OSCP Buffer Overflow 5

Question 1

When crafting a buffer overflow exploit in Python, what struct.pack format is used to convert an integer address like 0x0049BF4A into little-endian bytes?

Accepted Answer

struct.pack('<I', 0x0049BF4A)

Answer

struct.pack('>I', 0x0049BF4A)

Answer

struct.pack('!I', 0x0049BF4A)

Answer

struct.pack('=I', 0x0049BF4A)

Question 2

In a network-based buffer overflow exploit, the vulnerable service reads input until it sees '
'. Your payload must avoid this sequence. Why?

Accepted Answer

acts as a delimiter that terminates the read, truncating your payload

Answer

will cause the service to restart before processing the buffer

Answer

is automatically converted to shellcode by the service parser

Answer

triggers ASLR re-randomization in Windows services

Question 3

After successfully exploiting a buffer overflow to get a reverse shell, you find you have low-privileged access. What OSCP methodology comes next?

Accepted Answer

Perform local privilege escalation enumeration to elevate from the current user

Answer

Re-exploit the same vulnerability with a different payload to get SYSTEM

Answer

Use the buffer overflow to inject a second shellcode directly as SYSTEM

Answer

Restart the exploit with a bind shell instead of a reverse shell

Question 4

What command in GDB is used to examine 20 words of memory at the ESP register to verify shellcode placement?

Accepted Answer

x/20x $esp

Answer

display/20x $esp

Answer

dump memory /tmp/stack.bin $esp $esp+80

Answer

info registers esp 20

Question 5

A vulnerable program uses strcpy() to copy user input into a fixed-size buffer. Why is strcpy() exploitable compared to strncpy()?

Accepted Answer

strcpy() copies until a null byte with no length check, allowing overflow of adjacent memory

Answer

strcpy() is slower and allows more time for the exploit to execute

Answer

strcpy() converts input to wide chars that overwrite more stack space

Answer

strcpy() skips the stack canary check in older glibc versions

Question 6

You run msf-pattern_offset with the 4 bytes found in EIP (41306241) and get offset 1978. Your exploit buffer should look like which of the following?

Accepted Answer

'A' * 1978 + EIP + shellcode

Answer

'A' * 1982 + EIP + shellcode

Answer

'A' * 1974 + EIP + shellcode

Answer

'A' * 1978 + shellcode + EIP

Question 7

When verifying EIP control in a buffer overflow, you write 4 B's (\x42\x42\x42\x42) at the calculated offset. The debugger shows EIP = 42424242. What does this confirm?

Accepted Answer

You have precise control over the return address and can place any 4-byte address in EIP

Answer

The exploit has already succeeded and a shell is ready

Answer

The binary is not ASLR-protected so all addresses are static

Answer

The buffer is exactly 4 bytes too small and needs adjustment