Symlink Path Shortening

Updated 13 Sep 2026

•
What it is
- •
  Pre-create a short symlink name for a target file so size-constrained shellcode needs fewer bytes to build its path. This requires filesystem access before execution.
•
How it works
- •
  Outside the shellcode entirely, from a shell: ln -s /flag a creates a symlink named a in the working directory pointing at /flag.
- •
  open and chmod normally follow symlinks. The target permissions and the process working directory still matter.
- •
  A one-character path plus a null terminator is shorter to construct than a longer filename.
•
When to use it
- •
  You need a way to pre-create the symlink in a location accessible to the challenge before the constrained payload runs.
- •
  Useful when path construction consumes too much of a strict shellcode byte budget.
•
Examples
- •
  Run ln -s /flag a, then use the relative path a from that directory. It is shorter than /flag; normal target-file permissions still apply.

pwntools

path = b'a\x00'
print(len(path))  # Two bytes for the shortened path and terminator.

ls -l a  # Shell: confirm the symlink and current working directory.