| name | pwn |
| description | Solve CTF binary exploitation (pwn) challenges: buffer overflows, format strings, ROP chains, heap exploitation, and shellcoding. Use when given ELF/PE binaries with a remote service to exploit. Triggers: "buffer overflow", "format string", "ROP", "shellcode", "checksec", "NX", "canary", "PIE", "GOT overwrite", "ret2libc", pwntools scripts, .elf files, nc/netcat connection targets. Tools: checksec, ROPgadget, pwntools, gdb, one_gadget. NOT for static reverse engineering (use reverse). |
CTF Pwn
Analyze and exploit binary exploitation challenges.
When to Use
Use this command for challenges involving:
- ELF binaries
- Buffer overflows
- Format string vulnerabilities
- ROP chains
- Heap exploitation
Bundled Scripts
- check-tools.sh — Verify required pwn tools are installed
- run-checksec.sh — Check binary protections (CANARY, NX, PIE, RELRO). Outputs JSON with protection status, attack vectors, and suggested exploitation strategy.
Instructions
-
First check tool availability: bash scripts/check-tools.sh
-
Start with checksec to understand binary protections:
bash scripts/run-checksec.sh $ARGUMENTS
The JSON output includes:
protections: status of each protection (enabled/disabled/partial)attack_vectors: viable exploitation approachessuggestions[0]: recommended exploitation STRATEGY based on protections
Example: if stack_canary=disabled and nx=disabled, the strategy is "Classic buffer overflow with shellcode injection".
-
Based on checksec JSON, proceed with exploitation:
No Canary + No NX (shellcode):
from pwn import *
p = process('./binary')
shellcode = asm(shellcraft.sh())
payload = shellcode + b'A' * (offset - len(shellcode)) + p64(buf_addr)
p.sendline(payload)
p.interactive()
No Canary + NX + No PIE (ROP):
ROPgadget --binary ./binary --re "pop rdi"
payload = b'A' * offset + p64(pop_rdi) + p64(bin_sh) + p64(system)
PIE enabled (need leak):
- Leak address via format string or partial overwrite
- Calculate base address
- Build ROP chain with calculated addresses
-
Find offset to return address:
from pwn import *
print(cyclic(200))
Exploitation Checklist
- Run binary, understand behavior
run-checksec.sh → read JSON attack_vectors- Find vulnerability (overflow, format string)
- Find offset to control
- Build exploit (shellcode or ROP)
- Test locally, then remote
Team Roles
When using /ctf-kit:team-solve with a pwn challenge, the lead spawns 3 specialists.
Exploit-dev requires plan approval before connecting to remote targets.
| Role | Teammate Name | Focus | Tools | First Action |
|---|
| Static Analyst | binary-analyst | checksec, disassembly, vulnerability identification, function mapping, string cross-refs | checksec, radare2, scripts/run-checksec.sh | Run checksec, disassemble main + interesting functions, identify vuln class |
| Exploit Developer | exploit-dev | Payload crafting, ROP chain building, shellcode, format string exploitation, ret2libc/ret2csu | pwntools, ROPgadget, one_gadget | Build exploit based on static analysis, find gadgets, calculate offsets |
| Dynamic Analyst | dynamic-analyst | GDB debugging, offset finding, leak discovery, heap state inspection, ASLR/PIE bypass | gdb, pwntools, ltrace, strace | Run binary with cyclic pattern, find crash offset, identify leakable addresses |
Workflow coordination
The pwn team has a natural dependency chain:
- Static analyst runs first → identifies protections and vulnerability type
- Dynamic analyst runs in parallel → finds offsets and leaks
- Exploit developer waits for both → builds the final exploit
When to broadcast
- Static: "Binary has no canary + no PIE, vuln in read() at offset 0x40" — exploit dev starts building
- Dynamic: "Crash at offset 72, libc leak via puts@GOT" — exploit dev uses these values
- Exploit dev: "Exploit works locally, switching to remote" — lead reviews plan before remote connection
- Any: "Got shell / found flag" — immediate broadcast, all stop
Example Usage
/ctf-kit:pwn ./challenge
/ctf-kit:pwn ./binary
