The following is an entry captured by a network IDS. You are assigned the task of analyzing this entry. You notice the value 0x90, which is the most common NOOP instruction for the Intel processor…

Question

Exhibit

Options

• AThe buffer overflow attack has been neutralized by the IDS
• BThe attacker is creating a directory on the compromised machine
• CThe attacker is attempting a buffer overflow attack and has succeeded
• DThe attacker is attempting an exploit that launches a command-line shell

• A
  7% (3)
• B
  2% (1)
• C
  11% (5)
• D
  80% (35)

Explanation

Explanation

Option D is correct because the presence of /bin/sh in the payload strongly indicates the attacker's shellcode is designed to spawn a Unix command-line shell - this is a classic buffer overflow exploitation technique where the attacker injects shellcode containing NOP sleds (0x90) followed by code that executes /bin/sh, granting them a shell on the target system.

Why the distractors are wrong:

• A is incorrect because an IDS (Intrusion Detection System) only monitors and alerts - it does not actively block or neutralize attacks; that is the role of an IPS (Intrusion Prevention System).
• B is incorrect because creating a directory would involve commands like mkdir, not /bin/sh, and NOP sleds have no association with directory creation.
• C is incorrect because capturing the traffic in an IDS log only confirms an attempt is being made - you cannot conclude success purely from the captured packet.

Memory Tip

Remember the two key indicators: NOP sled (0x90) = buffer overflow attempt, and /bin/sh = shell spawn payload. Together they spell "shellcode attack" - the attacker wants a shell, not just a crash. Think: "NOP + /bin/sh = shell me in!"

No community discussion yet for this question.