ctf-pwn
ctf-pwn equips you with techniques to weaponize memory corruption vulnerabilities in CTF challenges. From buffer overflows and format strings to advanced heap exploitation, ROP chains, and kernel attacks, it covers the full spectrum of low-level privilege escalation and code execution paths. Use it when you have a vulnerable target and need to convert corruption primitives into shell access.
ctf-pwn turns memory corruption bugs into code execution using ROP chains, shellcode, and ret2win techniques.
AI-generated summary based on this skill's SKILL.md
Install
ljagiello/ctf-skills/ctf-pwn · repository language: Python
git clone https://github.com/ljagiello/ctf-skills
cp -r ctf-skills/ctf-pwn ~/.claude/skills/ctf-pwnnpx skillfed install ljagiello/ctf-skills/ctf-pwnFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What binary exploitation CTF techniques does ctf-pwn cover?
ctf-pwn teaches you to weaponize memory corruption vulnerabilities across the full exploitation spectrum. It covers buffer overflows, format strings, ROP chain construction, shellcode generation, ret2libc attacks, ret2win exploits, and advanced heap techniques like UAF and House of Orange. The skill focuses on converting corruption primitives into code execution and privilege escalation in CTF challenges.
How do I find and chain ROP gadgets with ctf-pwn?
ctf-pwn equips you with methods to locate and chain ROP gadgets for arbitrary function calls and syscalls. It covers gadget search strategies using tools like ropper, techniques for building ROP chains with pwntools, and approaches for bypassing protections like RELRO and PIE. You'll learn to construct gadget sequences that achieve your exploitation goals.
Can ctf-pwn help me bypass stack canary and other protections?
Yes. ctf-pwn teaches techniques to bypass stack/heap protections including canaries, RELRO, PIE, and NX in CTF exploits. It covers canary leaks via format strings, RELRO GOT overwrites, PIE defeats through libc leaks and DynELF discovery, and NX circumvention via ROP and ret2libc. Protection bypass is a core focus.
What heap exploitation techniques are included in ctf-pwn?
ctf-pwn covers heap exploitation including use-after-free (UAF) bugs, tcache poisoning attacks, and advanced techniques like House of Orange and FSOP (File Stream Oriented Programming). These methods let you corrupt heap metadata and achieve arbitrary writes or code execution when traditional stack-based approaches are blocked.
Does ctf-pwn address kernel and sandbox exploitation?
ctf-pwn includes kernel exploitation for privilege escalation and sandbox escape methods targeting seccomp and similar restrictions. It teaches you to identify kernel vulnerabilities and leverage them to break out of sandboxed environments or gain elevated privileges in CTF scenarios.
What's the best way to use ctf-pwn when I find a vulnerable target?
ctf-pwn is designed for when you have a vulnerable target and need to convert corruption primitives into shell access. Start by identifying the vulnerability type (buffer overflow, format string, heap bug), then apply the corresponding exploitation technique—whether that's ROP chain building, shellcode generation, protection bypass, or advanced heap methods—to achieve code execution.
SKILL.md
rendered from the published skill — quoted content, verbatim
CTF Binary Exploitation (Pwn)
Quick reference for binary exploitation (pwn) CTF challenges. Each technique has a one-liner here; see supporting files for full details.
Prerequisites
Python packages (all platforms):
pip install pwntools ropper ROPgadget
Linux (apt): ```bash apt
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 15 files
ctf-pwn/SKILL.md
ctf-pwn/advanced-exploits-2.md
ctf-pwn/advanced-exploits-3.md
ctf-pwn/advanced-exploits-4.md
ctf-pwn/advanced-exploits-5.md
ctf-pwn/advanced-exploits.md
ctf-pwn/advanced.md
ctf-pwn/field-notes.md
ctf-pwn/format-string.md
ctf-pwn/heap-fsop.md
ctf-pwn/heap-techniques-2.md
ctf-pwn/heap-techniques.md
ctf-pwn/kernel-bypass.md
ctf-pwn/kernel-techniques.md
ctf-pwn/kernel.md