Bypassing Windows Memory Protections GXPN Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which Windows mitigation randomizes the base addresses of modules, heap, and stack to make memory addresses unpredictable for an attacker?

   • ADEP
   • BSEHOP
   • CCFG
   • DASLR
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   To bypass Control Flow Guard (CFG), an attacker must redirect control flow to which type of address?

   • AThe address of a heap metadata structure
   • BThe address of a stack cookie
   • CAny address in a non-executable memory page
   • DA valid indirect call target that is marked as valid in the CFG bitmap
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are exploiting a Windows service that is compiled with /GS (stack cookies), SafeSEH, and DEP. You have found a stack buffer overflow in a function that does not use exception handlers. You have a memory disclosure that reveals the stack cookie value. What is the most efficient way to achieve code execution?

   • AOverwrite the return address with a ROP chain that calls VirtualProtect, after placing the correct stack cookie in the overflow.
   • BOverwrite the SEH handler to point to your shellcode, bypassing the stack cookie check.
   • CDisable DEP by flipping the NX bit in the page table entry for your shellcode.
   • DUse a partial overwrite of the return address to skip the cookie check and jump to your shellcode.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When ASLR is enabled, which technique can be used to bypass it by overwriting only the lower bytes of a pointer, leaving the randomized upper bytes intact?

   • AHeap spraying
   • BSEH overwrite
   • CPartial overwrite
   • DReturn-to-libc
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   You are exploiting a heap overflow in a Windows application that uses the LFH (Low Fragmentation Heap) and has DEP enabled. You need to achieve code execution. Which strategy is most appropriate?

   • ADisable DEP by calling VirtualProtect from your shellcode after a direct jump.
   • BPerform heap grooming to place a vulnerable object next to a function pointer, then overwrite the pointer with a ROP chain that calls VirtualProtect.
   • CUse a 'House of Force' attack to allocate a chunk at an arbitrary address and write shellcode there.
   • DOverwrite the heap metadata to create a fake chunk that points to your shellcode.
   Reveal Solution Discussion Select an answer first