{"repo":"4xura/pwnkit","free":true,"listed":false,"github":"https://github.com/4xura/pwnkit","clone":"git clone https://github.com/4xura/pwnkit.git","description":"Pwn exploitation toolkit with a CLI for exp templates, and provide Python APIs for Linux binex, scripts, etc.","language":"Python","stars":32,"topics":["binex","exploit","linux","pwn","pwntools","template"],"license":"MIT","category":"cli-tools","readme_excerpt":"pwnkit Exploitation toolkit for pwn CTFs & Linux binary exploitation research. Includes exploit templates, I/O helpers, ROP gadget mappers, pointer mangling utilities, curated shellcodes, exploit gadgets, House of Maleficarum, gdb/helper scripts, etc. --- Installation From PyPI: Method 1 . Install into current Python environment (could be system-wide, venv, conda env, etc.). use it both as CLI and Python API: Method 2 . Install using pipx as standalone CLI tools : Method 3. Install from source (dev): --- Quick Start CLI All options: Create an exploit script template: Example using default template: Cleanest exploit script using the minmal template: List available built-in templates: Use a built-in template: Python API We can use pwnkit as Python API, by import the project as a Python module. Using the pwnkit CLI introduced earlier, we generate a ready-to-use exploit template that automatically loads the target binaries: Context Initialization The first step is to initialize the exploitation context: Or we can use the preset built-in contexts: A few preset options: ROP Gadgets To leverage ROP gadgets, we first need to disclose the binary’s base address when it is dynamically linked, PIE enabled or ASLR in effect. For example, when chaining gadgets from libc.so.6 , leak libc base: At this stage, with the pwnkit module, we are able to: The dump() method in the ROPGadget class allows us to validate gadget addresses dynamically at runtime: Pointer Protection In newer glibc version","default_branch":null,"files":null,"tree":[],"storefront":"/r/4xura","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/4xura/pwnkit/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}