PEN-200 Buffer Overflow Fundamentals — 10 Questions

Question 1

In the context of the PEN-200, why is the 'JMP ESP' instruction considered the 'gold standard' for stack-based overflows?

Accepted Answer

It effectively jumps to the location where the shellcode resides.. JMP ESP is the gold standard because it effectively redirects the CPU to the current location of the stack pointer. Since the attacker has already filled the stack with their shellcode, this instruction acts as a reliable bridge. It is frequently found in common system DLLs, making it easily accessible for redirecting the instruction pointer to the shellcode without needing to know the exact, changing memory address of the stack buffer.

Answer

It is the only instruction that can bypass DEP.

Answer

It automatically cleans up the stack frame for the shellcode.

Answer

It is the only instruction that does not contain bad characters.

Question 2

You are developing an exploit for a 32-bit Windows application. After sending a 5000-byte payload, you observe that the EIP value is 0x41414141. However, your payload contains no 'A' characters after byte 2000. What is the most likely reason for this EIP value?

Accepted Answer

The EIP was overwritten by a previous test run where the buffer was filled with 'A's, and the crash is not from the current payload.. The EIP value 0x41414141 indicates that the register was overwritten with 'A' characters. Since the current payload lacks 'A's after byte 2000, the value must originate from a prior state. In Windows debugging, if the service is not restarted between tests, the memory may retain previous data. Therefore, the crash is likely from an earlier payload. Restarting the service and resending the current payload would clarify the true offset.

Answer

The application is using a different character encoding that converts your payload to 'A's.

Answer

The application is interpreting the payload as Unicode, causing each byte to be expanded to two bytes, resulting in 'A's.

Answer

The offset to EIP is actually 2000 bytes, and the 'A's are from the first part of the payload.

Question 3

You are exploiting a stack-based buffer overflow on a Linux x86-64 binary. You have determined the offset to overwrite the return address. Which TWO of the following steps are essential to achieve reliable code execution? (Choose two.)

Accepted Answer

Identify a gadget to set the RDI register to point to "/bin/sh".. To reliably execute a shell via a buffer overflow on x86-64 Linux, you typically need to control RDI to pass the argument to system(), and you need the address of system() or a one-gadget. These steps bypass ASLR and NX. Executable stack or NOP sleds are not essential and are often unreliable.

Answer

Overwrite the saved return address with a pointer to the stack.

Answer

Ensure the stack is executable to run shellcode directly.

Answer

Use a NOP sled to increase the chance of landing on shellcode.

Question 4

You are preparing to exploit a stack-based buffer overflow in a 32-bit Windows application. You have identified the offset to EIP and found a reliable JMP ESP instruction. Which TWO of the following steps are essential to ensure the shellcode executes successfully? (Choose two.)

Accepted Answer

Ensure the shellcode is placed immediately after the JMP ESP address in the buffer.. The essential steps are to ensure the JMP ESP address is free of bad characters and that the shellcode is placed immediately after the return address so ESP points to it. A NOP sled is not required because JMP ESP provides a direct jump, and encoding or disabling ASLR are not universally necessary. These two steps guarantee that the overwrite is clean and execution flows into the shellcode.

Answer

Encode the shellcode with an XOR encoder to avoid bad characters.

Answer

Use a NOP sled before the shellcode to increase the chance of landing on it.

Answer

Disable ASLR on the target system to ensure the JMP ESP address is static.

Question 5

You are exploiting a stack-based buffer overflow in a Linux x86 binary. The binary has NX enabled, but you have identified a way to leak a stack address. You plan to use a return-to-libc attack to call system("/bin/sh"). Which TWO of the following are required to successfully execute this attack? (Choose two.)

Accepted Answer

A pointer to the string "/bin/sh" in memory.. Return-to-libc on Linux requires overwriting the return address with the address of system() and arranging for its argument to point to "/bin/sh". The offset to the return address is a given from the overflow analysis. JMP ESP and POP POP RET are irrelevant because they pertain to different exploitation techniques and platforms. Thus, the essential components are the system() address and a pointer to the command string.

Answer

A JMP ESP instruction in a non-ASLR module.

Answer

A POP POP RET sequence to bypass SafeSEH.

