# Linux Exploitation Fundamentals

> A progressive path from CPU registers to remote exploitation, covering stack overflows, ROP chains, NX and ASLR bypasses on x86 and x64 Linux.

- Source: https://stevenfoerster.com/tutorials/paths/linux-exploitation-fundamentals/

Learning Path

A progressive path from CPU registers to remote exploitation, covering stack overflows, ROP chains, NX and ASLR bypasses on x86 and x64 Linux.

14 available [Start the path](https://stevenfoerster.com/tutorials/x86-x64-registers-and-calling-conventions/)

1.  - 1
    - beginner

    ## [x86 and x64 Registers and Calling Conventions](https://stevenfoerster.com/tutorials/x86-x64-registers-and-calling-conventions/)

    A practical guide to CPU registers, partial register access, flags, and how function arguments are passed on x86 and x64 Linux.

2.  - 2
    - beginner

    ## [The Stack: Memory Layout and Function Frames](https://stevenfoerster.com/tutorials/stack-memory-layout-and-function-frames/)

    How the stack works in x86 and x64 Linux: memory layout, push/pop mechanics, function prologues and epilogues, and why overflows overwrite the return address.

3.  - 3
    - beginner

    ## [Redirecting Execution to Hidden Functions](https://stevenfoerster.com/tutorials/redirecting-execution-to-hidden-functions/)

    Learn how to exploit a basic stack buffer overflow to redirect execution to a hidden function in a SUID binary and gain elevated privileges.

4.  - 4
    - intermediate

    ## [Linux Syscalls for Exploit Development](https://stevenfoerster.com/tutorials/linux-syscalls-for-exploit-development/)

    How Linux syscalls work at the instruction level, int 0x80 vs syscall, register setup, and the key syscalls used in shellcode and ROP chains.

5.  - 5
    - intermediate

    ## [Basic Stack Buffer Overflow on x86](https://stevenfoerster.com/tutorials/basic-stack-buffer-overflow-x86/)

    Exploit a stack buffer overflow on 32-bit Linux, from vulnerability discovery to shellcode execution.

6.  - 6
    - intermediate

    ## [Stack Buffer Overflow on x64 Linux](https://stevenfoerster.com/tutorials/stack-buffer-overflow-x64/)

    Exploit stack buffer overflows on 64-bit Linux systems, understanding the differences from x86 including register usage and address handling.

7.  - 7
    - intermediate

    ## [Return-to-libc Attack on x86](https://stevenfoerster.com/tutorials/return-to-libc-attack-x86/)

    Bypass NX protection by returning to libc functions instead of executing shellcode on the stack. Learn to leak addresses and chain function calls.

8.  - 8
    - advanced

    ## [Bypassing NX with ROP on x64 Linux](https://stevenfoerster.com/tutorials/bypassing-nx-with-rop-x64/)

    Use Return-Oriented Programming to bypass NX protection on 64-bit Linux, chaining gadgets to call system() with /bin/sh.

9.  - 9
    - intermediate

    ## [ROP Gadget Hunting Toolkit](https://stevenfoerster.com/tutorials/rop-gadget-hunting-toolkit/)

    A practical reference for finding, filtering, and verifying ROP gadgets with ropper, ROPgadget, and GDB-PEDA, plus chaining strategies.

10.  - 10
     - advanced

     ## [Bypassing NX with mprotect ROP Chains](https://stevenfoerster.com/tutorials/bypassing-nx-with-mprotect-rop/)

     Use Return-Oriented Programming to call mprotect() and make stack memory executable, then jump to shellcode on x64 Linux.

11.  - 11
     - advanced

     ## [Bypassing ASLR on x64 Linux](https://stevenfoerster.com/tutorials/bypassing-aslr-x64/)

     Defeat Address Space Layout Randomization using fixed addresses in the binary when PIE is disabled.

12.  - 12
     - advanced

     ## [Remote Exploitation with Socket Reuse Shellcode](https://stevenfoerster.com/tutorials/remote-exploitation-socket-reuse/)

     Exploit a remote x86 Linux service: leak addresses to bypass PIE, split shellcode across discontinuous buffers, and reuse the socket to evade firewall rules.

13.  - 13
     - intermediate

     ## [Format String Vulnerabilities on x86](https://stevenfoerster.com/tutorials/format-string-vulnerabilities-x86/)

     Exploit printf-family functions when user input is the format argument: leak stack values, dump memory at arbitrary addresses, and write a byte into the GOT.

14.  - 14
     - advanced

     ## [Bypassing GCC Stack Canaries on Linux](https://stevenfoerster.com/tutorials/bypassing-stack-canaries-on-linux/)

     Defeat -fstack-protector by leaking canaries via format strings, brute-forcing them across forks, and overwriting \_\_stack\_chk\_fail in the GOT.


[All tutorials and learning paths](https://stevenfoerster.com/tutorials/)