Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   On x86-64, which instruction is commonly used in position-independent shellcode to obtain the current instruction pointer?

   • APUSH RIP
   • BMOV RAX, [RIP]
   • CCALL (to a label, then POP the return address)
   • DLEA RAX, [RIP]
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which two segments in a Linux process memory layout are typically adjacent and both used for global and static variables, with one holding initialized data and the other holding uninitialized data?

   • AData and BSS
   • BText and data
   • CHeap and stack
   • DStack and BSS
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   You are developing shellcode for a Linux x86-64 target that has a filter rejecting bytes outside the range 0x00–0x7F (ASCII). Your shellcode contains a byte 0x80, which is rejected. You decide to XOR-encode the shellcode with a single-byte key. Which key would you choose to ensure that the encoded payload contains no bytes above 0x7F?

   • AA key of 0xFF, which inverts all bits.
   • BA key of 0x00, which leaves the shellcode unchanged.
   • CA key of 0x7F, which clears the high bit of every byte.
   • DA key of 0x80, which flips the high bit of every byte.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You are testing a Linux binary that has ASLR enabled but NX disabled. You have a stack buffer overflow and can control the return address. The binary is not PIE. What is the most reliable exploitation strategy?

   • AUse a ROP chain to call mprotect and make the stack executable, then jump to shellcode.
   • BPlace shellcode on the stack and overwrite the return address with the stack address where the shellcode resides.
   • CUse a ret2libc attack to call system('/bin/sh') without needing shellcode.
   • DOverwrite the GOT entry for a function to redirect to system().
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You have written x86-64 shellcode that spawns a shell, but it contains null bytes that are filtered by the target application. You decide to XOR-encode the shellcode with a key. After encoding, you notice the encoded payload still contains null bytes. What should you do?

   • AChoose a different XOR key and re-encode the payload.
   • BUse a multi-byte XOR key instead of a single-byte key.
   • CAdd a NOP sled before the encoded payload to absorb the null bytes.
   • DPlace the encoded payload in the .data section to avoid the filter.
   Reveal Solution Discussion Select an answer first