Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shel

CTF Binary Exploitation (Pwn) Quick reference for binary exploitation (pwn) CTF challenges. Each technique has a one liner here; see supporting files for full details. Prerequisites Python packages (all platforms): uv alternative: Linux (apt): Optional cross arch (ARM/MIPS — Debian/Ubuntu): macOS (Homebrew): Ruby gems (all platforms): Manual install: pwndbg — Linux: [GitHub](https://github.com/pwndbg/pwndbg), macOS: brew install pwndbg/tap/pwndbg gdb checksec — included with pwntools ( checksec file=binary ) Additional Resources [overflow basics.md](overflow basics.md) Stack/global buffer overflow, ret2win, canary bypass, canary byte by byte brute force on forking servers, struct pointer overwrite, signed integer bypass, hidden gadgets, stride based OOB read leak, parser stack overflow via unchecked memcpy length with callee saved register restoration [rop and shellcode.md](rop and shellcode.md) Core ROP chains (ret2libc, syscall ROP, rdx control, shell interaction), ret2csu, bad character XOR bypass, exotic x86 gadgets (BEXTR/XLAT/STOSB/PEXT), stack pivot via xchg rax,esp, sprintf() gadget chaining for bad character bypass, canary XOR epilogue as RDX zeroing gadget, stub execveat syscall as execve alternative via read() return value [rop advanced.md](rop advanced.md) Advanced ROP techniques: double stack pivot to BSS via leave;ret, SROP (Sigreturn Oriented Programming) with UTF 8 constraints, seccomp bypass, RETF architecture switch (x64→x32) for seccomp bypass, shellcode with input reversal, .fini array hijack, ret2vdso, pwntools template, x32 ABI syscall aliasing for seccomp bypass, time based blind shellcode exfiltration [format string.md](format string.md) Format string exploitation (leaks, GOT overwrite, blind pwn, filter bypass, canary leak, free hook, .rela.plt patching, saved EBP overwrite for .bss pivot, argv[0] overwrite for stack smash info leak, .fini array loop for multi stage exploitation, printf chk bypass with sequential %p, single call leak + GOT overwrite, ROT13 encoded format string exploit through input transformation) [advanced.md](advanced.md) Seccomp advanced techniques, UAF, JIT, esoteric GOT, heap overlap via base conversion, tree data structure stack underallocation, ret2dlresolve, kernel exploitation (basic) [heap techniques.md](heap techniques.md) House of Apple 2 (+ setcontext SUID variant), House of Einherjar, House of Orange/Spirit/Lore/Force, heap grooming, custom allocators (nginx, talloc), classic unlink, musl libc heap (meta pointer + atexit hijack), tcache stashing unlink attack, unsafe unlink + top chunk consolidation [heap techniques 2.md](heap techniques 2.md) CTF writeup heap variants: UAF vtable pointer encoding shell argument, uninitialized chunk residue pointer leak, tcache strcpy null byte overflow + backward consolidation, adjacent struct fn pointer overflow for libc leak + GOT overwrite, hidden menu tcache poisoning, tcache double free + fake IO FILE vtable stdout hijack, tcache to fastbin promotion cross bin attack, 6 bit index OOB + written bytes accumulator, IS MMAPED bit flip for unsorted bin leak on calloc'd chunk, filename regex constrained fastbin via LSB only heap pointer overwrite, custom allocator unsafe unlink to GOT [heap fsop.md](heap fsop.md) FILE structure ( IO FILE) exploitation: fastbin stdout vtable two stage hijack for PIE + Full RELRO, IO buf base null byte stdin hijack, glibc 2.24+ IO FILE vtable validation bypass, unsorted bin attack on stdin IO buf end, unsorted bin corruption via mp structure, realloc(ptr, 0) as free() UAF, single byte reference counter wraparound UAF [advanced exploits.md](advanced exploits.md) Advanced exploit techniques (part 1): VM signed comparison, BF JIT shellcode, type confusion, off by one index corruption, DNS overflow, ASAN shadow memory, format string with encoding