pwn-chain

82 / 100 · Low risk

Fine to try.

By stanfish06/skillquarium (GitHub) · data · 12 stars · scanned at commit ced6c96

从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。覆盖三大方向：栈溢出 / 堆利用 / 内核 pwn。强调"CTF 本地通 → 真实远程稳定打通"的工程差距：libc 版本错配、堆喷射时序、SMEP/SMAP/KASLR、栈对齐、远程缓冲。核心工具链：pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system 内核调试。触发关键词：pwn、栈溢出、堆溢出、ROP、ret2libc、ret2csu、one_gadget、libc-database、堆利用、tcache、fastbin、unsorted bin、kernel pwn、kROP、SMEP、SMAP、KASLR、modprobe_path、pwntools、GEF、pwndbg。

Works with any agent that supports SKILL.md skills.

What this skill can do

Downloads and installs other software

The author does not mention this.

Found in 7 places.

skills/pwn-chain/SKILL.md, line 129| pwntools | exploit 编写框架 | `pip install pwntools` |
skills/pwn-chain/SKILL.md, line 132| ROPgadget | gadget 搜索 | `pip install ropgadget` |
skills/pwn-chain/SKILL.md, line 133| Ropper | gadget 搜索（备选，支持架构多） | `pip install ropper` |

Show 4 more

skills/pwn-chain/SKILL.md, line 136| qemu-system-x86_64 | 内核题调试 | `apt install qemu-system-x86` |
skills/pwn-chain/SKILL.md, line 137| binwalk / cpio | initramfs 拆包 | `apt install binwalk cpio` |
skills/pwn-chain/SKILL.md, line 138| patchelf | 切换 libc 版本 | `apt install patchelf` |
skills/pwn-chain/SKILL.md, line 145pip show $t >/dev/null 2>&1 || pip install $t

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README.

Found in 1 place.

skills/pwn-chain/SKILL.md, line 144for t in pwntools ropgadget ropper; do

Other copies in this repository

stanfish06/skillquarium has 1 more folder with a skill named pwn-chain. This page shows the lowest-scoring copy.

skills/reverse-skill-router/pwn-chain 82/100 · Low risk

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'pwn-chain' ] || [ -L ~/.agents/skills/'pwn-chain' ]; then echo 'A skill folder named pwn-chain already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/stanfish06/skillquarium' "$d" && git -C "$d" checkout --quiet 'ced6c96bd67acccbf0280a5071e59a523c118c66' -- 'skills/pwn-chain' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/pwn-chain' ~/.agents/skills/'pwn-chain' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'pwn-chain' ~/.claude/skills/'pwn-chain' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for stanfish06/skillquarium shows the score of its lowest-scoring skill.

SkillTrust badge for stanfish06/skillquarium

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/stanfish06/skillquarium.svg)](https://zalavijaysinh.github.io/skilltrust/repos/stanfish06/skillquarium/)

Score history

Date	Version	Score
2026-11-13	`ced6c96`	82
2026-11-08	`f748ea9`	100