ROP Emporium - NFHN Reader

Learn return-oriented programming through a series of challenges.

View Beginners' guide Download all challenges

Challenge 1

ret2win

ret2win means "return here to win" and it's recommended you start with this challenge. Visit the challenge page by clicking this card to learn more.

Challenge 2

split

Combine elements from the ret2win challenge that have been split apart to beat this challenge. Learn how to use another tool whilst crafting a short ROP chain.

Challenge 3

callme

Chain calls to multiple imported methods with specific arguments and see how the differences between 64 & 32 bit calling conventions affect your ROP chain.

Challenge 4

write4

Find and manipulate gadgets to construct an arbitrary write primitive, then use it to learn where and how to get your data into process memory.

Challenge 5

badchars

Learn to deal with "badchars": characters that will not make it into process memory intact or cause other issues such as premature chain termination.

Challenge 6

fluff

Sort the useful gadgets from the fluff to construct another write primitive in this challenge. You'll have to get creative though, the gadgets aren't straightforward.

Challenge 7

pivot

Stack space is at a premium in this challenge and you'll have to pivot the stack onto a second ROP chain elsewhere in memory to ensure your success.

Challenge 8

ret2csu

Learn a ROP technique that lets you populate useful calling convention registers like rdi, rsi and rdx even in an environment where gadgets are sparse.

Linux heap exploitation

with HeapLAB

Enjoyed the ROP Emporium challenges but still looking to improve your exploit development skills? I created HeapLAB to teach hands-on, modern Linux heap exploitation techniques.

Part 1 Part 2