skills.rest
wgpsec
wgpsecOFFICIAL
Explore all skills by this author →
Website𝕏@wgpsecGitHub

binary-exploitation-methodology

Guides analysis and exploitation of binary vulnerabilities including stack overflows, heap corruption, and format strings.

1.7k|238|Updated Dec 7, 2019
Search Tags:#stack overflow#pwntools#pwn#binary exploitation#ret2libc#heap exploitation#ROP chain
One-click install
npx skills add https://github.com/wgpsec/AboutSecurity --skill binary-exploitation-methodology
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: binary-exploitation-methodology
Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/exploit/binary/binary-exploitation-methodology
Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill binary-exploitation-methodology

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Analyzing and exploiting binary vulnerabilities requires navigating complex protection mechanisms (ASLR, NX, Stack Canary, PIE, RELRO) and choosing the right exploitation strategy, which is error-prone without a systematic methodology.

Core Features & Use Cases

  • Structured Six-Phase Workflow: Covers target analysis, protection mechanism identification via checksec, vulnerability type classification (stack overflow, heap overflow, format string, UAF), exploitation strategy selection (ret2win, ret2shellcode, ROP, ret2libc), exploit development with pwntools, and testing validation.
  • In-Depth Reference Guides: Detailed references for heap exploitation (tcache poisoning, fastbin attacks, House of X), format string attacks, libc version identification and offset calculation, and seccomp sandbox assessment and bypass.
  • Use Case: Given a vulnerable ELF binary in a penetration test, follow the decision trees to identify enabled protections, classify the vulnerability, leak the libc base address, and build a ret2libc ROP chain with pwntools to obtain a shell.

Quick Start

Analyze the target binary with checksec and file, then follow the methodology's decision trees to identify the vulnerability type and select an exploitation strategy.

Frequently Asked Questions about binary-exploitation-methodology

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a stack buffer overflow in a binary?▼

First determine the offset to the return address using a cyclic pattern from pwntools, then check protections with checksec. If NX is enabled, build a ROP chain with gadgets from ROPgadget; if not, jump to shellcode placed on the stack.

How to bypass ASLR when exploiting a binary?▼

Leak a libc address at runtime, typically by using a ROP chain that calls puts on a GOT entry or by reading unsorted bin fd/bk pointers in heap exploits. Subtract the known symbol offset to compute the libc base, then calculate system and /bin/sh addresses.

What is the difference between ret2libc and ret2shellcode?▼

ret2shellcode jumps to attacker-supplied shellcode on the stack and only works when NX is disabled. ret2libc reuses existing libc functions like system with a /bin/sh argument, which works when NX is enabled but requires knowing the libc base address.

How do I identify the remote libc version during exploitation?▼

Leak two or more libc function addresses and match their low 12 bits against libc.blukat.me or the libc-database tool. The low 12 bits are page offsets unaffected by ASLR, allowing reliable version identification.

Why does my exploit work locally but fail on the remote target?▼

Remote failures usually stem from different libc versions, stack alignment issues, or environment differences. Use patchelf to bind the target libc locally, add a ret gadget for 16-byte stack alignment on x86_64, and verify addresses in GDB.

Can seccomp sandbox restrictions be bypassed in binary exploitation?▼

Yes, depending on the filter rules. Common approaches include using alternative syscalls like openat instead of open, exploiting x32 ABI when architecture checks are incomplete, or leveraging already-open file descriptors inherited before the filter was installed.

Related Skills

Explore More Software Engineering Skills→
mohitmishra786mohitmishra786
159

elf-inspection

Analyzes ELF binaries using readelf, objdump, nm, and ldd.

Community
Intermediate
duriandurinoduriandurino

post

Automate privilege escalation checks and credential harvesting on compromised Linux systems.

Community
Advanced
p-o-ke-naep-o-ke-nae

binary-analysis-patterns

Reconstruct program logic from compiled binaries using Ghidra and IDA Pro.

Community
Intermediate
asdfgh1445asdfgh1445
735

Strix•SSRF 测试

Identify SSRF attack surfaces in web applications and cloud environments.

Community
Intermediate