PT0-002 Practice Question: During a penetration test, a tester finds a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Return-oriented programming (ROP) to bypass DEP

  Why it's wrong here

  Return-oriented programming (ROP) is indeed used to bypass Data Execution Prevention (DEP), which is enabled in the scenario. However, with ASLR disabled, library addresses are static and predictable. This allows for a more direct exploitation method, such as Return-to-libc, which simply calls a known function at a fixed address without needing to chain multiple gadgets. ROP would be the most effective choice if ASLR were also enabled, as it provides a robust way to execute arbitrary code when library addresses are randomised.

• ✗

  Heap spraying to inject shellcode

  Why it's wrong here

  Heap spraying does not bypass DEP; it merely allocates many blocks of memory filled with shellcode or a NOP sled to improve the odds that a redirected instruction pointer lands on attacker-controlled content. With DEP active, the heap is marked non-executable, so any jump into those sprayed regions will trigger an access violation before the shellcode runs. Additionally, since ASLR is disabled in this scenario, the heap is at a predictable address, but that predictability does nothing to counter DEP. The technique often complements exploitation, but it is not a mitigation bypass.

• ✓

  ret2libc to call system() with a controlled argument

  Why this is correct

  ret2libc is the correct choice because it reuses existing executable code in libc, specifically the system() function, to execute commands like '/bin/sh', completely sidestepping DEP's non-executable stack and heap. With ASLR disabled, libc's base address is fixed, so the exact addresses of system() and the string '/bin/sh' (which can be placed in a writable area or found in libc's data section) are known in advance. The attacker crafts a stack overflow that overwrites the return address with system()'s address and arranges the stack such that the first argument points to the command string. This is far simpler than full ROP because only a single function call is required—no gadget chains necessary.

• ✗

  Stack pivoting to redirect execution to a known location

  Why it's wrong here

  Stack pivoting is a technique used to shift the stack pointer (esp/rsp) to an attacker-controlled buffer, typically to support a ROP chain when the original stack is unreliable or not addressable. It does not itself bypass DEP; even after you pivot, the code you call must still reside in executable memory, and if you pivot to a non-executable heap, direct shellcode execution is still blocked. In this scenario, with ASLR off, the simpler and more direct solution is ret2libc, which calls system() at a fixed address without needing to pivot or chain gadgets. Pivoting might be necessary if the overflow is tiny or the stack is corrupted, but it is a technique for gaining stack control, not a DEP evasion.