SKILL.md

ctf-pwn

Provides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not use it when the main blocker is understanding what the binary does; use reverse engineering first. Do not use it for pure web bugs, disk or packet forensics, or standalone crypto/math challenges.

install ctf-pwn

# install the ctf-skills pack with the skills CLI

npx skills add ljagiello/ctf-skills

# or add only this skill to Claude Code: copy the folder

ctf-pwn/

# into

~/.claude/skills/ctf-pwn/ (all projects)

.claude/skills/ctf-pwn/ (one project)

ctf-pwn/SKILL.md

MITFull file

1# CTF Binary Exploitation (Pwn)
2 
3Quick reference for binary exploitation (pwn) CTF challenges. Each technique has a one-liner here; see supporting files for full details.
4 
5## Prerequisites
6 
7**Python packages (all platforms):**
8```bash
9pip install "pwntools==4.15.0" "ROPgadget==7.7" "ropper==1.13.13"
10# or via script: bash scripts/install_ctf_tools.sh python
11```
12 
13**uv alternative:**
14```bash
15uv venv && uv pip install "pwntools==4.15.0" "ROPgadget==7.7" "ropper==1.13.13"
16```
17 
18**Linux (apt):**
19```bash
20apt install gdb binutils strace ltrace qemu-system-x86
21```
22 
23**Optional cross-arch (ARM/MIPS — Debian/Ubuntu):**
24```bash
25apt install qemu-user qemu-user-static gdb-multiarch binutils-multiarch libc6-armhf-cross libc6-arm64-cross libc6-mips-cross
26```
27 
28**macOS (Homebrew):**
29```bash
30brew install gdb binutils qemu
31```
32 
33**Ruby gems (all platforms):**
34```bash
35gem install one_gadget seccomp-tools
36```
37 
38**Manual install:**
39- pwndbg — Linux: [GitHub](https://github.com/pwndbg/pwndbg), macOS: `brew install pwndbg/tap/pwndbg-gdb`
40- checksec — included with pwntools (`checksec --file=binary`)
41 
42**MCP servers (optional):** WinDbg MCP ([svnscha/mcp-windbg](https://github.com/svnscha/mcp-windbg)) for Windows crash dumps, live breakpoint-driven exploitation, and kernel/driver debugging; IDA Pro MCP / Ghidra MCP for decompiling the vulnerable function — see [tools-mcp.md](tools-mcp.md).
43 
44## Additional Resources
45…

Excerpt shown under the repository's MIT license.

How to install ctf-pwn

ctf-pwn/SKILL.md

More skills in ctf-skills

Newsletter

Join the Community