I85PREP
⌘ K
OSEE study materials
OSEE study resources

OSEE practice questions

One question at a time. Build your OSEE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Exploit Development

In a classic stack-based buffer overflow on 32-bit x86 Linux, which register is overwritten by the saved return address that an attacker typically aims to control?

  1. EIP Correct answer.
  2. ESP
  3. EBP
  4. ECX

Explanation

When a function returns, the value at the top of the stack is popped into EIP, so corrupting the saved return address lets an attacker redirect execution. ESP points to the current stack top and EBP is the frame pointer, neither of which is loaded from the saved return slot.

Question 2Exploit Development

What does the NX (no-execute) bit accomplish on modern x86-64 systems?

  1. It randomizes the base address of shared libraries at process startup.
  2. It marks memory pages as non-executable so injected shellcode on the stack cannot run. Correct answer.
  3. It enforces read-only relocations for the GOT and similar tables.
  4. It inserts canary values between local variables and the saved return address.

Explanation

NX uses page-table permission bits to make writable data pages non-executable, defeating classic code-injection attacks that jump to shellcode on the stack or heap. ASLR, stack canaries, and RELRO are separate mitigations addressing different attack primitives.

Question 3Exploit Development

An attacker needs to locate the offset at which input overwrites the saved return address in a 32-bit binary. Which technique most directly determines that offset?

  1. Sending a cyclic pattern of unique four-byte sequences and reading the faulting EIP value. Correct answer.
  2. Running the binary under strace and counting write syscalls.
  3. Measuring the process resident set size after the crash.
  4. Disassembling main and counting the number of push instructions.

Explanation

A de Bruijn (cyclic) pattern lets you map the overwritten EIP value back to a unique offset in the input, giving the exact distance to the return address. Static instruction counting and syscall tracing do not reveal the runtime buffer layout reliably.

Question 4Exploit Development

Which condition must hold for a ret2libc attack to succeed on a non-executable stack?

  1. The binary must be statically linked with no shared libraries.
  2. The stack must be mapped with execute permission.
  3. The stack canary must be disabled at compile time.
  4. The address of a function such as system and a pointer to a controlled string are known or predictable. Correct answer.

Explanation

ret2libc reuses existing executable code, so the attacker needs the runtime address of the target function plus a way to pass a controlled argument such as a "/bin/sh" string. It specifically does not require an executable stack, which is the point of the technique.

Question 5Exploit Development

What is the primary purpose of a ROP gadget such as pop rdi; ret?

  1. To load a chosen value into rdi before returning to the next gadget or function. Correct answer.
  2. To allocate a new stack frame for the current function.
  3. To disable ASLR for the current process.
  4. To decrypt an encrypted payload in memory.

Explanation

On x86-64 the first argument is passed in rdi, so a pop rdi; ret gadget lets the attacker place a controlled value from the ROP chain into rdi and then transfer control onward. Gadgets chain existing instructions together; they do not change process-wide mitigations.

Question 6Exploit Development

Which of the following best describes a format string vulnerability?

  1. User-controlled data is passed as the format argument to printf-family functions. Correct answer.
  2. A buffer is copied with strcpy into a fixed-size stack array.
  3. An integer is used as an array index without bounds checking.
  4. A function pointer is called after its object is freed.

Explanation

When attacker input becomes the format string itself, conversion specifiers like %x and %n let the attacker read stack memory and write to arbitrary addresses. The other options describe buffer overflow, out-of-bounds indexing, and use-after-free respectively.

Question 7Exploit Development

In a heap exploitation context, what does a use-after-free primitive allow an attacker to do?

  1. Force the loader to map a library at a fixed address.
  2. Bypass stack canaries by leaking the TLS value.
  3. Overwrite the saved return address directly on the stack.
  4. Access a freed chunk that has been reallocated with attacker-controlled contents. Correct answer.

Explanation

A use-after-free occurs when a pointer to freed memory is used after the allocator may have handed that chunk to a new allocation, letting the attacker influence the data the stale pointer reads or writes. It operates on heap metadata and objects rather than the stack return address.

Question 8Exploit Development

Why does an attacker often need an information leak before exploiting a binary protected by ASLR and PIE?

