CAS-003 · Question #365
A forensic analyst suspects that a buffer overflow exists in a kernel module. The analyst executes the following command: dd if=/dev/ram of=/tmp/mem/dmp The analyst then reviews the associated…
The correct answer is B. The system uses ASLR. “Address space layout randomization (ASLR) is an operating system technique that randomizes where components of a running process (the base executable, application programming interfaces [APIs], the heap, etc.) are placed in memory. This makes it more difficult for an attacker…
Question
A forensic analyst suspects that a buffer overflow exists in a kernel module. The analyst executes the following command:
dd if=/dev/ram of=/tmp/mem/dmp The analyst then reviews the associated output:
^34^#AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/bin/bash^21^03#45 However, the analyst is unable to find any evidence of the running shell. Which of the following of the MOST likely reason the analyst cannot find a process ID for the shell?
Options
- AThe NX bit is enabled
- BThe system uses ASLR
- CThe shell is obfuscated
- DThe code uses dynamic libraries
How the community answered
(24 responses)- A13% (3)
- B58% (14)
- C25% (6)
- D4% (1)
Explanation
“Address space layout randomization (ASLR) is an operating system technique that randomizes where components of a running process (the base executable, application programming interfaces [APIs], the heap, etc.) are placed in memory. This makes it more difficult for an attacker to aim a buffer overflow at specific points in the address space. ASLR mechanisms can prevent intentional software crashes that could also lead to privilege escalation attacks. Most modern OSes provide code libraries that support ASLR use. For example, on Windows, you can integrate ASLR-enabled executables and dynamic link libraries (DLL) in your app. Keep in mind, however, that some attacks have proven effective against ASLR-so don’t mistake it for a flawless countermeasure to memory-based threats.”
Topics
Community Discussion
No community discussion yet for this question.