Return Oriented Stack-Based Exploits GXPN Practice Questions (Page 6)

Questions 26–29

1. 26application · easy

   A tester is using ROPgadget to find a gadget that pops two values from the stack and then returns. Which gadget should the tester search for?

   • Apop rdi; pop rsi; ret
   • Badd rsp, 16; ret
   • Cpop rax; ret
   • Dmov rdi, rax; ret
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In a ROP chain, what is the role of the data placed immediately after each gadget address on the stack?

   • AIt is used as arguments or values popped by the gadget's instructions
   • BIt is the address of the function to call
   • CIt is ignored and only used for stack alignment
   • DIt serves as the return address for the next gadget
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following instruction sequences would be considered a useful ROP gadget for setting a register to a controlled value?

   • Apop rdi; ret
   • Bint 0x80; ret
   • Cnop; nop; ret
   • Dret
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A tester is exploiting a 64-bit binary with NX and ASLR enabled. The binary has a stack overflow and a format string vulnerability that leaks a stack address. The tester wants to call system('/bin/sh') but does not know the libc base. The binary does not import system. Which technique is most likely to succeed?

   • AUse the format string to overwrite the GOT entry of a function with the address of system, then trigger a call to that function with '/bin/sh' as an argument.
   • BUse the stack leak to calculate the libc base, then build a ret2libc chain.
   • CUse a ROP chain to call mprotect to make the stack executable, then jump to shellcode.
   • DUse ret2dl-resolve to resolve system dynamically.
   Reveal Solution Discussion Select an answer first