CVA Exploit Frameworks & Attack Vectors Flashcards

What is a 'buffer overflow' vulnerability and how is it typically exploited?

Answer: A programming flaw where more data is written to a fixed-size buffer than it can hold, allowing attackers to overwrite adjacent memory including return addresses

Buffer overflow vulnerabilities occur when programs fail to validate input size, allowing attackers to overwrite adjacent memory — including function return addresses — to redirect code execution.

Which attack technique involves manipulating the return address on the stack to point to attacker-controlled shellcode?

Answer: Stack-based buffer overflow

Stack-based buffer overflow overwrites the saved return address on the program's stack, redirecting execution to attacker-supplied shellcode when the function returns.

What does 'fuzzing' accomplish in vulnerability research and assessment?

Answer: Sending large amounts of random, malformed, or unexpected input to applications to discover crashes and potential vulnerabilities

Fuzzing automatically generates malformed inputs and monitors target applications for crashes, unexpected behavior, or security violations that indicate exploitable vulnerabilities.

What is a 'use-after-free' vulnerability?

Answer: A vulnerability where freed memory is subsequently accessed and potentially controlled by an attacker to achieve code execution

Use-after-free vulnerabilities occur when a program continues to use a memory pointer after the referenced memory has been freed, allowing attackers to control the freed memory and achieve code execution.

During a vulnerability assessment, you encounter a Windows system without the MS17-010 patch. Which well-known exploit targets this vulnerability?

Answer: EternalBlue

EternalBlue exploits a critical SMB protocol vulnerability (MS17-010) in Windows, and was famously used by the WannaCry and NotPetya ransomware attacks.

What is 'pass-the-hash' and why is it significant in post-exploitation?

Answer: Using captured NTLM password hashes to authenticate to services without knowing the plaintext password

Pass-the-hash uses a captured NTLM hash directly for authentication against Windows services, bypassing the need to crack the hash to plaintext — enabling lateral movement across the network.