hardMultiple Choice
PT0-002 Practice Question: A penetration tester is attempting to exploit a…
A penetration tester is attempting to exploit a buffer overflow vulnerability in a Linux binary. The binary has Data Execution Prevention (DEP) enabled but Address Space Layout Randomization (ASLR) is disabled. Which exploitation technique would be the MOST effective to achieve code execution?
⚠ Common exam trap
It's easy for candidates to assume DEP alone forces the use of ROP chains, but when ASLR is disabled, a simpler return-to-libc attack is more effective and directly achieves code execution without the complexity of building a ROP chain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Perform a return-to-libc attack to call system("/bin/sh")
With DEP enabled, the stack is non-executable, so injecting shellcode directly into the buffer (Option A) would fail. Since ASLR is disabled, library addresses are fixed, making a return-to-libc attack viable. Option C exploits this by overwriting the return address with the address of system() and placing the string "/bin/sh" in memory, achieving code execution without needing an executable stack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inject shellcode into the buffer and redirect execution to it
Why it's wrong here
Injecting raw shellcode into the buffer and overwriting the return address to point directly at that buffer fails because Data Execution Prevention (DEP/NX) marks the stack and heap as non-executable memory regions. When the CPU attempts to fetch an instruction from a non-executable page, a hardware exception (STATUS_ACCESS_VIOLATION on Windows, SIGSEGV on Linux) is raised, terminating the process. Even though the shellcode resides at a predictable address and the overflow succeeds, the processor refuses to execute it, making this technique ineffective in a DEP-enabled environment.
- ✗
Use a ROP chain to call mprotect() to make the stack executable, then jump to shellcode
Why it's wrong here
Since ASLR is disabled, the attacker can use a Ret2Libc attack to jump directly to existing library functions like system() without needing to modify memory permissions. Using mprotect() to bypass DEP via ROP chains is required only when the attacker must execute custom shellcode residing on the stack or heap. In this scenario, bypassing DEP by making memory executable adds unnecessary complexity when direct function calls are possible due to known static addresses.
- ✓
Perform a return-to-libc attack to call system("/bin/sh")
Why this is correct
A return-to-libc (ret2libc) attack is correct because it bypasses DEP by reusing existing executable code from the C standard library instead of injecting instructions. Since ASLR is disabled, the base address of libc and the offset of the system() function are known, so the attacker can overwrite the saved return address with the address of system() and place a pointer to the string "/bin/sh" at the appropriate stack position to be interpreted as system()'s argument. This causes the process to call system("/bin/sh") directly from executable memory, completely avoiding the non-executable stack while achieving arbitrary command execution.
- ✗
Use a heap spray to place shellcode at a known address and then trigger the overflow
Why it's wrong here
A heap spray does not address Data Execution Prevention (DEP); it is primarily a technique to defeat Address Space Layout Randomization (ASLR) by filling large portions of the heap with a NOP sled and shellcode, increasing the chance that a jump lands somewhere in the sled. Even if a predictable address is achieved, DEP still marks the heap as non-executable, so any attempt to execute the sprayed shellcode will trigger the same hardware exception as stack injection. Unless the heap is explicitly mapped with executable permissions, which modern systems do not do, heap spraying remains useless against DEP alone and is therefore the wrong choice here.
Go deeper
Related to this question
Learn chapter
Buffer Overflow Exploitation Concepts
Key term
Shellcode
Shellcode is a small piece of code used as a payload in the exploitation of a software vulnerability, typically giving an attacker a command shell on the target machine.
Key term
Exploitation
Exploitation is the act of using a vulnerability or weakness in a system, network, or application to gain unauthorized access, cause damage, or extract data.
About these practice questions
Courseiva writes every PT0-003 question from scratch — 777 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.