binary-exploitation

name	binary-exploitation
description	Binary exploitation techniques — buffer overflow, format string, heap exploitation, ROP, kernel exploitation, sandbox escape, shellcode. Use when the target is a native binary (ELF/PE), remote service with memory corruption, or kernel module. Requires pwntools, GDB, and binary analysis tools.
license	MIT
compatibility	Requires filesystem-based agent with bash, Python 3, pwntools, GDB, and checksec.
allowed-tools	Bash Read Write Edit Glob Grep
metadata	{"user-invocable":"true","argument-hint":"<exploit-type or binary-path>"}

Binary Exploitation

Routing skill for binary exploitation techniques.

Triage

file binary
checksec --file=binary
strings binary | grep -iE '(flag|pass|key)'
readelf -h binary        # architecture, entry point
readelf -l binary        # segments (stack executable?)
readelf -d binary        # dynamic (RELRO?)
ldd binary               # libc version

Signal → Document Map

Signal	Document
gets, strcpy, read into fixed buffer, no canary	Buffer Overflow
printf(user_input), variable format string	Format String
malloc/free menu, UAF, double free, heap overflow	Heap
NX enabled, no exec stack, need code reuse	ROP
Kernel module, /dev/, syscall interface	Kernel
seccomp filter, restricted syscalls	Sandbox Escape
Need custom shellcode, badchar constraints	Shellcode

Protections

Protection	Bypass Strategy
NX/DEP	ROP chain, ret2libc, mprotect
Stack canary	Fork brute-force, format string leak, overwrite __stack_chk_fail GOT
PIE	Partial overwrite, format string leak, vsyscall leak
Full RELRO	Target libc data (__free_hook pre-2.34, _IO_FILE vtable)
ASLR	Info leak required — unsorted bin, format string, stack leak
seccomp	open+read+write chain instead of execve, sendfile

Python Template

from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'

elf = ELF('./binary')
libc = ELF('./libc.so.6')
p = process('./binary')  # or remote('host', port)

# Exploit here

p.interactive()