Claude Code plugin for binary exploitation (pwn) challenges on HackTheBox and CTFs.
Part of a security plugin suite alongside whitebox-claude-plugin and blackbox-claude-plugin .
5-Phase Methodology — structured workflow: setup, recon, static analysis, dynamic analysis, exploit development16 Slash Commands — from full methodology (/pwn) to individual exploit templates (/pwn-ret2libc, /pwn-rop, etc.)3 Autonomous Agents — binary-analyzer, exploit-suggester, template-generatorPwntools Exploit Templates — ret2win, ret2libc, format string, master templateGDB/pwndbg Integration — project-specific .gdbinit generation, crash analysis, offset calculationHook-Based Binary Auto-Detection — automatically detects and analyzes ELF binaries on session startProtection-Aware — adapts exploitation suggestions based on checksec output (NX, PIE, RELRO, canary, etc.)
git clone https://github.com/allsmog/pwn-claude-plugin.git
claude --plugin-dir ./pwn-claude-plugin/pwn-htb
Python 3.8+
pwntools (pip install pwntools)GDB with pwndbg extension
checksec (apt install checksec or via pwntools)
Optional (auto-installed via pip if missing)
ropper (pip install ropper)
one_gadget (gem install one_gadget)
seccomp-tools (gem install seccomp-tools)
ROPgadget (pip install ROPgadget)
claude --plugin-dir ./pwn-claude-plugin/pwn-htb
# Verify tools are installed> /pwn-setup
# Recon a binary> /pwn-recon ./challenge
# Static analysis> /pwn-static ./challenge
# Generate an exploit from findings> /pwn-exploit Or run the full 5-phase methodology in one command:
Command
Description
/pwn <binary>Run full methodology (all 5 phases with confirmations)
/pwn-setupEnvironment setup and tool verification
/pwn-recon <binary>Reconnaissance phase (checksec, file, strings)
/pwn-static <binary>Static analysis (disassembly, dangerous functions)
/pwn-dynamic <binary>Dynamic analysis (GDB scripts, offset calculation)
/pwn-exploitExploit development guidance
Command
Description
/pwn-templateInteractive template selector
/pwn-ret2libcret2libc / ret2system template
/pwn-ropROP chain construction template
/pwn-format-stringFormat string exploit template
/pwn-shellcodeShellcode injection template
/pwn-got-overwriteGOT overwrite template
/pwn-heapHeap exploitation (tcache/fastbin) template
/pwn-sropSigreturn-oriented programming template
Command
Description
/pwn-gdbinitGenerate project-specific .gdbinit for pwndbg
/pwn-libc <address>Identify libc version from leaked addresses
Agent
Purpose
binary-analyzer Autonomous reconnaissance and static analysis
exploit-suggester Recommends exploitation techniques based on findings
template-generator Creates customized pwntools exploit skeletons
Pre-built pwntools templates in pwn-htb/templates/:
Template
File
Master template
exploit-template.py
ret2win
ret2win.py
ret2libc
ret2libc.py
Format string
format-string.py
MIT