OSCP Buffer Overflow 3

Question 1

When a module shows 'Rebase: False, SafeSEH: False, ASLR: False, NXCompat: False' in Mona, what does this indicate for exploitation?

Accepted Answer

The module's addresses are static and safe to use as JMP ESP targets

Answer

All protections disabled means the module loads at a fixed base address every time, making its instruction addresses reliable for exploitation.

Question 2

During SEH-based buffer overflow exploitation, what two values must be overwritten in the SEH chain?

Accepted Answer

nSEH (next SEH) and SEH handler address

Answer

In SEH overwrites, nSEH is replaced with a short jump over itself and the handler pointer is replaced with a POP POP RET gadget address.

Question 3

What is the purpose of placing '\xeb\x06\x90\x90' in the nSEH position of an SEH buffer overflow exploit?

Accepted Answer

It is a short forward jump that skips over the 4-byte SEH handler pointer

Answer

\xeb\x06 is a 2-byte short JMP +6 that jumps past the 4-byte SEH handler overwrite, landing in the NOP sled before shellcode.

Question 4

In Windows x86 exploitation, a POP POP RET gadget is used in SEH overwrites because it accomplishes what?

Accepted Answer

It removes two stack values then returns to the address stored in ESP, which points to nSEH

Answer

POP POP RET adjusts ESP past the exception record pointers so that RET loads the nSEH address into EIP.

Question 5

Which msfvenom encoder is commonly used when 0x00, 0x0a, and 0x0d are bad characters and encoding is required?

Accepted Answer

x86/shikata_ga_nai

Answer

x86/shikata_ga_nai is a polymorphic XOR encoder that avoids null bytes and other common bad characters by default.

OSCP - Offensive Security Certified Professional Practice Test