Lesson pack 10 · Advanced · 150 minutes
Binary exploitation
Read a binary’s protections, find an overflow offset in one crash, and build a ROP chain when the stack is not executable.
Print this page for a paper plan - the navigation and links drop out.Student-facing version
Before the session
- Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
- Read the lesson yourself first - about 7 minutes.
- Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.
Objectives
Written as things a student can do afterwards, so they can be assessed rather than asserted.
- Read NX, PIE, canary, and RELRO from a binary and say what each rules out
- Find an overflow offset with a de Bruijn pattern in a single crash
- Build a ret2libc chain, including stack alignment
- Turn a leaked pointer into a libc base and resolve arbitrary symbols
Running order (150 min)
| Time | What happens |
|---|---|
| 0:00-0:15 | Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails. |
| 0:15-0:45 | Teach the methodThe technique itself, on the board or from the lesson. No tools open yet. |
| 0:45-1:23 | Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice. |
| 1:23-2:16 | Practice setStudents work the challenges. Circulate rather than present. |
| 2:16-2:30 | Checkpoint and wrapCollect the artefact, name what comes next. |
Tools used
- ELF, PE and Mach-O binary analyzer - Parse headers, sections, imports, and symbols from Linux, Windows, and macOS binaries, with C++ symbol demangling and gadget discovery.https://ctfpal.com/?tool=elf-pe-analyzer
- Buffer overflow offset finder - Find the exact number of bytes before the saved return address using a de Bruijn pattern and the value from a single crash.https://ctfpal.com/?tool=buffer-overflow-offset
- ROP gadget finder - Search a binary for return-oriented programming gadgets, filter by the registers they touch, and exclude ones containing bad bytes.https://ctfpal.com/?tool=rop-gadget-finder
- ROP chain and payload builder - Assemble an exploit payload from padding, addresses, and raw bytes, with a live hexdump and offset ruler - the pwntools flat() workflow.https://ctfpal.com/?tool=rop-payload-builder
- Libc base address calculator - Turn a leaked libc pointer into the library’s base address, then resolve any other symbol - the arithmetic every ret2libc exploit runs on.https://ctfpal.com/?tool=libc-base-calculator
- Pwntools exploit script generator - Generate a working pwntools template with the right context, process or remote connection, and the boilerplate every exploit repeats.https://ctfpal.com/?tool=pwntools-script-generator
Reading
- From crash to shell: stack overflows, offsets, ret2win, and ret2libc - 7 min. A segfault is not an exploit. The path from an unexpected crash to a controlled instruction pointer to a shell, with the mitigation checks that decide which technique you need and the stack-alignment detail that breaks working exploits.
Practice set
Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.
- format string 0 - picoCTF 2024, easy
- babygame01 - picoCTF 2023, medium
- basic-file-exploit - picoCTF 2022, medium
- Binary Gauntlet 0 - picoCTF 2021, medium
- Binary Gauntlet 1 - picoCTF 2021, medium
- Binary Gauntlet 2 - picoCTF 2021, medium
- Binary Gauntlet 3 - picoCTF 2021, medium
- buffer overflow 0 - picoCTF 2022, medium
- buffer overflow 1 - picoCTF 2022, medium
- buffer overflow 2 - picoCTF 2022, medium
- clutter-overflow - picoMini by redpwn, medium
- Echo Escape 1 - picoCTF 2026, medium
Checkpoint (gradeable)
Given a 64-bit binary with NX and no PIE, produce a working ret2libc exploit and explain each entry in the chain.
Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.
Where the room gets stuck
The alignment `ret` gadget is the single most common blocker: the exploit is correct and crashes inside `system` anyway. Warn about it in advance or students will conclude their whole chain is wrong.
If you finish early
- Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
- Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
- Ask a student to break their own example - construct an input that defeats the tool, and explain why.