  1. To learn runtime addresses of code and libraries so the payload can reference them. Correct answer.
  2. To obtain the stack canary from the file on disk.
  3. To determine the CPU model of the target host.
  4. To recover the source code of the target binary.

Explanation

With ASLR and PIE, code and library base addresses change per execution, so hardcoded addresses fail; a leak reveals the current mapping so gadgets and functions can be addressed. The canary is generated at runtime and is not stored in the file on disk.

Question 9Exploit Development

A 64-bit binary passes a controlled buffer to system via a ROP chain. Which sequence correctly sets up the call on the System V AMD64 ABI?

  1. pop rsi; ret, then the buffer address, then the address of system.
  2. pop rdi; ret, then the address of the "/bin/sh" string, then the address of system. Correct answer.
  3. pop rax; ret, then the address of system, then the buffer address.
  4. push rdi; ret, then the buffer address, then the address of system.

Explanation

Under the System V AMD64 ABI the first integer argument goes in rdi, so the chain pops the string address into rdi and then returns into system. Using rsi or rax would place the argument in the wrong register for the first parameter.

Question 10Exploit Development

What is the purpose of a stack pivot in exploitation?

  1. To increase the size of the stack canary.
  2. To convert a heap overflow into a format string bug.
  3. To redirect the stack pointer to attacker-controlled memory so a larger ROP chain can execute. Correct answer.
  4. To make the GOT section writable at runtime.

Explanation

When the overflow provides too few bytes for a full chain, a pivot gadget such as leave; ret or xchg rsp, rax moves the stack pointer to a buffer the attacker fully controls. It does not alter canaries, GOT permissions, or convert bug classes.

Question 11Exploit Development

Which write target is typically used with the %n format specifier to achieve arbitrary memory write?

  1. The contents of the program's .rodata section.
  2. The saved return address located in the current stack frame.
  3. The value of the EAX register at the time of the call.
  4. A pointer value supplied on the stack that %n dereferences as its output address. Correct answer.

Explanation

%n writes the number of characters output so far to the address given by the corresponding variadic argument, so the attacker arranges a controlled pointer on the stack or in the format buffer. Directly naming the saved return address or a register is not how the variadic argument is selected.

Question 12Exploit Development

What does a partial overwrite of a return address accomplish in a PIE binary?

  1. It disables PIE for the current process.
  2. It changes only the low bytes of the address, preserving the randomized high bytes to reach a nearby gadget. Correct answer.
  3. It rewrites the entire address to a fixed absolute value.
  4. It overwrites the stack canary instead of the return address.

Explanation

Because ASLR randomizes the high bits but page offsets stay constant, overwriting only the low one or two bytes can redirect control within the same randomized region without knowing the base. A full absolute rewrite would require a leak of the entire address.

Question 13Exploit Development

Which heap structure in glibc's allocator is commonly targeted by an unsafe unlink attack?

  1. The GOT entry of printf.
  2. The program's entry point in the ELF header.
  3. The chunk header's fd and bk pointers of a free chunk. Correct answer.
  4. The thread-local stack canary.

Explanation

Unsafe unlink abuses the doubly linked free list: corrupting a free chunk's fd and bk causes the unlink macro to write a controlled value to a controlled address. The canary, GOT, and ELF header are not part of the free-list metadata.

Question 14Exploit Development

An attacker wants to call mprotect to make a buffer executable. What must a ROP chain supply to mprotect on x86-64 Linux?

  1. The buffer address in rax and the length in rcx.
  2. Only the buffer address in rdi, since the other arguments default to executable.
  3. The file descriptor of the target binary in rdi and the offset in rsi.
  4. The page-aligned address, length, and PROT_READ|PROT_WRITE|PROT_EXEC in rdi, rsi, and rdx respectively. Correct answer.

Explanation

mprotect takes three arguments: the page-aligned start address in rdi, the length in rsi, and the protection flags in rdx. The address must be page-aligned and the flags must explicitly include PROT_EXEC for execution to be permitted.

Question 15Exploit Development

What is the role of a stack canary in exploit mitigation?

  1. It detects corruption of the saved return path by comparing a random value before returning. Correct answer.
  2. It encrypts the contents of local variables.
  3. It randomizes the base address of the stack region.
  4. It prevents the use of ROP gadgets in shared libraries.

