GXPN Sample Questions & Answers

Constrained Language Mode (CLM) is designed to limit the capabilities of PowerShell to prevent abuse. It restricts access to critical .NET types (like System.Reflection or System.Runtime.InteropServices) and methods that allow memory manipulation or interaction with unmanaged code. Only a subset of 'safe' types is permitted.

In an 802.1X bypass scenario using a bridge (like a 'Phantom' or 'Shadow' attack), the attacker waits for the victim to authenticate. Once authenticated, the switch port allows traffic from the victim's MAC. The attacker must spoof the victim's MAC address to inject traffic. Crucially, the attacker must also drop EAPOL Logoff packets from the victim to keep the session alive if the victim disconnects or reboots.

Double Tagging (VLAN Hopping) involves sending a frame with two 802.1Q tags. The outer tag matches the native VLAN of the trunk port. The first switch strips this outer tag (as is standard for native VLAN traffic) and forwards the frame. The receiving switch then sees the second (inner) tag and forwards the packet to the target VLAN. This is a unidirectional attack.

When hijacking the HSRP Active role, your machine claims the Virtual IP (VIP). Clients will send all internet-bound traffic to you. If you simply drop this traffic, it's a DoS. To perform a Man-in-the-Middle (MITM) attack, you must route the received traffic back to the real router (the one you displaced) so it can reach the WAN. This often involves enabling IP forwarding and setting a static route.

LSA Injection involves an attacker establishing a neighbor relationship (adjacency) with a legitimate OSPF router. Once adjacent, the attacker can flood Link State Advertisements (LSAs) claiming to have the best metrics to specific networks, manipulating the routing tables of all routers in the area. This typically requires bypassing authentication.

mov rax, 59 compiles to machine code containing null bytes because rax is 64-bit and 59 is small. To avoid this, xor rax, rax clears the register (creating 0 without null bytes in opcode), and add rax, 59 sets the value. Alternatively, push 59; pop rax or using the lower 8-bit register al (mov al, 59) after clearing rax are common techniques.

In the standard virtual memory layout, the Stack is located at high memory addresses and grows 'down' towards lower addresses. The Heap is located above the Data/BSS segments and grows 'up' towards higher memory addresses. They grow towards each other.

In IPv6 SLAAC, routers send Router Advertisement (RA, Type 134) messages to inform clients of network prefixes and gateway information. By spoofing RA packets with a high priority, an attacker can designate themselves as the default gateway for the segment, enabling traffic interception.

ARP poisoning redirects the victim's traffic to the attacker's machine. If IP forwarding is not enabled, the attacker's kernel will drop packets destined for other IP addresses, cutting the victim off from the network (DoS). Enabling IP forwarding ensures the packets are routed to the legitimate gateway after interception.

In CBC mode, decryption involves decrypting the ciphertext block and then XORing with the previous ciphertext block. By modifying bytes in $C_{N-1}$, the attacker changes the input to the XOR operation for $P_N$. By iterating through 256 possibilities and observing padding errors, the attacker can deduce the 'Intermediate State' (the output of the block cipher decryption before the XOR). Knowing the Intermediate State and the original $C_{N-1}$ allows calculating the plaintext $P_N$.