stack-overflow-and-rop
Stack Overflow & ROP covers advanced control-flow hijacking via return address overwrite on Linux userland binaries. Learn buffer overflow fundamentals, libc leaking strategies, ROP gadget selection, ret2csu for multi-argument calls, ret2dlresolve for blind resolution, SROP for register control, and stack pivoting under constraints. Includes tool comparisons and real-world exploitation patterns.
Stack Overflow & ROP teaches buffer overflow exploitation, return-to-libc, ROP chains, ret2csu, ret2dlresolve, and SROP techniques for Linux binaries.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/stack-overflow-and-rop · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/stack-overflow-and-rop ~/.claude/skills/stack-overflow-and-ropnpx skillfed install yaklang/hack-skills/stack-overflow-and-ropFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is stack overflow exploitation and how does it work?
Stack Overflow & ROP teaches control-flow hijacking by overwriting return addresses on the stack. When a buffer overflows, attackers write past allocated memory into the return address (EIP on x86, RIP on x64), redirecting execution. Stack Overflow & ROP covers fundamentals, libc leaking strategies to defeat ASLR, and gadget selection for constructing exploit chains that bypass NX, ASLR, and canaries.
How do you construct ROP chains and gadget sequences for arbitrary code execution?
Stack Overflow & ROP explains ROP chain construction by chaining short instruction sequences (gadgets) ending in `ret` to set registers and call functions. The skill covers gadget search tools like ROPgadget and ropper, constraint-based selection, and techniques like ret2csu for multi-argument calls on x86-64, enabling arbitrary code execution when direct jumps are blocked by NX.
What does return to libc bypass NX and how is it used?
Stack Overflow & ROP covers ret2libc as a method to bypass NX by returning to existing libc functions instead of injected shellcode. The technique involves leaking libc addresses (via format strings or other means), calculating offsets, and chaining function calls. Stack Overflow & ROP teaches libc leaking strategies and how to construct arguments for functions like `system()` or `execve()` on both x86 and x64 architectures.
What are ret2csu, ret2dlresolve, and SROP attack methodologies?
Stack Overflow & ROP covers three advanced techniques: ret2csu uses `__libc_csu_init` gadgets to set arguments for x64 calls; ret2dlresolve exploits dynamic linking to resolve arbitrary functions without leaks; SROP (sigreturn-oriented programming) uses signal handlers to control all registers via `sigreturn` syscalls. Each bypasses specific protections in constrained exploitation scenarios.
How do stack pivoting and canary bypass techniques work in overflow scenarios?
Stack Overflow & ROP covers stack pivoting (using `leave; ret` gadgets to redirect the stack pointer) for exploits with limited overflow space, and canary bypass via brute-force (on local services), information leaks (format strings), or one-gadget RCE techniques. These methods enable exploitation when direct overflow is constrained by protections or buffer size limits.
What tools and methodologies does Stack Overflow & ROP recommend for binary exploitation?
Stack Overflow & ROP compares gadget search tools (ROPgadget, ropper), discusses blind ROP (BROP) methodology for unknown binaries, and covers real-world CTF pwn patterns. The skill includes x86-64 calling convention details, EIP/RIP overwrite mechanics, heap vs. stack overflow distinctions, and practical exploitation workflows for Linux userland binaries with NX, ASLR, and canary protections.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Stack Overflow & ROP — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert stack-based exploitation techniques. Covers classic buffer overflow, return-to-libc, ROP chain construction, ret2csu, ret2dlresolve, SROP, stack pivoting, and canary bypass. Distilled from ctf-wiki advanced-rop, real-world CVEs, and CTF competition patterns. Base models often miss the nuance of gadget selection under constrained conditions.
0. RELATED ROUTING
- format-string-exploitation — leak canary/libc/PIE base via format string before triggering overflow
- binary-protection-bypass — systematic bypass of NX, ASLR, PIE, canary, RELRO
- arbitrary-write-to-rce — convert a write primitive (GOT, hooks, vtable) into code execution
- heap-exploitation — when the vulnerability is in
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 2 files
skills/stack-overflow-and-rop/ROP_ADVANCED_TECHNIQUES.md
skills/stack-overflow-and-rop/SKILL.md