Which tool is commonly used as a post-exploitation payload enabling command execution and log wiping?

• A. Bash
• B. Cipher.exe
• C. Meterpreter shell
• D. fsutil

Answer: (C)

Post-exploitation payloads are built to give an attacker ongoing control after a system has been compromised. They typically provide a remote command interface, in-memory operation for stealth, and a suite of post-compromise capabilities that can include manipulating logs to cover tracks.

Meterpreter is a standout in this area. It’s a post-exploitation payload from Metasploit that runs in memory and delivers an interactive session with a full set of commands to control the host. It can execute OS commands directly and also access and modify system artifacts, including clearing event logs, which is a common technique used to obscure activity. This combination of remote command execution and built-in log-wiping capability fits the scenario described.

Bash is simply a command shell and isn’t a post-exploitation payload with integrated log-clearing features. Cipher.exe is a file-encryption utility, not a payload designed for post-exploitation. fsutil is a Windows file-system utility and not a payload for maintaining or hiding a foothold.

So, the Meterpreter shell is the best fit for a post-exploitation payload that enables command execution and log wiping.