Certified Ethical Hacker (CEH) — Question 17

A network administrator discovers several unknown files in the root directory of his Linux FTP server. One of the files is a tarball, two are shell script files, and the third is a binary file is named "nc." The FTP server's access logs show that the anonymous user account logged in to the server, uploaded the files, and extracted the contents of the tarball and ran the script using a function provided by the FTP server's software. The ps command shows that the nc file is running as process, and the netstat command shows the nc process is listening on a network port.
What kind of vulnerability must be present to make this remote attack possible?

Answer options

• A. File system permissions
• B. Privilege escalation
• C. Directory traversal
• D. Brute force login A

Correct answer:

Explanation

The correct answer is A. File system permissions must have been misconfigured to allow an anonymous user to upload and execute files on the server. B, privilege escalation, is incorrect because the attacker did not need to elevate privileges; they exploited existing permissions. C, directory traversal, is not applicable here as it pertains to accessing restricted directories, and D, brute force login, is irrelevant since the access was granted to an anonymous user.