In an unpatched IIS web server, a path traversal exploit to cmd.exe could result in which outcome?

In an unpatched IIS web server, a path traversal exploit to cmd.exe could result in which outcome?

• A. Directory listing of C: drive on the web server
• B. Execute a buffer overflow in the C: drive of the web server
• C. Directory listing of the C:\windows\system32 folder on the web server
• D. Insert a Trojan horse into the C: drive of the web server

Answer: (A)

Path traversal flaws happen when user input that selects a file path isn’t properly checked, letting an attacker navigate up and across the server’s filesystem (for example, using …/ or ..\ sequences) and access files outside the intended directory. On an unpatched IIS web server, if an attacker can trigger a response that reaches cmd.exe through such a flaw, the server may end up exposing the contents of directories on the host—for instance, listing the C: drive. This exposure arises because the web server is returning directory information or file names from a location the attacker is not supposed to see, rather than enforcing strict access controls. So, the most plausible outcome is that the attacker could obtain a directory listing of the C: drive on the web server, which gives them visibility into the filesystem and potential targets. The other options describe more specific or require additional conditions (like write access or a specific memory vulnerability) that aren’t inherent to a basic path traversal issue.

Path traversal flaws happen when user input that selects a file path isn’t properly checked, letting an attacker navigate up and across the server’s filesystem (for example, using …/ or ..\ sequences) and access files outside the intended directory. On an unpatched IIS web server, if an attacker can trigger a response that reaches cmd.exe through such a flaw, the server may end up exposing the contents of directories on the host—for instance, listing the C: drive. This exposure arises because the web server is returning directory information or file names from a location the attacker is not supposed to see, rather than enforcing strict access controls.

So, the most plausible outcome is that the attacker could obtain a directory listing of the C: drive on the web server, which gives them visibility into the filesystem and potential targets. The other options describe more specific or require additional conditions (like write access or a specific memory vulnerability) that aren’t inherent to a basic path traversal issue.