Explanation

A canary is a random value placed between local buffers and the saved return address; the epilogue checks it and aborts if it changed, so a linear overflow is detected. It does not randomize addresses, remove gadgets, or encrypt locals.

Question 16Exploit Development

Which technique allows leaking a libc address through a GOT entry in a non-PIE binary?

  1. Sending SIGSEGV to the process and reading the signal handler address.
  2. Reading the libc version string from the ELF header.
  3. Calling a function such as puts with the GOT entry of a resolved libc function as its argument. Correct answer.
  4. Overwriting the GOT entry with a stack address.

Explanation

A common approach is a ROP chain that calls puts or write with the GOT entry address as the argument, causing the resolved libc pointer to be printed. The attacker then computes the libc base from the known offset and can chain a second stage.

Question 17Exploit Development

What is the primary effect of the RELRO mitigation on the GOT?

  1. It moves the GOT to the stack.
  2. It randomizes the GOT base address on every call.
  3. It encrypts the GOT entries at runtime.
  4. It makes the GOT read-only after relocation, preventing GOT overwrite attacks. Correct answer.

Explanation

With full RELRO the dynamic linker resolves all symbols at startup and then remaps the GOT read-only, so an arbitrary write primitive cannot simply replace a GOT entry with a gadget address. Partial RELRO leaves parts writable and is a weaker form.

Question 18Exploit Development

In a ROP chain, why is a ret gadget often placed between function calls on x86-64?

  1. It clears the direction flag for string operations.
  2. It increments the instruction pointer by four bytes.
  3. It realigns the stack to a 16-byte boundary required by the System V ABI before calling a function. Correct answer.
  4. It restores the stack canary value.

Explanation

The System V ABI requires rsp to be 16-byte aligned at the call site, and a lone ret consumes eight bytes to correct misalignment introduced by the chain layout. Without it, functions using aligned SSE stores such as movaps can fault.

Question 19Exploit Development

Which primitive does a null-byte poisoning attack against glibc's heap rely on?

  1. Overwriting the least significant byte of a chunk's size field to shrink it. Correct answer.
  2. Overwriting the stack canary with a zero byte.
  3. Clearing the GOT entry of free.
  4. Zeroing the saved frame pointer.

Explanation

Off-by-one null writes can clear the low byte of an adjacent chunk's size field, making an in-use chunk appear smaller so it is consolidated or split in ways that create overlapping chunks. This is a heap metadata corruption technique, not a stack or GOT attack.

Question 20Exploit Development

A target uses seccomp to allow only read, write, and exit. Which exploitation approach remains viable for executing a command?

  1. A ret2dlresolve chain that invokes execve through the dynamic linker.
  2. Jumping to shellcode on an executable heap.
  3. A ret2libc chain calling system to spawn a shell.
  4. A ROP chain that performs an open/read/write sequence is blocked, so the attacker instead builds a chain using only the permitted syscalls to leak or exfiltrate data. Correct answer.

Explanation

seccomp filters syscalls, so spawning a shell via execve or calling system is blocked when those syscalls are not permitted. The attacker must work within the allowed set, for example using read and write for data exfiltration or building an open-read-write chain only if open is allowed.

Question 21Exploit Development

In glibc's tcache, what makes the tcache poisoning technique effective for obtaining an arbitrary write?

  1. The tcache allocates chunks only from the stack.
  2. The tcache stores chunks in a doubly linked list protected by safe-linking on all versions.
  3. The singly linked next pointer of a freed tcache chunk can be overwritten so a later allocation returns an attacker-chosen address. Correct answer.
  4. The tcache bypasses ASLR by design.

Explanation

Tcache chunks store a next pointer in the first word of the freed chunk's user data; corrupting it makes the allocator return the chosen address on a subsequent malloc. Safe-linking later XORs this pointer with the chunk address, requiring an additional heap leak on protected versions.

Question 22Exploit Development

Why can a stack canary be bypassed by a format string vulnerability using %n writes rather than a linear overflow?

  1. The canary is not checked when a format string bug is present.
  2. The canary value is stored in the format string buffer.
  3. The format string causes the canary check to be compiled out.
  4. The attacker writes directly to the saved return address without traversing the canary slot. Correct answer.

