DOCSEARCHbyAlgolia
Submit Docs

pwntools CTF Framework and Exploit Development Library

repository·dev·Indexed 12 days ago

https://github.com/gallopsled/pwntools

A Python-based CTF framework and exploit development library designed for rapid prototyping. It provides tools for assembling/disassembling foreign architectures, managing network connections via remote(), and automating exploit writing. Supports Python 3.10+ (version 5.0.0+) and older versions including Python 2.7 (version 4.x). Includes features like term-mode for TTY indentation, Docker images for standardized environments, and shell completion for Bash and ZSH.

Tokens
18.5K
Snippets
102
Records
149
Agent score
93%

What's inside pwntools

  2. Use pwnlib.libc for libc implementations

    dev
    The pwnlib.libc module provides a collection of convenient functions and abstractions for working with different libc implementations. It is designed to simplify tasks related to identifying, loading, and interacting with libc versions during exploit development.

  3. Encode shellcode using pwnlib.encoders

    dev

    The pwnlib.encoders module provides various encoding mechanisms to transform shellcode, often used to bypass security filters or evade detection. The module contains architecture-specific encoders for different instruction sets.

    Available encoder types include:

    • ASCII Shellcode: Encodes shellcode into printable ASCII characters (available for i386).
    • XOR Encoders: Performs XOR-based encoding (available for i386, arm, and mips).
    • Delta Encoders: Uses delta-based encoding to handle relative addressing (available for i386 and amd64).

  4. Use pwnlib.util.web for web utilities

    dev

    The pwnlib.util.web module provides a collection of utility functions designed for interacting with and manipulating web-related data (WWW). It is part of the pwnlib.util suite and is intended to simplify common tasks encountered during web-based exploitation or data processing.

    import tempfile
from pwnlib.context import context
from pwnlib.util.web import *

  5. Use pwnlib.fmtstr for format string bug exploitation

    dev

    The pwnlib.fmtstr module provides tools to automate the exploitation of format string vulnerabilities. It helps in calculating the necessary offsets and constructing payloads to read from or write to arbitrary memory locations using format string primitives.

    from pwn import *
# Use pwnlib.fmtstr tools to automate format string exploitation

  6. Understand the concept of Tubes in pwntools

    dev
    In pwntools, a Tube is the fundamental abstraction for communicating with an external process, network service, or any data stream. The pwnlib.tubes module provides various implementations (types of tubes) that allow you to interact with different targets (e.g., local processes, remote TCP connections, SSL/TLS sockets) using a unified API. This abstraction allows you to write exploit code that can switch between a local debugging session and a remote target with minimal changes.

  7. Manipulate local and remote files using pwnlib.filesystem

    dev

    The pwnlib.filesystem module provides a pathlib-compatible interface for interacting with filesystems. It allows you to perform file operations using a unified API whether the files are on your local machine or on a remote server via SSH.

    • .Path: Use this class to represent and manipulate paths on the local filesystem.
    • .SSHPath: Use this class to represent and manipulate paths on a remote filesystem accessible via SSH.
    from pwnlib.filesystem import Path, SSHPath

# Local filesystem usage
local_file = Path('/tmp/local_file.txt')
local_file.write(b'hello local')

# Remote filesystem usage via SSH
# Assuming an existing ssh connection object
remote_file = SSHPath(ssh_connection, '/tmp/remote_file.txt')
remote_file.write(b'hello remote')

  8. Use pwnlib.util.safeeval for safe Python code evaluation

    dev
    The pwnlib.util.safeeval module provides utilities for evaluating Python code in a restricted environment. This is useful when you need to process untrusted input (such as expressions from a CTF challenge) without the security risks associated with the standard eval() function. It works by restricting the available globals and builtins, and can be used to evaluate expressions safely.

  9. Use pwnlib.util.proc to work with /proc/

    dev
    The pwnlib.util.proc module provides utilities for interacting with the Linux /proc/ filesystem. It allows you to inspect and manipulate process information, such as file descriptors, memory maps, and other process-specific metadata available through the kernel's proc interface.

  10. Generate AMD64 shellcode with pwnlib.shellcraft.amd64

    dev

    The pwnlib.shellcraft.amd64 module provides a collection of shellcode generators for the AMD64 architecture. It is organized into submodules based on the target operating system, specifically pwnlib.shellcraft.amd64.linux for Linux and pwnlib.shellcraft.amd64.windows for Windows.

    To use these generators, you must first set the global context architecture to amd64 using context.arch = 'amd64'.

    from pwn import *

# Set the architecture context
context.arch = 'amd64'

# Example: Accessing Linux-specific shellcode
# shellcode = shellcraft.linux.some_function()

  11. Use pwnlib.term for terminal handling

    dev
    The pwnlib.term module provides utilities for terminal handling within the pwntools ecosystem. It is used to manage terminal interactions, such as controlling input/output behavior and integrating with specific terminal capabilities like readline. For advanced terminal-specific features, refer to the pwnlib.term.readline module.

  12. Use architecture-independent shellcode with pwnlib.shellcraft.common

    dev
    The pwnlib.shellcraft.common module provides shellcode snippets that are common to all architectures. Use this module when you need to generate shellcode sequences that do not rely on specific CPU instruction sets or register layouts, making them portable across different target architectures within your exploit development workflow.