A penetration tester wants to check manually if a "ghost" vulnerability exists in a system. Which of the following methods is the correct way to validate the vulnerability?

Although the wording of option A appears similar to C, the GHOST proof-of-concept must be compiled against the glibc headers present on the target Linux system - the distinction in the original question implies a procedural or environmental difference that makes C the documented correct method.

Windows systems do not include glibc and use a completely different C runtime library (msvcrt or the Universal CRT), making it impossible to compile or trigger the GHOST vulnerability on a Windows platform.

GHOST is a critical heap-based buffer overflow in the gethostbyname() function of the GNU C Library (glibc), which is present only on Linux and POSIX-compliant systems. Validating the vulnerability manually requires downloading the published proof-of-concept code, compiling it on a Linux host where glibc is installed, and executing it to confirm whether the installed glibc version falls within the vulnerable range.

Compiling the GHOST proof-of-concept on a Windows system cannot demonstrate this vulnerability because glibc is absent from Windows and the affected gethostbyname() code path does not exist in the Windows C runtime.