PT0-002 Practice Question: During a penetration test, a tester identifies a…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Heap spraying to predict memory layout and inject shellcode

  Why it's wrong here

  Heap spraying fills the heap with a NOP sled and shellcode in an attempt to predict the memory address upon overflow. While this technique can defeat ASLR if the heap base is predictable, it does nothing against NX, because the heap is marked non-executable and the processor will refuse to run injected shellcode. Moreover, modern allocators add heap entropy, making reliable prediction even harder. Without also flipping the NX bit off or using code reuse, sprayed shellcode is dead on arrival.

• ✓

  Return-oriented programming (ROP) using the fixed gadgets

  Why this is correct

  Return-oriented programming (ROP) is the direct solution because it reuses machine code gadgets already present in the executable or its libraries, so no new code is injected and NX is never triggered. By chaining gadgets that end in 'ret', an attacker can perform arbitrary computation while maintaining control of the stack. If the binary is non-PIE or ASLR is defeated with a leak, the fixed gadget addresses are known, making the chain deterministic. This elegantly bypasses both NX and ASLR, which is why it is the correct answer.

• ✗

  Stack canary bypass using information leak

  Why it's wrong here

  A stack canary is a random value placed between the buffer and the saved return address; overwriting it triggers an abort, so an information leak can reveal the canary and allow the attacker to preserve it during the overflow. However, bypassing the canary only ensures the overflow is not detected—it says nothing about whether the attacker’s payload can execute. With NX enabled, the stack is non-executable, and with ASLR, the stack or library addresses are randomized, so a canary leak alone does not enable code execution. The attacker still needs a code-reuse technique such as ROP to do something useful with the overwritten return address.

• ✗

  Format string attack to overwrite GOT entries

  Why it's wrong here

  A format string vulnerability uses %n specifiers to write arbitrary data to an arbitrary address, commonly a GOT entry, redirecting a function call to attacker-controlled memory. While this gives write-what-where, it does not by itself defeat NX—if the overwritten GOT entry points to stack or heap, execution is still blocked because those pages are non-executable. Even if you redirect to a libc function like system, ASLR randomizes libc addresses, so you usually need an info leak to find a usable target. In the context of a simple buffer overflow, ROP is the simpler, more complete bypass because it directly works around both NX and ASLR through existing gadgets.

Go deeper

Related to this question