Binary Exploitation 101 – Tools Setup & Key Commands

Sources: Crypto-Cat Binary Exploitation 101 | HackTricks

---

The Exploitation Workflow (Overview)

1. RECON          →  file, checksec, strings, ltrace, strace
2. FIND VULN      →  Ghidra/IDA decompile, spot unsafe functions
3. FIND OFFSET    →  cyclic pattern (pwntools / msf-pattern)
4. CONTROL EIP    →  Overwrite return address
5. EXPLOIT        →  ret2win / shellcode / ret2libc / ROP
6. PROFIT         →  Shell / flag

---

Essential Tools & Commands

checksec — Binary Protection Audit

checksec --file=./binary          # Single binary
checksec --dir=.                  # All binaries in directory

Output explained:

    Arch:     amd64-64-little       ← Architecture
    RELRO:    Full RELRO            ← GOT is read-only (can't overwrite GOT)
    Stack:    Canary found          ← Stack canary present (detects overflow)
    NX:       NX enabled            ← Stack is non-executable (no shellcode)
    PIE:      PIE enabled           ← Binary base randomized (ASLR for code)

Protection	OFF = Easy Exploit	ON = Need Bypass
NX	Shellcode on stack	ROP / ret2libc
Canary	Direct overflow	Leak canary first
PIE	Fixed addresses	Leak binary base
RELRO	GOT overwrite	Target hooks/fini_array
ASLR	Fixed libc addr	Leak libc addr

file — Binary Identification

file ./binary
# ELF 64-bit LSB executable, x86-64, dynamically linked, not stripped

Key things to note:

• 32-bit vs 64-bit → different calling conventions & register sizes
• statically vs dynamically linked → static = no libc GOT/PLT
• stripped vs not stripped → stripped = no symbol names in GDB

strings / FLOSS — Extract Readable Strings

strings ./binary                  # Basic ASCII strings
strings -n 8 ./binary            # Minimum 8 chars
floss ./binary                    # Deobfuscates encoded strings too

Look for: function names, file paths, URLs, passwords, /bin/sh, flag, error messages.

objdump — Quick Disassembly

objdump -d ./binary               # Full disassembly
objdump -d ./binary | grep -A 20 '<main>'  # Just main
objdump -t ./binary               # Symbol table
objdump -R ./binary               # Dynamic relocations (GOT entries)
objdump -M intel -d ./binary      # Intel syntax

readelf — ELF Header Inspection

readelf -h ./binary               # ELF header (entry point, arch)
readelf -S ./binary               # Section headers (.text, .got, .bss)
readelf -s ./binary               # Symbol table
readelf -l ./binary               # Program headers (segments)
readelf -d ./binary               # Dynamic section (shared libraries)

ROPgadget / ropper — Find ROP Gadgets

ROPgadget --binary ./binary
ROPgadget --binary ./binary | grep "pop rdi"
ROPgadget --binary ./binary --ropchain    # Auto-build execve chain

ropper --file ./binary
ropper --file ./binary --search "pop rdi; ret"

one_gadget — Libc One-Shot RCE

one_gadget /lib/x86_64-linux-gnu/libc.so.6
# Returns addresses that give instant shell (if constraints met)

pwninit — Patch Binary with Correct Libc

pwninit --bin ./vuln --libc ./libc.so.6
# Outputs: vuln_patched (uses correct libc + ld)

seccomp-tools — Sandbox Rule Inspection

seccomp-tools dump ./binary
# Shows which syscalls are allowed/blocked

patchelf — Manually Set Libc/Linker

patchelf --set-interpreter ./ld-2.27.so ./binary
patchelf --replace-needed libc.so.6 ./libc.so.6 ./binary

---

Compilation Flags for Practice

# Everything OFF (easiest — start here)
gcc vuln.c -o vuln -fno-stack-protector -z execstack -no-pie -m32

# 64-bit, no protections
gcc vuln.c -o vuln -fno-stack-protector -z execstack -no-pie

# NX on (need ROP, no shellcode)
gcc vuln.c -o vuln -fno-stack-protector -no-pie

# Everything ON (realistic)
gcc vuln.c -o vuln -fstack-protector-all -pie -z relro -z now

# Disable ASLR system-wide (for debugging)
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

---

Quick Vulnerability Checklist

When you open a binary, ask:

1. What does checksec show? → Determines your exploit strategy
2. Is there gets(), strcpy(), sprintf(), scanf("%s")? → Buffer overflow
3. Is there printf(user_input)? → Format string vulnerability
4. Is there free() without nulling pointer? → Use-after-free
5. Any interesting functions? (win, flag, shell, system) → ret2win candidate
6. Does it fork? → Canary brute-force possible (same canary in child)

---

References

• Crypto-Cat Binary Exploitation 101 (11 videos)
• Crypto-Cat CTF Pwn
• HackTricks Binary Exploitation
• Nightmare (guyinatuxedo)
• Ir0nstone Notes