Reverse Engineering, Fuzzing, and Binary Exploitation CPENT Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A tester discovers a use-after-free vulnerability in a web server's session management. The freed object is a structure containing a function pointer. The tester wants to gain code execution. Which exploitation technique is most appropriate?

   • AUsing a format string to write to the GOT
   • BOverwriting the return address on the stack with a ROP chain
   • CSimply calling free() twice on the same pointer
   • DHeap spraying to place a fake object with a controlled function pointer at the freed address
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the main advantage of dynamic analysis over static analysis when reverse engineering a binary?

   • AIt can recover the original source code exactly
   • BIt does not require the binary to be executable on the analysis system
   • CIt is faster than static analysis for large binaries
   • DIt reveals the actual runtime behavior, such as function calls and memory access patterns
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A researcher is developing an exploit for an ARM-based IoT device. The device has a non-executable stack and uses ASLR. The researcher wants to achieve code execution. Which approach is most appropriate?

   • AUse a ROP chain that calls mprotect() to make the stack executable, then jump to shellcode
   • BUse a format string to overwrite the return address with a fixed address
   • CInject ARM shellcode directly onto the stack and jump to it
   • DUse a ret2libc attack to call system() with a fixed address
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the purpose of crash triage in fuzzing?

   • ATo generate more fuzzing inputs based on the crash
   • BTo automatically fix all crashes found by the fuzzer
   • CTo determine the root cause and potential exploitability of each unique crash
   • DTo delete duplicate crashes to save disk space
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is a format string vulnerability?

   • AA bug where a program writes to a file in the wrong format
   • BA bug where a program uses the wrong format specifier for a variable type
   • CA bug where a program cannot parse a date format
   • DA bug where user input is passed as the format string to a function like printf, allowing memory reads or writes
   Reveal Solution Discussion Select an answer first