binary-exploitation-writeups

## https://sploitus.com/exploit?id=6DB67B97-3F93-581A-9548-034DCB450FC3
# Binary Exploitation CTF Writeups

A comprehensive collection of binary exploitation (pwn) challenge writeups covering fundamental exploitation techniques encountered in Capture The Flag (CTF) competitions. Each challenge includes a vulnerable program, a working exploit, and a detailed educational walkthrough.

## Table of Contents

- [Overview](#overview)
- [Exploit Development Methodology](#exploit-development-methodology)
- [Tool Setup Guide](#tool-setup-guide)
- [Challenges](#challenges)
  - [Challenge 01: Buffer Overflow](#challenge-01-buffer-overflow)
  - [Challenge 02: Return-to-libc (ret2libc)](#challenge-02-return-to-libc-ret2libc)
  - [Challenge 03: ROP Chain](#challenge-03-rop-chain)
  - [Challenge 04: Format String](#challenge-04-format-string)
  - [Challenge 05: Shellcode Injection](#challenge-05-shellcode-injection)
- [References](#references)

## Overview

This repository serves as both a reference and a learning resource for binary exploitation. Each challenge is self-contained with:

- **`vuln.c`** — The vulnerable C program
- **`exploit.py`** — A Python3/Pwntools exploit script
- **`walkthrough.md`** — A detailed educational writeup
- **`Makefile`** — Build instructions (where applicable)

## Exploit Development Methodology

1. **Reconnaissance** — Identify the vulnerability class (BOF, format string, etc.)
2. **Binary Analysis** — Check protections with `checksec`, disassemble with `objdump`/`gdb`
3. **Offset Determination** — Find the offset to RIP/EIP using cyclic patterns (`cyclic`/`cyclic_find`)
4. **Control Flow Hijack** — Overwrite return address or function pointer
5. **Payload Construction** — Build the final payload with necessary gadgets/addresses
6. **Exploitation** — Execute the exploit, test locally and remotely

## Tool Setup Guide

### pwntools

Python library for exploit development.

```bash
# Install via pip
python3 -m pip install --user pwntools

# Verify installation
python3 -c "from pwn import *; print('pwntools ready')"
```

Key features: `cyclic`/`cyclic_find` for offset discovery, `ELF()` for binary analysis, tube objects for I/O, ROP builder, and assembly/disassembly utilities.

### GDB with pwndbg

GNU Debugger enhanced with pwndbg for exploitation work.

```bash
# Install gdb
sudo apt-get install gdb

# Install pwndbg
git clone https://github.com/pwndbg/pwndbg
cd pwndbg && ./setup.sh

# Alternative: GEF (GDB Enhanced Features)
# bash -c "$(curl -fsSL https://gef.blah.cat/sh)"
```

Essential commands: `checksec` (binary protections), `vmmap` (memory mappings), `search-pattern` (find values in memory), `cyclic` (pattern generation), `telescope` (stack inspection).

### ROPgadget / ropper

Tools for finding ROP gadgets in binaries.

```bash
# ROPgadget
python3 -m pip install --user ROPgadget

# Ropper
python3 -m pip install --user ropper

# Usage
ROPgadget --binary vuln
ropper --file vuln --search "pop rdi"
```

### one_gadget

Finds magic gadgets in libc that spawn a shell with minimal constraints.

```bash
# Installation
gem install one_gadget

# Usage
one_gadget /lib/x86_64-linux-gnu/libc.so.6
```

### checksec

Check binary security protections.

```bash
# Via pwntools
python3 -c "from pwn import *; print(ELF('./vuln'))"

# Via pwndbg (inside gdb)
# checksec
```

### objdump / readelf

`objdump` disassembles binaries; `readelf` parses ELF headers and sections.

## Challenges

### Challenge 01: Buffer Overflow

**Technique:** Basic stack buffer overflow  
**Protections:** No stack canary, no PIE, executable stack  
**Goal:** Overwrite return address to jump to a win function or shellcode on the stack  

[Go to challenge →](challenge-01-buffer-overflow/walkthrough.md)

### Challenge 02: Return-to-libc (ret2libc)

**Technique:** Return-to-libc  
**Protections:** NX enabled, ASLR enabled  
**Goal:** Leak libc address via GOT, calculate `system()` and `/bin/sh` offsets, bypass ASLR  

[Go to challenge →](challenge-02-ret2libc/walkthrough.md)

### Challenge 03: ROP Chain

**Technique:** Return-Oriented Programming (ROP)  
**Protections:** NX enabled, PIE disabled  
**Goal:** Chain gadgets to call `execve("/bin/sh", NULL, NULL)` without executing code on the stack  

[Go to challenge →](challenge-03-rop-chain/walkthrough.md)

### Challenge 04: Format String

**Technique:** Format string read/write  
**Protections:** Full RELRO, PIE, NX, stack canary  
**Goal:** Use `%x` to leak stack values, `%n` for arbitrary write to overwrite GOT entry  

[Go to challenge →](challenge-04-format-string/walkthrough.md)

### Challenge 05: Shellcode Injection

**Technique:** Custom shellcode injection  
**Protections:** No protections — executable stack  
**Goal:** Write null-byte-free execve("/bin/sh") shellcode and jump to it  

[Go to challenge →](challenge-05-shellcode-injection/walkthrough.md)

## References

- [pwntools documentation](https://docs.pwntools.com/)
- [CTF 101 — Binary Exploitation](https://ctf101.org/binary-exploitation/overview/)
- [Shellcode Database](http://shell-storm.org/shellcode/)
- [LiveOverflow Binary Exploitation Playlist](https://www.youtube.com/playlist?list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyHF)
- [RPISEC Modern Binary Exploitation](https://github.com/RPISEC/MBE)