Explanation

A format string arbitrary write targets the return address directly, so the bytes between the buffer and the return address, including the canary, are never modified. The canary check therefore passes even though control flow is hijacked.

Question 23Exploit Development

An exploit must defeat both full RELRO and ASLR on a 64-bit binary. Which combination of primitives is most appropriate?

  1. A ret2plt chain that overwrites the .dynamic section.
  2. An information leak of a libc or PIE address plus a ROP chain that reuses existing code without writing to the GOT. Correct answer.
  3. A GOT overwrite to redirect printf to system.
  4. A stack pivot into the .bss without any address leak.

Explanation

Full RELRO makes the GOT read-only, so GOT overwrite is unavailable, and ASLR requires a leak to know code addresses. The attacker therefore leaks a libc or PIE pointer and builds a ROP chain that calls existing functions or syscalls directly.

Question 24Exploit Development

What does the safe-linking mitigation in modern glibc change about tcache and fastbin exploitation?

  1. It removes the tcache entirely from the allocator.
  2. It moves free chunks to the stack.
  3. It XORs the stored next pointer with the chunk address shifted right, so a heap leak is needed to forge a valid pointer. Correct answer.
  4. It encrypts the entire chunk contents with a per-process key.

Explanation

Safe-linking stores next as (address >> 12) XOR next, so an attacker who overwrites the pointer must know the chunk's location to encode a valid target. This raises the bar by requiring a heap address disclosure before tcache or fastbin poisoning succeeds.

Question 25Exploit Development

A binary is compiled with CET shadow stack enabled. What effect does this have on a classic ROP attack that overwrites the return address?

  1. It encrypts the return address in the regular stack.
  2. It disables ASLR for the code segment.
  3. The ret instruction compares the return address with the shadow copy and faults on mismatch. Correct answer.
  4. It prevents the use of the pop rdi gadget.

Explanation

The shadow stack keeps a separate, protected copy of return addresses, and ret checks the regular stack value against it, so a corrupted return address triggers a control-protection fault. Gadgets remain usable in principle, but the initial return-address hijack is detected.

Question 26Exploit Development

In a 32-bit x86 Linux binary using the cdecl calling convention, how does a function receive its arguments from the caller?

  1. Via a shadow space allocated by the caller on the stack.
  2. By being pushed onto the stack in right-to-left order before the call. Correct answer.
  3. Through registers such as EAX, EBX, and ECX.
  4. Through a pointer to an argument structure passed in EDX.

Explanation

In cdecl, the caller pushes arguments onto the stack from right to left, and the caller cleans up the stack after the call returns. This convention is standard for 32-bit Linux userland code and is important when constructing ROP chains or shellcode that must call existing functions.

Question 27Exploit Development

When exploiting a stack-based buffer overflow on a system with no stack protections, what is the primary purpose of NOP sled padding before the shellcode?

  1. To align the stack pointer to a 16-byte boundary before the shellcode executes.
  2. To overwrite the stack canary with a known value before the return address.
  3. To increase the reliability of redirecting execution into the payload by widening the landing zone. Correct answer.
  4. To encode the shellcode so that it avoids null bytes in the payload.

Explanation

A NOP sled is a sequence of no-operation instructions that, when execution lands anywhere within it, slides into the shellcode. This makes the exploit more reliable when the exact stack address is uncertain, which is common without ASLR or when the address is only approximately known.

Question 28Exploit Development

In x86-64 assembly, what is the effect of the leave instruction?

  1. It subtracts a constant from RSP to allocate local stack space.
  2. It restores all callee-saved registers from the stack.
  3. It pops the return address from the stack into RIP.
  4. It sets RSP to RBP and then pops the saved RBP from the stack. Correct answer.

Explanation

The leave instruction is equivalent to mov rsp, rbp followed by pop rbp. It tears down the current stack frame, discarding local variables and restoring the caller's frame pointer, which is why it often appears just before ret in function epilogues.

Question 29Exploit Development

Which memory region of a Linux process is typically mapped with read, write, and execute permissions in a non-PIE binary compiled without stack protections?

