OSCP Buffer Overflow 4 — Questions and Answers
Question 1: What does ASLR (Address Space Layout Randomization) do that complicates standard buffer overflow exploitation?
- It encrypts the stack so shellcode cannot execute
- It randomizes base addresses of the stack, heap, and libraries each run, making hardcoded addresses unreliable (Correct answer)
- It inserts stack canaries before every function return
- It marks all memory pages as non-executable by default
Correct answer: It randomizes base addresses of the stack, heap, and libraries each run, making hardcoded addresses unreliable
ASLR randomizes memory layout on each execution, so a hardcoded JMP ESP or shellcode address will be invalid on the next run.
Question 2: A stack canary (stack cookie) mitigation places a random value before the saved return address. What exploitation technique can defeat it without leaking the canary?
- Overwriting only up to the canary byte and using a format string to skip past it
- Using a heap overflow to corrupt a function pointer instead of the stack return address (Correct answer)
- Encoding shellcode with shikata_ga_nai to bypass canary checks
- Jumping directly to the libc system() call via a JMP ESP gadget
Correct answer: Using a heap overflow to corrupt a function pointer instead of the stack return address
Targeting heap-based function pointers or other non-stack control flow bypasses the stack canary entirely since the canary check only guards the stack.
Question 3: In a DEP (Data Execution Prevention) environment, why does placing shellcode on the stack and jumping to it fail?
- DEP encrypts stack contents so the CPU cannot decode the shellcode
- DEP marks the stack memory page as non-executable, causing a fault when ESP-resident code is executed (Correct answer)
- DEP randomizes the stack base address so JMP ESP misses the shellcode
- DEP inserts hardware breakpoints at the stack boundary to detect shellcode
Correct answer: DEP marks the stack memory page as non-executable, causing a fault when ESP-resident code is executed
DEP enforces a W^X (write XOR execute) policy: pages that are writable (like the stack) are marked non-executable, so code injected there faults.
Question 4: Return-Oriented Programming (ROP) is used to bypass DEP. What are ROP gadgets?
- Shellcode stubs stored in the .text section of the target binary
- Short sequences of existing executable instructions ending in a RET, chained via the stack (Correct answer)
- Heap spray payloads that pivot execution to a non-DEP region
- NOP slides encoded to avoid DEP page permission checks
Correct answer: Short sequences of existing executable instructions ending in a RET, chained via the stack
ROP chains existing code (gadgets: instruction sequences ending in RET) already marked executable to perform arbitrary operations without injecting new code.
Question 5: During OSCP buffer overflow labs, the 'spike' tool is used. What is its primary function?
- It generates cyclic De Bruijn sequences for offset finding
- It performs protocol fuzzing by sending malformed data to network services (Correct answer)
- It scans for JMP ESP gadgets in loaded modules
- It captures crash dumps from a running process
Correct answer: It performs protocol fuzzing by sending malformed data to network services
SPIKE is a fuzzing framework that sends progressively mutated protocol-aware input to network services to identify crash-inducing inputs.
Question 6: You are exploiting a buffer overflow and your reverse shell payload is 400 bytes. The buffer space after EIP is only 300 bytes. What is the best solution?
- Use a smaller encoder to shrink the shellcode below 300 bytes
- Jump backward to earlier buffer space or use a first-stage egghunter payload (Correct answer)
- Split the shellcode across multiple packets and reassemble in memory
- Use a null-free payload since null bytes take less space
Correct answer: Jump backward to earlier buffer space or use a first-stage egghunter payload
When available space after EIP is too small, a short egghunter (about 32 bytes) or a backward JMP to earlier buffer space where the full shellcode fits is the standard solution.
Question 7: What is an egghunter shellcode and when is it used in buffer overflow exploitation?
- A shellcode that exploits heap metadata to escalate privileges
- A small stub (~32 bytes) that searches process memory for a 8-byte tag preceding the real shellcode (Correct answer)
- A NOP sled variant that egg-hunts for the correct stack offset
- A Metasploit module that fuzzes for the overflow offset automatically
Correct answer: A small stub (~32 bytes) that searches process memory for a 8-byte tag preceding the real shellcode
An egghunter is a tiny payload that scans memory for a unique 4-byte tag repeated twice, then jumps to the full shellcode placed elsewhere in memory.
OSCP Buffer Overflow 4
What does ASLR (Address Space Layout Randomization) do that complicates standard buffer overflow exploitation?