constraints, custom canary preservation, signed integer bypass, canary aware partial overflow, CSV injection, MD5 preimage gadgets, VM GC UAF slab reuse, path traversal sanitizer bypass, FSOP + seccomp bypass via openat/mmap/write [advanced exploits 2.md](advanced exploits 2.md) Advanced exploit techniques (part 2): bytecode validator bypass via self modification, io uring UAF with SQE injection, integer truncation int32 int16, GC null reference cascading corruption, leakless libc via multi fgets stdout FILE overwrite, signed/unsigned char underflow heap overflow, XOR keystream brute force write primitive, tcache pointer decryption heap leak, unsorted bin promotion via forged chunk size, FSOP stdout TLS leak, TLS destructor hijack via call tls dtors , custom shadow stack pointer overflow bypass, signed int overflow negative OOB heap write, XSS to binary pwn bridge [advanced exploits 4.md](advanced exploits 4.md) Advanced exploit techniques (part 4): Windows SEH overwrite + pushad VirtualAlloc ROP, IAT relative resolution, detached process shell stability, SeDebugPrivilege SYSTEM escalation, ARM buffer overflow with Thumb shellcode, Forth interpreter system word exploitation, GF(2) Gaussian elimination for multi pass tcache poisoning, single bit flip exploitation primitive (mprotect + iterative code patching), Game of Life shellcode evolution via still lifes, UAF via menu driven strdup/free ordering, Windows CFG bypass via system() as valid call target, neural network output as function pointer index OOB, shellcode unique byte limit bypass via counter overflow [advanced exploits 3.md](advanced exploits 3.md) Advanced exploit techniques (part 3): stack variable overlap / carry corruption OOB, 1 byte overflow via 8 bit loop counter, game AI arithmetic mean OOB read, arbitrary read/write GOT overwrite to shell, stack leak via environ + memcpy overflow, JIT sandbox escape via uint16 jump truncation, DNS compression pointer stack overflow with multi question ROP, ELF code signing bypass via program header manipulation, game level format signed/unsigned coordinate mismatch, file descriptor inheritance via missing O CLOEXEC, sign extension integer underflow in metadata parsing, ROP chain construction with read only primitive, 4 byte shellcode with timing side channel via persistent registers, CRC oracle as arbitrary read, UTF 8 case conversion buffer overflow [advanced exploits 5.md](advanced exploits 5.md) Advanced exploit techniques (part 5): data interpretation exploitation — Chip 8 emulator OOB memory for ret2libc, double precision float quicksort canary repositioning, bloom filter abs(INT MIN) negative index OOB write [sandbox escape.md](sandbox escape.md) Custom VM exploitation, FUSE/CUSE devices, busybox/restricted shell, shell tricks, process vm readv sandbox bypass, named pipe file size bypass, CPU emulator print opcode Python eval injection (cross references ctf misc/pyjails.md for Python jail techniques) [kernel.md](kernel.md) Linux kernel exploitation fundamentals: environment setup, QEMU debug, heap spray structures (tty struct, poll list, user key payload, seq operations), kernel stack overflow, canary leak, privilege escalation (ret2usr, kernel ROP), modprobe path overwrite, core pattern overwrite, kmalloc size mismatch heap overflow + struct file f op corruption [kernel techniques.md](kernel techniques.md) Kernel exploitation techniques: tty struct kROP (fake vtable + stack pivot), AAW via ioctl register control, userfaultfd race stabilization, SLUB allocator internals (freelist hardening/obfuscation), leak via kernel panic, MADV DONTNEED race window extension (DiceCTF 2026), cross cache CPU split attack (DiceCTF 2026), PTE overlap file write (DiceCTF 2026), addr limit bypass via failed file open for kernel memory read/write [kernel bypass.md](kernel bypass.md) Kernel protection bypass: KASLR/FGKASLR bypass ( ksymtab), KPTI