Binary Exploitation Methodology

Sources: HackTricks - Binary Exploitation | Crypto-Cat CTF/pwn

---

Overview - Exploitation Flow

1. Identify vulnerability (overflow, format string, etc.)
2. Determine protections (checksec)
3. Find offset to control EIP/RIP
4. Choose exploitation technique based on protections
5. Build payload & get shell

---

Step 1: Recon & Binary Analysis

# Check binary protections
checksec --file=./binary

# File type
file ./binary

# Strings
strings ./binary | grep -i flag
strings ./binary | grep -i bin/sh

# Trace library/system calls
ltrace ./binary
strace ./binary

# Disassemble
objdump -d ./binary | less

ELF Basic Info

• ELF = Executable and Linkable Format (Linux binaries)
• Sections: .text (code), .data (initialized data), .bss (uninitialized), .got (Global Offset Table), .plt (Procedure Linkage Table)
• GOT/PLT used for dynamic linking → key targets for exploitation

---

Step 2: Controlling Execution Flow

Ways to hijack control flow:

1. Stack Overflow → overwrite saved return address (EIP/RIP)
2. Format String → arbitrary read/write via printf misuse
3. Array Indexing → abuse poorly bounds-checked indexing
4. Integer Overflow → cause unexpected allocation sizes → heap/stack overflow
5. Heap Exploitation → corrupt heap metadata for arbitrary write

---

Step 3: Choose Exploitation Goal

Goal A: Call an Existing Function (ret2win)

• No PIE, no canary → just overwrite return address with function address
• With PIE → need a PIE leak first
• With canary → need canary leak/bypass
• Need params? → use ROP gadgets or SROP

Goal B: Remote Code Execution (RCE)

Via Shellcode (NX disabled):

• Place shellcode on stack → jump to it
• No ASLR → hardcode stack address
• With ASLR → use ret2esp / ret2reg gadgets
• With NX → use ROP to call mprotect() → make region executable → jump to shellcode

Via Syscall:

• ret2syscall → set up execve("/bin/sh", NULL, NULL) via ROP
• SROP → use sigreturn to set all registers at once

Via Libc (ret2libc):

• Call system("/bin/sh") using libc addresses
• No ASLR → static addresses
• With ASLR → leak libc address from GOT, calculate offsets
• Unknown libc? → leak 2+ function addresses → identify version via libc.blukat.me or libc.rip

Via EBP/RBP (Stack Pivoting):

• Control ESP through stored EBP
• Useful for off-by-one overflows

---

Step 4: Eternal Loops (Re-exploitation)

When one exploitation isn’t enough:

• ROP chain back to main or vulnerable function
• Overwrite exit() GOT entry → point back to vulnerability
• Use .fini_array → store function pointer to loop back

---

Compilation Flags for Practice

# Compile with NO protections (for practice)
gcc vuln.c -o vuln -fno-stack-protector -z execstack -no-pie -m32

# 64-bit no protections
gcc vuln.c -o vuln -fno-stack-protector -z execstack -no-pie

# Set permissions for CTF-style challenges
sudo chown root:root flag.txt && sudo chmod 600 flag.txt
sudo chown root:root vuln && sudo chmod 4655 vuln

# Disable ASLR (for local testing)
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

---

Quick Reference: Vulnerability → Technique

Vulnerability	Protections	Technique
Stack BOF	None	ret2win / shellcode
Stack BOF	NX	ret2libc / ROP
Stack BOF	NX + ASLR	Leak libc → ret2libc
Stack BOF	NX + ASLR + PIE	Leak PIE base + libc → ROP
Stack BOF	NX + Canary	Leak/brute canary → ROP
Format String	Any	Arbitrary read/write → GOT overwrite
Heap Overflow	Any	Corrupt metadata → arbitrary write
Integer Overflow	Any	Trigger secondary vuln (BOF/heap)

---

References

• HackTricks Binary Exploitation
• Crypto-Cat Binary Exploitation 101 (VIDEO Series)
• Ir0nstone Notes
• Nightmare