CVA CVA Exploit Frameworks & Attack Vectors 2 — Questions and Answers
Question 1: What is a 'buffer overflow' vulnerability and how is it typically exploited?
- A network protocol error causing packet loss
- A programming flaw where more data is written to a fixed-size buffer than it can hold, allowing attackers to overwrite adjacent memory including return addresses (Correct answer)
- A database query error causing data corruption
- A web application vulnerability allowing file inclusion
Correct answer: A programming flaw where more data is written to a fixed-size buffer than it can hold, allowing attackers to overwrite adjacent memory including return addresses
Buffer overflow vulnerabilities occur when programs fail to validate input size, allowing attackers to overwrite adjacent memory — including function return addresses — to redirect code execution.
Question 2: Which attack technique involves manipulating the return address on the stack to point to attacker-controlled shellcode?
- Heap spray
- Stack-based buffer overflow (Correct answer)
- Use-after-free
- Integer overflow
Correct answer: Stack-based buffer overflow
Stack-based buffer overflow overwrites the saved return address on the program's stack, redirecting execution to attacker-supplied shellcode when the function returns.
Question 3: What does 'fuzzing' accomplish in vulnerability research and assessment?
- Encrypting network communications to assess cipher strength
- Sending large amounts of random, malformed, or unexpected input to applications to discover crashes and potential vulnerabilities (Correct answer)
- Scanning for open network ports and services
- Analyzing application source code for logical flaws
Correct answer: Sending large amounts of random, malformed, or unexpected input to applications to discover crashes and potential vulnerabilities
Fuzzing automatically generates malformed inputs and monitors target applications for crashes, unexpected behavior, or security violations that indicate exploitable vulnerabilities.
Question 4: What is a 'use-after-free' vulnerability?
- A vulnerability where freed memory is subsequently accessed and potentially controlled by an attacker to achieve code execution (Correct answer)
- A web vulnerability allowing reuse of expired session tokens
- A database vulnerability enabling reuse of deleted records
- A network protocol flaw allowing session replay
Correct answer: A vulnerability where freed memory is subsequently accessed and potentially controlled by an attacker to achieve code execution
Use-after-free vulnerabilities occur when a program continues to use a memory pointer after the referenced memory has been freed, allowing attackers to control the freed memory and achieve code execution.
Question 5: During a vulnerability assessment, you encounter a Windows system without the MS17-010 patch. Which well-known exploit targets this vulnerability?
- Heartbleed
- EternalBlue (Correct answer)
- Shellshock
- Dirty COW
Correct answer: EternalBlue
EternalBlue exploits a critical SMB protocol vulnerability (MS17-010) in Windows, and was famously used by the WannaCry and NotPetya ransomware attacks.
Question 6: What is 'pass-the-hash' and why is it significant in post-exploitation?
- Cracking password hashes using rainbow tables
- Using captured NTLM password hashes to authenticate to services without knowing the plaintext password (Correct answer)
- Hashing data to verify file integrity after exploitation
- Passing encrypted credentials between domain controllers
Correct answer: Using captured NTLM password hashes to authenticate to services without knowing the plaintext password
Pass-the-hash uses a captured NTLM hash directly for authentication against Windows services, bypassing the need to crack the hash to plaintext — enabling lateral movement across the network.
CVA CVA Exploit Frameworks & Attack Vectors 2
What is a 'buffer overflow' vulnerability and how is it typically exploited?