Certified Ethical Hacker CEH · Free Practice Question Hard
Question 50
Matt is conducting a penetration test against Dion Training's network. This engagement aims to simulate an advanced persistent threat and demonstrate persistence for 30 days without their system administrators identifying the intrusion. Matt enters the following command into the terminal:
-=-=-=-=-=-=-
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v beacon /d C: \Windows\Temp\beacon.bat
-=-=-=-=-=-=-
Which of the following types of persistence is Matt trying to utilize?
- A Services
- B Scheduled task
- C Registry startup
- D PS remoting
Reveal correct answer
Correct answer: C
Explanation
OBJ-3.2: A penetration tester can use the "reg add" command to cause a particular program or command to start every time the Windows machine is booted up. To achieve this, the penetration tester stores the program in the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry keys. The first one will cause the program to run whenever any user logs into the machine. The second will only cause the program to start when the victimized user logs in again.Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
You must be logged in to post a comment.
