pwn-exploit

---
name: pwn-exploit
description: Comprehensive binary exploitation techniques covering stack overflow, format string, heap exploitation, integer overflow, and advanced exploitation methods. Use when working on CTF challenges, binary vulnerability analysis, exploit development, or debugging memory corruption vulnerabilities in Linux binaries (x86/x64).
license: MIT
---

# Pwn Exploit

## Overview

This skill provides structured access to binary exploitation techniques organized by vulnerability type. It serves as a reference guide for developing exploits, understanding attack vectors, and navigating CTF-Wiki documentation.

## Quick Start

Identify the vulnerability type in your target binary and navigate to the corresponding reference:

- **Stack overflow** → See [Stack Overflow Reference](references/stack-overflow.md)
- **Format string** → See [Format String Reference](references/format-string.md)
- **Heap corruption** → See [Heap Exploitation Reference](references/heap-exploitation.md)
- **Integer overflow** → See [Integer Overflow Reference](references/integer-overflow.md)

## Exploitation Workflow

### 1. Vulnerability Analysis

Use static/dynamic analysis tools to identify:
- Memory corruption vulnerabilities
- Unsafe function calls
- Missing input validation
- Protection mechanisms (ASLR, NX, PIE, stack canary)

### 2. Technique Selection

Choose exploitation technique based on:
- **Vulnerability type** (stack overflow, heap overflow, format string, etc.)
- **Available gadgets** (ROP, ret2libc, system calls)
- **Mitigations present** (bypass NX with ROP, bypass ASLR with leaks)
- **Constraints** (limited buffer size, character restrictions)

### 3. Exploit Development

Follow reference documentation for specific technique:
- Understand the underlying mechanism
- Identify required primitives (read, write, execute)
- Build payload step by step
- Test and iterate

## Common Exploit Primitives

### Information Leak
- **Libc leak**: Use `puts`, `printf`, or `write` functions to leak libc addresses
- **Binary leak**: Leak PIE base using GOT entries
- **Stack leak**: Leak canary or stack addresses

### Control Flow Hijack
- **Ret2libc**: Return to libc functions (system, execve)
- **ROP**: Chain ROP gadgets for arbitrary execution
- **One-byte writes**: Modify GOT entries, hook functions

### Memory Write
- **Arbitrary write**: Use fastbin, unsorted bin, or format string writes
- **Pointer hijacking**: Overwrite function pointers, vtable pointers

## Tool Integration

Common tools for exploitation development:
- **pwntools**: Python framework for exploit development
- **ROPgadget**: Find ROP gadgets in binaries
- **one_gadget**: Find execve("/bin/sh", ...) in libc
- **checksec**: Analyze binary protections

## References

Detailed technique documentation is organized by category:

| Category | Reference File |
|----------|---------------|
| Stack Overflow | [stack-overflow.md](references/stack-overflow.md) |
| Format String | [format-string.md](references/format-string.md) |
| Heap Exploitation | [heap-exploitation.md](references/heap-exploitation.md) |
| Integer Overflow | [integer-overflow.md](references/integer-overflow.md) |

## When to Use This Skill

Use this skill when:
- **Analyzing CTF challenges** involving pwn vulnerabilities
- **Developing binary exploits** for Linux targets
- **Learning exploitation techniques** and understanding attack vectors
- **Debugging memory corruption** in vulnerable programs
- **Bypassing security mitigations** (ASLR, NX, PIE, stack canary)