PEN-200 Public Exploits Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Run the exploit as-is and observe the target's behavior to determine whether ASLR is enabled.

  Why it's wrong here

  Running the exploit unchanged against a target with ASLR enabled will likely crash the vulnerable service without achieving code execution, potentially destabilizing the host and losing your foothold. The hardcoded 0x41414141 return address and comment about a different build with ASLR disabled are red flags that the exploit is not reliable here. Observation should come from configuration checks, not from a blind execution attempt.

• ✗

  Replace the hardcoded return address with a NOP sled of equivalent length and rerun the exploit.

  Why it's wrong here

  A NOP sled does not replace a return address; it is a sequence of no-operation instructions that helps the CPU slide into shellcode. Substituting a NOP sled for the return address would cause the exploit to jump to an unpredictable location and likely crash the service. The return address must point to a valid instruction that transfers control to the payload.

• ✓

  Recompile the exploit with a debugger, identify the correct return address for this target, and update the payload accordingly.

  Why this is correct

  The hardcoded address and the note about ASLR being disabled on a different build indicate the exploit must be retargeted. By attaching a debugger such as Immunity Debugger or WinDbg, determining the actual return address and offset for your specific Windows build, and updating the payload, you adapt the exploit to the target's memory layout. This is the standard PEN-200 approach for porting public exploits.

• ✗

  Disable ASLR on the target by editing the system registry, then run the exploit unchanged.

  Why it's wrong here

  Modifying the target's registry to disable ASLR is a post-exploitation or test-environment action, not something you would do during an initial exploitation attempt. It also requires administrative access you do not yet have, and it changes the target's security posture in a way that may violate the engagement scope. The correct approach is to adapt the exploit, not alter the target's defenses.