When developing a ROP exploit, what is the purpose of using a debugger like GDB?

To disable ASLR and NX on the target system

To find the exact offset to control the return address and verify gadget addresses at runtime

To compile the vulnerable program with debugging symbols

To automatically generate a working ROP chain

A tester is exploiting a 32-bit binary with NX enabled but ASLR disabled. The binary has a stack overflow and the tester knows the address of system() and '/bin/sh' in libc. Which technique should the tester use?

ret2libc: overwrite the return address with system() and place the address of '/bin/sh' as the argument.

ret2dl-resolve: use the dynamic linker to resolve system() at runtime.

ret2plt: use the PLT entry of system() to call it.

ret2csu: use the __libc_csu_init gadgets to call system().

You are exploiting a 64-bit Linux binary with NX enabled and ASLR active. You have a stack buffer overflow and want to call mprotect() to make the stack executable, then jump to shellcode placed on the stack. Which approach is most viable?

Use a JOP (jump-oriented programming) chain to bypass NX without calling mprotect.

Use a ret2libc chain to call mprotect() with the stack page address, size, and PROT_EXEC, then return to the stack shellcode.

Disable ASLR by writing to /proc/sys/kernel/randomize_va_space from the ROP chain.

Use a ret2plt chain to call mprotect@plt and then jump to the shellcode.

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 3

Return Oriented Stack-Based Exploits GXPN Practice Questions (Page 1)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 1–5

1foundation · easy
When developing a ROP exploit, what is the purpose of using a debugger like GDB?
Select an answer first
2application · medium
A tester is exploiting a 32-bit binary with NX enabled but ASLR disabled. The binary has a stack overflow and the tester knows the address of system() and '/bin/sh' in libc. Which technique should the tester use?
Select an answer first
3foundation · easy
In the x86-64 System V calling convention, which register holds the first integer/pointer argument to a function?
Select an answer first
4application · hard
You are exploiting a 64-bit Linux binary with NX enabled and ASLR active. You have a stack buffer overflow and want to call mprotect() to make the stack executable, then jump to shellcode placed on the stack. Which approach is most viable?
Select an answer first
5application · easy
A tester is using ROPgadget to find gadgets in a binary. The tester needs to move a value from rax to rdi. Which gadget should the tester look for?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.

Return Oriented Stack-Based Exploits GXPN Practice Questions (Page 1)

Questions 1–5

When developing a ROP exploit, what is the purpose of using a debugger like GDB?

A tester is exploiting a 32-bit binary with NX enabled but ASLR disabled. The binary has a stack overflow and the tester knows the address of system() and '/bin/sh' in libc. Which technique should the tester use?

In the x86-64 System V calling convention, which register holds the first integer/pointer argument to a function?

You are exploiting a 64-bit Linux binary with NX enabled and ASLR active. You have a stack buffer overflow and want to call mprotect() to make the stack executable, then jump to shellcode placed on the stack. Which approach is most viable?

A tester is using ROPgadget to find gadgets in a binary. The tester needs to move a value from rax to rdi. Which gadget should the tester look for?

Keep studying — Exploitation Foundations and Memory Corruption