Free GXPN sample questions

Correct answer: [Address of system()] [Return Address for system()] [Address of "/bin/sh"]

In a standard 32-bit x86 ret2libc attack, the stack must be arranged so that the return address of the vulnerable function points to the `system()` function. Immediately following this must be the return address where `system()` should return after completion (often `exit()`), followed by the arguments for `system()` (the pointer to "/bin/sh"). The calling convention dictates that arguments are pushed onto the stack before the call.

Correct answer: Perform a byte-by-byte brute force attack to guess the canary value.

In a forking server architecture on Linux, the parent process's memory layout, including the stack canary value, is inherited by the child processes. Because the canary remains constant across forks until the parent restarts, an attacker can brute-force the canary one byte at a time. If a byte is incorrect, the child crashes; if correct, it does not. This allows determining the full canary value.

Correct answer: The gadget must reside in a loaded module that was compiled without SafeSEH support.

SafeSEH validates exception handlers against a table of registered handlers within the module. To bypass this, attackers look for gadgets (like `pop pop ret`) in modules loaded by the application that were compiled *without* SafeSEH (or have it disabled). Addresses in these non-SafeSEH modules are not validated against the SafeSEH table, allowing execution flow redirection.

Correct answer: Control Flow Guard (CFG)

Control Flow Guard (CFG) is a compiler-enabled security feature that adds checks before every indirect call (like function pointers). It verifies that the destination address is a valid entry point for a function, significantly restricting the ability to jump to arbitrary ROP gadgets in the middle of functions.

Correct answer: InstallUtil.exe

InstallUtil.exe is a Microsoft .NET framework utility often whitelisted by default. It can be used to bypass AppLocker by executing code embedded in the Uninstall method of a compiled .NET assembly (or sometimes text-based inputs if configured). This is a classic AppLocker bypass technique.

Correct answer: CLM restricts access to .NET types and methods that are not explicitly allowed in the core types list, preventing direct memory manipulation.

Constrained Language Mode (CLM) is designed to limit the capabilities of PowerShell to prevent abuse. It restricts access to critical .NET types (like `System.Reflection` or `System.Runtime.InteropServices`) and methods that allow memory manipulation or interaction with unmanaged code. Only a subset of 'safe' types is permitted.

Correct answer: It must spoof the victim's MAC address and IP address for all outgoing traffic while suppressing the victim's EAPOL logoff frames.

In an 802.1X bypass scenario using a bridge (like a 'Phantom' or 'Shadow' attack), the attacker waits for the victim to authenticate. Once authenticated, the switch port allows traffic from the victim's MAC. The attacker must spoof the victim's MAC address to inject traffic. Crucially, the attacker must also drop EAPOL Logoff packets from the victim to keep the session alive if the victim disconnects or reboots.

Correct answer: Double Tagging

Double Tagging (VLAN Hopping) involves sending a frame with two 802.1Q tags. The outer tag matches the native VLAN of the trunk port. The first switch strips this outer tag (as is standard for native VLAN traffic) and forwards the frame. The receiving switch then sees the second (inner) tag and forwards the packet to the target VLAN. This is a unidirectional attack.

Correct answer: You must enable port forwarding and configure a NAT rule or route traffic back to the legitimate (formerly Active) gateway IP.

When hijacking the HSRP Active role, your machine claims the Virtual IP (VIP). Clients will send all internet-bound traffic to you. If you simply drop this traffic, it's a DoS. To perform a Man-in-the-Middle (MITM) attack, you must route the received traffic back to the real router (the one you displaced) so it can reach the WAN. This often involves enabling IP forwarding and setting a static route.

Correct answer: LSA (Link State Advertisement) Injection

LSA Injection involves an attacker establishing a neighbor relationship (adjacency) with a legitimate OSPF router. Once adjacent, the attacker can flood Link State Advertisements (LSAs) claiming to have the best metrics to specific networks, manipulating the routing tables of all routers in the area. This typically requires bypassing authentication.