HackTricks
Searchโ€ฆ
๐Ÿ‘ฝ
Network Services Pentesting
PwnTools
Support HackTricks and get benefits!
1
pip3 install pwntools
Copied!

Pwn asm

Get opcodes from line or file.
1
pwn asm "jmp esp"
2
pwn asm -i <filepath>
Copied!
Can select:
  • output type (raw,hex,string,elf)
  • output file context (16,32,64,linux,windows...)
  • avoid bytes (new lines, null, a list)
  • select encoder debug shellcode using gdb run the output

Pwn checksec

Checksec script
1
pwn checksec <executable>
Copied!

Pwn constgrep

Pwn cyclic

Get a pattern
1
pwn cyclic 3000
2
pwn cyclic -l faad
Copied!
Can select:
  • The used alphabet (lowercase chars by default)
  • Length of uniq pattern (default 4)
  • context (16,32,64,linux,windows...)
  • Take the offset (-l)

Pwn debug

Attach GDB to a process
1
pwn debug --exec /bin/bash
2
pwn debug --pid 1234
3
pwn debug --process bash
Copied!
Can select:
  • By executable, by name or by pid context (16,32,64,linux,windows...)
  • gdbscript to execute
  • sysrootpath

Pwn disablenx

Disable nx of a binary
1
pwn disablenx <filepath>
Copied!

Pwn disasm

Disas hex opcodes
1
pwn disasm ffe4
Copied!
Can select:
  • context (16,32,64,linux,windows...)
  • base addres
  • color(default)/no color

Pwn elfdiff

Print differences between 2 fiels
1
pwn elfdiff <file1> <file2>
Copied!

Pwn hex

Get hexadecimal representation
1
pwn hex hola #Get hex of "hola" ascii
Copied!

Pwn phd

Get hexdump
1
pwn phd <file>
Copied!
Can select:
  • Number of bytes to show
  • Number of bytes per line highlight byte
  • Skip bytes at beginning

Pwn pwnstrip

Pwn scrable

Pwn shellcraft

Get shellcodes
1
pwn shellcraft -l #List shellcodes
2
pwn shellcraft -l amd #Shellcode with amd in the name
3
pwn shellcraft -f hex amd64.linux.sh #Create in C and run
4
pwn shellcraft -r amd64.linux.sh #Run to test. Get shell
5
pwn shellcraft .r amd64.linux.bindsh 9095 #Bind SH to port
Copied!
Can select:
  • shellcode and arguments for the shellcode
  • Out file
  • output format
  • debug (attach dbg to shellcode)
  • before (debug trap before code)
  • after
  • avoid using opcodes (default: not null and new line)
  • Run the shellcode
  • Color/no color
  • list syscalls
  • list possible shellcodes
  • Generate ELF as a shared library

Pwn template

Get a python template
1
pwn template
Copied!
Can select: host, port, user, pass, path and quiet

Pwn unhex

From hex to string
1
pwn unhex 686f6c61
Copied!

Pwn update

To update pwntools
1
pwn update
Copied!
Support HackTricks and get benefits!