When NX is enabled, an attacker cannot directly execute shellcode placed on the stack. Which technique allows code execution by reusing existing instructions already present in executable memory?

Return-Oriented Programming (ROP)

A tester is exploiting a 64-bit binary with PIE and ASLR enabled. The tester has a buffer overflow that allows overwriting the saved return address. The tester has a single information leak that reveals the address of a function inside the binary. What is the most reliable way to bypass ASLR and PIE?

Overwrite the saved return address with the address of system() and place '/bin/sh' on the stack, relying on the fact that PIE does not randomize libc.

Compute the binary base from the leaked function address, then use a ROP chain with gadgets from the binary to call a libc function via the PLT.

Use a partial overwrite of the saved return address to redirect to a one-gadget in libc without needing the binary base.

Use ret2dlresolve to resolve system() without needing any leaks, because PIE does not affect the PLT.

Which of the following is a common prerequisite for reliably bypassing ASLR in a 64-bit Linux binary?

The ability to write to the GOT

An information leak that reveals a runtime address

The ability to execute shellcode on the stack

What is the purpose of a seccomp sandbox in a Linux process?

To prevent the process from reading files

To restrict the set of syscalls a process can make

To encrypt the process's memory

To randomize the process's memory layout

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 2Objective 1

Bypassing Linux Exploit Mitigations GXPN Practice Questions (Page 1)

Part of the Exploit Mitigation Bypass Techniques domain, which makes up ~9% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~6–11 in this domain), expect 3–6 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

9concepts

Questions 1–5

1foundation · easy
When NX is enabled, an attacker cannot directly execute shellcode placed on the stack. Which technique allows code execution by reusing existing instructions already present in executable memory?
Select an answer first
2application · medium
A tester is exploiting a 64-bit binary with PIE and ASLR enabled. The tester has a buffer overflow that allows overwriting the saved return address. The tester has a single information leak that reveals the address of a function inside the binary. What is the most reliable way to bypass ASLR and PIE?
Select an answer first
3foundation · easy
Which of the following is a common prerequisite for reliably bypassing ASLR in a 64-bit Linux binary?
Select an answer first
4foundation · easy
What is the purpose of a seccomp sandbox in a Linux process?
Select an answer first
5foundation · easy
Which technique is specifically used to bypass Full RELRO by resolving a function symbol dynamically without relying on a writable GOT?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Bypassing Linux Exploit Mitigations GXPN Practice Questions (Page 1)

Questions 1–5

When NX is enabled, an attacker cannot directly execute shellcode placed on the stack. Which technique allows code execution by reusing existing instructions already present in executable memory?

Which of the following is a common prerequisite for reliably bypassing ASLR in a 64-bit Linux binary?

What is the purpose of a seccomp sandbox in a Linux process?

Which technique is specifically used to bypass Full RELRO by resolving a function symbol dynamically without relying on a writable GOT?

Keep studying — Exploit Mitigation Bypass Techniques