Memory-corruption exploitation

When it applies

You have a native binary or service on an authorized target that mishandles your input — a network-facing daemon, a thick-client, a setuid helper found during privesc, or a binary carved from firmware (reverse-eng-firmware). reverse-eng-binary-triage located the bug; this skill turns that crash into controlled execution. Pentest-only — this is destructive and can crash the service.

Why it works

C/C++ has no memory safety: writing past a buffer overwrites saved return addresses and pointers, and a user-controlled format string reads/writes arbitrary memory. Redirect execution to your code or to existing code (ROP) and the process does your bidding. Modern mitigations (NX, ASLR, PIE, stack canaries) don't remove the bug — they shape the technique.