Binary exploitation
Read a binary’s protections, find an overflow offset in one crash, and build a ROP chain when the stack is not executable.
By the end you can
- Read NX, PIE, canary, and RELRO from a binary and say what each rules out
- Find an overflow offset with a de Bruijn pattern in a single crash
- Build a ret2libc chain, including stack alignment
- Turn a leaked pointer into a libc base and resolve arbitrary symbols
1. Read
2. Use the tools
In the order they come up while solving. Each opens the workspace tab that runs it.
ELF, PE and Mach-O binary analyzer
Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.
Buffer overflow offset finder
Find the exact number of bytes before the saved return address using a de Bruijn pattern and the value from a single crash.
ROP gadget finder
Search a binary for return-oriented programming gadgets, filter by the registers they touch, and exclude ones containing bad bytes.
ROP chain and payload builder
Assemble an exploit payload from padding, addresses, and raw bytes, with a live hexdump and offset ruler - the pwntools flat() workflow.
Libc base address calculator
Turn a leaked libc pointer into the library’s base address, then resolve any other symbol - the arithmetic every ret2libc exploit runs on.
Pwntools exploit script generator
Generate a working pwntools template with the right context, process or remote connection, and the boilerplate every exploit repeats.
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
Practice
generated here, checked here, no account and nothing to download
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 51 match in total - see the full index.
Checkpoint
Given a 64-bit binary with NX and no PIE, produce a working ret2libc exploit and explain each entry in the chain.
Teaching note
The alignment `ret` gadget is the single most common blocker: the exploit is correct and crashes inside `system` anyway. Warn about it in advance or students will conclude their whole chain is wrong.