Package: pwnypack
pwnypackThe officialCertified Edible DinosaursCTF toolkit.pwnypackattempts to provide a toolset which can be used to more easily develop
CTF solutions.MotivationAfter seeing the excellentpwntoolsby Gallopsled, I
got interested in building my own CTF toolkit.pwntoolsis much more
complete so you should probably use that.pwnypackwas created mostly
out of curiosity.InstallationFirst, make sure yoursetuptoolsandpippackages are up to date:$pipinstall-UsetuptoolspipTo install the latest released version of pwnypack with all optional
dependencies, run:$pipinstall--no-binarycapstone,keystone-enginepwnypack[all]To install the latest released version of pwnypack with minimal
dependencies, run:$pipinstallpwnypackOther available install targets are:--no-binarykeystone-enginepwnypack[asm]- installskeystone-engineto support all assembler targets without any additional depenencies.--no-binarycapstone pwnypack[disasm]- installscapstonefor AT&T
and intel syntax disassembly, required to disassemble ARM binaries.--no-binarycapstone pwnypack[rop]- installscapstoneto validate
ROP gadgets.pwnypack[ssh]- installsparamikoto enable theFlowmodule to
connect to SSH servers.pwnypack[shell]- installsipythonto support the enhanced pwnypack
REPL environment.pwnypack[pwnbook]- installsjupyterto support thepwnbookjupyter
notebook.If you want to use the interactive shell I highly recommend installing
eitherbpythonoripythonas those packages can make your time in
the shell a lot more enjoyable.DockerYou can also use our published docker images.To start an ipython powered pwnypack shell:dockerpulledibledinos/pwnypack:latestdockerrun--rm-itedibledinos/pwnypack:latestOr, to run pwnbook:dockerpulledibledinos/pwnbook:latestdockerrun--rm-it-p8888:8888edibledinos/pwnbook:latestBoth images expose a volume (/projects). Feel free to mount something
interesting there.Three tags are available:py3(or:latest) installs python 3 and pwnypack/pwnbook.py2installs python 2 and pwnypack/pwnbook.UsageTo import all ofpwnypackinto your global namespace, use:>>>frompwnyimport*Or, if you’re using python 2.7+ or python 3.3+, try the customized
bpython or IPython shell:$pwnyshellIf you have bpython and/or IPython installed you can use--bpython,--ipythonor--pythonto select which interactive kernel to use.I promise that effort will be put into not exposing unnecessary stuff
and thus overly polluting your global namespace.For an example, check out theBig Prison
Fenceexample in the wiki.Common errorsCapstone/keystone fails to import the dynamic library.Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/ingmar/.virtualenvs/pp/lib/python3.5/site-packages/capstone/__init__.py", line 230, in <module>
    raise ImportError("ERROR: fail to load the dynamic library.")
ImportError: ERROR: fail to load the dynamic library.Thecapstoneandkeystonepackages have a bug which when used with a
new verion ofpipwill end up installing the dynamic libraries in the
wrong location on some platforms. Re-installcapstoneand/orkeystoneusing:$pipinstall--no-binarycapstonecapstone$pipinstall--no-binarykeystone-enginekeystone-engineSyntaxError when importing pwnypack.Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "pwny/__init__.py", line 9, in <module>
    from pwnypack.pwnbook import *
  File "pwnypack/pwnbook.py", line 2, in <module>
    from jupyter_client import kernelspec as kernelspec
  File "/Users/ingmar/.virtualenvs/pwny26/lib/python2.6/site-packages/jupyter_client/__init__.py", line 4, in <module>
    from .connect import *
  File "/Users/ingmar/.virtualenvs/pwny26/lib/python2.6/site-packages/jupyter_client/connect.py", line 23, in <module>
    from traitlets.config import LoggingConfigurable
  File "/Users/ingmar/.virtualenvs/pwny26/lib/python2.6/site-packages/traitlets/__init__.py", line 1, in <module>
    from .traitlets import *
  File "/Users/ingmar/.virtualenvs/pwny26/lib/python2.6/site-packages/traitlets/traitlets.py", line 1331
    return {n: t for (n, t) in cls.class_traits(**metadata).items()
