Return Oriented Stack-Based Exploits GXPN Practice Questions (Page 4)

Questions 16–20

1. 16application · easy

   A tester is explaining ROP to a colleague. Which statement best describes the core principle of return-oriented programming?

   • AIt chains together small sequences of instructions ending in 'ret' to perform arbitrary operations.
   • BIt overwrites the return address to jump to a single function like system.
   • CIt uses the heap to store a chain of function pointers.
   • DIt injects shellcode onto the stack and executes it directly.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following best describes how a ROP chain achieves code execution on a system with a non-executable stack?

   • ABy mapping new executable memory and placing shellcode there
   • BBy disabling the NX bit using a kernel module
   • CBy reusing existing executable code fragments in the binary or loaded libraries
   • DBy writing shellcode to the stack and then jumping to it
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   You are explaining ROP to a colleague. Which statement best describes the core principle of return-oriented programming?

   • AIt uses the heap to store a chain of function pointers.
   • BIt overwrites the GOT to redirect function calls.
   • CIt injects shellcode onto the stack and executes it directly.
   • DIt uses existing code sequences ending in `ret` as gadgets, chaining them via the return address stack to perform arbitrary operations.
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   A tester is building a ROP chain for a 64-bit binary. The chain needs to call a function that takes three arguments. The tester has found a 'pop rdi; ret' gadget and a 'pop rsi; pop r15; ret' gadget. What is missing to set the third argument?

   • AA 'pop rcx; ret' gadget
   • BA 'pop rdx; ret' gadget
   • CA 'pop rax; ret' gadget
   • DA 'pop r8; ret' gadget
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   When constructing a ROP chain, what is the purpose of placing a series of gadget addresses on the stack?

   • ATo execute each gadget sequentially as each ret transfers control to the next address
   • BTo store data that will be used by the kernel during syscalls
   • CTo overwrite the return address with a single long jump
   • DTo fill the stack with NOP sleds for shellcode
   Reveal Solution Discussion Select an answer first