ctf-pwn

The ctf-pwn skill provides guidance and reference material for binary exploitation challenges commonly found in Capture The Flag (CTF) competitions. It is designed for situations where a vulnerable native binary or service has already been identified and the goal is to escalate low-level memory corruption primitives into code execution, privilege escalation, or sandbox escape. The skill focuses on exploit development techniques rather than reverse engineering or binary analysis, making it most useful after the target’s behavior and vulnerabilities are already understood. It supports workflows involving stack overflows, heap corruption, format string vulnerabilities, return-oriented programming (ROP), shellcode execution, kernel exploitation, seccomp bypasses, and exploit chaining on Linux and Windows targets.

The skill includes a curated set of exploitation references covering both foundational and advanced techniques. Documented topics include ret2libc, syscall-oriented ROP, Sigreturn-Oriented Programming (SROP), heap exploitation methods such as House of Orange and House of Einherjar, GOT overwrites, ret2dlresolve, seccomp bypass strategies, stack pivots, shell interaction primitives, blind exploitation, and custom allocator abuse. It also provides setup instructions for common exploitation tooling such as pwntools, ROPgadget, ropper, gdb, pwndbg, strace, ltrace, qemu, one_gadget, and seccomp-tools. Supporting markdown files organize exploit categories into focused references for overflow exploitation, heap techniques, format string attacks, and advanced exploitation workflows.

This skill is intended for security researchers, CTF participants, exploit developers, and advanced students studying binary exploitation. It is best suited for filesystem-based AI agents with access to Bash, Python 3, and internet connectivity for installing dependencies. Typical use cases include solving pwnable challenges, developing proof-of-concept exploits, bypassing modern mitigations such as stack canaries and seccomp filters, experimenting with heap allocator internals, and practicing low-level offensive security techniques in controlled environments.