{"id":21134363,"url":"https://github.com/last-byte/ropexploits","last_synced_at":"2025-06-21T06:03:18.968Z","repository":{"id":74157470,"uuid":"126833455","full_name":"last-byte/ROPExploits","owner":"last-byte","description":"ROP Emporium challenges solved in Python using Pwntools.","archived":false,"fork":false,"pushed_at":"2018-04-02T18:09:44.000Z","size":859,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-03-14T12:44:31.166Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/last-byte.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2018-03-26T13:31:10.000Z","updated_at":"2023-12-07T08:35:49.000Z","dependencies_parsed_at":"2023-12-07T10:35:11.663Z","dependency_job_id":"e690ae6d-08df-45ca-86ea-b26ef1feecc1","html_url":"https://github.com/last-byte/ROPExploits","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/last-byte/ROPExploits","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last-byte%2FROPExploits","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last-byte%2FROPExploits/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last-byte%2FROPExploits/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last-byte%2FROPExploits/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/last-byte","download_url":"https://codeload.github.com/last-byte/ROPExploits/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/last-byte%2FROPExploits/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261073293,"owners_count":23105637,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-20T06:27:42.864Z","updated_at":"2025-06-21T06:03:13.950Z","avatar_url":"https://github.com/last-byte.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ROPExploits - Solutions to ROP Emporium challenges\n\n## Introduction\nThis repository contains the challenges from ROP Emporium along with an **exploit.py** script to solve them. All of the code has been commented in order for the reader to understand what's happening. All the challenges have been completed, both 32bit and 64bit, except for ~~*pivot* and~~ *badchars* (still WIP at the moment). The script is able to bypass ASLR if it's turned on. On some scripts it's possible to uncomment a certain line to enable full interactive shell instead of just having printed the flag. \n\n## Requirements\n* Python 2\n* Pwntools\n\n## Usage\n```\ngit clone https://github.com/last-byte/ROPExploits.git\ncd ./ROPExploits/\u003cchallenge\u003e/(32bit|64bit)/\nsocat TCP4-LISTEN:1234,reuseaddr,fork EXEC:./$CHALLENGE\npython exploit.py\n```\n\n## Warnings\n* Make sure the libc used by exploit is the same your binary is using (`ldd ./binary` and check it) \n* While syntax is compatible with Python 3 use Python 2 instead because Pwntools is quite problematic with Python 3\n\n## Notes\n* It seems like Pwntools, when dealing with 64bit binaries, doesn't automatically update rop gadgets addresses generated with ROP(libc) if libc base address is updated using libc.address. Be sure to generate ropchains using ROP(libc) only after having set libc.address.\n\n## TO-DO\n* [x] Solve pivot\n* [ ] Solve badchars\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flast-byte%2Fropexploits","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flast-byte%2Fropexploits","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flast-byte%2Fropexploits/lists"}