OSCP Buffer Overflow 4

Question 1

What does ASLR (Address Space Layout Randomization) do that complicates standard buffer overflow exploitation?

Accepted Answer

It randomizes base addresses of the stack, heap, and libraries each run, making hardcoded addresses unreliable

Answer

ASLR randomizes memory layout on each execution, so a hardcoded JMP ESP or shellcode address will be invalid on the next run.

Question 2

A stack canary (stack cookie) mitigation places a random value before the saved return address. What exploitation technique can defeat it without leaking the canary?

Accepted Answer

Using a heap overflow to corrupt a function pointer instead of the stack return address

Answer

Targeting heap-based function pointers or other non-stack control flow bypasses the stack canary entirely since the canary check only guards the stack.

Question 3

In a DEP (Data Execution Prevention) environment, why does placing shellcode on the stack and jumping to it fail?

Accepted Answer

DEP marks the stack memory page as non-executable, causing a fault when ESP-resident code is executed

Answer

DEP enforces a W^X (write XOR execute) policy: pages that are writable (like the stack) are marked non-executable, so code injected there faults.

Question 4

Return-Oriented Programming (ROP) is used to bypass DEP. What are ROP gadgets?

Accepted Answer

Short sequences of existing executable instructions ending in a RET, chained via the stack

Answer

ROP chains existing code (gadgets: instruction sequences ending in RET) already marked executable to perform arbitrary operations without injecting new code.

Question 5

During OSCP buffer overflow labs, the 'spike' tool is used. What is its primary function?

Accepted Answer

It performs protocol fuzzing by sending malformed data to network services

Answer

SPIKE is a fuzzing framework that sends progressively mutated protocol-aware input to network services to identify crash-inducing inputs.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Buffer Overflow 4