Agent skill · security · yaklang
stack-overflow-and-rop
Stack overflow and ROP playbook. Use when exploiting buffer overflows to hijack control flow via return address overwrite, ROP chains, ret2libc, ret2csu, ret2dlresolve, or SROP on Linux userland binaries.
Why this skill is useful
Adds detailed exploitation techniques and scripts for buffer overflow and ROP attacks that are not commonly known or documented.
What it needs
Requires pwntools, ropper installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Stack Overflow & ROP — Expert Attack Playbook AI LOAD INSTRUCTION: Expert stack-based exploitation techniques. Covers classic buffer overflow, return-to-libc, ROP chain construction, ret2csu, ret2dlresolve, SROP, stack pivoting, and canary bypass. Distilled from ctf-wiki advanced-rop, real-world CVEs, and CTF competition patterns. Base models often miss the nuance of gadget selection under constrained conditions. 0. RELATED ROUTING format-string-exploitation — leak canary/libc/PIE base via format string before triggering overflow binary-protection-bypass — systematic bypass of NX, ASLR, PIE, canary, RELRO arbitrary-write-to-rce — convert a write primitive (GOT, hooks, vtable) into code execution heap-exploitation — when the vulnerability is in heap rather than stack Advanced Reference Load ROPADVANCEDTECHNIQUES.md when you need: Blind ROP (BROP) methodology against remote services without binary ret2vdso for ASLR bypass on 32-bit systems Partial overwrite techniques for PIE bypass JOP / COP alternative code-reuse paradigms --- 1. STACK LAYOUT FUNDAMENTALS Element x86 (32-bit) x86-64 (64-bit) --- --- --- Return address size 4 bytes 8 bytes Saved frame pointer 4 bytes (EBP) 8 bytes (RBP) Canary size 4 bytes 8 bytes Calling convention args on stack RDI, RSI, RDX, RCX, R8, R9 then stack Syscall instruction int 0x80 syscall --- 2. RETURN-TO-LIBC When NX is enabled (stack not executable), redirect execution to libc functions. Classic ret2libc (32-bit) ret2libc (64-bit) — Need Gadgets for Arguments Libc Base Leak Methods Method Technique When --- --- --- puts@plt(puts@GOT) Leak resolved libc address GOT already resolved, puts in PLT write@plt(1, read@GOT, 8) Leak via write syscall write available printf("%s", GOTentry) Leak via format string printf controllable Partial overwrite Overwrite low bytes of return to reach leak gadget PIE enabled, known last 12 bits onegadget — Single Gadget RCE Constraints must be satisfied — check register/stack state before using. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/stack-overflow-and-rop