During a red team exercise, a tester is analyzing a custom network service binary on a Linux host. The binary has ASLR and NX enabled. The tester has identified a stack-based buffer overflow that can overwrite the return address. However, the tester cannot inject shellcode onto the stack. The tester has found a series of useful gadgets in the binary's PLT and a libc library loaded at a randomized base. Which technique is most appropriate to achieve code execution?

Disable ASLR by writing to /proc/sys/kernel/randomize_va_space, then use a simple ret2libc attack.

Use a ROP chain to call mprotect() to make the stack executable, then jump to the shellcode placed on the stack.

Overwrite the return address with the address of a 'jmp esp' gadget in the binary's .text section to jump to shellcode on the stack.

Ret2libc: Overwrite the return address with the address of the 'system' function in libc, and set up the stack so it returns to 'system' with a pointer to '/bin/sh'.

A penetration tester is exploiting a buffer overflow in a 64-bit Linux binary. The binary is compiled with NX, ASLR, and stack canaries. The tester has a way to leak the canary and a libc address. The goal is to spawn a shell. Which technique is most appropriate?

Build a ROP chain that calls system('/bin/sh') using the leaked libc base

Overwrite the return address with a one-gadget in libc

Use a JOP (jump-oriented programming) chain

Use a ret2dl-resolve attack to resolve system() dynamically

Why do IoT devices often lack common exploit mitigations like ASLR and DEP?

Because these mitigations are not effective on ARM processors

Because they often run on low-power processors and use older or stripped-down operating systems without these protections

Because vendors intentionally disable them for performance

Because IoT devices are not connected to the internet

EC-CouncilCertified Penetration Testing Professional

Domain 6Objective 1

Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 11)

Part of the Advanced Exploitation and IoT domain, which makes up ~17% of our current practice bank.

59questions here

12free pages

16concepts

16 Concepts in This Objective

Reverse Engineering Fundamentals
Static Analysis Techniques
Dynamic Analysis Techniques
Disassembly and Decompilation
Binary File Formats
Fuzzing Fundamentals
Fuzzing Tools and Frameworks
Coverage-Guided Fuzzing
Crash Analysis and Triage
Binary Exploitation Basics
Shellcode Development
Exploit Mitigation Bypass
Return-Oriented Programming (ROP)
Heap Exploitation Techniques
Writing Exploits for IoT Devices
Firmware Analysis and Emulation

Questions 51–55

51foundation · easy
Which tool is commonly used for dynamic analysis of a binary by setting breakpoints and stepping through code?
Select an answer first
52foundation · easy
Which fuzzing tool is known for its coverage-guided approach and is widely used for fuzzing file parsers?
Select an answer first
53expert · hard
During a red team exercise, a tester is analyzing a custom network service binary on a Linux host. The binary has ASLR and NX enabled. The tester has identified a stack-based buffer overflow that can overwrite the return address. However, the tester cannot inject shellcode onto the stack. The tester has found a series of useful gadgets in the binary's PLT and a libc library loaded at a randomized base. Which technique is most appropriate to achieve code execution?
Select an answer first
54expert · hard
A penetration tester is exploiting a buffer overflow in a 64-bit Linux binary. The binary is compiled with NX, ASLR, and stack canaries. The tester has a way to leak the canary and a libc address. The goal is to spawn a shell. Which technique is most appropriate?
Select an answer first
55foundation · easy
Why do IoT devices often lack common exploit mitigations like ASLR and DEP?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CPENT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CPENT” is a trademark of its owner, used for identification only.

Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 11)

Questions 51–55

Which tool is commonly used for dynamic analysis of a binary by setting breakpoints and stepping through code?

Which fuzzing tool is known for its coverage-guided approach and is widely used for fuzzing file parsers?

A penetration tester is exploiting a buffer overflow in a 64-bit Linux binary. The binary is compiled with NX, ASLR, and stack canaries. The tester has a way to leak the canary and a libc address. The goal is to spawn a shell. Which technique is most appropriate?

Why do IoT devices often lack common exploit mitigations like ASLR and DEP?

Keep studying — Advanced Exploitation and IoT