OSCP Buffer Overflow 3 — Questions and Answers
Question 1: When a module shows 'Rebase: False, SafeSEH: False, ASLR: False, NXCompat: False' in Mona, what does this indicate for exploitation?
- The module is patched and cannot be used for gadgets
- The module's addresses are static and safe to use as JMP ESP targets (Correct answer)
- The module enforces DEP and requires ROP chains
- The module uses stack cookies that must be leaked first
Correct answer: The module's addresses are static and safe to use as JMP ESP targets
All protections disabled means the module loads at a fixed base address every time, making its instruction addresses reliable for exploitation.
Question 2: During SEH-based buffer overflow exploitation, what two values must be overwritten in the SEH chain?
- EIP and ESP
- nSEH (next SEH) and SEH handler address (Correct answer)
- EBP and return address
- TEB and PEB pointers
Correct answer: nSEH (next SEH) and SEH handler address
In SEH overwrites, nSEH is replaced with a short jump over itself and the handler pointer is replaced with a POP POP RET gadget address.
Question 3: What is the purpose of placing '\xeb\x06\x90\x90' in the nSEH position of an SEH buffer overflow exploit?
- It triggers a divide-by-zero exception to chain to the next handler
- It is a short forward jump that skips over the 4-byte SEH handler pointer (Correct answer)
- It is an encoded NOP sled that bypasses SafeSEH
- It patches the exception dispatcher to call shellcode directly
Correct answer: It is a short forward jump that skips over the 4-byte SEH handler pointer
\xeb\x06 is a 2-byte short JMP +6 that jumps past the 4-byte SEH handler overwrite, landing in the NOP sled before shellcode.
Question 4: In Windows x86 exploitation, a POP POP RET gadget is used in SEH overwrites because it accomplishes what?
- It pops shellcode off the stack into EIP directly
- It removes two stack values then returns to the address stored in ESP, which points to nSEH (Correct answer)
- It disables the SafeSEH check by corrupting the SEH validation table
- It slides execution through the NOP sled to shellcode
Correct answer: It removes two stack values then returns to the address stored in ESP, which points to nSEH
POP POP RET adjusts ESP past the exception record pointers so that RET loads the nSEH address into EIP.
Question 5: Which msfvenom encoder is commonly used when 0x00, 0x0a, and 0x0d are bad characters and encoding is required?
- x86/shikata_ga_nai (Correct answer)
- x64/xor_dynamic
- x86/alpha_mixed
- x86/call4_dword_xor
Correct answer: x86/shikata_ga_nai
x86/shikata_ga_nai is a polymorphic XOR encoder that avoids null bytes and other common bad characters by default.
Question 6: After generating shellcode with msfvenom for a reverse shell, what local command must be running to catch the connection?
- netcat on port 4444 in server mode
- A Metasploit multi/handler configured with matching payload and LHOST/LPORT (Correct answer)
- An HTTP server to deliver the second stage
- msfvenom in listener mode on the attacker machine
Correct answer: A Metasploit multi/handler configured with matching payload and LHOST/LPORT
A Metasploit multi/handler (or netcat for simple shells) must listen on the attacker's LHOST:LPORT matching the shellcode's compiled-in values.
Question 7: When testing badchars, you send \x01 through \xff in the payload. In the debugger's stack dump, \x0a is missing and \x0b appears as \x00. What can you conclude?
- Only 0x0a is a bad character
- Both 0x0a and 0x0b are bad characters (Correct answer)
- 0x0b is a bad character; 0x0a may be fine since it is absent
- Neither is bad — the debugger view is truncated
Correct answer: Both 0x0a and 0x0b are bad characters
A missing byte means it was stripped (bad), and a corrupted subsequent byte indicates the bad char caused corruption — both must be excluded.
OSCP Buffer Overflow 3
When a module shows 'Rebase: False, SafeSEH: False, ASLR: False, NXCompat: False' in Mona, what does this indicate for exploitation?