Windows Overflows and Execution Control GXPN Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A tester is exploiting a stack overflow in a Windows 10 application with DEP and ASLR enabled. The tester has identified a reliable info leak that reveals the base address of a non-ASLR module. The goal is to execute shellcode. Which approach is most appropriate?

   • AUse heap spraying to place shellcode at a predictable address and overwrite a function pointer to jump there.
   • BPlace shellcode on the stack and overwrite the return address with a direct jump to the stack.
   • CBuild a ROP chain using gadgets from the non-ASLR module to call `VirtualProtect` and then jump to shellcode.
   • DOverwrite the return address with the address of `system()` in a non-ASLR module and pass a command string on the stack.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An exploit developer is building a ROP chain for a Windows application that has DEP enabled. The developer has identified a stack pivot gadget that moves the stack pointer to a controlled buffer. What is the next step in the ROP chain?

   • APlace the ROP chain in the controlled buffer and use the pivot to set the stack pointer to that buffer, then call VirtualProtect.
   • BUse the pivot to jump directly to shellcode placed in the buffer.
   • CUse the pivot to set the stack pointer to a fixed address in the heap and execute shellcode there.
   • DUse the pivot to call a function like ExitProcess to terminate the process cleanly.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A developer is analyzing a crash dump from a Windows application that suffered a stack buffer overflow. The crash shows that the return address was overwritten with the value 0x41414141. The application is compiled with ASLR enabled. What does this indicate about the exploitability of the vulnerability?

   • AThe overflow is not exploitable because overwriting the return address with 0x41414141 will cause an access violation.
   • BThe overflow can overwrite the return address, but ASLR may prevent a direct jump to a fixed address, requiring an information leak or a non-ASLR module.
   • CThe overflow can be exploited by placing shellcode at a fixed address in the stack.
   • DThe overflow is only exploitable if DEP is disabled.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A tester is exploiting a stack overflow in a Windows service. The overflow buffer is small (only 64 bytes), but the tester can place a large payload in a heap buffer that is freed before the overflow occurs. DEP and ASLR are enabled. The tester wants to execute the large payload. Which technique is most appropriate?

   • AUse a ROP chain in the stack buffer to call `VirtualProtect` on the heap and then jump to the payload.
   • BPlace an egg hunter in the small stack buffer and have it search the heap for the egg-tagged payload.
   • CPlace the entire shellcode in the stack buffer and use a `jmp esp` gadget.
   • DUse heap spraying to place the payload at a predictable address and overwrite the return address with that address.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary consequence of a stack buffer overflow that writes beyond the bounds of a local array?

   • AIt causes the CPU to execute code from the heap.
   • BIt corrupts the heap metadata, leading to a denial of service.
   • CIt overwrites adjacent stack data, potentially including the saved return address.
   • DIt triggers an immediate access violation that always terminates the process.
   Reveal Solution Discussion Select an answer first