offensive-exploit-development

Name: offensive-exploit-development
Author: SnailSploit

2.8kstars447forks

How to install offensive-exploit-development?

snailsploit/claude-red/offensive-exploit-development

$npx -y skills add SnailSploit/Claude-Red --skill offensive-exploit-development

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Exploit Development
2
3	## Metadata
4	- Skill Name: exploit-development
5	- Folder: offensive-exploit-development
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/development.md
7
8	## Description
9	Exploit development operational guide: environment setup, debugging workflow, PoC development lifecycle, writing reliable exploits, using pwntools/pwndbg, heap exploitation techniques, and weaponization considerations. Use when actively developing exploits or setting up an exploit dev environment.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`exploit development, pwntools, pwndbg, heap exploitation, PoC development, exploit reliability, weaponization, debugging workflow, exploit dev environment`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Exploit Development
29
30	## Exploit Development Process
31
32	- Checkout [Bug Identification](/exploit/bug-identification.md) document for more information
33	- Also check [Fuzzing](/exploit/fuzzing.md) for specific fuzzing topics
34	- Integrate snapshot‑based fuzzing pipelines (AFL++, WinAFL, Snap‑Fuzz) and LLM‑guided input mutation to shorten time‑to‑bug.
35	- Incorporate LLM‑assisted fuzzers (ChatAFL, HyLLFuzz) for grammar inference or plateau escape when grey‑box coverage stalls.
36	- Add continuous‑integration security fuzzing (e.g., GitHub Actions with ASAN/UBSAN) so regressions are caught automatically.
37	- For Windows-specific vulnerabilities, see [Windows Kernel](/exploit/windows-kernel.md)
38
39	```mermaid
40	flowchart LR
41	BugId["Bug Identification"] --> Analysis["Vulnerability Analysis"]
42	Testing["Testing & Refinement"] --> Deployment["Deployment"]
43
44	subgraph "Analysis Phase"
45	direction LR
46	Root["Root Cause Analysis"]
47	Trig["Trigger Identification"]
48	Impact["Impact Assessment"]
49	end
50
51	subgraph "Weaponization Phase"
52	direction LR
53	MitBypass["Mitigation Bypass"]
54	Payload["Payload Development"]
55	Reliability["Reliability Improvements"]
56	end
57
58	Analysis --> Root
59	Analysis --> Trig
60	Analysis --> Impact
61
62	Root --> MitBypass
63	Impact --> Payload
64	Trig --> Payload
65	MitBypass --> Payload
66	Payload --> Reliability
67	Reliability --> Testing
68	Testing --> MitBypass
69
70	class BugId,Analysis,Testing,Deployment primary
71	```
72
73	## Bug Types
74
75	### Stack Overflow
76
77	Involves memory on the stack getting corrupted due to improper bounds checking when a memory write operation takes place.
78
79	#### Case Study — CVE‑2025‑0910 (TinyFTP stack overflow)
80
81	- Bug – Unchecked `strcpy` copies user‐supplied file path into a 256‑byte stack buffer when handling `STOR` commands.
82	- Trigger – Send `STOR /` followed by 420 bytes of `A…` to overflow the buffer and clobber SEH frame.
83	- Exploit – Overwrite next SEH with a `pop pop ret` inside `msvcrt.dll`; pivot to payload that disables DEP via ROP then spawns a reverse shell.
84	- Mitigations bypassed – DEP (ROP), ASLR (module without /DYNAMICBASE), SEHOP disabled in default config.
85	- Fixed in v1.5.3 by replacing `strcpy` with `strncpy_s` and enabling `/DYNAMICBASE /GS`.
86
87	#### SEH
88
89	- structured exception handler is a linked list of all exception handlers ( try catch clauses) and the default windows exception handler as the last node.
90	- `ntdll!KiUserExceptionDispatcher` is responsible for the exception handling process which itself calls `RtlDispatchException`
91	- `RtlDispatchException` retrieves the `TEB` and parses the exception handling linked list using `NtTib->ExceptionList`
92	- [SafeSEH](https://learn.microsoft.com/en-us/cpp/build/reference/safeseh-image-has-safe-exception-handlers?view=msvc-170) mitigates handler over‑writes only in 32‑bit images. On x64 Windows, newer toolchains and components support Guard EH Continuations; adoption varies by binary and build. `SEHOP` remains enabled by default.
93	- To check whether a module uses Guard EH Continuations, inspect `Load Configuration Directory → GuardEHContinuations` in the PE header (e.g., `dumpbin /loadconfig` or a `lief` script).
94	- Many core system DLLs are compiled with EHCONT metadata plus `/GS`, `/CETCOMPAT`; the classic approach of choosing a module without SafeSEH or ASLR is increasingly rare. Verify per target.
95	- `RtlpExecuteHandlerForException` calls the `ntdll!ExecuteHandler2` which in turn calls the actual exception handler function after validation
96	- In a SEH buffer overflow we try to overflow the buffer and overwrite the `ExceptionList` starting at the buffer
97	- so that the dispatcher calls our handler pointer —we gain control of the instruction pointer only if SEHOP is disabled or successfully bypassed.
98	-

