pwninit - GitLite

KO | EN

gitlite — search

#javascript #python #react #ai #llm #go #golang #deep-learning #nodejs #awesome #vue #pytorch #ios #mcp

pwninit

(★ 1,114)

pwninit - automate starting binary exploit challenges

File Explorer

Download Latest Version (.zip)

- - checks.yml
  - deploy.yml
- - build_id.rs
  - detect.rs
  - has_debug_syms.rs
  - mod.rs
  - parse.rs
- cpu_arch.rs
- fetch_ld.rs
- lib.rs
- libc_deb.rs
- libc_version.rs
- main.rs
- opts.rs
- patch_bin.rs
- pwninit.rs
- set_exec.rs
- solvepy.rs
- template.py
- unstrip_libc.rs
- warn.rs
.gitignore
Cargo.lock
Cargo.toml
flake.lock
flake.nix
LICENSE
README.md

# Installation Guide

1. Get the code

git clone https://github.com/io12/pwninit

Downloads the entire project code from GitHub to your computer.

cd pwninit

Moves into the project folder you just downloaded.

2. Official Install Script

Easy Recommended

Prerequisites

Rust (rustup) Rust is required to use cargo.

cargo install pwninit

Builds and installs the package published on crates.io — no need to clone the repo yourself.

✅ After installing, open a new terminal and run the program's version command (e.g. --version) to confirm it worked.

Pulled directly from this repo's README.

3. Rust

Medium

Prerequisites

Git Needed to download the project code from GitHub.
Rust (rustup) Installing via rustup also installs cargo.

cargo install pwninit

Builds and installs the package published on crates.io — no need to clone the repo yourself.

✅ If cargo build finishes without errors, it worked. The executable is created under target/.

Pulled directly from this repo's README.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

[![Checks Status](https://github.com/io12/pwninit/workflows/checks/badge.svg)](https://github.com/io12/pwninit/actions)
[![Deploy Status](https://github.com/io12/pwninit/workflows/deploy/badge.svg)](https://github.com/io12/pwninit/actions)
[![](https://img.shields.io/crates/v/pwninit)](https://crates.io/crates/pwninit)
[![](https://docs.rs/pwninit/badge.svg)](https://docs.rs/pwninit)

# `pwninit`

A tool for automating starting binary exploit challenges

## Features

- Set challenge binary to be executable
- Download a linker (`ld-linux.so.*`) that can segfaultlessly load the provided libc
- Download debug symbols and unstrip the libc
- Patch the binary with [`patchelf`](https://github.com/NixOS/patchelf) to use
  the correct RPATH and interpreter for the provided libc
- Fill in a template pwntools solve script

## Usage

### Short version

Run `pwninit`

### Long version

Run `pwninit` in a directory with the relevant files and it will detect which ones are the binary, libc, and linker. If the detection is wrong, you can specify the locations with `--bin`, `--libc`, and `--ld`.

#### Custom `solve.py` template

If you don't like the default template, you can use your own. Just specify `--template-path <path>`. Check [template.py](src/template.py) for the template format. The names of the `exe`, `libc`, and `ld` bindings can be customized with `--template-bin-name`, `--template-libc-name`, and `--template-ld-name`.

##### Persisting custom `solve.py`

You can make `pwninit` load your custom template automatically by adding an alias to your `~/.bashrc`.

###### Example

```bash
alias pwninit='pwninit --template-path ~/.config/pwninit-template.py --template-bin-name e'
```

## Install

### Arch Linux

Install [`pwninit`](https://aur.archlinux.org/packages/pwninit/) or
[`pwninit-bin`](https://aur.archlinux.org/packages/pwninit-bin/) from the AUR.

### Download

You can download statically-linked [musl](https://www.musl-libc.org/)
binaries from the [releases page](https://github.com/io12/pwninit/releases).

### Using cargo

Run

```sh
cargo install pwninit
```

This places the binary in `~/.cargo/bin`.

Note that `openssl`, `liblzma`, and `pkg-config` are required for the build.

## Example

```sh
$ ls
hunter  libc.so.6  readme

$ pwninit
bin: ./hunter
libc: ./libc.so.6

setting ./hunter executable
fetching linker
https://launchpad.net/ubuntu/+archive/primary/+files//libc6_2.23-0ubuntu10_i386.deb
unstripping libc
https://launchpad.net/ubuntu/+archive/primary/+files//libc6-dbg_2.23-0ubuntu10_i386.deb
setting ./ld-2.23.so executable
copying ./hunter to ./hunter_patched
running patchelf on ./hunter_patched
writing solve.py stub

$ ls
hunter	hunter_patched	ld-2.23.so  libc.so.6  readme  solve.py
```

`solve.py`:

```python
#!/usr/bin/env python3

from pwn import *

exe = ELF("./hunter_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-2.23.so")

context.binary = exe

def conn():
    if args.LOCAL:
        r = process([exe.path])
        if args.GDB:
            gdb.attach(r)
    else:
        r = remote("addr", 1337)

return r

def main():
    r = conn()

# good luck pwning :)

r.interactive()

if __name__ == "__main__":
    main()
```