CTF Pwn Binary Exploitation Quick Reference

Problem

CTF pwn challenges are often not about finding one textbook bug, but about choosing the right exploit path given binary behavior, runtime state, protections, and input filters. ctf-pwn organizes stack overflow, ROP, heap, format-string, kernel, and sandbox-escape techniques as a quick reference for engineers who have already identified the vulnerable primitive.

How It Works

• Protection triage: uses PIE, RELRO, NX, and canary status to decide whether direct GOT overwrites are possible, ROP is required, canary leak is needed, or heap-based routes are safer.
• Stack exploitation: covers offset discovery, ret2win, ret2libc, ret2csu, stack pivots, rdx control, bad-character bypasses, and obscure x86 gadgets.
• ROP and shellcode: includes puts@PLT/puts@GOT libc leaks, staged system/execve, raw syscalls, small-buffer stubs, XOR-based filtering bypasses, and nonstandard write gadgets.
• Heap and advanced primitives: covers fastbin, tcache, UAF, unlink, custom allocators, House of Einherjar/Orange, seccomp bypasses, SROP, .fini_array hijack, and ret2dlresolve.
• Format string, sandbox, and kernel: includes format-string leaks, GOT overwrites, hook-based writes, encoding bypasses, restricted-shell escapes, VM/FUSE/CUSE tricks, and kernel paths such as modprobe_path, core_pattern, kROP, and KASLR/KPTI/SMEP/SMAP bypasses.

Boundaries

It assumes the binary behavior, vulnerability site, and service type are already understood. If the target is mainly a restricted shell, encoding puzzle, web endpoint, crypto primitive, or requires deep reverse engineering first, use the corresponding CTF track instead. Many techniques depend on libc/glibc version, architecture, kernel version, seccomp policy, or challenge-specific constraints, and race/UAF/kernel exploits may be environment-sensitive.