300-215 Question 99
Single answerYou are performing forensic analysis on a suspected malware file. You discover the following code snippet in the file:
system("rm -rf / --no-preserve-root");
Based on the code provided, what type of code does this represent?
- A
Command injection code
- B
Malicious shell command execution
- C
Harmless debugging script
- D
Obfuscated encryption code
Show answer and explanation
Correct answer: B
Explanation
The code snippet uses the system() function to execute a shell command (rm -rf / --no-preserve-root), which is designed to delete all files on a system without preserving the root directory. This behavior is characteristic of malicious shell command execution, often found in malware aimed at causing extensive damage.
- A. Incorrect.
This is incorrect because the code does not involve injecting commands into another application or service. It directly executes a shell command.
- B. Correct.
This is correct because the code executes a shell command (
rm -rf / --no-preserve-root), which is a destructive operation typically associated with malicious intent. - C. Incorrect.
This is incorrect because the provided code is not used for debugging. Instead, it is a destructive operation targeting the file system.
- D. Incorrect.
This is incorrect because the code does not involve encryption or obfuscation. It is a straightforward execution of a shell command.