exploitation-grimoire - Knowledge Base of Exploitation Techniques

项目说明

PwnLand

<di="center">
<img src=" alt="PwnFuzz">
<img src=" alt="Focus">
<img src=" alt="License">
</div>

O

PwnLand is an open-source repository maintained by PwnFuzz, an R&D lab specializing in fuzzing, reverse engineering, research, and exploit de. This repository serves as a comprehensi for security researchers, CTF players, and anyone interested in binary exploitation.

PwnLand contains practical examples, tutorials, CTF writeups, and research materials co aspects of binary exploitation, including:

Buffer O and ROP Chains

Format String

Heap Exploitation Techniques

Kernel Exploitation

Assembly Language Fundamentals

Binary Debugging Strategies

Whether you're a beginner or an experienced security researcher, PwnLand provides hands-on materials to enhance your understanding of exploitation techniques across different en and security mechanisms.

Table of Contents

Directory Structure

Exploitation Techniques

- Buffer O
- Format String
- Heap Exploitation
- Kernel Exploitation
- Kernel Exploitation Primer Series

CTF Writeups

Research Materials

Assembly Resources

Debugging Guides

Challenges

Getting Started

Contributing

License

Directory Structure

Exploitation Techniques

Buffer O

Na to BufferO/ to explore:

Basic O Techniques

- Basic Buffer O
- File Pointer O
- gets()

Return-to-libc Attacks

- 32-bit Return-to-libc without ASLR
- 32-bit Return-to-libc with ASLR

Return-Oriented Programming (ROP)

- 32-bit Basic ROP
- 64-bit Basic ROP

Additional Resources

- Resources and References

Format String

Na to Format String/ to learn about:

Introduction to Format String

GOT O to System

Writing Shellcode to BSS

Value O

Heap Exploitation

Na to Heap/ for techniques organized by GLIBC :

GLIBC 2.23

- Fastbin Dup
- House of Force
- Use After Free (UAF)
- Unsafe Unlink

GLIBC 2.27

- Double Free
- Nullbyte O
- O Chunks

Kernel Exploitation

Na to Kernel/ to explore:

HE O

OTAu-lab10c Challenge

#### Kernel Exploitation Primer Series

This section was contributed by Nikhil. The following blog posts are beginner-friendly and offer in-depth guidance for those starting out with Windows kernel exploitation on modern systems.

Kernel Exploitation Primer 0x0 - Windows Driver 101

Kernel Exploitation Primer 0x1 - Setup & Re

Kernel Exploitation Primer 0x2 - SMEP & kASLR & VBS

Kernel Exploitation Primer 0x3 - VBS & HVCI

Kernel Exploitation Primer 0x4 - Type Confusion & Use-After-Free

Kernel Exploitation Primer 0x5 - Arbitrary Write (Write-What-Where)

CTF Writeups

Explore solutions from CTF competitions:

DownUnderCTF 2020

Hackti 2020

DarkCon 2021

DiceCTF 2021

SecurinetsCTF 2021

CyberApocalypse 2021

NahamCon 2021

BlueHens 2021

3kCTF 2020

HTB RopeTwo

Research Materials

Na to Research/ for deep dives into:

malloc() Internals

free() Internals

calloc() Internals

realloc() Internals

Hook Functions

Tcache Mechanisms

Stdout Functions

O Techniques

Assembly Resources

Na to Assembly/ for:

Chapter 1: Assembly Fundamentals

Debugging Guides

Na to Debugging/ for:

Chapter 1: Debugging Fundamentals

Challenges

Na to Challenges/ to test your skills:

Bit Flip Challenge

Getting Started

To get started with PwnLand:

1. Clone this repository:

2. Browse to a topic of interest in the repository.

3. Follow the tutorials and examples to enhance your skills.

4. For binary examples, na to the binaries/ directory.

Contributing

Contributions to PwnLand are welcome! Whether you want to fix a typo, add a tutorial, or contribute a CTF writeup, please follow these steps:

1. Fork the repository
2. Create a new branch (git checkout -b feature/your-feature)
3. Commit your changes (git commit -am 'Add new tutorial on XYZ')
4. Push to the branch (git push origin feature/your-feature)
5. Create a new Pull Request

Please ensure your contributions follow the existing structure and include appropriate documentation.

License

This project is licensed under the MIT License - see the LICENSE file for details.

---

<di="center">
<p>© 2025 PwnFuzz - Open Source R&D Lab for Fuzzing, Reverse Engineering, Research & Exploit De</p>
</div>

项目信息

开发语言：Python

Star 数：64

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Knowledge Base of Exploitation Techniques展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。