offensive-mitigations

Name: offensive-mitigations
Author: SnailSploit

2.8kstars447forks

How to install offensive-mitigations?

snailsploit/claude-red/offensive-mitigations

$npx -y skills add SnailSploit/Claude-Red --skill offensive-mitigations

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Modern Kernel Exploit Mitigations
2
3	## Metadata
4	- Skill Name: security-mitigations
5	- Folder: offensive-mitigations
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/mitigations.md
7
8	## Description
9	Security mitigation reference and bypass catalog: ASLR, DEP/NX, RELRO, stack canaries, CFI, sandboxing, seccomp. Covers both detection of enabled mitigations and known bypass techniques. Use when assessing target hardening or planning exploit mitigation bypasses.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`mitigations, ASLR bypass, DEP bypass, NX bypass, RELRO, stack canary bypass, CFI bypass, sandbox bypass, seccomp bypass, mitigation detection, checksec`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Modern Kernel Exploit Mitigations
29
30	## Memory-safety & Isolation
31
32	### Kernel Address Space Layout Randomization (KASLR)
33
34	- Randomizes memory addresses where the kernel and its components are loaded.
35	- Makes it difficult for attackers to predict kernel code and data locations.
36
37	#### Bypass Techniques
38
39	- Information Leaks: Exploiting vulnerabilities (e.g., uninitialized memory, side-channels) to leak kernel pointers and calculate the base address.
40	- Side-Channel Attacks: Using timing, cache, or other microarchitectural side channels to infer memory layout.
41	- Prefetch Cache Timing: Measures access speed across the kASLR range (0xfffff80000000000 to 0xfffff80800000000, ~0x8000 iterations with 0x100000 alignment). The fastest access indicates a cached address, revealing the actual kernel base. Uses `rdtscp` for timing, `mfence` for memory barriers, and `prefetchnta`/`prefetcht2` for cache manipulation.
42	- Targeting Non-Randomized Regions: Exploiting data or code segments that are not fully randomized.
43	- Brute-Force: Feasible in environments with limited entropy (e.g., some 32-bit systems or specific configurations).
44	- Intel LAM: Linear Address Masking support exists on recent kernels/CPUs but may be disabled by default. Verify with kernel config, boot params, and CPU flags on your target.
45
46	### Kernel Page Table Isolation (KPTI)
47
48	- Linux:
49	- Separates user-space and kernel-space page tables.
50	- Mitigates the Meltdown vulnerability by preventing user-space access to kernel memory.
51
52	#### Bypass Techniques
53
54	- Side-Channel Attacks: Exploiting microarchitectural side channels (e.g., TLB timing, cache attacks) that leak information across the isolation boundary.
55	- Hardware Vulnerabilities: Exploiting CPU vulnerabilities (e.g., L1TF, MDS) that can bypass page table separation.
56	- Implementation Flaws: Bugs in the KPTI implementation itself.
57
58	#### Practitioner
59
60	- Linux: check status via `/sys/devices/system/cpu/vulnerabilities/*` and `dmesg \| grep -i kpti`.
61	- Windows: verify meltdown/KVA shadowing with `Get-SpeculationControlSettings` PowerShell script from Microsoft.
62
63	### Supervisor Mode Access Prevention (SMAP)
64
65	- Linux:
66	- Hardware feature preventing unintended kernel access to user-space memory.
67	- Protects against attacks exploiting improper memory accesses.
68
69	#### Bypass Techniques
70
71	- ROP/JOP Gadgets: Finding instruction sequences (gadgets) within kernel code that disable SMAP temporarily (e.g., via `stac` instruction) before accessing user memory.
72	- Data-Only Attacks: Attacks that achieve their goal without directly accessing user-space data from the kernel inappropriately.
73	- Kernel Information Leaks: Combining with KASLR bypasses to find suitable gadgets.
74
75	#### Practitioner
76
77	- Linux: confirm with `grep smap /proc/cpuinfo` and `cat /proc/cpuinfo \| grep 'smep\\|smap'`.
78	- Check CR4 at runtime with `rdmsr`/`wrmsr` tools or `lscpu -e` on supported systems.
79
80	### Supervisor Mode Execution Protection (SMEP)
81
82	- Linux/Windows:
83	- Hardware feature preventing execution of user-space code when in supervisor mode.
84	- Located in bit 20 of the CR4 control register.
85	- Blocks certain privilege escalation attacks that rely on executing shellcode in user-mode memory.
86
87	#### Bypass Techniques
88
89	- ROP/JOP Chains: Constructing code reuse chains entirely from existing kernel code, avoiding execution of user-space code.
90	- Data-Only Attacks: Exploiting vulnerabilities without needing to execute shellcode (e.g., overwriting kernel data structures).
91	- Disabling SMEP: Finding gadgets or techniques to modify the CR4 control register to disable SMEP.
92	- Type Confusion Exploits: Using type confusion vulnerabilities to gain control flow and build ROP chains for SMEP bypass.
93	- Page Table Manipulation: Modifying page table entries (PTEs) to change user pages to supervisor pages, maki

