OSCP Buffer Overflow 2

Question 1

During a Windows x86 buffer overflow, after overwriting EIP, what is the typical next step to redirect execution to your shellcode?

Accepted Answer

Find a JMP ESP gadget in a non-ASLR module

Answer

A JMP ESP instruction in a module without ASLR redirects execution to the top of the stack where shellcode resides.

Question 2

What does the 'badchars' identification step accomplish in a buffer overflow exploit?

Accepted Answer

It finds characters that corrupt or truncate shellcode in memory

Answer

Bad characters are bytes that get modified, dropped, or cause early string termination, which would break shellcode execution.

Question 3

In Immunity Debugger, what is the purpose of the Mona plugin command '!mona jmp -r esp'?

Accepted Answer

It searches all loaded modules for JMP ESP instructions

Answer

'!mona jmp -r esp' finds all JMP ESP (or equivalent) instructions across loaded modules for use as an EIP redirect.

Question 4

When using msfvenom to generate shellcode for a Windows buffer overflow, which flag specifies characters to exclude from the payload?

Accepted Answer

-b

Answer

The -b flag in msfvenom specifies bad characters to exclude from the generated shellcode.

Question 5

Why are NOP sleds (\x90 instructions) typically prepended before shellcode in a buffer overflow payload?

Accepted Answer

They provide a landing zone that tolerates slight ESP offset variations

Answer

A NOP sled gives the exploit tolerance for minor address variations — the CPU slides through NOPs until reaching the shellcode.

OSCP - Offensive Security Certified Professional Practice Test