OSCP Buffer Overflow 2 — Questions and Answers
Question 1: During a Windows x86 buffer overflow, after overwriting EIP, what is the typical next step to redirect execution to your shellcode?
- Set a breakpoint at the return address
- Find a JMP ESP gadget in a non-ASLR module (Correct answer)
- Overwrite the SEH chain with NOP slides
- Patch the binary to disable stack canaries
Correct answer: Find a JMP ESP gadget in a non-ASLR module
A JMP ESP instruction in a module without ASLR redirects execution to the top of the stack where shellcode resides.
Question 2: What does the 'badchars' identification step accomplish in a buffer overflow exploit?
- It determines the exact offset to EIP
- It finds characters that corrupt or truncate shellcode in memory (Correct answer)
- It locates the JMP ESP instruction address
- It generates the final payload with msfvenom
Correct answer: It finds characters that corrupt or truncate shellcode in memory
Bad characters are bytes that get modified, dropped, or cause early string termination, which would break shellcode execution.
Question 3: In Immunity Debugger, what is the purpose of the Mona plugin command '!mona jmp -r esp'?
- It calculates the cyclic pattern offset
- It searches all loaded modules for JMP ESP instructions (Correct answer)
- It generates shellcode with no bad characters
- It bypasses DEP by finding ROP gadgets
Correct answer: It searches all loaded modules for JMP ESP instructions
'!mona jmp -r esp' finds all JMP ESP (or equivalent) instructions across loaded modules for use as an EIP redirect.
Question 4: When using msfvenom to generate shellcode for a Windows buffer overflow, which flag specifies characters to exclude from the payload?
- -e
- -b (Correct answer)
- -x
- -n
Correct answer: -b
The -b flag in msfvenom specifies bad characters to exclude from the generated shellcode.
Question 5: Why are NOP sleds (\x90 instructions) typically prepended before shellcode in a buffer overflow payload?
- They increase the total payload size to trigger the overflow
- They provide a landing zone that tolerates slight ESP offset variations (Correct answer)
- They obfuscate the shellcode from antivirus detection
- They act as padding to align the stack to a 16-byte boundary
Correct answer: They provide a landing zone that tolerates slight ESP offset variations
A NOP sled gives the exploit tolerance for minor address variations — the CPU slides through NOPs until reaching the shellcode.
Question 6: A fuzzer sends increasingly large strings to a vulnerable service and it crashes when the buffer is 1100 bytes. What is the correct next step?
- Send a cyclic pattern of 1100 bytes to find the exact EIP offset (Correct answer)
- Immediately generate shellcode and attempt exploitation
- Use GDB to find the JMP ESP address
- Send 2200 bytes to confirm the overflow is repeatable
Correct answer: Send a cyclic pattern of 1100 bytes to find the exact EIP offset
After identifying the crash size, a unique cyclic pattern (e.g., from msf-pattern_create) of that length is sent to determine the exact EIP offset.
Question 7: Which register is typically inspected after a crash to find the EIP offset when using a Metasploit cyclic pattern?
- EAX
- ECX
- EIP (Correct answer)
- ESP
Correct answer: EIP
EIP contains the 4-byte value from the cyclic pattern at crash time, which msf-pattern_offset uses to calculate the exact offset.
OSCP Buffer Overflow 2
During a Windows x86 buffer overflow, after overwriting EIP, what is the typical next step to redirect execution to your shellcode?