stack-overflow-and-rop

Provide a structured playbook for stack-based exploitation of Linux userland binaries.

1.6k|204|Updated Apr 7, 2026

Search Tags:#binary-exploitation #rop #stack-overflow #ret2libc #ret2csu #srop

Ready to run

npx skills add https://github.com/yaklang/hack-skills --skill stack-overflow-and-rop

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: stack-overflow-and-rop
Source: https://github.com/yaklang/hack-skills/tree/main/skills/stack-overflow-and-rop
Command: npx skills add https://github.com/yaklang/hack-skills --skill stack-overflow-and-rop

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a comprehensive playbook for exploiting stack-based vulnerabilities to hijack program control flow using techniques such as ROP, ret2libc, ret2csu, ret2dlresolve, and SROP on Linux userland binaries.

Core Features & Use Cases

Explains stack layout fundamentals and common overflow scenarios.
Details multiple exploitation techniques (ROP chains, libc-style redirects, dynamic linker resolution, and signal-return tricks) with practical patterns and gadget naming.
Includes a decision tree and tool usage guidance for vulnerability researchers from discovery to reliable code execution in lab environments.

Quick Start

Pivot to the vulnerable buffer and assemble a basic ROP chain to gain code execution in a provided test binary.

Frequently Asked Questions about stack-overflow-and-rop

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I build a ROP chain to exploit a stack overflow on a 64-bit Linux binary?▼

Bypass ASLR and PIE by leaking memory addresses through your ROP chain, then calculate libc base offsets to reliably execute ret2libc attacks and achieve code execution in the target binary.

When do I need SROP or ret2csu techniques for stack-based exploitation?▼

You need SROP to manipulate registers via SigreturnFrames, and ret2csu to populate arguments in 64-bit binaries lacking sufficient gadgets, overcoming limited control flow hijking options in complex stack overflow scenarios.

Does this playbook cover bypassing stack canaries and dynamic linker resolution?▼

Yes, the playbook details bypass strategies for stack canaries and includes ret2dlresolve techniques to resolve dynamic linker functions, expanding exploitation pathways when standard libc addresses are unknown.

What is the best way to decide between ret2libc and ret2dlresolve for hijacking control flow?▼

The best way to choose between ret2libc and ret2dlresolve is using the provided decision tree, which evaluates memory leak availability and gadget constraints to select the most reliable control flow hijacking method.