# pwntools — CTF Framework and Exploit Development Library

> A Python library designed for rapid exploit development and CTF competitions, providing utilities for binary exploitation, shellcode generation, and remote interaction.

## Install

Save as a script file and run:

# pwntools — CTF Framework and Exploit Development Library

## Quick Use

```bash
# Install pwntools
pip install pwntools

# Quick exploit script example
python3 -c "
from pwn import *
# Connect to a remote service
r = remote('example.com', 1337)
# Send a payload
r.sendline(b'AAAA' + p64(0xdeadbeef))
# Receive response
print(r.recvline())
r.close()
"
```

## Introduction

pwntools is a Python library built for exploit development and CTF (Capture The Flag) competitions. Developed by the Gallopsled CTF team, it provides a comprehensive set of utilities for interacting with processes, crafting payloads, generating shellcode, and performing binary analysis. It is one of the most widely adopted frameworks in the security research and competitive hacking communities.

## What pwntools Does

- Provides abstractions for local and remote process interaction (tubes) with send/receive primitives
- Generates shellcode for multiple architectures using the shellcraft module
- Packs and unpacks integers in various byte orders and widths for payload construction
- Integrates with GDB for attaching debuggers to exploit targets during development
- Includes ELF parsing, ROP chain generation, and format string exploit helpers

## Architecture Overview

pwntools is organized into context-aware modules under the `pwn` namespace. The tubes subsystem provides a unified interface for local processes, remote sockets, SSH connections, and serial ports. The ELF module parses binary files to extract symbols, GOT/PLT entries, and section information. The ROP module automates return-oriented programming chain construction by scanning binaries for gadgets. Architecture and OS settings are managed through a global context object that configures byte order, word size, and logging behavior across all modules.

## Self-Hosting & Configuration

- Install via pip; requires Python 3.6+ and works best on Linux systems
- Set architecture context with `context.arch = 'amd64'` or `context.arch = 'arm'`
- Configure logging verbosity with `context.log_level = 'debug'` for detailed output
- Use `context.binary` to automatically set architecture from an ELF file
- Docker images are available for reproducible exploit development environments

## Key Features

- ROP chain automation with gadget finding and chain construction for x86, x64, ARM, and MIPS
- Shellcraft templating engine with hundreds of pre-built shellcode templates
- Format string exploit automation for reading and writing arbitrary memory
- SROP (Sigreturn-Oriented Programming) frame construction utilities
- DynELF module for remote symbol resolution without access to libc binaries

## Comparison with Similar Tools

- **ROPgadget**: Focuses solely on gadget finding and chain generation; pwntools provides gadget search as part of a broader exploitation framework
- **radare2/r2pipe**: A reverse engineering framework with scripting support; pwntools focuses on exploit development rather than static analysis
- **Metasploit**: A penetration testing framework with exploit modules; pwntools is a developer library for writing custom exploits from scratch
- **angr**: A binary analysis platform with symbolic execution; pwntools is more hands-on and oriented toward manual exploit crafting
- **zio**: A lightweight Python I/O library for CTFs; pwntools provides significantly more functionality including shellcode, ROP, and ELF parsing

## FAQ

**Q: Does pwntools work on macOS or Windows?**
A: pwntools is primarily designed for Linux. It can be installed on macOS with reduced functionality, but many features like process interaction and shellcode assembly require Linux. On Windows, use WSL.

**Q: How do I attach GDB to a process started by pwntools?**
A: Use `gdb.attach(process)` or start the process with `gdb.debug('./binary', gdbscript)` to launch with GDB attached and optional GDB commands pre-loaded.

**Q: Can pwntools generate shellcode for ARM or MIPS?**
A: Yes. Set `context.arch` to the target architecture (arm, aarch64, mips, etc.) and use the `shellcraft` module to generate architecture-specific shellcode.

**Q: What is the difference between pwntools and pwnlib?**
A: pwnlib is the underlying library package. The `pwn` module is a convenience wrapper that imports everything from pwnlib and installs signal handlers and terminal utilities for interactive use.

## Sources

- Repository: https://github.com/Gallopsled/pwntools
- Documentation: https://docs.pwntools.com/

---
Source: https://tokrepo.com/en/workflows/asset-aaee2bd2
Author: Script Depot