Binary Exploitation (Pwn)
A core hacking pillar focusing on exploiting low-level vulnerabilities in compiled binaries. This guide covers memory corruption, control flow hijacking, and modern mitigation bypasses.
Advanced Topic
Exploit Development Workflow
Recon
Binary analysis
Find Bug
Fuzzing, audit
Trigger
Crash, control
Exploit
Bypass, execute
Shell
Code execution
What You'll Learn
- Stack-based buffer overflow exploitation
- Return-Oriented Programming (ROP)
- Heap exploitation techniques
- Format string vulnerabilities
- ASLR and PIE bypass methods
- Shellcode development
- Pwntools scripting
- GDB and debugging techniques
Core Topics
Understanding stack-based buffer overflows, EIP control, and shellcode execution.
Return Oriented Programming to bypass NX/DEP protections.
Attacking the heap allocator, use-after-free, and heap grooming.
Exploiting format string vulnerabilities for memory reads and writes.
Techniques for defeating address randomization protections.
Process Memory Layout
Stack Memory (High → Low)
Stack Frame
Buffer overflows occur when local variables overflow into return address.
Security Mitigations
| Protection | Description | Bypass |
|---|---|---|
| NX/DEP | Stack not executable | ROP chains, ret2libc |
| ASLR | Randomize memory addresses | Info leak, brute force |
| Stack Canary | Detect stack overflow | Leak canary, format string |
| PIE | Position Independent Executable | Leak base address |
| RELRO | Read-only relocations (GOT) | Partial: GOT overwrite |
| CFI | Control Flow Integrity | Advanced: JIT-ROP |
Checking Binary Protections
# Using checksec (pwntools)
checksec ./binary
# Example output:
# Arch: amd64-64-little
# RELRO: Partial RELRO
# Stack: Canary found
# NX: NX enabled
# PIE: No PIE (0x400000)
# Using file
file ./binary
# Check ASLR status (Linux)
cat /proc/sys/kernel/randomize_va_space
# 0 = Off, 1 = Conservative, 2 = Full
# Disable ASLR for testing
echo 0 | sudo tee /proc/sys/kernel/randomize_va_spaceEssential Tools
pwntools
ExploitationCTF framework and exploit development library. Essential for writing exploits in Python.
Installation
pip install pwntoolsGDB + pwndbg
DebuggingEnhanced GDB with exploit development features, heap analysis, and better visualization.
Installation
git clone https://github.com/pwndbg/pwndbg && ./setup.shGhidra
Reverse EngineeringNSA's reverse engineering suite. Excellent decompiler for static analysis.
Installation
# Download from websiteROPgadget
ROPFind ROP gadgets in binaries. Essential for building ROP chains.
Installation
pip install ropgadgetone_gadget
ExploitationFind one-shot RCE gadgets in libc for instant shell.
Installation
gem install one_gadgetradare2
Reverse EngineeringAdvanced commandline reverse engineering framework.
Installation
# Install from package managerQuick Start: Pwntools
from pwn import *
# Set architecture
context.arch = 'amd64'
context.log_level = 'debug'
# Connect to binary or remote
# p = process('./vuln')
p = remote('pwn.ctf.com', 1337)
# Create payload
payload = b'A' * 72 # Padding to return address
payload += p64(0xdeadbeef) # Overwrite return address
# Send payload
p.sendline(payload)
# Interactive shell
p.interactive()Practice Resources