log/httpd: The logs indicate an error related to parsing a request and references a suspicious URL (http://grohl.ve.da/tmp/brkgtr.zip). This suggests that the adversary attempted to exploit a vulnerability in the web application (likely a file upload or remote code execution vulnerability) to download and potentially execute a malicious file. Given this information: The adversary is most likely trying to execute commands through an unsecured service account (B). The modification of the http account to use /bin/bash indicates an attempt to gain shell access using that account, which could be leveraged for further exploitation. The log entries also suggest an attempt to download and possibly execute malicious files through the compromised web server.

• Chose B5

  It is B, There is no indication in the provided logs or user account information that a backdoor root account named zsh is being created. The /etc/passwd file does not show a user with such a name or hint towards such an action. This option seems less likely based on the information given. Normally, service accounts like http (associated with the HTTP service) should have minimal permissions and use restrictive shells like /usr/bin/nologin. The presence of a shell like /bin/bash may allow an attacker to execute commands if they manage to exploit the service.