Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A fuzzing campaign on a network service produces hundreds of crashes. The tester wants to prioritize which crashes to analyze first for potential exploitability. Which approach is most appropriate?

   • AIgnore crashes that do not produce a core dump
   • BFocus on crashes that occur in the main function
   • CUse a tool like CrashWrangler or GDB to triage crashes and group them by root cause
   • DAnalyze every crash individually in a debugger
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security team wants to fuzz a command-line tool that parses configuration files. The tool is open-source and can be compiled with instrumentation. The team wants to maximize code coverage and find crashes efficiently. Which fuzzing framework is most appropriate?

   • AAFL with a seed corpus of valid configuration files
   • BlibFuzzer without any seed corpus
   • CPeach with a fixed mutation template
   • DA simple random byte generator
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A penetration tester is exploiting a buffer overflow in a Linux binary that has ASLR and stack canaries enabled. The tester has found a way to leak a canary value and a libc address. Which mitigation bypass technique is most appropriate?

   • AInject shellcode onto the stack and jump to it
   • BOverwrite the return address directly without the canary
   • CInclude the leaked canary in the payload and use a ROP chain to call system()
   • DUse a ret2libc attack with a fixed system() address
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A fuzzing campaign on a network daemon has produced a crash. The crash report shows a SIGSEGV in a function that processes a linked list. The tester suspects a use-after-free vulnerability. Which analysis step is most critical to confirm this hypothesis and distinguish it from a simple NULL pointer dereference?

   • AUse the 'file' command on the crashing input to verify it is a valid file for the daemon.
   • BRe-run the crashing input under Valgrind to check for invalid memory access and use-after-free errors.
   • CExamine the core dump with GDB and look at the value of the pointer that caused the crash.
   • DDisassemble the function that crashed and look for calls to free() and the subsequent use of the pointer.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A penetration tester is assessing an IoT device that runs an ARM-based firmware. The device has a web interface that is vulnerable to a buffer overflow in the HTTP header parsing. The firmware is protected by NX and ASLR, and the tester cannot easily obtain a libc leak. The device has a small memory footprint and no standard libc functions are directly reachable. Which exploitation strategy is most likely to succeed?

   • AUse a heap spray to place shellcode in the heap and jump to a fixed heap address
   • BInject ARM shellcode directly onto the stack and jump to it
   • CUse a ROP chain that calls mprotect() to make the stack executable, then jump to ARM shellcode
   • DUse a ret2libc attack to call system() with a fixed address
   Reveal Solution Discussion Select an answer first