Pwntools Blog

dCTF 2021 - Hotel ROP

Returning 2 LIBC in a PIE enabled binary

Posted on May 24, 2021 | 4 minutes | 828 words | elma

Today, we will be looking at a pwn challenge from dCTF 2021 which features ret2libc exploitation with a little twist of a PIE-enabled binary. The following PwnTools features will be introduced here: pwnlib.rop to help us craft ROP chains pwnlib.elf to make finding addresses quick and easy and many more little modules from pwntools to help us pwn faster ~ Challenge Description They say programmers' dream is California. [Read More]

Simple GOT Overwrite

Exploiting a basic vulnerability involving a GOT overwrite

Posted on February 23, 2021 | 8 minutes | 1658 words | ebeip90

Modern Linux relies on a linker to match imported symbols to an external library, generally libc.so. The process of overwriting entries in the Global Offset Table (GOT) can easily lead to controlled code execution.

[Read More]

got aslr easy elf libc

Pwnable.kr: fd

Using pwntools to solve a simple challenge that does not require binary exploitation

Posted on February 23, 2021 | 8 minutes | 1613 words | ebeip90

Pwnable.kr is a website that offers exploitable CTF challenges, with four difficulty categories. Today, we’ll be looking at a very simple challenge, fd. The following Pwntools features are demonstrated hereL

pwn template command-line utility for generating exploit scripts
Magic args for setting runtime arguments
Processes via process and pwnlib.ssh
Basic information about file descriptors