Windows Overflows and Execution Control GXPN Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A penetration tester is assessing a legacy Windows application that is vulnerable to a stack buffer overflow. The application is compiled without ASLR but with DEP enabled. The tester has control over the return address and wants to execute a payload. What is the most appropriate technique to bypass DEP?

   • ADisable DEP by modifying the PE header's NX_COMPAT flag and reloading the process.
   • BUse a ROP chain to call VirtualProtect and mark the stack executable, then jump to the shellcode.
   • CUse a heap spray to place shellcode at a predictable address and jump directly to it.
   • DOverwrite the return address with the address of a JMP ESP instruction and place shellcode on the stack.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the primary goal of overwriting a function pointer in a Windows process?

   • ATo change the permissions of the stack to executable
   • BTo redirect execution to attacker-controlled code or a ROP chain when the pointer is called
   • CTo leak the base address of the executable
   • DTo disable ASLR for the process
   Reveal Solution Discussion Select an answer first