OSCP Buffer Overflow 5 — Questions and Answers
Question 1: When crafting a buffer overflow exploit in Python, what struct.pack format is used to convert an integer address like 0x0049BF4A into little-endian bytes?
- struct.pack('>I', 0x0049BF4A)
- struct.pack('<I', 0x0049BF4A) (Correct answer)
- struct.pack('!I', 0x0049BF4A)
- struct.pack('=I', 0x0049BF4A)
Correct answer: struct.pack('<I', 0x0049BF4A)
'<I' specifies little-endian unsigned int, which is required for x86 architecture where the least significant byte is stored at the lowest address.
Question 2: In a network-based buffer overflow exploit, the vulnerable service reads input until it sees '\r\n'. Your payload must avoid this sequence. Why?
- \r\n will cause the service to restart before processing the buffer
- \r\n acts as a delimiter that terminates the read, truncating your payload (Correct answer)
- \r\n is automatically converted to shellcode by the service parser
- \r\n triggers ASLR re-randomization in Windows services
Correct answer: \r\n acts as a delimiter that terminates the read, truncating your payload
Network protocols often use \r\n as line terminators; if present inside the payload, the service stops reading, cutting off the shellcode.
Question 3: After successfully exploiting a buffer overflow to get a reverse shell, you find you have low-privileged access. What OSCP methodology comes next?
- Re-exploit the same vulnerability with a different payload to get SYSTEM
- Perform local privilege escalation enumeration to elevate from the current user (Correct answer)
- Use the buffer overflow to inject a second shellcode directly as SYSTEM
- Restart the exploit with a bind shell instead of a reverse shell
Correct answer: Perform local privilege escalation enumeration to elevate from the current user
Post-exploitation privilege escalation (checking misconfigurations, unquoted paths, weak service permissions, etc.) is the next step after gaining initial access.
Question 4: What command in GDB is used to examine 20 words of memory at the ESP register to verify shellcode placement?
- display/20x $esp
- x/20x $esp (Correct answer)
- dump memory /tmp/stack.bin $esp $esp+80
- info registers esp 20
Correct answer: x/20x $esp
The 'x' (examine) command with format specifier x/20x $esp shows 20 hex words starting at ESP, allowing verification of stack contents.
Question 5: A vulnerable program uses strcpy() to copy user input into a fixed-size buffer. Why is strcpy() exploitable compared to strncpy()?
- strcpy() is slower and allows more time for the exploit to execute
- strcpy() copies until a null byte with no length check, allowing overflow of adjacent memory (Correct answer)
- strcpy() converts input to wide chars that overwrite more stack space
- strcpy() skips the stack canary check in older glibc versions
Correct answer: strcpy() copies until a null byte with no length check, allowing overflow of adjacent memory
strcpy() does not check the destination buffer size and copies until null termination, so oversized input overwrites adjacent stack data including the return address.
Question 6: You run msf-pattern_offset with the 4 bytes found in EIP (41306241) and get offset 1978. Your exploit buffer should look like which of the following?
- 'A' * 1978 + EIP + shellcode (Correct answer)
- 'A' * 1982 + EIP + shellcode
- 'A' * 1974 + EIP + shellcode
- 'A' * 1978 + shellcode + EIP
Correct answer: 'A' * 1978 + EIP + shellcode
1978 A's fill the buffer up to EIP, the next 4 bytes overwrite EIP with your chosen address, then the shellcode follows in the remaining buffer.
Question 7: When verifying EIP control in a buffer overflow, you write 4 B's (\x42\x42\x42\x42) at the calculated offset. The debugger shows EIP = 42424242. What does this confirm?
- The exploit has already succeeded and a shell is ready
- You have precise control over the return address and can place any 4-byte address in EIP (Correct answer)
- The binary is not ASLR-protected so all addresses are static
- The buffer is exactly 4 bytes too small and needs adjustment
Correct answer: You have precise control over the return address and can place any 4-byte address in EIP
EIP containing 0x42424242 confirms the offset is correct and you can substitute those 4 bytes with any address — such as a JMP ESP gadget — to redirect execution.
OSCP Buffer Overflow 5
When crafting a buffer overflow exploit in Python, what struct.pack format is used to convert an integer address like 0x0049BF4A into little-endian bytes?