Step 1: Confirm vulnerability type + protection mechanisms
   ├─ checksec ./vuln（NX / Canary / PIE / RELRO / Fortify）
   ├─ file ./vuln  + readelf -d ./vuln
   ├─ Vulnerability classification: stack overflow / format string / heap (UAF/DF/OF) / integer / race condition / kernel
   └─ → Decide which references/ to use

Step 2: Select exploitation strategy
   ├─ NX disabled + no ASLR → Direct shellcode
   ├─ NX enabled + libc provided → ret2libc / one_gadget
   ├─ NX enabled + no libc provided → Leak then reverse lookup via libc-database
   ├─ Heap → Use techniques corresponding to glibc version (tcache/fastbin/unsorted/large)
   └─ Kernel → commit_creds / modprobe_path / core_pattern

Step 3: Prepare libc + gadget
   ├─ libc-database: ./find puts 0x6f0
   ├─ ROPgadget --binary ./libc.so.6 --only "pop|ret"
   ├─ one_gadget ./libc.so.6
   └─ Calculate base: leak_addr - libc.sym['puts']

Step 4: Write pwntools template (local process)
   ├─ context.binary = ELF('./vuln')
   ├─ p = process('./vuln')  /  p = gdb.debug('./vuln','b *main+xx')
   ├─ payload = cyclic(N) + p64(ret) + ...
   └─ p.interactive()

Step 5: Local success
   ├─ Repeatedly attach + check registers + adjust offset
   ├─ Use pwndbg/GEF's vmmap / heap / bins / telescope
   └─ Switch to remote() after success

Step 6: Remote stabilization
   ├─ libc offset: Reverse lookup via libc-database using leak, do not guess
   ├─ Stack alignment: 16-byte misalignment → movaps crash → Add a ret gadget
   ├─ Remote network delay → Use recvuntil to precisely anchor strings, disable fuzzy sleep
   ├─ Remote buffering → sendlineafter is more stable than sendline
   ├─ Heap spray success rate: Increase spray count + leave padding chunks to prevent merging
   └─ Run multiple times: Write while True to verify success rate ≥ 95%

Available: ./vuln (64-bit ELF, NX, PIE, canary) + ./libc.so.6 + nc host port
Vulnerability: read(buf, 0x200) but buf is only 0x40 bytes → Stack overflow
Protection: Canary blocks, PIE randomizes .text

Strategy:
1. First leak canary (stack/format string/partial read)
2. Then leak a libc function address (puts@got)
3. Calculate libc base using libc.address = leaked - libc.sym['puts']
4. Use one_gadget ./libc.so.6 to select a magic gadget that meets constraints
5. payload = padding + canary + saved_rbp + (pop_rdi + bin_sh + system) or directly one_gadget
6. Add a ret gadget to fix stack alignment (critical!)

Available: vmlinux + bzImage + initramfs.cpio.gz + custom vuln.ko
Vulnerability: copy_from_user in ioctl(0x1337, ptr) has controllable length → Kernel heap overflow (kmalloc-64 slab)
Protection: SMEP, SMAP, KASLR, KPTI

Strategy:
1. Modify init script to get root shell (CTF) or first leak KASLR base then proceed (real scenario)
2. Leak kernel base address via /proc/kallsyms (may be restricted) or uninitialized heap spray
3. Spray tty_struct / msg_msg / pipe_buffer in kmalloc-64 slab
4. Overwrite vtable pointer to user mode → Not allowed (SMEP), switch to stack pivot + kernel ROP
5. ROP chain: prepare_kernel_cred(0) → commit_creds → swapgs+iretq → User mode execve("/bin/sh")
6. Or easier: Overwrite modprobe_path to "/tmp/x", write a /tmp/x, then trigger modprobe

# One-click check + install core tools
for t in pwntools ropgadget ropper; do
  pip show $t >/dev/null 2>&1 || pip install $t
done

command -v one_gadget >/dev/null || gem install one_gadget

[ -d ~/tools/libc-database ] || git clone https://github.com/niklasb/libc-database ~/tools/libc-database
[ -d ~/tools/libc-database/db ] || (cd ~/tools/libc-database && ./get ubuntu debian)

[ -d ~/tools/pwndbg ] || (git clone https://github.com/pwndbg/pwndbg ~/tools/pwndbg && cd ~/tools/pwndbg && ./setup.sh)