EC-Council
312-50V9 · Question #555
312-50V9 Question #555: Real Exam Question with Answer & Explanation
The correct answer is D: The attacker is attempting an exploit that launches a command-line shell. The 0x90 NOP sled combined with '/bin/sh' in the payload is a classic indicator of shellcode designed to spawn an interactive command shell via a buffer overflow.
Question
The following is an entry captured by a network IDS.You are assigned the task of analyzing this entry. You notice the value 0x90, which is the most common NOOP instruction for the Intel processor. You figure that the attacker is attempting a buffer overflow attack. You also notice "/bin/sh" in the ASCII part of the output. As an analyst what would you conclude about the attack?
Exhibit
Options
- AThe buffer overflow attack has been neutralized by the IDS
- BThe attacker is creating a directory on the compromised machine
- CThe attacker is attempting a buffer overflow attack and has succeeded
- DThe attacker is attempting an exploit that launches a command-line shell
Explanation
The 0x90 NOP sled combined with '/bin/sh' in the payload is a classic indicator of shellcode designed to spawn an interactive command shell via a buffer overflow.
Common mistakes.
- A. An IDS passively captures and alerts on traffic but does not neutralize or block attacks unless configured as an IPS; the log entry indicates detection, not mitigation.
- B. Creating a directory would involve filesystem commands such as mkdir, not a NOP sled and '/bin/sh' payload, which are characteristic of shellcode execution aimed at shell access.
- C. The IDS log confirms an attempt was made and detected, but does not itself confirm the exploit succeeded and a shell was actually spawned on the target.
Concept tested. Buffer overflow shellcode analysis with NOP sled
Reference. https://owasp.org/www-community/attacks/Buffer_overflow_attack
Community Discussion
No community discussion yet for this question.