hacktricks/exploiting/tools/pwntools.md

# PwnTools

```
pip3 install pwntools
```

## Pwn asm 

Get opcodes from line or file. 

```
pwn asm "jmp esp" 
pwn asm -i <filepath>
```

**Can select:**&#x20;

* output type (raw,hex,string,elf)
* output file context (16,32,64,linux,windows...)
* avoid bytes (new lines, null, a list)&#x20;
* select encoder debug shellcode using gdb run the output

## &#x20; **Pwn checksec**

Checksec script&#x20;

```
pwn checksec <executable>
```

## Pwn constgrep

## Pwn cyclic&#x20;

Get a pattern

```
pwn cyclic 3000
pwn cyclic -l faad
```

**Can select:**   &#x20;

* The used alphabet (lowercase chars by default)
* Length of uniq pattern (default 4)
* context (16,32,64,linux,windows...)
* Take the offset (-l)

## Pwn debug

Attach GDB to a process

```
pwn debug --exec /bin/bash
pwn debug --pid 1234
pwn debug --process bash
```

**Can select:**&#x20;

* By executable, by name or by pid context (16,32,64,linux,windows...)&#x20;
* gdbscript to execute&#x20;
* sysrootpath

## Pwn disablenx&#x20;

Disable nx of a binary &#x20;

```
pwn disablenx <filepath>
```

## Pwn disasm&#x20;

Disas hex opcodes

```
pwn disasm ffe4
```

**Can select:**&#x20;

* context (16,32,64,linux,windows...)&#x20;
* base addres&#x20;
* color(default)/no color

## Pwn elfdiff&#x20;

Print differences between 2 fiels

```
pwn elfdiff <file1> <file2>
```

## Pwn hex&#x20;

Get hexadecimal representation

```bash
pwn hex hola #Get hex of "hola" ascii
```

## Pwn phd&#x20;

Get hexdump&#x20;

```
pwn phd <file>
```

&#x20;**Can select:**&#x20;

* Number of bytes to show&#x20;
* Number of bytes per line highlight byte&#x20;
* Skip bytes at beginning

## Pwn pwnstrip&#x20;

## Pwn scrable

## Pwn shellcraft&#x20;

Get shellcodes

```
pwn shellcraft -l #List shellcodes 
pwn shellcraft -l amd #Shellcode with amd in the name
pwn shellcraft -f hex amd64.linux.sh #Create in C and run
pwn shellcraft -r amd64.linux.sh #Run to test. Get shell 
pwn shellcraft .r amd64.linux.bindsh 9095 #Bind SH to port
```

**Can select:**

* shellcode and arguments for the shellcode
* Out file
* output format
* debug (attach dbg to shellcode)
* before (debug trap before code)&#x20;
* after
* avoid using opcodes (default: not null and new line)
* Run the shellcode
* Color/no color
* list syscalls&#x20;
* list possible shellcodes&#x20;
* Generate ELF as a shared library

## Pwn template&#x20;

Get a python template&#x20;

```
pwn template
```

**Can select:** host, port, user, pass, path and quiet

## Pwn unhex&#x20;

From hex to string&#x20;

```
pwn unhex 686f6c61
```

## Pwn update&#x20;

To update pwntools

```
pwn update
```