Pwn Exploit
Overview
This skill provides structured access to binary exploitation techniques organized by vulnerability type. It serves as a reference guide for developing exploits, understanding attack vectors, and navigating CTF-Wiki documentation.
Quick Start
Identify the vulnerability type in your target binary and navigate to the corresponding reference:
- Stack overflow → See Stack Overflow Reference
- Format string → See Format String Reference
- Heap corruption → See Heap Exploitation Reference
- Integer overflow → See Integer Overflow Reference
Exploitation Workflow
1. Vulnerability Analysis
Use static/dynamic analysis tools to identify:
- Memory corruption vulnerabilities
- Unsafe function calls
- Missing input validation
- Protection mechanisms (ASLR, NX, PIE, stack canary)
2. Technique Selection
Choose exploitation technique based on:
- Vulnerability type (stack overflow, heap overflow, format string, etc.)
- Available gadgets (ROP, ret2libc, system calls)
- Mitigations present (bypass NX with ROP, bypass ASLR with leaks)
- Constraints (limited buffer size, character restrictions)
3. Exploit Development
Follow reference documentation for specific technique:
- Understand the underlying mechanism
- Identify required primitives (read, write, execute)
- Build payload step by step
- Test and iterate
Common Exploit Primitives
Information Leak
- Libc leak: Use
puts, printf, or write functions to leak libc addresses
- Binary leak: Leak PIE base using GOT entries
- Stack leak: Leak canary or stack addresses
Control Flow Hijack
- Ret2libc: Return to libc functions (system, execve)
- ROP: Chain ROP gadgets for arbitrary execution
- One-byte writes: Modify GOT entries, hook functions
Memory Write
- Arbitrary write: Use fastbin, unsorted bin, or format string writes
- Pointer hijacking: Overwrite function pointers, vtable pointers
Tool Integration
Common tools for exploitation development:
- pwntools: Python framework for exploit development
- ROPgadget: Find ROP gadgets in binaries
- one_gadget: Find execve("/bin/sh", ...) in libc
- checksec: Analyze binary protections
References
Detailed technique documentation is organized by category:
| Category |
Reference File |
| Stack Overflow |
stack-overflow.md |
| Format String |
format-string.md |
| Heap Exploitation |
heap-exploitation.md |
| Integer Overflow |
integer-overflow.md |
When to Use This Skill
Use this skill when:
- Analyzing CTF challenges involving pwn vulnerabilities
- Developing binary exploits for Linux targets
- Learning exploitation techniques and understanding attack vectors
- Debugging memory corruption in vulnerable programs
- Bypassing security mitigations (ASLR, NX, PIE, stack canary)
1---2name: pwn-exploit3description: Comprehensive binary exploitation techniques covering stack overflow, format string, heap exploitation, integer overflow, and advanced exploitation methods. Use when working on CTF challenges, binary vulnerability analysis, exploit development, or debugging memory corruption vulnerabilities in Linux binaries (x86/x64).4---56# Pwn Exploit78## Overview910This skill provides structured access to binary exploitation techniques organized by vulnerability type. It serves as a reference guide for developing exploits, understanding attack vectors, and navigating CTF-Wiki documentation.1112## Quick Start1314Identify the vulnerability type in your target binary and navigate to the corresponding reference:1516- **Stack overflow** → See [Stack Overflow Reference](references/stack-overflow.md)17- **Format string** → See [Format String Reference](references/format-string.md)18- **Heap corruption** → See [Heap Exploitation Reference](references/heap-exploitation.md)19- **Integer overflow** → See [Integer Overflow Reference](references/integer-overflow.md)2021## Exploitation Workflow2223### 1. Vulnerability Analysis2425Use static/dynamic analysis tools to identify:26- Memory corruption vulnerabilities27- Unsafe function calls28- Missing input validation29- Protection mechanisms (ASLR, NX, PIE, stack canary)3031### 2. Technique Selection3233Choose exploitation technique based on:34- **Vulnerability type** (stack overflow, heap overflow, format string, etc.)35- **Available gadgets** (ROP, ret2libc, system calls)36- **Mitigations present** (bypass NX with ROP, bypass ASLR with leaks)37- **Constraints** (limited buffer size, character restrictions)3839### 3. Exploit Development4041Follow reference documentation for specific technique:42- Understand the underlying mechanism43- Identify required primitives (read, write, execute)44- Build payload step by step45- Test and iterate4647## Common Exploit Primitives4849### Information Leak50- **Libc leak**: Use `puts`, `printf`, or `write` functions to leak libc addresses51- **Binary leak**: Leak PIE base using GOT entries52- **Stack leak**: Leak canary or stack addresses5354### Control Flow Hijack55- **Ret2libc**: Return to libc functions (system, execve)56- **ROP**: Chain ROP gadgets for arbitrary execution57- **One-byte writes**: Modify GOT entries, hook functions5859### Memory Write60- **Arbitrary write**: Use fastbin, unsorted bin, or format string writes61- **Pointer hijacking**: Overwrite function pointers, vtable pointers6263## Tool Integration6465Common tools for exploitation development:66- **pwntools**: Python framework for exploit development67- **ROPgadget**: Find ROP gadgets in binaries68- **one_gadget**: Find execve("/bin/sh", ...) in libc69- **checksec**: Analyze binary protections7071## References7273Detailed technique documentation is organized by category:7475| Category | Reference File |76|----------|---------------|77| Stack Overflow | [stack-overflow.md](references/stack-overflow.md) |78| Format String | [format-string.md](references/format-string.md) |79| Heap Exploitation | [heap-exploitation.md](references/heap-exploitation.md) |80| Integer Overflow | [integer-overflow.md](references/integer-overflow.md) |8182## When to Use This Skill8384Use this skill when:85- **Analyzing CTF challenges** involving pwn vulnerabilities86- **Developing binary exploits** for Linux targets87- **Learning exploitation techniques** and understanding attack vectors88- **Debugging memory corruption** in vulnerable programs89- **Bypassing security mitigations** (ASLR, NX, PIE, stack canary)
xuziqiang98