OSCP Buffer Overflow 5

Question 1

When crafting a buffer overflow exploit in Python, what struct.pack format is used to convert an integer address like 0x0049BF4A into little-endian bytes?

Accepted Answer

struct.pack('<I', 0x0049BF4A)

Answer

'<I' specifies little-endian unsigned int, which is required for x86 architecture where the least significant byte is stored at the lowest address.

Question 2

In a network-based buffer overflow exploit, the vulnerable service reads input until it sees '
'. Your payload must avoid this sequence. Why?

Accepted Answer

acts as a delimiter that terminates the read, truncating your payload

Answer

Network protocols often use 
 as line terminators; if present inside the payload, the service stops reading, cutting off the shellcode.

Question 3

After successfully exploiting a buffer overflow to get a reverse shell, you find you have low-privileged access. What OSCP methodology comes next?

Accepted Answer

Perform local privilege escalation enumeration to elevate from the current user

Answer

Post-exploitation privilege escalation (checking misconfigurations, unquoted paths, weak service permissions, etc.) is the next step after gaining initial access.

Question 4

What command in GDB is used to examine 20 words of memory at the ESP register to verify shellcode placement?

Accepted Answer

x/20x $esp

Answer

The 'x' (examine) command with format specifier x/20x $esp shows 20 hex words starting at ESP, allowing verification of stack contents.

Question 5

A vulnerable program uses strcpy() to copy user input into a fixed-size buffer. Why is strcpy() exploitable compared to strncpy()?

Accepted Answer

strcpy() copies until a null byte with no length check, allowing overflow of adjacent memory

Answer

strcpy() does not check the destination buffer size and copies until null termination, so oversized input overwrites adjacent stack data including the return address.

OSCP - Offensive Security Certified Professional Practice Test

OSCP - Offensive Security Certified Professional Practice Test

OSCP Buffer Overflow 5