GSEC practice question 4 of 35

You are doing some analysis of malware on a Unix computer in a closed test network. The IP address of the computer is 192.168.1.120. From a packet…

Domain Linux: Security and Administration

You are doing some analysis of malware on a Unix computer in a closed test network. The IP address of the computer is 192.168.1.120. From a packet capture, you see the malware is attempting to do a DNS query for a server called iamabadserver.com so that it can connect to it. There is no DNS server on the test network to do name resolution. You have another computer, whose IP is 192.168.1.115, available on the test network that you would like for the malware connect to it instead. How do you get the malware to connect to that computer on the test network?

Answer options

A: You modify the HOSTS file on the computer you want the malware to connect to and add an entry that reads: 192.168.1.120 iamabadserver iamabadserver.com

B: You modify the HOSTS file on the Unix computer your malware is running on and add an entry that reads: 192.168.1.115 iamabadserveriamabadserver.com Correct answer

C: You modify the HOSTS file on the Unix computer your malware is running on and add an entry that reads: 192.168.1.120 iamabadserver iamabadserver.com

D: You modify the HOSTS file on the computer you want the malware to connect to and add an entry that reads: 192.168.1.115 iamabadserver iamabadserver.com

Correct Answer:

B. You modify the HOSTS file on the Unix computer your malware is running on and add an entry that reads: 192.168.1.115 iamabadserveriamabadserver.com

Explanation

The name resolution process on a Unix system first checks the local /etc/hosts file before querying a DNS server. The goal is to make the malware running on the infected computer (192.168.1.120) connect to the analysis computer (192.168.1.115). To achieve this, the hosts file on the infected machine must be modified. An entry must be added that maps the hostname the malware is trying to resolve (iamabadserver.com) to the IP address of the desired destination (192.168.1.115). This redirects the malware's network traffic to the controlled analysis machine, a common technique in dynamic malware analysis.

Why Incorrect

A. Modifying the hosts file on the destination computer has no effect on the name resolution process occurring on the source (infected) computer.
C. This entry modifies the correct file but redirects the malware to connect to itself (192.168.1.120), not the intended analysis computer.
D. The name resolution is performed by the client initiating the connection (the infected machine), not the machine it is intended to connect to.

References

1. Red Hat Enterprise Linux 8 Documentation

"Configuring host names"

Section 3.2

"Configuring static host names using the /etc/hosts file": This official documentation specifies that the /etc/hosts file is used to map hostnames to IP addresses on a local machine

particularly in the absence of a DNS server. It confirms the format IP-address canonical-hostname [aliases...] and its role in the name resolution process.

2. MIT OpenCourseWare

6.033 Computer System Engineering

Spring 2018

Recitation 10: Naming

Section 2

"Name Resolution": This university courseware explains the hierarchy of name resolution. It clarifies that a system will check local configuration files

such as /etc/hosts

for a mapping before attempting to contact an external DNS server. This principle is central to why modifying the local hosts file works.

3. Sikorski

& Honig

A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software. No Starch Press. (Referenced in numerous university curricula

e.g.

Carnegie Mellon University

Course 14-822): Chapter 16

"Malware-Focused Network Signatures

" and Chapter 19

"Analyzing Malicious Documents

" describe the technique of using the /etc/hosts file to redirect a malware's network communications to a local analysis machine to observe its behavior in a controlled environment.

Keep practicing

Take the free GSEC practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test