People who liked this also viewed

6 picks

Type

offensive-exploit-development

2.8kstars447forks

View on GitHub

How to install offensive-exploit-development?

snailsploit/claude-red/offensive-exploit-development

$npx -y skills add SnailSploit/Claude-Red --skill offensive-exploit-development

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Exploit Development
2
3	## Metadata
4	- Skill Name: exploit-development
5	- Folder: offensive-exploit-development
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/development.md
7
8	## Description
9	Exploit development operational guide: environment setup, debugging workflow, PoC development lifecycle, writing reliable exploits, using pwntools/pwndbg, heap exploitation techniques, and weaponization considerations. Use when actively developing exploits or setting up an exploit dev environment.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`exploit development, pwntools, pwndbg, heap exploitation, PoC development, exploit reliability, weaponization, debugging workflow, exploit dev environment`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Exploit Development
29
30	## Exploit Development Process
31
32	- Checkout [Bug Identification](/exploit/bug-identification.md) document for more information
33	- Also check [Fuzzing](/exploit/fuzzing.md) for specific fuzzing topics
34	- Integrate snapshot‑based fuzzing pipelines (AFL++, WinAFL, Snap‑Fuzz) and LLM‑guided input mutation to shorten time‑to‑bug.
35	- Incorporate LLM‑assisted fuzzers (ChatAFL, HyLLFuzz) for grammar inference or plateau escape when grey‑box coverage stalls.
36	- Add continuous‑integration security fuzzing (e.g., GitHub Actions with ASAN/UBSAN) so regressions are caught automatically.
37	- For Windows-specific vulnerabilities, see [Windows Kernel](/exploit/windows-kernel.md)
38
39	```mermaid
40	flowchart LR
41	BugId["Bug Identification"] --> Analysis["Vulnerability Analysis"]
42	Testing["Testing & Refinement"] --> Deployment["Deployment"]
43
44	subgraph "Analysis Phase"
45	direction LR
46	Root["Root Cause Analysis"]
47	Trig["Trigger Identification"]
48	Impact["Impact Assessment"]
49	end
50
51	subgraph "Weaponization Phase"
52	direction LR
53	MitBypass["Mitigation Bypass"]
54	Payload["Payload Development"]
55	Reliability["Reliability Improvements"]
56	end
57
58	Analysis --> Root
59	Analysis --> Trig
60	Analysis --> Impact
61
62	Root --> MitBypass
63	Impact --> Payload
64	Trig --> Payload
65	MitBypass --> Payload
66	Payload --> Reliability
67	Reliability --> Testing
68	Testing --> MitBypass
69
70	class BugId,Analysis,Testing,Deployment primary
71	```
72
73	## Bug Types
74
75	### Stack Overflow
76
77	Involves memory on the stack getting corrupted due to improper bounds checking when a memory write operation takes place.
78
79	#### Case Study — CVE‑2025‑0910 (TinyFTP stack overflow)
80
81	- Bug – Unchecked `strcpy` copies user‐supplied file path into a 256‑byte stack buffer when handling `STOR` commands.
82	- Trigger – Send `STOR /` followed by 420 bytes of `A…` to overflow the buffer and clobber SEH frame.
83	- Exploit – Overwrite next SEH with a `pop pop ret` inside `msvcrt.dll`; pivot to payload that disables DEP via ROP then spawns a reverse shell.
84	- Mitigations bypassed – DEP (ROP), ASLR (module without /DYNAMICBASE), SEHOP disabled in default config.
85	- Fixed in v1.5.3 by replacing `strcpy` with `strncpy_s` and enabling `/DYNAMICBASE /GS`.
86
87	#### SEH
88
89	- structured exception handler is a linked list of all exception handlers ( try catch clauses) and the default windows exception handler as the last node.
90	- `ntdll!KiUserExceptionDispatcher` is responsible for the exception handling process which itself calls `RtlDispatchException`
91	- `RtlDispatchException` retrieves the `TEB` and parses the exception handling linked list using `NtTib->ExceptionList`
92	- [SafeSEH](https://learn.microsoft.com/en-us/cpp/build/reference/safeseh-image-has-safe-exception-handlers?view=msvc-170) mitigates handler over‑writes only in 32‑bit images. On x64 Windows, newer toolchains and components support Guard EH Continuations; adoption varies by binary and build. `SEHOP` remains enabled by default.
93	- To check whether a module uses Guard EH Continuations, inspect `Load Configuration Directory → GuardEHContinuations` in the PE header (e.g., `dumpbin /loadconfig` or a `lief` script).
94	- Many core system DLLs are compiled with EHCONT metadata plus `/GS`, `/CETCOMPAT`; the classic approach of choosing a module without SafeSEH or ASLR is increasingly rare. Verify per target.
95	- `RtlpExecuteHandlerForException` calls the `ntdll!ExecuteHandler2` which in turn calls the actual exception handler function after validation
96	- In a SEH buffer overflow we try to overflow the buffer and overwrite the `ExceptionList` starting at the buffer
97	- so that the dispatcher calls our handler pointer —we gain control of the instruction pointer only if SEHOP is disabled or successfully bypassed.
98	-

People who liked this also viewed

6 picks

Type