People who liked this also viewed

6 picks

Type

offensive-mitigations

2.8kstars447forks

View on GitHub

How to install offensive-mitigations?

snailsploit/claude-red/offensive-mitigations

$npx -y skills add SnailSploit/Claude-Red --skill offensive-mitigations

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Modern Kernel Exploit Mitigations
2
3	## Metadata
4	- Skill Name: security-mitigations
5	- Folder: offensive-mitigations
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/mitigations.md
7
8	## Description
9	Security mitigation reference and bypass catalog: ASLR, DEP/NX, RELRO, stack canaries, CFI, sandboxing, seccomp. Covers both detection of enabled mitigations and known bypass techniques. Use when assessing target hardening or planning exploit mitigation bypasses.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`mitigations, ASLR bypass, DEP bypass, NX bypass, RELRO, stack canary bypass, CFI bypass, sandbox bypass, seccomp bypass, mitigation detection, checksec`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# Modern Kernel Exploit Mitigations
29
30	## Memory-safety & Isolation
31
32	### Kernel Address Space Layout Randomization (KASLR)
33
34	- Randomizes memory addresses where the kernel and its components are loaded.
35	- Makes it difficult for attackers to predict kernel code and data locations.
36
37	#### Bypass Techniques
38
39	- Information Leaks: Exploiting vulnerabilities (e.g., uninitialized memory, side-channels) to leak kernel pointers and calculate the base address.
40	- Side-Channel Attacks: Using timing, cache, or other microarchitectural side channels to infer memory layout.
41	- Prefetch Cache Timing: Measures access speed across the kASLR range (0xfffff80000000000 to 0xfffff80800000000, ~0x8000 iterations with 0x100000 alignment). The fastest access indicates a cached address, revealing the actual kernel base. Uses `rdtscp` for timing, `mfence` for memory barriers, and `prefetchnta`/`prefetcht2` for cache manipulation.
42	- Targeting Non-Randomized Regions: Exploiting data or code segments that are not fully randomized.
43	- Brute-Force: Feasible in environments with limited entropy (e.g., some 32-bit systems or specific configurations).
44	- Intel LAM: Linear Address Masking support exists on recent kernels/CPUs but may be disabled by default. Verify with kernel config, boot params, and CPU flags on your target.
45
46	### Kernel Page Table Isolation (KPTI)
47
48	- Linux:
49	- Separates user-space and kernel-space page tables.
50	- Mitigates the Meltdown vulnerability by preventing user-space access to kernel memory.
51
52	#### Bypass Techniques
53
54	- Side-Channel Attacks: Exploiting microarchitectural side channels (e.g., TLB timing, cache attacks) that leak information across the isolation boundary.
55	- Hardware Vulnerabilities: Exploiting CPU vulnerabilities (e.g., L1TF, MDS) that can bypass page table separation.
56	- Implementation Flaws: Bugs in the KPTI implementation itself.
57
58	#### Practitioner
59
60	- Linux: check status via `/sys/devices/system/cpu/vulnerabilities/*` and `dmesg \| grep -i kpti`.
61	- Windows: verify meltdown/KVA shadowing with `Get-SpeculationControlSettings` PowerShell script from Microsoft.
62
63	### Supervisor Mode Access Prevention (SMAP)
64
65	- Linux:
66	- Hardware feature preventing unintended kernel access to user-space memory.
67	- Protects against attacks exploiting improper memory accesses.
68
69	#### Bypass Techniques
70
71	- ROP/JOP Gadgets: Finding instruction sequences (gadgets) within kernel code that disable SMAP temporarily (e.g., via `stac` instruction) before accessing user memory.
72	- Data-Only Attacks: Attacks that achieve their goal without directly accessing user-space data from the kernel inappropriately.
73	- Kernel Information Leaks: Combining with KASLR bypasses to find suitable gadgets.
74
75	#### Practitioner
76
77	- Linux: confirm with `grep smap /proc/cpuinfo` and `cat /proc/cpuinfo \| grep 'smep\\|smap'`.
78	- Check CR4 at runtime with `rdmsr`/`wrmsr` tools or `lscpu -e` on supported systems.
79
80	### Supervisor Mode Execution Protection (SMEP)
81
82	- Linux/Windows:
83	- Hardware feature preventing execution of user-space code when in supervisor mode.
84	- Located in bit 20 of the CR4 control register.
85	- Blocks certain privilege escalation attacks that rely on executing shellcode in user-mode memory.
86
87	#### Bypass Techniques
88
89	- ROP/JOP Chains: Constructing code reuse chains entirely from existing kernel code, avoiding execution of user-space code.
90	- Data-Only Attacks: Exploiting vulnerabilities without needing to execute shellcode (e.g., overwriting kernel data structures).
91	- Disabling SMEP: Finding gadgets or techniques to modify the CR4 control register to disable SMEP.
92	- Type Confusion Exploits: Using type confusion vulnerabilities to gain control flow and build ROP chains for SMEP bypass.
93	- Page Table Manipulation: Modifying page table entries (PTEs) to change user pages to supervisor pages, maki

People who liked this also viewed

6 picks

Type