Ctf Pwn
Provides binary exploitation techniques for CTF challenges.
Install
npx skills add ljagiello/ctf-skills --skill ctf-pwn -g -a claude-code -y- Repository
- ljagiello/ctf-skills3.6k
- Category
- Security
- Updated
- 5d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- Yes, review before use
What it does
Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not use it when the main blocker is understanding what the binary does; use reverse engineering first. Do not use it for pure web bugs, disk or packet forensics, or standalone crypto/math challenges.
CTF Binary Exploitation (Pwn)
Quick reference for binary exploitation (pwn) CTF challenges. Each technique has a one-liner here; see supporting files for full details.
Prerequisites
Python packages (all platforms):
pip install "pwntools==4.15.0" "ROPgadget==7.7" "ropper==1.13.13"
# or via script: bash scripts/install_ctf_tools.sh python
uv alternative:
uv venv && uv pip install "pwntools==4.15.0" "ROPgadget==7.7" "ropper==1.13.13"
Linux (apt):
apt install gdb binutils strace ltrace qemu-system-x86
Optional cross-arch (ARM/MIPS, Debian/Ubuntu):
apt install qemu-user qemu-user-static gdb-multiarch binutils-multiarch libc6-armhf-cross libc6-arm64-cross libc6-mips-cross
macOS (Homebrew):
brew install gdb binutils qemu
Ruby gems (all platforms):
gem install one_gadget seccomp-tools
Manual install:
- pwndbg, Linux: GitHub, macOS:
brew install pwndbg/tap/pwndbg-gdb - checksec, included with pwntools (
checksec --file=binary)
MCP servers (optional): WinDbg MCP (svnscha/mcp-windbg) for Windows crash dumps, live breakpoint-driven exploitation, and kernel/driver debugging; IDA Pro MCP / Ghidra MCP for decompiling the vulnerable function, see tools-mcp.md.
