A tester is exploiting a 64-bit binary with NX enabled and full ASLR. The binary has a stack overflow and a function that prints a libc address. The tester wants to call system('/bin/sh'). Which approach is most efficient?

Use a ROP chain to call mprotect to make the stack executable, then jump to shellcode.

Overwrite the return address with the address of system from the GOT, which is fixed.

Leak a libc address, calculate the libc base, then use a ROP chain to call system with '/bin/sh'.

Use a ret2plt chain to call system@plt, which is not affected by ASLR.

What is the purpose of a 'ret' gadget placed at the beginning of a ROP chain on x86-64?

To align the stack to a 16-byte boundary before calling a function

To call a function with no arguments

To increase the number of gadgets in the chain

A tester is exploiting a 64-bit binary with NX and ASLR enabled. The binary has a stack overflow and a function that leaks a libc address. The tester wants to call execve('/bin/sh', NULL, NULL). Which ROP chain is most appropriate?

Leak libc base, then use gadgets to set rdi, rsi, rdx and call execve.

Use ret2plt to call execve@plt, which is not affected by ASLR.

Use a one-gadget in libc that calls execve directly.

Use mprotect to make the stack executable, then jump to shellcode.

What is the primary challenge that ASLR poses to a ret2libc attack, and how is it commonly addressed?

ASLR randomizes the addresses of shared libraries; it is addressed by leaking a library address or using ret2plt

ASLR randomizes the heap; it is addressed by using heap spraying

ASLR randomizes the stack address; it is addressed by using a NOP sled

ASLR randomizes the binary's code segment; it is addressed by recompiling the binary without PIE

During a penetration test, you find a stack buffer overflow in a 32-bit Linux binary compiled with NX enabled and ASLR active. The binary imports system() and has a writable .bss section. You plan to use a ret2libc chain. What is the most reliable way to pass the command string to system() given ASLR?

Place the command string at the start of the ROP chain on the stack and pass its stack address to system().

Use a ret2plt call to system@plt with the string address from the GOT entry.

Write the command string to .bss using a ROP gadget that copies from the stack, then pass the fixed .bss address to system().

Disable ASLR by calling personality() from the ROP chain before invoking system().

GIAC Exploit Researcher and Advanced Penetration Tester

Domain 1Objective 3

Return Oriented Stack-Based Exploits GXPN Practice Questions (Page 5)

Part of the Exploitation Foundations and Memory Corruption domain, which makes up ~26% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~18–31 in this domain), expect 5–8 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

6concepts

Questions 21–25

21expert · hard
A tester is exploiting a 64-bit binary with NX enabled and full ASLR. The binary has a stack overflow and a function that prints a libc address. The tester wants to call system('/bin/sh'). Which approach is most efficient?
Select an answer first
22foundation · easy
What is the purpose of a 'ret' gadget placed at the beginning of a ROP chain on x86-64?
Select an answer first
23expert · hard
A tester is exploiting a 64-bit binary with NX and ASLR enabled. The binary has a stack overflow and a function that leaks a libc address. The tester wants to call execve('/bin/sh', NULL, NULL). Which ROP chain is most appropriate?
Select an answer first
24foundation · easy
What is the primary challenge that ASLR poses to a ret2libc attack, and how is it commonly addressed?
Select an answer first
25application · medium
During a penetration test, you find a stack buffer overflow in a 32-bit Linux binary compiled with NX enabled and ASLR active. The binary imports system() and has a writable .bss section. You plan to use a ret2libc chain. What is the most reliable way to pass the command string to system() given ASLR?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GXPN

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GXPN” is a trademark of its owner, used for identification only.