Free GXPN sample questions

Correct answer: The gadget must reside in a loaded module that was compiled without SafeSEH support.

SafeSEH validates exception handlers against a table of registered handlers within the module. To bypass this, attackers look for gadgets (like `pop pop ret`) in modules loaded by the application that were compiled *without* SafeSEH (or have it disabled). Addresses in these non-SafeSEH modules are not validated against the SafeSEH table, allowing execution flow redirection.

Correct answer: Control Flow Guard (CFG)

Control Flow Guard (CFG) is a compiler-enabled security feature that adds checks before every indirect call (like function pointers). It verifies that the destination address is a valid entry point for a function, significantly restricting the ability to jump to arbitrary ROP gadgets in the middle of functions.

Correct answer: InstallUtil.exe

InstallUtil.exe is a Microsoft .NET framework utility often whitelisted by default. It can be used to bypass AppLocker by executing code embedded in the Uninstall method of a compiled .NET assembly (or sometimes text-based inputs if configured). This is a classic AppLocker bypass technique.

Correct answer: CLM restricts access to .NET types and methods that are not explicitly allowed in the core types list, preventing direct memory manipulation.

Constrained Language Mode (CLM) is designed to limit the capabilities of PowerShell to prevent abuse. It restricts access to critical .NET types (like `System.Reflection` or `System.Runtime.InteropServices`) and methods that allow memory manipulation or interaction with unmanaged code. Only a subset of 'safe' types is permitted.

Correct answer: It must spoof the victim's MAC address and IP address for all outgoing traffic while suppressing the victim's EAPOL logoff frames.

In an 802.1X bypass scenario using a bridge (like a 'Phantom' or 'Shadow' attack), the attacker waits for the victim to authenticate. Once authenticated, the switch port allows traffic from the victim's MAC. The attacker must spoof the victim's MAC address to inject traffic. Crucially, the attacker must also drop EAPOL Logoff packets from the victim to keep the session alive if the victim disconnects or reboots.

Correct answer: Double Tagging

Double Tagging (VLAN Hopping) involves sending a frame with two 802.1Q tags. The outer tag matches the native VLAN of the trunk port. The first switch strips this outer tag (as is standard for native VLAN traffic) and forwards the frame. The receiving switch then sees the second (inner) tag and forwards the packet to the target VLAN. This is a unidirectional attack.

Correct answer: You must enable port forwarding and configure a NAT rule or route traffic back to the legitimate (formerly Active) gateway IP.

When hijacking the HSRP Active role, your machine claims the Virtual IP (VIP). Clients will send all internet-bound traffic to you. If you simply drop this traffic, it's a DoS. To perform a Man-in-the-Middle (MITM) attack, you must route the received traffic back to the real router (the one you displaced) so it can reach the WAN. This often involves enabling IP forwarding and setting a static route.

Correct answer: LSA (Link State Advertisement) Injection

LSA Injection involves an attacker establishing a neighbor relationship (adjacency) with a legitimate OSPF router. Once adjacent, the attacker can flood Link State Advertisements (LSAs) claiming to have the best metrics to specific networks, manipulating the routing tables of all routers in the area. This typically requires bypassing authentication.

Correct answer: xor rax, rax; add rax, 59

`mov rax, 59` compiles to machine code containing null bytes because `rax` is 64-bit and 59 is small. To avoid this, `xor rax, rax` clears the register (creating 0 without null bytes in opcode), and `add rax, 59` sets the value. Alternatively, `push 59; pop rax` or using the lower 8-bit register `al` (`mov al, 59`) after clearing `rax` are common techniques.

Correct answer: Stack grows towards lower memory addresses; Heap grows towards higher memory addresses.

In the standard virtual memory layout, the Stack is located at high memory addresses and grows 'down' towards lower addresses. The Heap is located above the Data/BSS segments and grows 'up' towards higher memory addresses. They grow towards each other.