PEN-200 Buffer Overflow Fundamentals — Timed 25 Questions

Question 1

In the context of the PEN-200, why is the 'JMP ESP' instruction considered the 'gold standard' for stack-based overflows?

Accepted Answer

It effectively jumps to the location where the shellcode resides.. JMP ESP is the gold standard because it effectively redirects the CPU to the current location of the stack pointer. Since the attacker has already filled the stack with their shellcode, this instruction acts as a reliable bridge. It is frequently found in common system DLLs, making it easily accessible for redirecting the instruction pointer to the shellcode without needing to know the exact, changing memory address of the stack buffer.

Answer

It is the only instruction that can bypass DEP.

Answer

It automatically cleans up the stack frame for the shellcode.

Answer

It is the only instruction that does not contain bad characters.

Question 2

You are developing an exploit for a 32-bit Windows application. After sending a 5000-byte payload, you observe that the EIP value is 0x41414141. However, your payload contains no 'A' characters after byte 2000. What is the most likely reason for this EIP value?

Accepted Answer

The EIP was overwritten by a previous test run where the buffer was filled with 'A's, and the crash is not from the current payload.. The EIP value 0x41414141 indicates that the register was overwritten with 'A' characters. Since the current payload lacks 'A's after byte 2000, the value must originate from a prior state. In Windows debugging, if the service is not restarted between tests, the memory may retain previous data. Therefore, the crash is likely from an earlier payload. Restarting the service and resending the current payload would clarify the true offset.

Answer

The application is using a different character encoding that converts your payload to 'A's.

Answer

The application is interpreting the payload as Unicode, causing each byte to be expanded to two bytes, resulting in 'A's.

Answer

The offset to EIP is actually 2000 bytes, and the 'A's are from the first part of the payload.

Question 3

You are exploiting a stack-based buffer overflow on a Linux x86-64 binary. You have determined the offset to overwrite the return address. Which TWO of the following steps are essential to achieve reliable code execution? (Choose two.)

Accepted Answer

Identify a gadget to set the RDI register to point to "/bin/sh".. To reliably execute a shell via a buffer overflow on x86-64 Linux, you typically need to control RDI to pass the argument to system(), and you need the address of system() or a one-gadget. These steps bypass ASLR and NX. Executable stack or NOP sleds are not essential and are often unreliable.

Answer

Overwrite the saved return address with a pointer to the stack.

Answer

Ensure the stack is executable to run shellcode directly.

Answer

Use a NOP sled to increase the chance of landing on shellcode.

Question 4

You are preparing to exploit a stack-based buffer overflow in a 32-bit Windows application. You have identified the offset to EIP and found a reliable JMP ESP instruction. Which TWO of the following steps are essential to ensure the shellcode executes successfully? (Choose two.)

Accepted Answer

Ensure the shellcode is placed immediately after the JMP ESP address in the buffer.. The essential steps are to ensure the JMP ESP address is free of bad characters and that the shellcode is placed immediately after the return address so ESP points to it. A NOP sled is not required because JMP ESP provides a direct jump, and encoding or disabling ASLR are not universally necessary. These two steps guarantee that the overwrite is clean and execution flows into the shellcode.

Answer

Encode the shellcode with an XOR encoder to avoid bad characters.

Answer

Use a NOP sled before the shellcode to increase the chance of landing on it.

Answer

Disable ASLR on the target system to ensure the JMP ESP address is static.

Question 5

You are exploiting a stack-based buffer overflow in a Linux x86 binary. The binary has NX enabled, but you have identified a way to leak a stack address. You plan to use a return-to-libc attack to call system("/bin/sh"). Which TWO of the following are required to successfully execute this attack? (Choose two.)

Accepted Answer

A pointer to the string "/bin/sh" in memory.. Return-to-libc on Linux requires overwriting the return address with the address of system() and arranging for its argument to point to "/bin/sh". The offset to the return address is a given from the overflow analysis. JMP ESP and POP POP RET are irrelevant because they pertain to different exploitation techniques and platforms. Thus, the essential components are the system() address and a pointer to the command string.

Answer

A JMP ESP instruction in a non-ASLR module.

Answer

A POP POP RET sequence to bypass SafeSEH.

Answer

The exact offset to the saved return address.

Question 6

You are analyzing a 32-bit Windows executable and notice that the stack is executable. You want to place your shellcode directly on the stack and redirect execution to it. Which of the following is the most reliable way to redirect execution to your shellcode?

Accepted Answer

Overwrite the saved return address with the address of a JMP ESP instruction.. With an executable stack, the most reliable redirection method is to overwrite the saved return address with the address of a JMP ESP instruction. This instruction jumps to the stack pointer, which points to the shellcode placed after the overwritten return address. The address of JMP ESP must be from a module without ASLR to ensure it is static. This approach is standard in buffer overflow exploitation.

Answer

Overwrite the saved return address with the address of the shellcode on the stack.

