💥

Binary Exploitation (Pwn)

Pwn challenges require you to exploit memory corruption vulnerabilities — buffer overflows, format strings, heap mismanagement, and more — to hijack program execution, spawn a shell, or read protected memory.

What is it?

Binary exploitation ("pwn") is the art of taking control of a running process by abusing memory-safety bugs. When a program fails to validate input size or type, an attacker can overwrite memory structures — redirecting execution to arbitrary code or leaking sensitive data.

It requires a deep understanding of process memory layout (stack, heap, BSS), CPU calling conventions, OS protections (ASLR, NX, stack canaries, PIE, RELRO), and low-level C/assembly behaviour.

How it works in a CTF

In a CTF, you are given a compiled binary and (usually) a remote service running it. Your goal is to provide crafted input that hijacks execution and reads a flag from a privileged file or environment variable on the server.

Common workflow: check protections with checksec → find the vulnerability (overflow, format string, use-after-free) → calculate offsets → build the exploit payload with pwntools → leak a libc address if needed → get a shell and cat flag.txt.

Example challenge types
Stack buffer overflow (ret2win)ROP chain (bypass NX)Format string leak + overwriteret2libc / ret2pltHeap overflow (fastbin dup)Use-after-free (UAF)Stack canary brute-force (forking server)SROP (sigreturn-oriented programming)GOT overwriteOff-by-one overflowTcache poisoning (glibc 2.29+)Shellcode injection (NX disabled)

Sample Challenge

ret2win
Pwn Easy 150 pts
A 64-bit Linux ELF service reads your name with gets() into a 64-byte stack buffer and then calls greet(). There is also a function called win() that runs /bin/sh — it is never called by the program. NX is enabled; PIE is disabled.
vulnlibc.so.6
How to solve it
  1. Run checksec vuln: NX=on, PIE=off, no canary — confirms a ret-to-win approach.
  2. Find the win() address: objdump -d vuln | grep win (e.g. 0x401196).
  3. Calculate the offset to the return address: python3 -c "import pwn; pwn.cyclic(200)", crash the binary, read rsp in GDB, run pwn.cyclic_find().
  4. Build the exploit: payload = b'A'*offset + p64(win_addr).
  5. Send with pwntools: p = process('./vuln'); p.sendline(payload); p.interactive() — drops you to a shell.
FLAG{sm4shed_the_st4ck_g0t_sh3ll}

Official Resources & Standards

pwntools
The essential Python library for writing CTF exploits — process control, ROP, packing, shellcode, and remote connections.
ToolOpen Source
GDB (GNU Debugger)
The standard Linux debugger. Used with plugins like pwndbg for exploit development.
ToolOpen Source
ROPgadget
Searches binaries for usable ROP gadgets and builds chains automatically.
ToolOpen Source
one_gadget
Finds magic one-gadget execve('/bin/sh') gadgets in libc for quick shell.
ToolOpen Source

Free Training & Practice

pwn.college
ASU's free, world-class course on binary exploitation — from shellcode to heap and kernel exploits. The best free resource available.
FreeCoursesHighly Recommended
ROPEmporium
Eight focused challenges that teach Return-Oriented Programming technique by technique.
FreeChallengesROP
ir0nstone — Binary Exploitation Notes
Comprehensive free notes covering stack, format strings, ROP, SROP, heap, and kernel topics.
FreeReference
exploit.education
Provides vulnerable VMs (Phoenix, Nebula, Protostar, Fusion) designed for learning exploitation.
FreeVMs
LiveOverflow YouTube
In-depth binary exploitation series and real CTF walkthroughs — explains the 'why' behind techniques.
FreeVideos
HackTheBox Academy — Stack-Based Buffer Overflows
Guided exploitation labs from basic stack smashing to modern bypass techniques.
Free TierLabs
picoCTF — Binary Exploitation
Beginner binary exploitation challenges with hints. Good for first-timers learning gdb.
FreeBeginner

Essential Tools

pwndbg
GDB plugin with colour-coded context, heap inspection, and one-command GOT/PLT lookup.
FreeDebugger
pwntools
Python exploit framework — write, test, and script exploits in minutes.
FreeOpen Source
checksec
Quickly check which mitigations (ASLR, PIE, stack canary, NX, RELRO) are enabled.
FreeOpen Source
libc-database
Search for a libc version by function offsets — critical for ret2libc attacks.
FreeOpen Source

Getting Started Tips

💡 Tip: Run `checksec` first — knowing whether PIE / canary / NX are enabled immediately narrows your attack surface.
💡 Tip: pwn.college is the single best resource, even for experienced players. Start from the beginning; the early modules build crucial fundamentals.
💡 Tip: Use pwntools' `cyclic` / `cyclic_find` to determine the offset to the return address quickly — avoid manual counting.
💡 Tip: When stuck on a heap challenge, read the allocator source (glibc malloc/free) and draw the bin structure by hand.