> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/binary-exp/toolkit.md).

# CTF Binary Exploitation Toolkit

Complete toolkit for CTF binary exploitation challenges. Covers everything from basic ret2win to heap exploitation.

***

## Directory Structure

```
ctf-toolkit/
├── cheatsheets/
│   ├── 00-MASTER-CHEATSHEET.md        ← Start here every CTF
│   ├── 01-PWNTOOLS-CHEATSHEET.md      ← Full pwntools API reference
│   ├── 02-GDB-PWNDBG-CHEATSHEET.md    ← GDB + pwndbg commands
│   ├── 03-ROP-CHEATSHEET.md           ← ROP gadgets + common chains
│   ├── 04-HEAP-CHEATSHEET.md          ← Heap internals + attacks
│   ├── 05-FORMAT-STRING-CHEATSHEET.md ← FSV read/write techniques
│   └── 06-SHELLCODE-SYSCALL-CHEATSHEET.md ← Syscalls + shellcraft
│
├── scripts/
│   ├── templates/
│   │   ├── exploit_template.py        ← Universal starting point
│   │   ├── ret2win.py                 ← Simplest: jump to win()
│   │   ├── ret2libc.py                ← 2-stage GOT leak + system()
│   │   ├── ret2syscall.py             ← Raw execve syscall
│   │   ├── format_string.py           ← FSV: read/write/GOT overwrite
│   │   ├── heap_uaf_doublefree.py     ← UAF + Double Free + tcache
│   │   ├── srop.py                    ← Sigreturn frames
│   │   ├── stack_pivot.py             ← leave;ret pivot to BSS
│   │   ├── ret2csu_onegadget.py       ← CSU gadgets + one_gadget
│   │   └── seccomp_orw.py             ← ORW when execve is blocked
│   │
│   ├── helpers/
│   │   ├── recon.py                   ← Full binary analysis
│   │   ├── find_offset.py             ← Auto/manual overflow offset
│   │   └── libc_helper.py             ← Libc version + offsets
│   │
│   └── one-liners/
│       └── one_liners.sh              ← Bash one-liners reference
```

***

## Quick Start Workflow

### 1. Recon (always first)

```bash
python3 scripts/helpers/recon.py ./vuln ./libc.so.6
```

### 2. Find overflow offset

```bash
python3 scripts/helpers/find_offset.py ./vuln "Input: "
```

### 3. Choose your exploit template

| Situation                         | Template                 |
| --------------------------------- | ------------------------ |
| Binary has `win()` function       | `ret2win.py`             |
| NX + ASLR, dynamic binary         | `ret2libc.py`            |
| Static binary, no libc            | `ret2syscall.py`         |
| Few gadgets available             | `srop.py`                |
| No pop rdi/rsi/rdx gadgets        | `ret2csu_onegadget.py`   |
| Small overflow, need more space   | `stack_pivot.py`         |
| `printf(buf)` style vulnerability | `format_string.py`       |
| Heap with UAF / double free       | `heap_uaf_doublefree.py` |
| execve blocked by seccomp         | `seccomp_orw.py`         |

### 4. Fill in the gaps

Every template has clearly marked `← CHANGE THIS` comments for:

* `OFFSET` — buffer overflow offset
* `PROMPT` — what to wait for before sending
* Gadget addresses (`POP_RDI`, `RET`, etc.)
* `HOST`/`PORT` for remote targets

### 5. Run locally first

```bash
python3 exploit.py
# Once working locally:
python3 exploit.py remote
```

***

## Finding Gadgets (quick)

```bash
ROPgadget --binary ./vuln | grep "pop rdi"
ROPgadget --binary ./vuln | grep ": ret$"
one_gadget ./libc.so.6
```

## libc Version (if unknown)

1. Leak a GOT address from the running binary
2. Visit <https://libc.rip/> and enter the address
3. Download the matching libc

## Patch binary to use local libc

```bash
pwninit              # automatic
# or manually:
patchelf --set-interpreter ./ld.so --set-rpath . ./vuln
```

***

## Required Tools

```bash
pip install pwntools
apt install gdb
pip install pwndbg   # or: git clone https://github.com/pwndbg/pwndbg && ./setup.sh
gem install one_gadget
pip install ROPgadget
apt install seccomp-tools
apt install patchelf
```

***

## Cheatsheet Priority

For any CTF challenge:

1. `00-MASTER-CHEATSHEET.md` — protections table + quick patterns
2. `01-PWNTOOLS-CHEATSHEET.md` — API when you forget syntax
3. `03-ROP-CHEATSHEET.md` — gadget hunting + chain patterns
4. Pick the relevant deep-dive cheatsheet (format string / heap / etc.)