Answer

Use a return-to-libc attack to call the system() function.

Answer

Overwrite the saved return address with the address of a POP POP RET sequence.

Question 7

You are preparing to exploit a stack-based buffer overflow in a 32-bit Linux binary running as a setuid root program. The binary is compiled without stack canaries and has no ASLR. You have confirmed EIP control and identified a suitable JMP ESP equivalent. Which TWO of the following steps are necessary to ensure reliable shellcode execution after overwriting the return address? (Choose two.)

Accepted Answer

Ensure that the shellcode is placed at an address that ESP will point to after the function returns, or adjust ESP with a stack pivot.. Reliable execution requires that the shellcode survives input processing (no bad characters) and that ESP points to it after the return. These two conditions ensure the payload is intact and reachable. Other options either duplicate existing conditions, introduce unreliability, or misunderstand privilege inheritance.

Answer

Compile the binary with stack protector disabled to prevent canary checks from interfering with the overflow.

Answer

Replace the JMP ESP address with a direct jump to the stack address where the shellcode resides to avoid using a module address.

Answer

Set the setuid bit on the shellcode binary to ensure it runs with root privileges.

Question 8

You are analyzing a 32-bit Windows application that crashes when a long string is sent to a network service. The crash occurs in a function that copies data into a 256-byte stack buffer using a loop that stops at a null byte. You have determined that the offset to EIP is 260 bytes. However, when you send a payload with 260 'A's followed by a JMP ESP address and shellcode, the application crashes but no shellcode executes. What is the most likely explanation?

Accepted Answer

ESP does not point to the beginning of the shellcode after the JMP ESP executes, so the CPU executes unintended bytes.. The most likely cause is that ESP does not point to the shellcode after JMP ESP executes. Even with correct EIP control, if ESP is misaligned, the CPU executes unintended bytes and crashes. A short jump or stack pivot can realign ESP with the payload. Null bytes would prevent EIP overwrite, and ASLR is not indicated.

Answer

The JMP ESP address contains a null byte, which terminates the string copy before the shellcode is fully written to the stack.

Answer

The shellcode contains a null byte, causing the copy loop to terminate before the return address is overwritten.

Answer

The application is protected by ASLR, so the JMP ESP address changes between runs.

Question 9

You are analyzing a binary and identify a function that uses strcpy() to copy user input into a fixed-size stack buffer. Which register must be controlled to redirect the instruction pointer to your shellcode?

Accepted Answer

The saved Return Address on the stack. To redirect the execution flow, you must overwrite the saved Return Address on the stack. When a function finishes, the CPU pops the value at the saved EIP/RIP location into the Instruction Pointer. By overflowing the buffer and reaching this specific memory location, you gain control over the program's subsequent execution path, which is the foundational concept for stack-based buffer overflow exploitation in the PEN-200 curriculum.

Answer

The ESP register

Answer

The EAX register

Answer

The EBP register

Question 10

Based on the exhibit, what is the primary risk if your shellcode contains the byte \x0d?

Accepted Answer

The application terminates the input string early. The exhibit lists \x0d as a bad character, which often acts as a carriage return in various network protocols or string-handling functions. If shellcode contains this byte, the application may truncate the input buffer prematurely, preventing the full payload from reaching the stack. This truncation causes the exploit to fail, as the shellcode becomes malformed or incomplete before the CPU can execute it during the return sequence.

Answer

The memory address becomes non-executable

Answer

The JMP ESP instruction fails to trigger

Answer

The CPU enters an infinite loop state

Question 11

Which TWO of the following statements correctly describe the function of a NOP sled in a buffer overflow exploit?

Accepted Answer

It provides a wider range of addresses for successful jump redirection.. A NOP sled (No-Operation) is a sequence of instructions that do nothing but pass control to the next instruction. It is critical for increasing the reliability of an exploit by providing a larger landing zone for the instruction pointer. If the exact address of the shellcode fluctuates due to environment variables or minor stack shifts, the NOP sled ensures the CPU eventually slides into the functional payload.

Answer

It acts as a primary payload to bypass antivirus software.

Answer

It executes complex arithmetic to prepare registers for shellcode.

Answer

It is required to disable hardware-based stack protections.

Question 12

When fuzzing an application to identify a buffer overflow, what is the most common symptom indicating that the application's memory boundaries have been exceeded?

Accepted Answer

The application returns an 'Access Violation' or 'Segmentation Fault'. Fuzzing involves sending large amounts of data to an application to find stability issues. The most common indicator of a buffer overflow is the application crashing, specifically resulting in a segmentation fault or an access violation. This occurs because the injected data has overwritten critical stack memory, such as the return address, causing the CPU to attempt an execution from an invalid or unauthorized memory location.

Answer

The application begins to consume high CPU resources

Answer

The application prints a stack dump to the console

Answer

The application generates a new network port listener

Question 13

Why must you carefully identify 'bad characters' before finalizing an exploit payload?

