312-50 Question 137
Single answer▪ Vulnerability ExploitationDuring an authorized internal assessment, you identify a Linux web server running a vulnerable version of Apache Struts 2 that is known to allow remote command execution through crafted HTTP requests. The client has asked you to verify exploitability while minimizing operational risk and avoiding unnecessary changes to the target. What is the MOST appropriate next step?
- A
Launch the exploit in Metasploit using a reverse TCP Meterpreter payload to immediately gain an interactive shell
- B
Use a safe proof-of-concept request that executes a harmless command such as 'id' or 'whoami' and capture the response as evidence
- C
Run a denial-of-service test against the application to prove the vulnerability can impact availability
- D
Upload a persistent web shell to the server so you can demonstrate post-exploitation access later
Show answer and explanation
Correct answer: B
Explanation
For vulnerability exploitation in a CEH-style scenario, the best practice is to validate the finding using the least intrusive method that still proves real-world impact. When assessing an RCE issue such as historical Apache Struts 2 command injection flaws, a controlled proof-of-concept that runs a benign command is typically sufficient to confirm exploitability. This aligns with common penetration testing methodology: verify the issue, collect evidence, minimize impact, and stay within the rules of engagement. More invasive actions such as deploying Meterpreter, installing web shells, or performing DoS testing should only be used when specifically required and authorized. This approach is consistent with professional guidance from penetration testing standards and vendor documentation emphasizing safe validation, evidence collection, and change minimization during exploitation.
- A. Incorrect.
This is not the most appropriate next step when the goal is to verify exploitability with minimal operational risk. A reverse TCP Meterpreter payload is far more invasive than necessary, may trigger endpoint controls, creates a live session on the target, and increases the chance of service disruption. In a professional assessment, the least invasive method that proves the finding is preferred unless the rules of engagement explicitly require a full compromise demonstration.
- B. Correct.
This is correct. Executing a harmless command such as 'id' or 'whoami' through a carefully crafted proof-of-concept request is a common and low-impact way to validate remote command execution. It demonstrates that the vulnerability is exploitable while minimizing changes to the system and reducing the risk of destabilizing the application. Capturing the HTTP request and response provides defensible evidence for the report.
- C. Incorrect.
This is incorrect because a denial-of-service test validates availability impact, not remote code execution in a controlled manner. It also introduces unnecessary operational risk and may violate engagement constraints unless explicitly authorized. Proving exploitability for an RCE issue should focus on safe command execution rather than disruptive testing.
- D. Incorrect.
This is incorrect because uploading a persistent web shell unnecessarily alters the target, increases the security impact of the test, and may leave artifacts that require cleanup. It goes beyond what is needed to confirm exploitability and is inconsistent with standard ethical hacking practice when a non-persistent, low-impact validation method is sufficient.