  1. The heap.
  2. The .rodata section.
  3. The .text section of the main executable.
  4. The stack. Correct answer.

Explanation

In the absence of NX, the stack is mapped as readable, writable, and executable, which allows shellcode placed on the stack to run. The .text section is executable but not writable, while .rodata is read-only and the heap is non-executable on modern systems by default.

Question 30Exploit Development

What is the primary purpose of a debugger such as GDB when developing an exploit?

  1. To patch the binary's GOT entries before runtime.
  2. To compile the target binary with exploit mitigations disabled.
  3. To automatically generate shellcode from high-level source code.
  4. To inspect registers and memory at the point of a crash to determine control of execution. Correct answer.

Explanation

GDB allows the exploit developer to break at a crash, examine register state such as RIP and RSP, and inspect memory to see exactly how the overflow affected the stack. This information is used to calculate offsets and verify control of the instruction pointer.

Question 31Exploit Development

Which of the following best describes the role of the PLT and GOT in a dynamically linked ELF binary?

  1. The PLT stores resolved function addresses, and the GOT contains stubs that jump to the PLT.
  2. The GOT is used only for global variables, while the PLT handles all function calls.
  3. Both the PLT and GOT are read-only sections that contain the program's own code.
  4. The PLT contains stubs that jump through the GOT, which holds resolved addresses of external functions. Correct answer.

Explanation

The Procedure Linkage Table (PLT) provides stubs for calls to external functions. Each stub jumps to an address stored in the Global Offset Table (GOT), which the dynamic linker fills with the actual function address on first call. This lazy binding mechanism is a common target for exploitation.

Question 32Exploit Development

What does the term 'egg hunter' refer to in exploit development?

  1. A method for encoding shellcode to avoid bad characters.
  2. A technique for bypassing stack canaries by brute-forcing the canary value.
  3. A tool that automatically discovers vulnerabilities in network services.
  4. A small shellcode stub that searches process memory for a larger payload and jumps to it. Correct answer.

Explanation

An egg hunter is a compact piece of shellcode that scans memory for a unique tag (the egg) and then transfers execution to the larger payload that follows. It is used when the available buffer for shellcode is too small to hold the entire payload.

Question 33Exploit Development

In the context of return-oriented programming on x86-64, what is a 'gadget'?

  1. A hardware feature that randomizes the stack address.
  2. A debugging breakpoint set at a function entry.
  3. A sequence of instructions ending in a ret that performs a useful operation. Correct answer.
  4. A type of heap metadata structure used by the allocator.

Explanation

A gadget is a short instruction sequence that ends with a ret (or similar control-transfer instruction) and can be chained together with other gadgets to perform arbitrary computation. Gadgets are typically found in the executable and shared libraries and are the building blocks of ROP chains.

Question 34Exploit Development

When exploiting a stack buffer overflow on x86-64, what is the typical offset from the start of the buffer to the saved return address?

  1. The size of the buffer plus 16 bytes.
  2. The size of the buffer plus the size of the stack canary.
  3. The size of the buffer plus 4 bytes.
  4. The size of the buffer plus 8 bytes. Correct answer.

Explanation

On x86-64, the saved return address is located 8 bytes after the saved frame pointer (RBP), which itself is immediately after the buffer if the buffer is the last local variable. Therefore, the offset is typically buffer size plus 8 bytes, assuming no other locals or alignment padding intervene.

Question 35Exploit Development

A binary uses a stack canary. Which approach most directly allows an attacker to bypass the canary without leaking it?

  1. Overwriting the saved return address via a separate pointer that is not protected by the canary.
  2. Triggering a signal handler that restores the original canary value.
  3. Brute-forcing the canary byte by byte using a fork server that preserves the canary value. Correct answer.
  4. Using a format string to write the canary value to a known location before overflowing.

Explanation

When a service forks a new process for each connection, the child inherits the parent's canary value, so the canary remains constant across attempts. An attacker can brute-force the canary one byte at a time, detecting correct guesses by whether the process crashes, and eventually overwrite the return address.

Question 36Exploit Development

In a return-to-libc attack on a 32-bit x86 binary with ASLR disabled, what is typically placed at the location of the saved return address?

  1. The address of the .text section.
  2. The address of the stack pointer.
  3. The address of the system function in libc. Correct answer.
  4. The address of the main function.

