A penetration tester has obtained shell access to a Windows host and wants to run a specially crafted binary for later execution using the wmic.exe process call create function.
Which of the following OS or filesystem mechanisms is MOST likely to support this objective?
Click on the arrows to vote for the correct answer
A. B. C. D.D.
https://www.varonis.com/blog/wmi-windows-management-instrumentation/The correct answer is D. PsExec.
Explanation:
The penetration tester wants to run a specially crafted binary for later execution using the wmic.exe process call create function. In this context, PsExec is the most appropriate tool for the job as it allows for running processes on remote systems, and since the tester has shell access to the Windows host, it would be relatively easy to use PsExec to execute the binary remotely.
A. Alternate data streams: Alternate data streams are a feature of the NTFS file system that allows for attaching data to a file without changing its content. However, it is unlikely that alternate data streams would be useful in this situation since the tester needs to execute a binary, not attach data to a file.
B. PowerShell modules: PowerShell is a scripting language developed by Microsoft, and it comes with several built-in modules for system administration. Although PowerShell can be used to execute binaries, it is unlikely that this would be the most efficient way to achieve the tester's objectives.
C. MP4 steganography: Steganography is the practice of hiding data within other data (such as images, audio files, or videos). Although it is technically possible to hide a binary within an MP4 file using steganography, it is unlikely that this approach would be practical in this situation since the tester needs to execute the binary, not hide it.
D. PsExec: PsExec is a command-line tool developed by Sysinternals (now owned by Microsoft) that allows for running processes on remote systems. Since the tester has shell access to the Windows host, it would be relatively easy to use PsExec to execute the binary remotely.
In conclusion, the most appropriate tool for the job would be PsExec, which allows for running processes on remote systems.