                   ^
SyntaxError: invalid syntaxYou’ve installed jupyter notebooks on python 2.6. Use a more modern version
of python.Documentationpwnypack’s API documentation is hosted onreadthedocs.For information on the commandline apps use the built in help function:$pwny--help$pwnyshell--helpContributorspwnypackwas created by Certified Edible Dinosaurs (dsc & doskop). If you
want to contribute, feel free to fork and create a pull request onGitHub.Current contributors:blasty <peter@haxx.in> contributed the ARM shellcode generator.Licensepwnypackis distributed under the MIT license.Release historynext release0.9.0 (2017-11-17)Adding missing dev packages on docker images.Docker images clone latest branch of pwnypack repository.Fix magic command registration on IPython >= 5.0.0.Support parsing (a subset of) ~/.ssh/config in flow.SSHClient.Fix aarch64 support when using keystone engine.Added padding oracle attack functions.Added keystone-engine dependency for ‘asm’ and ‘all’ targets.Make pwnbook, shell and ssh targets require python 2.7+.Added internals for python 3.5.2 and 3.6.0.8.0 (2016-05-17)Return empty list when trying to read non-existing .dynamic section.Don’t print newline when piping the output of a gadget.Fix output of raw binary data on python 3.Add pwnypack extension for ipython.Add pwnypack jupyter notebook wrapper (pwnbook).Moved and renamed util.pickle_call to pickle.pickle_invoke.Added pickle_func that pickles a function and its invocation.Added support for using GNU binutils to assemble AT&T and intel syntax.Added support for assembling/disassembling ARM using binutils/capstone.Use extras_require to make capstone, paramiko and jupyter optional.Add Dockerfile for pwnypack shell and pwnbook.Fix interact on python 3 in Flow.Add python bytecode manipulation functions.Added shellcode generator for X86/X86_64, ARM (+Thumb) and AArch64.Use keystone engine as assembler engine by default.Added xor mask finder.Added python independent marshal and .pyc loader.Fix internal escaping of reghex expressions.Allow wildcards when searching for ROP gadgets using assembly statements.0.7.2 (2016-03-11)Added support for .dynamic section parsing to ELF class.Added checksec command line app.Make pwnypack available as a universal wheel.0.7.1 (2016-03-07)Add support for bpython and plain python interactive shells.Fix missing newline after the output of several commandline apps.Added PHP serialized data generation function and helper.Add enurlform / deurlform / enurlquote / deurlquote functions.0.7.0 (2015-07-12)Made IPython an optional dependency (pip install pwnypack[shell]).Added pickle_call function to easily execute a function on unpickle.Added format string vulnerability exploit builder.Renamed TCPSocketChannel to TCPClientSocketChannel.Added TCPServerSocketChannel which can listen for an incoming connection.Added Flow.interact() method.Added support for connecting to SSH servers from Flow.0.6.0 (2015-04-14)Bugfixes (and travis-ci integration).API documentationand docstrings.Cycle-find can read from stdin.Major refactoring of ELF class. It can now parse section headers, program
headers, symbol tables and extract section, symbols.Major refactoring of Target class. It’s no longer tied to ELF (ELF is still
a subclass of Target though).A reghex compiler.Verifying ROP gadget finder.Disassembler functionality (based on ndisasm or capstone).The ability to redirect stderr to stdout in flow.ProcessChannel.The ability to create symlinks for commandline apps.New commandline apps:asmto assemble from commandline.symbolsto list the symbol table of an ELF file.gadgetto find ROP gadgets in an ELF file.symbol-extractto extract a symbol from an ELF file.symbol-disasmto disassemble a symbol in an ELF file.0.5.2 (2015-03-22)Added command line apps and a customized IPython shell.0.5.1 (2015-03-21)Python3 fixes for flow:Use latin1 for echo mode as not everything will be encodable as utf-8.Disable buffering on subprocess.0.5.0 (2015-03-21)Initial release.