Advanced Binary Exploitation
Once a simple ret2win stops working because of stack canaries, PIE, and ASLR, exploitation becomes a craft of leaks and chains. You will brute-force and leak canaries, build return-oriented programs, poison the heap allocator, turn format strings into arbitrary writes, and escape seccomp sandboxes. This path assumes you understand stack layout, basic overflows, and format strings.
Guides for this path
Read these alongside the challenges below. The first one orients you; the rest go deeper on the techniques each step needs.
- Stack Canary Bypass for CTF: Leak It, Brute It, or Walk Around ItStack canary bypass, three ways: leak it with a format string, brute-force it across forks, or never cross it, for picoCTF stack-smashing binaries.
- ret2libc for CTF: Leaking libc and Returning to system()NX killed your shellcode and there is no win function. Learn ret2libc: leak a libc address with puts, rebase libc, and return to system('/bin/sh') in pwntools.
- ROP Beyond ret2libc: The Gadget Ladder for CTF ExploitationBuild a ROP chain without a libc leak. Five techniques (ret2plt, ret2syscall, ret2dlresolve, ret2csu, SROP) plus stack pivots, with pwntools code and CTF receipts.
- Heap Exploitation for CTF: From heap Overflow to tcache PoisoningHeap exploitation on modern glibc (2.35+): four primitives that still work, mapped to picoCTF heap 0-3, Heap Havoc, and Pizza Router, with pwntools templates.
- Use-After-Free for CTF: Dangling Pointers and tcacheUse-after-free for CTF: turn a dangling pointer into a shell. Read freed chunks for heap and libc leaks, tcache poisoning, hook targets, and double-free bypass.
- Writing x86-64 Shellcode for CTF: From Syscall to Shellx86-64 shellcode for CTF: hand-write null-free execve('/bin/sh'), fire it with pwntools, and debug in GDB. The syscall is easy; the filter is the craft.
- Step 01
Defeating Canaries and PIE
Modern binaries ship with a stack canary and randomized base addresses. To overwrite a return address you first have to defeat both, either by brute-forcing the canary one byte at a time or by leaking it (and the PIE and libc bases) through a format string before you ever send your overflow.
- Step 02
Return-Oriented Programming
When there is no convenient win function and the stack is non-executable, you build your payload out of gadgets already in the binary. ropfu makes you chain gadgets to call execve, Here's a LIBC adds a libc leak under ASLR for a ret2libc, and function overwrite redirects a call through an out-of-bounds pointer table.
- Step 03
Heap Exploitation
The heap is where allocator metadata becomes your weapon. These challenges teach tcache poisoning to redirect a malloc, use-after-free to reclaim a freed struct and overwrite a function pointer, and heap overflows that corrupt chunk metadata into an arbitrary write.
- Step 04
Format String to Arbitrary Write
A single uncontrolled format string is a read and write primitive over the whole address space. Using %p chains to leak and %n to write, these challenges escalate from leaking stack values to overwriting saved pointers and GOT entries to hijack control flow.
- Step 05
Shellcode and Sandbox Escapes
When the binary executes bytes you supply, the challenge shifts to writing shellcode that survives the constraints: a tiny input window, a byte filter, or a seccomp policy that forbids the syscalls you need. These force you to craft minimal, alphanumeric, or syscall-restricted payloads.
- Step 06
JIT and Modern Targets
The frontier of binary exploitation is browser and engine internals. Turboflan and Kit Engine hand you a patched JavaScript engine where a JIT type confusion or bounds-check removal gives you out-of-bounds memory access, the same primitive real browser exploits are built on.