pwn-chain

Leak a libc function address via the GOT, compute the libc base by subtracting the symbol offset, then build a ROP chain calling system with a /bin/sh string address. Insert a single ret gadget before the chain to fix 16-byte stack alignment, which is the most common cause of remote crashes.

Remote failures usually come from libc version mismatches, stack misalignment triggering movaps faults, or network timing issues. Use libc-database to fingerprint the remote libc from leaked addresses, add a ret gadget for alignment, and replace sleep calls with recvuntil anchored on exact strings.

Heap techniques are tightly bound to glibc versions: tcache appeared in 2.27, safe-linking in 2.32 requires leaking the heap base first, and 2.34 removed __free_hook and __malloc_hook entirely. For 2.34+, exploitation shifts to FILE struct vtable hijacking or exit handler overwrites.

SMEP and SMAP prevent executing or accessing userland from kernel mode, so exploits use kernel ROP chains calling prepare_kernel_cred(0) then commit_creds, returning via swapgs_restore_regs_and_return_to_usermode. Alternatively, overwrite modprobe_path with an arbitrary write primitive to trigger root execution.

The core toolchain is pwntools for exploit scripting, GEF or pwndbg for debugging, ROPgadget or Ropper for gadget search, one_gadget for magic gadgets, and libc-database for remote libc fingerprinting. Kernel work additionally requires qemu-system-x86_64 and cpio for initramfs manipulation.

Use this skill only after a vulnerability has already been identified through auditing, fuzzing, or static analysis. It covers the path from a known bug to a working exploit; discovering the vulnerability itself belongs to reverse engineering or fuzzing workflows.