In-Depth Reference
The following reference materialsOrganized by vulnerability type, load on demand:
| Vulnerability Type | skill reference |
|---|---|
| Stack overflow / ret2win / Canary bypass | references/stack-overflow.md |
| Format string / leak / GOT overwrite / Blind Pwn | references/format-string.md |
| Heap (UAF/double free/tcache/House of X) | references/heap-exploitation.md |
| ROP (ret2csu/ret2libc/SROP/seccomp bypass/RETF) | references/rop-techniques.md |
| Kernel heap spray / tty_struct / userfaultfd / modprobe_path | references/kernel-exploitation.md |
| KASLR / KPTI / SMEP / SMAP / FGKASLR bypass | references/kernel-bypass.md |
| Custom VM / JIT / type confusion / FSOP / Windows / ARM | references/advanced-pwn.md |
| Python sandbox / FUSE / Busybox / restricted shell | references/sandbox-escape.md |
| Stack overflow basics / struct overwrite / signed integers / Canary | references/overflow-basics.md |
| ROP chain construction / ret2csu / XOR encoding / shellcode | references/rop-and-shellcode.md |
| Advanced ROP / dual stack pivot / UTF-8 SROP / RETF seccomp bypass | references/rop-advanced.md |
| Heap techniques (House of Apple2/Einherjar/custom allocator) | references/heap-techniques.md |
| Heap FILE structures (fastbin→stdout/vtable hijacking/glibc 2.24+) | references/heap-fsop.md |
| Kernel basics (environment/heap spray structures/stack overflow/privilege escalation primitives) | references/kernel.md |
| Kernel techniques (tty_struct/userfaultfd/SLUB/Panic leak) | references/kernel-techniques.md |
| Advanced exploitation 2 (bytecode/io_uring/integer truncation/GC) | references/advanced-exploits-2.md |
| Advanced exploitation 3 (stack variable overlap/1-byte overflow/GOT overwrite) | references/advanced-exploits-3.md |
| Advanced exploitation 4 (Windows SEH/ARM Thumb/Forth/GF(2)) | references/advanced-exploits-4.md |
| Advanced exploitation 5 (Chip-8 emulator/floating-point Canary/Bloom Filter) | references/advanced-exploits-5.md |
| Pwn practical notes (heap quick reference/exploitation memo/common commands) | references/field-notes.md |
Large file directory index (>300 lines, it is recommended to check the table of contents first to locate)
format-string.md (331 lines):
- Format String Basics / Argument Retargeting / Blind Pwn / Filter Bypass / Canary+PIE Leak / __free_hook Overwrite / .rela.plt Patching / Game State / .bss Pivot / argv[0] Leak
kernel-bypass.md (421 lines):
- KASLR/FGKASLR Bypass / KPTI Bypass (4 methods) / SMEP/SMAP Bypass / GDB Debug / Initramfs Workflow / Exploit Templates
kernel-exploitation.md (398 lines):
- QEMU Setup / vmlinux extraction / Config Checks / Heap Spray Structures / ret2usr / kROP / modprobe_path / core_pattern / tty_struct / userfaultfd / SLUB Internals / Cross-Cache / PTE Overlap
advanced-pwn.md (591 lines):
- VM Exploitation / Integer Vulnerabilities / Memory Primitives / Arbitrary R/W / FSOP+Heap / Specialized (ASAN/DNS/ELF Signing/JIT) / TLS Destructor / GF(2) Gaussian / Windows/ARM/Forth
Classification decision tree
Pwn 题目分析？
├─ 检查保护: checksec binary
│ ├─ PIE 关闭 → 地址固定，直接覆写 GOT/PLT
│ ├─ Partial RELRO → GOT 可写 → GOT覆写
│ ├─ Full RELRO → 需找替代目标(hooks/vtable/.fini_array)
│ ├─ NX 开启 → 不能执行栈/堆shellcode → 用 ROP
│ └─ Canary → 需泄漏或用堆/字节溢出绕过
├─ 漏洞类型
│ ├─ 栈溢出
│ │ ├─ 基础 ret2win → `stack-overflow.md`
│ │ ├─ ret2libc / ROP → `rop-techniques.md`
│ │ ├─ Canary绕过 → `stack-overflow.md` + `advanced-pwn.md`
│ │ └─ 堆叠溢出 → `advanced-pwn.md`
│ ├─ 格式化字符串
│ │ └─ `format-string.md`
│ ├─ 堆(UAF/double free/tcache)
│ │ ├─ 基础 tcache poisoning → `heap-exploitation.md`
│ │ ├─ House of X/Orange/Lore → `heap-exploitation.md` + `advanced-pwn.md`
│ │ └─ FSOP → `advanced-pwn.md`
│ ├─ 内核模块
│ │ ├─ 基础环境/提权 → `kernel-exploitation.md`
│ │ └─ 保护绕过 → `kernel-bypass.md`
│ └─ 自定义 VM / JIT / 类型混淆
│ └─ `advanced-pwn.md`
└─ 利用链
├─ 泄漏 → 计算libc基址 → one_gadget / system / FSOP
├─ ROP → ret2libc / SROP / ret2dlresolve / seccomp绕过
└─ 堆 → House of X / tcache poisoning → __free_hook / TLS dtors
Protection mechanism quick reference
| Protection | Status | Impact | Bypass method |
|---|---|---|---|
| PIE | Disabled | GOT/PLT/function addresses fixed | Direct overwrite |
| PIE | Enabled | Address randomization | Leak → calculate base address |
| RELRO | Partial | GOT writable | GOT overwrite |
| RELRO | Full | GOT read-only | hooks/vtable/.fini_array/FSOP |
| NX | Enabled | Stack non-executable | ROP |
| NX | Disabled | Stack executable | shellcode |
| Canary | Present | Overflow is detected | Leak/byte overflow/BRK |
Common dangerous functions
gets() / scanf("%s") / strcpy() → 栈溢出
printf(user_input) → 格式化字符串
free() 后继续使用 → UAF
read(fd, buf, size) → 堆溢出 / 栈溢出
pwntools template
from pwn import *
context.binary = elf = ELF('./binary')
libc = ELF('./libc.so.6')
p = remote('host', port) # or process('./binary')
# 泄漏 → 计算基址 → 覆写 → getshell
Race condition exploitation
bash -c '{ echo "cmd1"; echo "cmd2"; sleep 1; } | nc host port'
Notes
- Leak first, then attack: Almost all exploits rely on information leaks, prioritize finding the leak point
- one_gadget constraint check: After finding a gadget, use
one_gadget libc.so.6to list all of them, then filter for those that satisfy the constraints - seccomp-tools dump: Always check the seccomp rules first, then decide on the bypass approach
- pwntools corefile: After a crash, a core file is automatically generated; use
cyclic_find()to precisely locate the overflow offset