Windows Execution and Memory Foundations GXPN Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How does Address Space Layout Randomization (ASLR) hinder exploitation?

   • AIt validates function pointers before they are called.
   • BIt marks memory pages as non-executable to prevent shellcode execution.
   • CIt randomizes the locations of key memory regions, making it harder to predict addresses.
   • DIt encrypts the stack and heap to prevent data tampering.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   You are exploiting a heap overflow in a 64-bit Windows application. The application uses the default heap and has enabled the Low Fragmentation Heap (LFH) for allocations smaller than 16 KB. You have identified a vulnerable function that allows you to overwrite data beyond a heap chunk. Which exploitation technique is most likely to succeed under these conditions?

   • AUse the overflow to modify the PEB's heap flags to disable LFH and then perform a classic unlink attack.
   • BOverwrite the metadata of an adjacent chunk to corrupt the free list and achieve arbitrary write.
   • COverwrite a function pointer stored in the heap chunk to redirect execution when the application calls it.
   • DUse the overflow to write to the stack and overwrite a return address.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   You are on a red team engagement against a Windows 10 host. You have achieved user-mode code execution in a process running as a standard user. Your goal is to read a file that is only accessible to SYSTEM. You have identified a kernel vulnerability that requires you to know the base address of the kernel (ntoskrnl.exe). Which approach is most reliable to obtain this address from user mode?

   • AUse the NtQuerySystemInformation API with the SystemModuleInformation class to enumerate loaded kernel modules.
   • BRead the kernel base address from the KUSER_SHARED_DATA structure at a fixed address.
   • CUse the GetModuleHandle function to get the base address of ntoskrnl.exe.
   • DUse the RtlGetVersion API to retrieve the kernel version and then look up the base address in a public symbol server.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A developer is debugging a stack buffer overflow in a Windows application. The compiler has enabled /GS. Which part of the stack frame is specifically protected by the security cookie?

   • AThe return address
   • BThe stack pointer
   • CThe heap chunk header
   • DThe function arguments
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which PE section typically contains the executable code of a program?

   • A.reloc
   • B.text
   • C.rdata
   • D.data
   Reveal Solution Discussion Select an answer first