Libc base address calculator
Turn a leaked libc pointer into the library’s base address, then resolve any other symbol - the arithmetic every ret2libc exploit runs on.
Open in ctfpalASLR randomises where libc is loaded, but only the base - the internal layout is fixed by the build. So one leaked pointer into libc reveals everything: subtract the symbol’s known offset to get the base, then add any other symbol’s offset to locate it.
libc_base = leaked_puts - libc.symbols['puts']
system_addr = libc_base + libc.symbols['system']
binsh_addr = libc_base + next(libc.search(b'/bin/sh'))Identifying the libc version
The offsets differ between builds, so the arithmetic requires the exact libc the target uses. When a challenge does not provide the binary, the standard technique is to leak two or three symbol addresses and match their low twelve bits - which ASLR does not randomise, because pages are aligned - against a database of known builds. That fingerprint identifies the version uniquely in almost every case.
Part of a module
10. Binary exploitation
Read a binary’s protections, find an overflow offset in one crash, and build a ROP chain when the stack is not executable.
Practise on real challenges
Go deeper
- From crash to shell: stack overflows, offsets, ret2win, and ret2libcA segfault is not an exploit. The path from an unexpected crash to a controlled instruction pointer to a shell, with the mitigation checks that decide which technique you need and the stack-alignment detail that breaks working exploits.
Related tools
ROP gadget finder
Search a binary for return-oriented programming gadgets, filter by the registers they touch, and exclude ones containing bad bytes.
ROP chain and payload builder
Assemble an exploit payload from padding, addresses, and raw bytes, with a live hexdump and offset ruler - the pwntools flat() workflow.
Format string exploit builder
Find your input’s position on the stack and build %n write primitives - turning an uncontrolled printf into an arbitrary read and write.
Struct pack and unpack (p32, p64, u32, u64)
Convert integers to little-endian byte strings and back at 8, 16, 32, and 64 bits - the pwntools p32/p64 helpers without the install.