pwn-exploit

PWN Exploit - Exploit Development

Guide exploit development based on previous analysis findings.

Execution Steps

Step 1: Gather Findings

Review previous analysis to determine:

• Vulnerability type (buffer overflow, format string, etc.)
• Protections (RELRO, Canary, NX, PIE)
• Available primitives (win function, libc, gadgets)
• Calculated offsets

If findings not available, ask user for:

• Binary protections
• Vulnerability type
• Offset to return address
• Available targets (win function address, libc)

Step 2: Select Technique

Based on protections, recommend technique:

Protections	Recommended Technique
No NX, No PIE	Shellcode injection
NX, No PIE, win()	ret2win
NX, No PIE, No win	ret2libc
NX, PIE	Leak + ret2libc
Canary present	Leak canary first
Full RELRO	Stack-based attack only

If --technique flag provided, use that technique. Otherwise, ask user to confirm recommended technique.

Step 3: Find Required Components

Based on technique:

ret2win:

nm <binary> | grep -i win

ret2libc:

# Find gadgets
ROPgadget --binary <binary> | grep "pop rdi"
# Find /bin/sh in libc
strings -t x <libc> | grep "/bin/sh"

ROP:

ROPgadget --binary <binary> --only "pop|ret"
ropper -f <binary> --search "pop rdi"

Format string: Determine offset by testing with pattern.

Step 4: Generate Exploit

Create pwntools exploit script with:

• Correct context setup
• Local/remote toggle
• GDB attach option
• Educational comments explaining each step
• All calculated values filled in

Step 5: Save and Test

Save exploit to exploit.py and provide test instructions:

# Local test
python3 exploit.py

# With GDB
python3 exploit.py GDB

# Remote
python3 exploit.py REMOTE

Output Format

## Exploit Development

### Technique Selection
- Vulnerability: Buffer overflow (gets)
- Protections: NX enabled, No PIE, No Canary
- Selected: ret2libc (no win function available)

### Required Components
- pop rdi gadget: 0x401234
- puts@plt: 0x401030
- puts@got: 0x404018
- main: 0x401150

### Exploit Strategy
1. Stage 1: Leak libc address via puts(puts@got)
2. Return to main for second input
3. Stage 2: Call system("/bin/sh") with leaked libc base

### Generated Exploit
```python
#!/usr/bin/env python3
from pwn import *