offensive-basic-exploitation

Name: offensive-basic-exploitation
Author: SnailSploit

2.8kstars447forks

How to install offensive-basic-exploitation?

snailsploit/claude-red/offensive-basic-exploitation

$npx -y skills add SnailSploit/Claude-Red --skill offensive-basic-exploitation

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Week 5: Basic Exploitation (Linux with Mitigations Disabled)
2
3	## Metadata
4	- Skill Name: basic-exploitation
5	- Folder: offensive-basic-exploitation
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/5-basic-exploitation.md
7
8	## Description
9	Week 5 exploit development curriculum. Foundational exploitation techniques: controlling EIP/RIP, ROP chain construction, ret2libc, shellcode injection, heap spraying, bypass techniques for ASLR/NX/stack canaries. Use when building initial PoCs or understanding classic exploitation primitives.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`basic exploitation, EIP control, RIP control, ROP chain, ret2libc, shellcode injection, heap spray, ASLR bypass, NX bypass, stack canary bypass, week 5`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Week 5: Basic Exploitation (Linux with Mitigations Disabled)
29
30	## Overview
31
32	_created by AnotherOne from @Pwn3rzs Telegram channel_.
33
34	Now that you can find and analyze vulnerabilities (Week 2 & 4), it's time to learn exploitation. This week focuses on fundamental exploitation techniques in a simplified Linux environment with modern mitigations (DEP, ASLR, stack canaries) disabled. Mastering these basics is essential before tackling mitigation bypasses in Week 7.
35
36	Next week (Week 6) we'll focus on understanding mitigations in both Linux and Windows. Week 7 will cover bypassing them.
37
38	Learning Environment:
39
40	- CPU arch (default): amd64 (x86-64)
41	- OS: Ubuntu 24.04 LTS (Linux)
42	- Compiler Flags: Disable protections (`-fno-stack-protector`, `-no-pie`, `-z execstack` for ret2shellcode labs, `/GS-`)
43	- ASLR: Keep enabled system-wide; disable per-process (`setarch -R`) or in GDB (`set disable-randomization on`) for deterministic labs
44	- Focus: Pure exploitation techniques without bypass complexity
45
46	## Day 1: Environment Setup and Stack Overflow Fundamentals
47
48	- Goal: Set up exploitation lab and understand stack buffer overflow mechanics.
49	- Activities:
50	- _Reading_:
51	- "Hacking: The Art of Exploitation" 2nd edition, by Jon Erickson - Chapter 0x300: "EXPLOITATION"
52	- [Smashing The Stack For Fun And Profit](https://phrack.org/issues/49/14_md#article) - Classic paper
53	- _Online Resources_:
54	- [x86-64 Calling Conventions](https://wiki.osdev.org/Calling_Conventions)
55	- [Stack Layout Visualization](https://eli.thegreenplace.net/2011/09/06/stack-frame-layout-on-x86-64)
56	- _Tool Setup_:
57	- Ubuntu VM with protections disabled
58	- pwntools, pwndbg, ROPgadget
59	- _Exercise_:
60	- Compile and exploit first vulnerable program
61	- Overwrite return address to execute shellcode
62
63	### Context: QNAP Stack Overflow (CVE-2024-27130)
64
65	- Recall the QNAP QTS Stack Overflow from Week 1? That was a classic stack buffer overflow caused by `strcpy` without bounds checking—exactly what we'll be exploiting today.
66	- While modern systems have mitigations (which we'll disable for now), the underlying mechanic remains the same: overwriting the return address to hijack control flow.
67
68	### Deliverables
69
70	- Environment: `~/check_env.sh` passes and you recorded its output
71	- Binary: `vuln1` built and verified with `checksec`
72	- Primitive proof: RIP control demonstrated (controlled crash address)
73	- Exploit: `exploit1.py` (or equivalent) spawns a shell reliably
74	- Notes: brief writeup covering offset, return target, and payload layout
75
76	### Setting Up the Lab Environment
77
78	Ubuntu VM Configuration:
79
80	> [!IMPORTANT]
81	> ASLR Policy: Keep ASLR enabled system-wide for security. Disable only per-process for labs.
82	> Never disable ASLR globally on a machine connected to the internet.
83
84	```bash
85	# ============================================================
86	# ASLR CONFIGURATION (Per-Process Only - Do NOT disable globally!)
87	# ============================================================
88	# Option 0: Disable ASLR system-wide
89	# echo 0 \| sudo tee /proc/sys/kernel/randomize_va_space
90	# echo "kernel.randomize_va_space = 0" \| sudo tee /etc/sysctl.d/99-disable-aslr.conf
91	# sudo sysctl --system
92
93	# Option 1: Disable in GDB (recommended for debugging)
94	# In GDB/pwndbg:
95	# (gdb) set disable-randomization on # Default in GDB
96	# (gdb) set disable-randomization off # If you want ASLR during debug
97
98	# Option 2: Disable for a single binary run
99	setarch x86_64 -R ./binary
100
101	# Option 3: In pwntools (for local process only)
102	# p = process('./binary', aslr=False)
103
104	# VERIFY: Check system ASLR is STILL ENABLED
105	cat /proc/sys/kernel/randomize_va_space
106	# Should output: 2 (full ASLR) - DO NOT change this!
107
108	# If you previously disabled ASLR system-wide, RE-ENA

