# Ctf Pwn

Provides binary exploitation techniques for CTF challenges.

- Repository: https://github.com/ljagiello/ctf-skills (3598 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add ljagiello/ctf-skills --skill ctf-pwn -g -a claude-code -y`
Codex: `npx skills add ljagiello/ctf-skills --skill ctf-pwn -g -a codex -y`
Cursor: `npx skills add ljagiello/ctf-skills --skill ctf-pwn -g -a cursor -y`
Gemini CLI: `npx skills add ljagiello/ctf-skills --skill ctf-pwn -g -a gemini-cli -y`

## Description

Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not use it when the main blocker is understanding what the binary does; use reverse engineering first. Do not use it for pure web bugs, disk or packet forensics, or standalone crypto/math challenges.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# CTF Binary Exploitation (Pwn)

Quick reference for binary exploitation (pwn) CTF challenges. Each technique has a one-liner here; see supporting files for full details.

## Prerequisites

**Python packages (all platforms):**
```bash
pip install "pwntools==4.15.0" "ROPgadget==7.7" "ropper==1.13.13"
# or via script: bash scripts/install_ctf_tools.sh python
```

**uv alternative:**
```bash
uv venv && uv pip install "pwntools==4.15.0" "ROPgadget==7.7" "ropper==1.13.13"
```

**Linux (apt):**
```bash
apt install gdb binutils strace ltrace qemu-system-x86
```

**Optional cross-arch (ARM/MIPS, Debian/Ubuntu):**
```bash
apt install qemu-user qemu-user-static gdb-multiarch binutils-multiarch libc6-armhf-cross libc6-arm64-cross libc6-mips-cross
```

**macOS (Homebrew):**
```bash
brew install gdb binutils qemu
```

**Ruby gems (all platforms):**
```bash
gem install one_gadget seccomp-tools
```

**Manual install:**
- pwndbg, Linux: [GitHub](https://github.com/pwndbg/pwndbg), macOS: `brew install pwndbg/tap/pwndbg-gdb`
- checksec, included with pwntools (`checksec --file=binary`)

**MCP servers (optional):** WinDbg MCP ([svnscha/mcp-windbg](https://github.com/svnscha/mcp-windbg)) for Windows crash dumps, live breakpoint-driven exploitation, and kernel/driver debugging; IDA Pro MCP / Ghidra MCP for decompiling the vulnerable function, see [tools-mcp.md](tools-mcp.md).

## Additional Resources

The rest: https://github.com/ljagiello/ctf-skills/blob/HEAD/ctf-pwn/SKILL.md