Free Preparation Discussions
MENU
CompTIA Exam PT0-002 Topic 1 Question 53 Discussion
Topic #: 1
During an engagement, a penetration tester was able to upload to a server a PHP file with the following content:
Which of the following commands should the penetration tester run to successfully achieve RCE?
The PHP file uploaded by the penetration tester allows for Remote Code Execution (RCE) by executing the command supplied through the cmd POST parameter. To exploit this, the penetration tester needs to send a POST request to the PHP file with the command they want to execute.
Among the given options, Option A is the most suitable for achieving RCE:
It uses Python's requests library to send a POST request, which is appropriate because the PHP script expects data through the POST method.
The data parameter in the requests.post function is correctly formatted as a dictionary, which is the expected format for sending form data in POST requests. It includes the key cmd with the value id, which is a common command used to display the current user ID and group ID.
The only minor issue with Option A is that it prints the entire response object, which includes not just the response content but also metadata like status code and headers. To print just the response content (which would include the output of the id command), appending .text to the requests.post call would be more precise, but this is a small detail and does not affect the execution of the command.
The other options have various issues:
Option B is close but has a syntax error in the data argument. It uses parentheses () instead of curly braces {} for the dictionary, and also lacks the .text at the end to print the response content.
Options C and D use the requests.get method, which is not suitable in this scenario because the PHP script is expecting data through the POST method, not the GET method. Additionally, Option D has a syntax error similar to Option B.
Nguyet
10 months agoMarla
10 months agoMila
10 months agoNida
10 months agoCatalina
10 months agoSerina
11 months agoVeda
11 months agoMargart
11 months agoCiara
11 months agoNickie
11 months agoShelton
11 months agoErnie
11 months agoSylvie
1 years agoRenato
10 months agoJeffrey
10 months agoCristal
11 months agoJackie
1 years agoJustine
1 years agoBrittni
1 years agoTheron
1 years agoAhmed
1 years agoWillie
1 years agoAlaine
11 months agoLorean
12 months agoOwen
12 months agoSage
12 months agoRosita
12 months agoAnisha
12 months agoShantay
12 months agoAmber
1 years agoAlesia
1 years agoBernardo
1 years ago