People who liked this also viewed

6 picks

Type

offensive-basic-exploitation

2.8kstars447forks

View on GitHub

How to install offensive-basic-exploitation?

snailsploit/claude-red/offensive-basic-exploitation

$npx -y skills add SnailSploit/Claude-Red --skill offensive-basic-exploitation

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Week 5: Basic Exploitation (Linux with Mitigations Disabled)
2
3	## Metadata
4	- Skill Name: basic-exploitation
5	- Folder: offensive-basic-exploitation
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/5-basic-exploitation.md
7
8	## Description
9	Week 5 exploit development curriculum. Foundational exploitation techniques: controlling EIP/RIP, ROP chain construction, ret2libc, shellcode injection, heap spraying, bypass techniques for ASLR/NX/stack canaries. Use when building initial PoCs or understanding classic exploitation primitives.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`basic exploitation, EIP control, RIP control, ROP chain, ret2libc, shellcode injection, heap spray, ASLR bypass, NX bypass, stack canary bypass, week 5`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Week 5: Basic Exploitation (Linux with Mitigations Disabled)
29
30	## Overview
31
32	_created by AnotherOne from @Pwn3rzs Telegram channel_.
33
34	Now that you can find and analyze vulnerabilities (Week 2 & 4), it's time to learn exploitation. This week focuses on fundamental exploitation techniques in a simplified Linux environment with modern mitigations (DEP, ASLR, stack canaries) disabled. Mastering these basics is essential before tackling mitigation bypasses in Week 7.
35
36	Next week (Week 6) we'll focus on understanding mitigations in both Linux and Windows. Week 7 will cover bypassing them.
37
38	Learning Environment:
39
40	- CPU arch (default): amd64 (x86-64)
41	- OS: Ubuntu 24.04 LTS (Linux)
42	- Compiler Flags: Disable protections (`-fno-stack-protector`, `-no-pie`, `-z execstack` for ret2shellcode labs, `/GS-`)
43	- ASLR: Keep enabled system-wide; disable per-process (`setarch -R`) or in GDB (`set disable-randomization on`) for deterministic labs
44	- Focus: Pure exploitation techniques without bypass complexity
45
46	## Day 1: Environment Setup and Stack Overflow Fundamentals
47
48	- Goal: Set up exploitation lab and understand stack buffer overflow mechanics.
49	- Activities:
50	- _Reading_:
51	- "Hacking: The Art of Exploitation" 2nd edition, by Jon Erickson - Chapter 0x300: "EXPLOITATION"
52	- [Smashing The Stack For Fun And Profit](https://phrack.org/issues/49/14_md#article) - Classic paper
53	- _Online Resources_:
54	- [x86-64 Calling Conventions](https://wiki.osdev.org/Calling_Conventions)
55	- [Stack Layout Visualization](https://eli.thegreenplace.net/2011/09/06/stack-frame-layout-on-x86-64)
56	- _Tool Setup_:
57	- Ubuntu VM with protections disabled
58	- pwntools, pwndbg, ROPgadget
59	- _Exercise_:
60	- Compile and exploit first vulnerable program
61	- Overwrite return address to execute shellcode
62
63	### Context: QNAP Stack Overflow (CVE-2024-27130)
64
65	- Recall the QNAP QTS Stack Overflow from Week 1? That was a classic stack buffer overflow caused by `strcpy` without bounds checking—exactly what we'll be exploiting today.
66	- While modern systems have mitigations (which we'll disable for now), the underlying mechanic remains the same: overwriting the return address to hijack control flow.
67
68	### Deliverables
69
70	- Environment: `~/check_env.sh` passes and you recorded its output
71	- Binary: `vuln1` built and verified with `checksec`
72	- Primitive proof: RIP control demonstrated (controlled crash address)
73	- Exploit: `exploit1.py` (or equivalent) spawns a shell reliably
74	- Notes: brief writeup covering offset, return target, and payload layout
75
76	### Setting Up the Lab Environment
77
78	Ubuntu VM Configuration:
79
80	> [!IMPORTANT]
81	> ASLR Policy: Keep ASLR enabled system-wide for security. Disable only per-process for labs.
82	> Never disable ASLR globally on a machine connected to the internet.
83
84	```bash
85	# ============================================================
86	# ASLR CONFIGURATION (Per-Process Only - Do NOT disable globally!)
87	# ============================================================
88	# Option 0: Disable ASLR system-wide
89	# echo 0 \| sudo tee /proc/sys/kernel/randomize_va_space
90	# echo "kernel.randomize_va_space = 0" \| sudo tee /etc/sysctl.d/99-disable-aslr.conf
91	# sudo sysctl --system
92
93	# Option 1: Disable in GDB (recommended for debugging)
94	# In GDB/pwndbg:
95	# (gdb) set disable-randomization on # Default in GDB
96	# (gdb) set disable-randomization off # If you want ASLR during debug
97
98	# Option 2: Disable for a single binary run
99	setarch x86_64 -R ./binary
100
101	# Option 3: In pwntools (for local process only)
102	# p = process('./binary', aslr=False)
103
104	# VERIFY: Check system ASLR is STILL ENABLED
105	cat /proc/sys/kernel/randomize_va_space
106	# Should output: 2 (full ASLR) - DO NOT change this!
107
108	# If you previously disabled ASLR system-wide, RE-ENA

People who liked this also viewed

6 picks

Type