hardMultiple ChoiceObjective-mapped
PT0-002 Practice Question: A penetration tester gains a foothold on a Linux…
A penetration tester gains a foothold on a Linux system with ASLR and NX enabled. The tester identifies a stack buffer overflow in a SUID binary. The binary has no PIE (Position Independent Executable) and is compiled without stack canaries. The tester wants to execute a shell. Which technique should be used?
⚠ Common exam trap
CompTIA often tests the misconception that return-to-libc alone bypasses ASLR, but without a leak, the randomized libc base makes the attack fail; the trap here is that candidates may overlook the need for an information leak or assume that a non-PIE binary eliminates ASLR entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ROP chain
Since the binary has no PIE and lacks stack canaries, the attacker can predict the address of the return address on the stack. However, with ASLR and NX enabled, the stack is non-executable and system library addresses are randomized. A ROP chain allows the tester to bypass both protections by chaining small instruction sequences (gadgets) already present in the binary or loaded libraries to achieve arbitrary code execution, such as calling execve to spawn a shell.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Return-to-libc attack
Why it's wrong here
Return-to-libc attacks rely on ASLR being disabled to predict library function addresses; here ASLR is enabled, so the location of `system()` in libc is randomised and cannot be reliably called. This technique is tempting because it bypasses NX by reusing existing code rather than injecting shellcode, and would be correct if ASLR were absent, allowing fixed libc addresses.
- ✗
Heap spraying
Why it's wrong here
Heap spraying is used to bypass ASLR by filling the heap with NOP sleds and shellcode, but it does not bypass NX (read: NX prevents execution on heap as well). It is less effective here.
- ✓
ROP chain
Why this is correct
The binary is not compiled with PIE, so its own code segment resides at a fixed base address even when ASLR is enabled. An attacker can identify small instruction sequences (gadgets) ending in ret within that executable region and chain them together to call existing functions such as mprotect or system, thereby executing arbitrary logic without ever injecting shellcode. Because the execution never branches to the stack or heap, NX is bypassed, and because the gadgets live at static addresses in the binary, ASLR does not randomize their locations.
- ✗
Buffer overflow with NOP sled
Why it's wrong here
A classic buffer overflow that overwrites the return address with a pointer into a NOP sled assumes the stack is executable, but the NX flag marks the stack as non-executable so any redirected control flow to injected shellcode raises an access violation. ASLR further randomizes the stack base address, making the required absolute return address unpredictable without a separate memory leak. Thus, while this technique works in a non-hardened environment, it cannot bypass the combination of NX and ASLR present here.
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 185-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.