Windows Overflows and Execution Control GXPN Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a typical Windows process memory layout, which region is used for dynamic memory allocation during runtime and grows toward higher memory addresses?

   • AStack
   • BThread Environment Block (TEB)
   • CHeap
   • DExecutable image
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of an egg hunter in Windows exploitation?

   • ATo encrypt the shellcode to avoid signature detection
   • BTo search memory for a unique tag (egg) preceding the actual shellcode
   • CTo bypass ASLR by finding the base address of kernel32.dll
   • DTo disable DEP by calling VirtualProtect
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A penetration tester is exploiting a heap overflow in a Windows application that uses the LFH (Low Fragmentation Heap). The application has DEP and ASLR enabled. The tester has a write-what-where primitive but needs to achieve code execution. Which approach is most effective?

   • AOverwrite the heap metadata to create a fake chunk that, when freed, writes to the stack and overwrites a return address.
   • BOverwrite a function pointer with the address of a ROP gadget and use a ROP chain to call VirtualProtect.
   • COverwrite the heap metadata to change the chunk size and cause a large allocation that overwrites the stack.
   • DUse a heap spray to fill the heap with shellcode and jump to a fixed address.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of Data Execution Prevention (DEP) on Windows?

   • ATo detect and block buffer overflows in user-mode applications
   • BTo encrypt the stack to prevent return address overwrites
   • CTo prevent code execution from non-executable memory pages
   • DTo randomize the base addresses of loaded modules
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An exploit developer is working on a Windows exploit where the primary buffer is too small to hold the full shellcode. However, a larger buffer is allocated elsewhere in memory and contains the shellcode. The exploit has a limited overwrite that can redirect execution. What technique should be used to locate and execute the shellcode?

   • AUse an egg hunter to search memory for a unique tag placed before the shellcode, then jump to it.
   • BUse a heap spray to fill memory with the shellcode and jump to a fixed address.
   • COverwrite the return address with the address of the larger buffer directly.
   • DPlace the shellcode in the small buffer and use a NOP sled to increase the chance of landing in it.
   Reveal Solution Discussion Select an answer first