bypass (swapgs trampoline, signal handler, modprobe path/core pattern via ROP), SMEP/SMAP bypass, GDB kernel module debugging, initramfs/virtio 9p workflow, exploit templates, exploit delivery [field notes.md](field notes.md) Detailed pwn notes: heap exploitation quick reference, additional exploit notes, useful commands When to Pivot If you do not yet understand what the binary does, switch to /ctf reverse before trying to exploit it. If the service is really a restricted shell, encoding puzzle, or sandbox language challenge, switch to /ctf misc . If the exploit path depends on a web endpoint, session bug, or upload primitive more than memory corruption, switch to /ctf web . If the vulnerability requires breaking a cryptographic primitive before exploitation, switch to /ctf crypto . Quick Start Commands Source Code Red Flags Threading/ pthread race conditions usleep() / sleep() timing windows Global variables in multiple threads TOCTOU Race Condition Exploitation Common Vulnerabilities Buffer overflow: gets() , scanf("%s") , strcpy() Format string: printf(user input) Integer overflow, UAF, race conditions Protection Implications for Exploit Strategy Protection Status Implication PIE Disabled All addresses (GOT, PLT, functions) are fixed direct overwrites work RELRO Partial GOT is writable GOT overwrite attacks possible RELRO Full GOT is read only need alternative targets (hooks, vtables, return addr) NX Enabled Can't execute shellcode on stack/heap use ROP or ret2win Canary Present Stack smash detected need leak or avoid stack overflow (use heap) Quick decision tree: Partial RELRO + No PIE GOT overwrite (easiest, use fixed addresses) Full RELRO target free hook , malloc hook (glibc < 2.34), or return addresses Stack canary present prefer heap based attacks or leak canary first Stack Buffer Overflow 1. Find offset: cyclic 200 then cyclic l <value 2. Check protections: checksec file=binary 3. No PIE + No canary = direct ROP 4. Canary leak via format string or partial overwrite 5. Canary brute force byte by byte on forking servers (7 256 attempts max) ret2win with magic value: Overflow ret (alignment) pop rdi; ret magic win(). Stack alignment: SIGSEGV in movaps = add extra ret gadget. Offset: buffer at rbp N , return at rbp + 8 , total = N + 8. Input filtering: assert payload avoids memmem() banned strings. Gadgets: ROPgadget binary binary grep "pop rdi" , or pwntools ROP() for hidden gadgets in CMP immediates. See [overflow basics.md](overflow basics.md) for full exploit code. Parser Stack Overflow (Unchecked memcpy) Pattern: Custom file parser (PCAP, image, archive) allocates fixed stack buffer but input records can exceed it. memcpy copies before length validation, overflowing saved registers and return address. Must restore callee saved registers: rbx to readable memory (BSS), loop counters to exit values, then ret gadget + win function. See [overflow basics.md](overflow basics.md parser stack overflow via unchecked memcpy length metactf flash 2026). Struct Pointer Overwrite (Heap Menu Challenges) Pattern: Menu create/modify/delete on structs with data buffer + pointer. Overflow name into pointer field with GOT address, then write win address via modify. See [overflow basics.md](overflow basics.md) for full exploit and GOT target selection table. Signed Integer Bypass Pattern: scanf("%d") without sign check; negative quantity price = negative total, bypasses balance check. See [overflow basics.md](overflow basics.md). Canary Aware Partial Overflow Pattern: Overflow valid flag between buffer and canary. Use ./ as no op path padding for precise length. See [overflow basics.md](overflow basics.md) and [advanced.md](advanced.md) for full exploit chain. Global Buffer Overflow (CSV Injection) Pattern: Adjacent global variables; overflow via extra CSV delimiters changes filename pointer. See [overflow basics.md](overflo

ctf-pwn