Explanation

Return-to-libc redirects execution to a function already present in libc, such as system, by overwriting the return address with the function's address. The arguments for the function are placed further down the stack, and a return address for after the function is also supplied.

Question 37Exploit Development

When constructing a ROP chain to call a function with three arguments on x86-64 Linux, which registers must be loaded with the arguments?

  1. RAX, RBX, and RCX.
  2. RDI, RSI, and RDX. Correct answer.
  3. RSP, RBP, and RIP.
  4. R8, R9, and R10.

Explanation

The System V AMD64 ABI passes the first three integer arguments in RDI, RSI, and RDX, respectively. A ROP chain must therefore use gadgets that pop values into these registers before invoking the target function.

Question 38Exploit Development

Which glibc heap exploitation primitive allows an attacker to redirect an allocation to a chosen address, subject to allocator checks, by duplicating a fastbin entry through a double-free and corrupting its forward pointer?

  1. Unsafe unlink.
  2. Fastbin dup. Correct answer.
  3. House of Force.
  4. Tcache poisoning.

Explanation

Fastbin dup uses a double-free setup to place the same chunk into a fastbin more than once. A subsequent forward-pointer overwrite can redirect a later allocation to a chosen location that satisfies allocator checks. This targets the fastbin freelist, whereas tcache poisoning targets a separate cache.

Question 39Exploit Development

What is the primary effect of enabling Position Independent Executable (PIE) on the exploitation of a stack buffer overflow?

  1. It prevents the use of ROP gadgets entirely.
  2. It makes the stack non-executable.
  3. It encrypts the return address on the stack.
  4. It randomizes the base address of the main executable, complicating the use of absolute addresses in the payload. Correct answer.

Explanation

PIE causes the main executable to be loaded at a randomized base address, so addresses within the binary (such as gadgets or functions) are not fixed. An exploit must therefore first leak a code address to calculate the base, or use relative addressing techniques.

Question 40Exploit Development

In a format string vulnerability, which format specifier is commonly used to read a value from the stack and print it, aiding in leaking addresses?

  1. %x
  2. %s
  3. %p Correct answer.
  4. %n

Explanation

The %p specifier prints a pointer-sized value in hexadecimal, which is useful for leaking stack contents such as return addresses or stack addresses. While %x also prints hexadecimal, %p is preferred on 64-bit systems because it consumes a full pointer-sized argument and displays leading zeros, making leaks more reliable.

Question 41Exploit Development

What is the purpose of the ret2dlresolve technique in exploitation?

  1. To overwrite the GOT entry of a function with the address of system.
  2. To resolve a function symbol at runtime without needing a prior libc leak, by abusing the dynamic linker's symbol resolution. Correct answer.
  3. To execute shellcode from the heap by making it executable.
  4. To bypass ASLR by reading the stack canary.

Explanation

Ret2dlresolve crafts fake dynamic structures on the stack and invokes the dynamic linker's resolver to resolve an arbitrary function symbol. This avoids the need for a libc leak because the resolver looks up the symbol and calls it, which is useful when ASLR is enabled and no leak is available.

Question 42Exploit Development

In a program with a stack buffer overflow, which condition allows a 'stack pivot' to be effective?

  1. The stack is executable and contains shellcode.
  2. The attacker can control a register or memory location that is used to set RSP before a ret. Correct answer.
  3. The binary is compiled as PIE.
  4. The stack canary is present and has been leaked.

Explanation

A stack pivot changes the stack pointer to point to attacker-controlled memory, such as a heap buffer or a ROP chain elsewhere. This is effective when the attacker can influence a register (e.g., via a leave instruction or a gadget like xchg rsp, rax) that is then used to redirect RSP.

Question 43Exploit Development

What does the term 'SROP' (Sigreturn-Oriented Programming) exploit?

  1. The stack canary's predictable value in forked processes.
  2. The heap allocator's free list to achieve arbitrary write.
  3. The sigreturn syscall's use of a fake signal frame on the stack to set all registers. Correct answer.
  4. The lazy binding of PLT entries to resolve addresses.

Explanation

SROP abuses the sigreturn system call, which restores a signal context from the stack. By crafting a fake sigframe, an attacker can set all registers to chosen values and then invoke a syscall, often achieving arbitrary code execution with a single gadget.

