Binary Exploitation

Process

1. checksec
2. objdump -d ./file to get disassembly
3. objdump -t ./file to get symbol addresses
4. gdb ./file with Pwndbg
5. Create a script with pwntools

Concepts

• OS Stack
• C
• Shellcode
• Code Cave
• ROP
• NOP Slide
• cdecl
• SysV Calling Convention
• Global Offset Table
• Procedure Linkage Table
• Stack Canary
• Use After Free
• Ret2Libc
• ROP

Tricks

• C read()
• Format String Exploitation
• Bypassing ASLR Via Page Alignment
• House of Einherjar