wntools

pwntools — pwntools 4.15.0 documentationdocs.pwntools.com

Installation

$ sudo apt install python3-pwntools 

1. Command line

1.1 checksec

$ pwn checksec <binary>
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

• For more information on what each security feature means, refer to the relevant sections under the following link:

https://jarrettgxz-sec.gitbook.io/penetration-testing-ethical-hacking-concepts/reverse-engineering-binary-exploitation/general-knowledge/security-featuresjarrettgxz-sec.gitbook.io

2. Scripting

2.1 General payload script

from pwn import *

# establish the target process
target = process('./pwn1')

# create the payload
payload = ""
payload += ...

# send 1st argument
target.sendline("1st arg")
# send subsequent arugment
target.sendline("xxx")
# send payload
target.sendline(payload)

# interactive
target.interactive() 

2.2 Useful functions

from pwn import *

p32

pwnlib.util.packing — Packing and unpacking of strings — pwntools 4.15.0 documentationdocs.pwntools.com

p32(0x12345678) # -> b"\x78\x56\x34\x12"

# eg.
val = p32(0x12345678)
print(hexdump(val)) 

# output
# 00000000  78 56 34 12                                         
# 00000004