Accepted Answer

To ensure the shellcode is correctly copied into memory in its entirety.. Bad characters are bytes that cause a function or protocol to stop processing input prematurely. If these characters exist in your shellcode, the application will truncate the payload. Identifying these characters ensures that the full exploit string is correctly placed into memory, allowing the overflow to reach the return address and execute the shellcode as intended without corruption or partial injection.

Answer

To prevent the shellcode from triggering an antivirus alert.

Answer

To allow the CPU to perform faster instruction decoding.

Answer

To bypass DEP (Data Execution Prevention) controls.

Question 14

Which THREE of the following are essential steps when manually exploiting a stack-based buffer overflow?

Accepted Answer

Identifying the crash offset by using a pattern generator.. Exploiting a buffer overflow requires a structured methodology to ensure the payload executes correctly. The process begins with identifying the crash and the exact offset to the return address. Once the offset is found, the investigator must locate a viable jump address and filter for bad characters that would break the payload. Finally, the shellcode is generated and tested to confirm that execution is successfully redirected to the desired payload.

Answer

Disabling all firewall rules on the victim machine.

Answer

Upgrading the target application to the latest version.

Question 15

Given the exhibit, what is the correct strategy to redirect control flow to the shellcode?

Accepted Answer

Overwrite the EIP value with the address 0x77E14C29.. To redirect execution, you must replace the EIP value (currently 0x41414141) with the memory address of a JMP ESP instruction. The JMP ESP instruction serves as a pivot point that redirects the CPU to the stack, where your shellcode is located. By placing the address 0x77E14C29 in the exact offset where EIP is overwritten, the CPU will execute the jump instead of attempting to return to the original, now-corrupted address.

Answer

Replace the EIP value with 0x0012FF70.

Answer

Nop out the EIP value with 0x90909090.

Answer

Force the program to jump to the base address 0x00400000.

Question 16

Which of the following best describes the function of the EIP register in the context of a stack-based buffer overflow?

Accepted Answer

It points to the memory address of the next instruction to be executed.. The EIP (Extended Instruction Pointer) register holds the memory address of the next instruction the CPU should execute. In an exploit, the goal is to overwrite this register by corrupting the saved return address on the stack. When the function finishes, the CPU pops this controlled value into EIP, forcing the processor to jump to the attacker's shellcode, thus hijacking the control flow of the entire application.

Answer

It stores the current stack frame's base address.

Answer

It keeps track of the number of active threads.

Answer

It holds the results of arithmetic operations.

Question 17

Why are static memory addresses for 'JMP ESP' preferred over dynamic stack addresses?

Accepted Answer

Static addresses remain constant across different executions.. Stack addresses change during every execution of a program due to factors like system environment variables and memory allocation. If you use a hardcoded stack address in your exploit, it will likely be invalid the next time the program runs. A static JMP ESP address, found in a loaded DLL or the binary itself, remains constant, providing a reliable and stable redirect for your shellcode execution every time.

Answer

Static addresses are faster to access by the CPU.

Answer

Static addresses are less likely to contain bad characters.

Answer

Static addresses are protected by DEP and ASLR.

Question 18

What role does the 'padding' play in a buffer overflow payload structure?

Accepted Answer

It ensures the return address is correctly aligned for overwriting.. Padding is the data placed between the start of the buffer and the return address. Its purpose is to exactly fill the buffer space so that the subsequent bytes in the payload land precisely on the return address. Without correct padding, the return address would be overwritten by the wrong bytes, causing the program to jump to an unintended and invalid location, leading to a crash rather than code execution.

Answer

It acts as a NOP sled for the payload.

Answer

It prevents the stack from overflowing too quickly.

Answer

It is used to encode the shellcode against detection.

Question 19

Given the exhibit, why might using the address 0x00401020 to overwrite EIP be ineffective for shellcode execution?

Accepted Answer

The instruction does not redirect the CPU to the stack.. The instruction at 0x00401020 is a CALL [EAX], which does not transfer control to the stack where your shellcode resides. Instead, it attempts to call an address stored in the EAX register. Since you do not control EAX, this instruction will not lead to your shellcode. A successful exploit requires a direct jump to the stack pointer (JMP ESP) or a register you control, not a CALL instruction.

Answer

The memory address contains bad characters.

Answer

The address is located in the data segment.

Answer

The stack has already been corrupted by the padding.

Question 20

What is the primary purpose of an exploit payload in a buffer overflow context?

Accepted Answer

To execute arbitrary commands on the target system.. The exploit payload is the set of instructions (often shellcode) that you want the CPU to execute once you have successfully redirected the program's control flow. The goal is to perform an action, such as spawning a reverse shell or executing a command. The entire process of finding an offset and overwriting the return address is merely the delivery vehicle for this payload, which provides the desired post-exploitation access.

Answer

To increase the size of the target buffer.

Answer

To crash the application for a denial-of-service attack.

Answer

To bypass the authentication mechanism of the application.