Answer

The exact offset to the saved return address.

Question 6

You are analyzing a 32-bit Windows executable and notice that the stack is executable. You want to place your shellcode directly on the stack and redirect execution to it. Which of the following is the most reliable way to redirect execution to your shellcode?

Accepted Answer

Overwrite the saved return address with the address of a JMP ESP instruction.. With an executable stack, the most reliable redirection method is to overwrite the saved return address with the address of a JMP ESP instruction. This instruction jumps to the stack pointer, which points to the shellcode placed after the overwritten return address. The address of JMP ESP must be from a module without ASLR to ensure it is static. This approach is standard in buffer overflow exploitation.

Answer

Overwrite the saved return address with the address of the shellcode on the stack.

Answer

Use a return-to-libc attack to call the system() function.

Answer

Overwrite the saved return address with the address of a POP POP RET sequence.

Question 7

You are preparing to exploit a stack-based buffer overflow in a 32-bit Linux binary running as a setuid root program. The binary is compiled without stack canaries and has no ASLR. You have confirmed EIP control and identified a suitable JMP ESP equivalent. Which TWO of the following steps are necessary to ensure reliable shellcode execution after overwriting the return address? (Choose two.)

Accepted Answer

Ensure that the shellcode is placed at an address that ESP will point to after the function returns, or adjust ESP with a stack pivot.. Reliable execution requires that the shellcode survives input processing (no bad characters) and that ESP points to it after the return. These two conditions ensure the payload is intact and reachable. Other options either duplicate existing conditions, introduce unreliability, or misunderstand privilege inheritance.

Answer

Compile the binary with stack protector disabled to prevent canary checks from interfering with the overflow.

Answer

Replace the JMP ESP address with a direct jump to the stack address where the shellcode resides to avoid using a module address.

Answer

Set the setuid bit on the shellcode binary to ensure it runs with root privileges.

Question 8

You are analyzing a 32-bit Windows application that crashes when a long string is sent to a network service. The crash occurs in a function that copies data into a 256-byte stack buffer using a loop that stops at a null byte. You have determined that the offset to EIP is 260 bytes. However, when you send a payload with 260 'A's followed by a JMP ESP address and shellcode, the application crashes but no shellcode executes. What is the most likely explanation?

Accepted Answer

ESP does not point to the beginning of the shellcode after the JMP ESP executes, so the CPU executes unintended bytes.. The most likely cause is that ESP does not point to the shellcode after JMP ESP executes. Even with correct EIP control, if ESP is misaligned, the CPU executes unintended bytes and crashes. A short jump or stack pivot can realign ESP with the payload. Null bytes would prevent EIP overwrite, and ASLR is not indicated.

Answer

The JMP ESP address contains a null byte, which terminates the string copy before the shellcode is fully written to the stack.

Answer

The shellcode contains a null byte, causing the copy loop to terminate before the return address is overwritten.

Answer

The application is protected by ASLR, so the JMP ESP address changes between runs.

Question 9

You are analyzing a binary and identify a function that uses strcpy() to copy user input into a fixed-size stack buffer. Which register must be controlled to redirect the instruction pointer to your shellcode?

Accepted Answer

The saved Return Address on the stack. To redirect the execution flow, you must overwrite the saved Return Address on the stack. When a function finishes, the CPU pops the value at the saved EIP/RIP location into the Instruction Pointer. By overflowing the buffer and reaching this specific memory location, you gain control over the program's subsequent execution path, which is the foundational concept for stack-based buffer overflow exploitation in the PEN-200 curriculum.

Answer

The ESP register

Answer

The EAX register

Answer

The EBP register

Question 10

Based on the exhibit, what is the primary risk if your shellcode contains the byte \x0d?

Accepted Answer

The application terminates the input string early. The exhibit lists \x0d as a bad character, which often acts as a carriage return in various network protocols or string-handling functions. If shellcode contains this byte, the application may truncate the input buffer prematurely, preventing the full payload from reaching the stack. This truncation causes the exploit to fail, as the shellcode becomes malformed or incomplete before the CPU can execute it during the return sequence.

Answer

The memory address becomes non-executable

Answer

The JMP ESP instruction fails to trigger

Answer

The CPU enters an infinite loop state