Binary Exploitation

Every program on a computer ultimately exists as a sequence of zeros and ones — so-called binary code, i.e. directly executable machine instructions. Binary Exploitation means: searching this finished program for errors the developer did not anticipate, and thereby making the program do something other than intended. The goal can be to inject foreign commands, read out passwords, or gain admin rights — that is, unrestricted access to a system. The term appears primarily in IT security: both in real attacks and in the search for vulnerabilities before attackers find them.

Binary Exploitation in Security Research

Many programs that run daily on millions of devices were written in programming languages such as C or C++. These languages are fast, but give the developer a great deal of control over memory — which means a lot of room for error. A single misconfigured buffer, i.e. a memory area too small for incoming data, can be enough for an attacker to take over the program.

This is precisely why Binary Exploitation is its own professional field. Security researchers who hunt down such vulnerabilities are called vulnerability researchers. If they find a flaw and report it to the vendor before an attacker exploits it, this is called responsible disclosure. Some companies pay so-called bug bounties for this — rewards that, depending on the severity of the flaw, can range from a few hundred to several million euros.

Stack Overflows and Related Attack Vectors

The most classic attack is called a stack buffer overflow. A program reserves a small memory area — the buffer — for an input, such as a username. If an attacker deliberately writes more data into it than the buffer can hold, they overwrite adjacent memory areas. One of these, the so-called return address, tells the program where to jump back to after a function. If it is overwritten, the attacker can redirect the program to any location they choose — for example, to their own malicious code.

Besides buffer overflows, there are other techniques: format string attacks exploit errors in text formatting, and use-after-free vulnerabilities arise when a program accesses memory it has already released. Modern operating systems try to make such attacks harder with protective mechanisms — for example, ASLR (Address Space Layout Randomization), which randomly shifts the positions of memory areas each time a program starts. Binary exploitation techniques such as Return Oriented Programming (ROP) were developed specifically to bypass such protective measures.

This sounds abstract, but is in fact very concretely learnable: in hacking competitions known as CTFs (Capture the Flag), participants are given deliberately vulnerable programs and must retrieve a hidden string — the “flag” — from memory. For many, CTFs are the entry point into the field.

Where Binary Exploitation Shows Up in Practice

In the news, Binary Exploitation often appears as the foundation of high-profile attacks. Many state-sponsored espionage programs use so-called zero-day exploits — attacks on vulnerabilities still unknown to the vendor. The attack involving the Stuxnet trojan, which sabotaged Iranian nuclear centrifuges in 2010, exploited several such vulnerabilities simultaneously.

The consequences are also encountered in everyday life: when a browser update is released that is classified as “critical,” an exploited buffer overflow is often behind it. Smartphones are affected just as much — spyware like Pegasus got onto victims' devices via binary exploitation flaws in iOS without the victims having to click anything. Such attacks are called zero-click exploits.

Anyone interested in IT security quickly comes across platforms like “pwn.college” or “HackTheBox” on the topic of Binary Exploitation, which provide vulnerable practice environments. The word “pwn” — a phonetic rendering of “own,” meaning to possess — is a fixed term in the scene: to “pwn” a system means to have completely taken it over.