Index of all pwn/binary exploitation pages - from beginner stack overflows to advanced kernel exploitation.

Binary Exploitation (Pwn)

In CTFs, pwn challenges give you a compiled program and ask you to break it. The goal is almost always the same, trick the program into giving you a shell or printing the flag. You do this by finding bugs in how the program handles memory, then crafting input that takes control of what the program does.

This section starts from scratch. No prior pwn experience needed — just basic C knowledge and comfort with a terminal.

First step: Read Linux Protections. Before you can exploit a binary, you need to understand what protections are active and what they mean.

Prerequisites

Before diving in, make sure you're comfortable with:

C basics: pointers, arrays, strings, functions, the main() entry point
Terminal: running commands, navigating directories, basic shell usage
Hex and binary: reading hex addresses, understanding what a byte is

If you've never seen a buffer overflow before, start with Stack Buffer Overflow - it's the foundation everything else builds on.

What's in This Section

Page	Difficulty	What You'll Learn
Linux Protections	Beginner	What ASLR, NX, PIE, Canaries, RELRO are, and how to read `checksec` output
Stack Buffer Overflow	Beginner	Overflow a buffer to overwrite the return address and redirect execution
ROP Chains	Intermediate	Chain small code gadgets to bypass NX (non-executable stack)
ret2libc	Intermediate	Call `system("/bin/sh")` from libc when you can't inject shellcode
Shellcode	Intermediate	Write and inject your own machine code (when NX is off)
Format String	Intermediate	Use `printf` bugs to read and write arbitrary memory
GOT Overwrite	Intermediate	Redirect calls to libc functions by overwriting the GOT
Heap Exploitation	Advanced	How glibc's `malloc`/`free` work, and how to abuse them
Use-After-Free	Advanced	Exploit dangling pointers for leaks and arbitrary writes
Tcache Poisoning	Advanced	Hijack the tcache freelist to get arbitrary allocation
House of Series	Advanced	Named heap exploitation techniques (Force, Spirit, Apple, etc.)
SROP	Advanced	Use `sigreturn` to set every register at once with minimal gadgets
Seccomp Bypass	Advanced	Bypass syscall filters when `execve` is blocked
Kernel Pwn	Expert	Exploit Linux kernel modules for privilege escalation

Learning Path

Beginner — Foundations

Start here. These three pages give you the mental model for everything that follows.

Linux Protections — Learn what checksec tells you. Every exploit decision depends on this.
Stack Buffer Overflow — The simplest exploit: overflow a buffer, overwrite the return address, jump to a win() function.
ROP Chains — The stack is non-executable? Chain existing code snippets to do what you want.

Intermediate — More Attack Surface

These techniques expand what you can exploit beyond simple stack overflows.

ret2libc — Call system("/bin/sh") from libc. You'll need this when there's no win() function.
Shellcode — When NX is off, write your own machine code and inject it.
Format String — When printf(buf) lets you control the format string, you can read and write memory freely.
GOT Overwrite — Turn an arbitrary write into code execution by redirecting function calls.

Advanced — Heap & Specialized Techniques

Heap exploitation is a different world from stack-based attacks. These pages build on each other.

Heap Exploitation — Understand chunks, bins, and how malloc/free actually work.
Use-After-Free — The most common heap bug in CTFs. Free a chunk, then use it again.
Tcache Poisoning — The go-to technique for turning a UAF into arbitrary allocation.
SROP — When you have very few gadgets, sigreturn sets everything at once.
Seccomp Bypass — When execve is blocked, use open-read-write shellcode.

Expert — Kernel & Named Techniques

House of Series — A reference of named heap techniques for different glibc versions.
Kernel Pwn — Exploit kernel modules for root. Different tooling, different mindset.

Your First Exploit in 60 Seconds

Here's what a typical pwn challenge looks like end-to-end:

# 1. Receive the binary
file ./vuln          # ELF 64-bit, dynamically linked
checksec --file=./vuln  # check protections

# 2. Run it to understand behavior
./vuln               # "Enter your name: " → type something → "Hello, <input>"

# 3. Find the vulnerability
# (reverse engineer it, or notice it crashes with long input)

# 4. Write the exploit in Python with pwntools

from pwn import *

p = process('./vuln')
payload = b'A' * 72 + p64(0x401234)  # overflow + address of win()
p.sendline(payload)
p.interactive()  # get a shell

That's the pattern. Every page in this section is a variation on this — find the bug, craft the payload, get control.

How to Decide What Technique to Use

Run checksec first. Then:

`checksec` shows	What to try
No NX	Shellcode injection
NX + No PIE + No ASLR	ret2win or ret2libc with fixed addresses
NX + PIE + ASLR	Leak addresses first → ROP chain
Canary found	Leak canary via format string before overflow
Full RELRO	Target hooks or FSOP, not GOT

Essential Tools

pwntools is the Python library you'll use for almost every exploit.

pip3 install pwntools

Boilerplate:

from pwn import *

context.binary = elf = ELF('./vuln')
context.log_level = 'info'

def start():
    if args.REMOTE:
        return remote('challenge.ctf.com', 1337)
    elif args.GDB:
        return gdb.debug('./vuln', gdbscript='break main\ncontinue\n')
    else:
        return process('./vuln')

p = start()
# ... your exploit ...
p.interactive()

Key functions: process(), remote(), sendline(), p64()/u64(), flat(), cyclic(), cyclic_find(), ROP(), SigreturnFrame(), fmtstr_payload().

Last updated on Aug 1, 2025

Binary Exploitation