Bypassing Linux Exploit Mitigations GXPN Practice Questions (Page 5)

Questions 21–22

1. 21expert · hard

   A tester is targeting a binary that uses Intel CET (Control-flow Enforcement Technology) with both shadow stack and indirect branch tracking (IBT). The binary has a buffer overflow that allows overwriting a function pointer. The tester wants to achieve code execution. What is the most viable strategy?

   • AUse a ROP chain that uses ret instructions to bypass the shadow stack by overwriting the return address.
   • BUse a JOP chain that uses indirect jumps to gadgets that do not start with ENDBR64, because IBT only checks the first instruction of the target.
   • CUse a ret2dlresolve attack to resolve system() and overwrite a GOT entry, but the GOT is read-only due to Full RELRO.
   • DOverwrite the function pointer to point to a valid function that is a legitimate indirect branch target, such as a function that calls system() with a user-controlled argument.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A tester has achieved code execution in a Linux process that is confined by a seccomp filter allowing only read, write, openat, exit, and exit_group syscalls. The tester wants to read a sensitive file and exfiltrate its contents over the network. What is the most practical approach?

   • AUse openat, read, and write to read the file and write the contents to a file descriptor that is a network socket already open in the process.
   • BUse the sendfile syscall to send the file directly to a network socket.
   • CUse the socketcall syscall to create a new socket and connect to a remote server, then write the file contents.
   • DUse the ptrace syscall to attach to another process that is not sandboxed and use it to exfiltrate the data.
   Reveal Solution Discussion Select an answer first