Binary Exploitation

My notes on Linux x86-64 binary exploitation, from the process memory model and tooling through stack overflows, shellcode, mitigations, ROP, format strings, GOT/PLT and basic heap. Every exploit lesson is built against Ubuntu 24.04 with glibc 2.39 and the payloads are run for real.

The labs ship with source, a build script and an exploit. Everything is for learning, CTFs, and systems you are allowed to test.

Pwn · Getting Started

#	Lesson
0.1	Binary Exploitation and the Life Cycle of a Bug
0.2	Setting Up a Pwn Lab with Ubuntu, pwntools, pwndbg and glibc
0.3	Linux Process Memory Layout and Page Permissions

Pwn · Foundations

#	Lesson
1.1	x86-64 Assembly Review for Pwn, Registers, Instructions, Intel vs AT&T
1.2	Stack Frames, call/ret, Saved RIP, and the System V AMD64 Calling Convention
1.3	ELF, GOT, PLT, and Lazy Binding
1.4	Dangerous C Functions and Buffer Overflows

Pwn · Tooling

#	Lesson
2.1	pwntools Basics, the Skeleton of Every Exploit
2.2	gdb and pwndbg, Looking Inside a Running Program
2.3	checksec, ROPgadget, ropper, and one_gadget

Pwn · Buffer Overflow

#	Lesson
3.1	Overwriting a Local Variable to Bypass a Check
3.2	Finding the Saved RIP Offset and ret2win
3.3	Passing a Function Argument with pop rdi
3.4	A ret2win Lab, Three Challenges From Easy to Hard

Pwn · Shellcode

#	Lesson
4.1	Writing execve Shellcode by Hand
4.2	Jumping into stack shellcode with jmp rsp

Pwn · Mitigations

#	Lesson
5.1	Overview of mitigations, NX, ASLR, PIE, canary, RELRO
5.2	Stack canary mechanism, leak, and brute force
5.3	ASLR and PIE, why you need an address leak

Pwn · ret2libc and ROP

#	Lesson
6.1	ret2libc, calling system when NX is on
6.2	Leaking libc Through the GOT with puts or write
6.3	Chaining ROP Gadgets and ret2syscall
6.4	Lab, Solving ROP Emporium

Pwn · Format String

#	Lesson
7.1	Format String Bugs, Leaking the Stack and Memory
7.2	Arbitrary Memory Writes with %n

Pwn · GOT and PLT

#	Lesson
8.1	GOT Overwrite to Hijack Function Calls
8.2	ret2plt and ret2dlresolve

Pwn · Heap Basics

#	Lesson
9.1	How malloc and free Work, Chunks, Bins, Tcache
9.2	Use-After-Free and Type Confusion
9.3	Double Free and Tcache Poisoning
9.4	Heap Note Lab, From UAF to Shell

Pwn · Real-World Practice

#	Lesson
10.1	The approach workflow for an unknown pwn binary, from triage to exploit
10.2	How to write a pwn writeup, with a full worked example
10.3	Final project, build and exploit your own vulnerable binary