Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   You are crafting an exploit for a 64-bit Linux binary and need to overwrite a 64-bit pointer on the stack. The target system is little-endian. You are sending the overwrite value byte-by-byte. In what order should you send the bytes of the pointer?

   • AThe order does not matter, as the CPU will interpret the bytes correctly.
   • BMost significant byte first, followed by the next bytes down to the least significant byte.
   • CSend the bytes in reverse order of the pointer's hexadecimal representation, but only if the pointer is aligned.
   • DLeast significant byte first, followed by the next bytes up to the most significant byte.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   You are analyzing a 32-bit Linux binary that uses the cdecl calling convention. You have found a format string vulnerability that allows you to write to arbitrary memory. You want to overwrite the return address of a function to redirect execution. Where is the return address located relative to the stack pointer when the function is executing?

   • AIn a register, not on the stack.
   • BAt the same address as the current stack pointer.
   • CAt a higher address than the current stack pointer, above the local variables and saved frame pointer.
   • DAt a lower address than the current stack pointer, below the local variables.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are crafting shellcode for a Linux x86-64 target, but the application filters input and rejects any bytes that are null (0x00). Your shellcode contains the string /bin/sh, which includes a null terminator. How should you handle the null byte in the string to avoid detection?

   • AEncode the entire shellcode with XOR and include the null byte in the encoded payload.
   • BConstruct the string at runtime by writing the null terminator with an instruction like mov byte [rax], 0 after copying the non-null characters.
   • CUse a different command that does not require a null terminator, such as /bin/ls.
   • DReplace the null terminator with a non-null byte, such as 0x01, and rely on the kernel to ignore it.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During a penetration test, you have a buffer overflow in a Linux x86-64 application that allows you to redirect execution to a buffer you control. The application filters input and rejects any bytes that are not printable ASCII (0x20–0x7E). You need to execute a command like /bin/sh. What is the most appropriate technique to achieve code execution under these constraints?

   • APlace the raw shellcode in the buffer and rely on the fact that the filter only rejects non-printable bytes during input validation, not during execution.
   • BWrite the shellcode using only alphanumeric bytes and place it directly in the buffer without any decoder.
   • CEncode the shellcode with a XOR decoder stub that uses only printable bytes, then decode at runtime before executing the payload.
   • DUse a return-to-libc attack to call system() with a pointer to a string already present in the binary's .rodata section.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You are crafting shellcode for a Linux x86-64 target. The application filters input and rejects any bytes that are not alphanumeric (0x30–0x39, 0x41–0x5A, 0x61–0x7A). You need to execute a command. Which approach is most appropriate to bypass this filter?

   • AUse a return-to-libc attack to call system() with a string already present in the binary.
   • BUse a ROP chain to call execve with arguments constructed from existing memory.
   • CUse alphanumeric shellcode that is self-decoding, where the decoder stub and encoded payload consist only of alphanumeric bytes.
   • DEncode the shellcode with XOR and include the encoded payload in the buffer.
   Reveal Solution Discussion Select an answer first