312-50 Question 267
Single answer▪ Evading FirewallsDuring an authorized internal assessment, you discover that a perimeter firewall blocks inbound connections to most ports but allows outbound web traffic from internal systems through an HTTP proxy. You need to determine whether an externally controlled host can receive a reverse shell from a compromised internal workstation without being blocked by the firewall. Which approach is the most appropriate to test this firewall evasion path while blending with permitted traffic?
- A
Configure the payload to use a reverse HTTPS connection over TCP 443 and, if needed, route it through the organization’s allowed proxy settings
- B
Use a bind shell on the internal workstation listening on TCP 4444 so the external host can connect directly inbound through the firewall
- C
Send oversized ICMP echo requests with embedded commands because ICMP is always permitted through enterprise firewalls
- D
Use a reverse TCP shell over port 21 because FTP control traffic is commonly prioritized and less likely to be inspected
Show answer and explanation
Correct answer: A
Explanation
The key to this scenario is understanding egress-based firewall evasion in a realistic enterprise network. When inbound connections are blocked but outbound web traffic is allowed, a reverse shell that uses HTTPS on TCP 443 is the most plausible method for testing whether an attacker could communicate externally over approved channels. This is especially relevant when organizations permit outbound traffic only through a proxy; in such cases, proxy-aware tooling or payload configuration becomes important. From a defensive perspective, this is why best practices emphasize strict egress filtering, authenticated proxying, TLS inspection where legally and operationally appropriate, and anomaly detection based on destination, process behavior, and protocol conformity rather than port number alone. This aligns with common security guidance such as NIST recommendations on boundary protection and egress traffic control, as well as the general principle that allowed ports should not be assumed safe without validating the actual application protocol and destination behavior.
- A. Correct.
Correct. If outbound HTTPS traffic is allowed, a reverse HTTPS connection over TCP 443 is a practical and realistic firewall evasion technique because it aligns with traffic commonly permitted by perimeter controls. In environments that require web access through an HTTP/HTTPS proxy, malware simulation or red-team tooling may need to honor proxy settings or use proxy-aware communication. This approach tests whether egress filtering and proxy controls can be bypassed using allowed channels rather than attempting blocked inbound access.
- B. Incorrect.
Incorrect. A bind shell requires the attacker to initiate an inbound connection from the external host to the compromised internal system. In the scenario, inbound connections to most ports are blocked by the perimeter firewall, so this approach is unlikely to succeed and does not match the stated objective of using an allowed outbound path.
- C. Incorrect.
Incorrect. ICMP is not always allowed through enterprise firewalls, and relying on that assumption is a common misconception. Even when ICMP is permitted for limited diagnostic purposes, using it for command tunneling is noisy, often anomalous, and less likely to blend with the explicitly allowed web/proxy traffic described in the scenario.
- D. Incorrect.
Incorrect. Using a reverse shell over port 21 is not the most appropriate choice here. Port 21 is associated with FTP control traffic, which is commonly restricted, monitored, or handled by application-aware firewalls. Simply choosing a well-known port does not make traffic blend in if the protocol does not match expected behavior. In contrast, HTTPS over 443 aligns better with the permitted outbound web traffic in the scenario.