Question 44Exploit Development

When exploiting a heap overflow in glibc, what is the primary goal of corrupting the size field of a chunk?

  1. To disable ASLR for the process.
  2. To directly overwrite the return address on the stack.
  3. To leak the stack canary value.
  4. To cause the allocator to return a chunk that overlaps with other chunks or metadata. Correct answer.

Explanation

Corrupting a chunk's size field can trick the allocator during operations like consolidation or splitting, leading to overlapping chunks. Overlapping chunks allow an attacker to read or write memory that belongs to other allocations, often leading to further exploitation.

Question 45Exploit Development

Which of the following is a common way to find the offset to the instruction pointer in a cyclic pattern overflow?

  1. Using ltrace to intercept library calls and determine the offset.
  2. Using a debugger to examine the value of RIP after the crash and calculating its position in the cyclic pattern. Correct answer.
  3. Compiling the binary with -fno-stack-protector and observing the stack layout.
  4. Running the binary under strace and observing the syscall arguments.

Explanation

A cyclic pattern is a non-repeating sequence of bytes. When the overflow crashes, the value in RIP is a substring of the pattern; by locating that substring's offset in the pattern, the attacker determines the exact number of bytes needed to reach the return address.

Question 46Exploit Development

What is the main advantage of using a ROP chain over injecting shellcode on the stack when NX is enabled?

  1. ROP uses existing executable code, so it does not require the stack to be executable. Correct answer.
  2. ROP chains are shorter and simpler to construct than shellcode.
  3. ROP avoids the need for a stack canary bypass.
  4. ROP automatically bypasses ASLR without any leak.

Explanation

With NX, the stack is non-executable, so injected shellcode cannot run. ROP reuses code already present in executable memory (gadgets), allowing arbitrary computation without executing data on the stack.

Question 47Exploit Development

In a 64-bit Linux process, which syscall number corresponds to the execve system call?

  1. 1
  2. 59 Correct answer.
  3. 11
  4. 2

Explanation

On x86-64 Linux, the execve syscall has number 59. This number must be placed in RAX before invoking the syscall instruction when writing shellcode or ROP chains that execute a program.

Question 48Exploit Development

Which of the following best describes the 'House of Spirit' heap exploitation technique?

  1. It overwrites the top chunk size to enable allocation at an arbitrary address.
  2. It tricks the allocator into returning a pointer to a fake chunk located in attacker-controlled memory, such as on the stack. Correct answer.
  3. It corrupts the tcache per-thread structure to achieve arbitrary write.
  4. It uses a double-free in fastbins to create overlapping chunks.

Explanation

House of Spirit involves crafting a fake chunk in an area the attacker controls, such as a stack buffer, and then freeing it. When the allocator later services an allocation of the same size, it returns a pointer to that fake chunk, allowing the attacker to write to that location.

Question 49Exploit Development

When bypassing ASLR on a 64-bit Linux system with a format string vulnerability, which approach allows writing a controlled value to a specific address?

  1. Using %n to write the number of printed characters to a pointer supplied on the stack. Correct answer.
  2. Using %s to read memory at an arbitrary address.
  3. Using %x to leak the canary.
  4. Using %p to print stack values and derive the base address.

Explanation

%n writes the count of characters printed so far to the address pointed to by its argument. By placing the target address on the stack and using width specifiers to control the count, an attacker can write arbitrary values to arbitrary addresses, enabling GOT overwrites or other modifications.

Question 50Exploit Development

In the context of glibc's malloc, what is the primary effect of the tcache introduced in glibc 2.26?

  1. It encrypts heap pointers to prevent corruption.
  2. It enforces safe-linking on all freed chunks by default.
  3. It adds a per-thread cache of freed chunks that speeds up allocation and introduces new exploitation primitives due to reduced integrity checks. Correct answer.
  4. It removes fastbins entirely, consolidating all small allocations into the unsorted bin.

Explanation

The tcache is a per-thread cache that stores recently freed chunks for fast reuse. In its initial implementation, it had minimal integrity checks, making tcache poisoning a powerful exploitation primitive. Later versions added safe-linking and other checks.