You are exploiting a Linux x86-64 binary with ASLR enabled and NX enabled. You have a buffer overflow that allows you to control the return address. You have also found a way to leak a libc address, which allows you to calculate the base address of libc. Which technique is most effective to achieve code execution?

Use a heap overflow to overwrite a function pointer with the address of system().

Use a ret2libc attack to call system() with a pointer to /bin/sh, using the leaked libc base to calculate the addresses.

Overwrite the GOT entry for a function to point to system().

Use a ROP chain to call mprotect() to make the stack executable, then jump to your shellcode.

You are writing x86-64 shellcode that must spawn a shell. To avoid null bytes in the machine code, you decide to build the string '/bin/sh' on the stack. Which approach correctly constructs the string without introducing null bytes?

Push the string one byte at a time using multiple push instructions with byte immediates.

Store the string in the .data section of the binary and reference it with a RIP-relative address.

Use XOR to zero a register, push that register to create the null terminator, then push the two 4-byte chunks of '/bin/sh' in reverse order.

Push 0x0068732f and 0x6e69622f onto the stack, then set RDI to RSP.

You are exploiting a buffer overflow in a Linux binary that has NX (non-executable stack) enabled. You have control of the return address and want to execute your own code. Which technique is most appropriate to bypass NX?

Overwrite the GOT entry for a function to point to your shellcode.

Use a return-to-libc attack to call system() or another useful function.

Place your shellcode on the stack and jump to it.

Use mprotect() to make the stack executable before jumping to your shellcode.

What is the primary effect of the NX (No-eXecute) bit on shellcode execution?

It randomizes the base address of the stack and heap

It encrypts the code segment to prevent reverse engineering

It marks memory pages as non-executable, preventing shellcode from running in data, stack, or heap segments

It prevents the program from writing to read-only segments

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 1

Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 4)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

9concepts

Questions 16–20

16foundation · easy
In the standard memory layout of a Linux process, which segment is placed at the lowest virtual address and contains the machine instructions of the program?
Select an answer first
17expert · hard
You are exploiting a Linux x86-64 binary with ASLR enabled and NX enabled. You have a buffer overflow that allows you to control the return address. You have also found a way to leak a libc address, which allows you to calculate the base address of libc. Which technique is most effective to achieve code execution?
Select an answer first
18application · hard
You are writing x86-64 shellcode that must spawn a shell. To avoid null bytes in the machine code, you decide to build the string '/bin/sh' on the stack. Which approach correctly constructs the string without introducing null bytes?
Select an answer first
19application · medium
You are exploiting a buffer overflow in a Linux binary that has NX (non-executable stack) enabled. You have control of the return address and want to execute your own code. Which technique is most appropriate to bypass NX?
Select an answer first
20foundation · easy
What is the primary effect of the NX (No-eXecute) bit on shellcode execution?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Linux Execution, Memory, and Shellcode Foundations GXPN Practice Questions (Page 4)

Questions 16–20

In the standard memory layout of a Linux process, which segment is placed at the lowest virtual address and contains the machine instructions of the program?

You are writing x86-64 shellcode that must spawn a shell. To avoid null bytes in the machine code, you decide to build the string '/bin/sh' on the stack. Which approach correctly constructs the string without introducing null bytes?

You are exploiting a buffer overflow in a Linux binary that has NX (non-executable stack) enabled. You have control of the return address and want to execute your own code. Which technique is most appropriate to bypass NX?

What is the primary effect of the NX (No-eXecute) bit on shellcode execution?

Keep studying — Exploitation Foundations and Memory Corruption